Rapid7, Inc. (RPD) Q1 2023 Earnings Call Transcript

Rapid7, Inc. (NASDAQ:RPD) Q1 2023 Earnings Conference Call May 9, 2023 4:30 PM ET

Company Participants

Sunil Shah - Vice President, Investor Relations

Corey Thomas - Chairman and Chief Executive Officer

Tim Adams - Chief Financial Officer

Conference Call Participants

Matthew Hedberg - RBC Capital Markets

Saket Kalia - Barclays

Rob Owens - Piper Sandler

Shrenik Kothari - RW Baird

Eric Heath - KeyBanc Capital Markets

Gregg Moskowitz - Mizuho

Brian Essex - JP Morgan

Brad Reback - Stifel

Matt Saltzman - Morgan Stanley

Adam Tindle - Raymond James

Joel Fishbein - Truist

Gray Powell - BTIG

Garrett Burkam - William Blair

Joshua Tilton - Wolfe Research

Alex Henderson - Needham and Company

Shebly Seyrafi - FBN Securities

Operator

Good afternoon and welcome to the Rapid7 First Quarter 2023 Earnings Call. All participants are in a listen-only mode. After the speakers' presentation, we will conduct a question-and-answer session. [Operator Instructions] as a reminder, this conference call is being recorded.

I would now like to turn the call to Sunil Shah, Vice President, Investor Relations. Thank you. Please go ahead.

Sunil Shah

Thank you, operator, and good afternoon, everyone. We appreciate you joining us today to discuss Rapid7's first quarter 2023 financial and operating results in addition to our financial outlook for the second quarter and full fiscal year 2023.

With me on the call today are Corey Thomas, our CEO; and Tim Adams, our CFO. We have distributed our earnings press release over the wire and is now posted on our website at investors.rapid7.com, along with the updated company presentation and financial metrics file. This call is being broadcast live via webcast, and following the call, an audio replay will be available at investors.rapid7.com.

During this call, we may make statements related to our business that are considered forward-looking under federal securities laws. These statements are made pursuant to the safe harbor provisions of the Private Securities Litigation Reform Act of 1995 and include statements related to the company's positioning, strategy, business plans and financial guidance for the second quarter and full year 2023 and the assumptions underlying such goals and guidance.

These forward-looking statements are based on our current expectations and beliefs and on information currently available to us. Actual outcomes and results may differ materially from the future results expressed or implied in these statements due to a number of risks and uncertainties, including those contained in our most recent annual report on Form 10-Q filed on February 24, 2023, and in the subsequent reports that we filed with the SEC. The information provided on this conference call should be considered in light of such risks. Actual results and the timing of certain events may differ materially from the results or timing predicted or implied by such forward-looking statements, and reported results should not be considered as an indication of future performance.

Rapid7 does not assume any obligation to update the information presented on this conference call, except to the extent required by applicable law. Our commentary today will be primarily in non-GAAP terms and reconciliations between our historical GAAP and non-GAAP results and guidance can be found in today's earnings press release and on our website at investors.rapid7.com.

At times in our prepared remarks or in response to your questions, we may offer incremental metrics to provide greater insight into the dynamics of our business or quarterly results. Please be advised that this additional detail may be one-time in nature, and we may or may not update these metrics in the future.

With that, I'd like to turn the call over to our CEO, Corey Thomas. Corey?

Corey Thomas

Thank you, Sunil. Hello to everyone on the call today. Thank you for joining us this afternoon on our first quarter 2023 earnings call.

I am pleased to report that Rapid7 started the year with strong momentum as we work to deliver customers a comprehensive security operations platform at the most compelling economic value. Faster than expected traction from our Threat Complete and Cloud Risk Complete consolidation offerings, which together represented over 20% of new ARR in the first quarter, supported steady customer demand for our insight platform, driving 16% year-over-year growth in ARR the $728 million. Revenue and operating income both exceeded our expectations as customers gravitate towards our security operations solutions and as we manage the business for profitable growth.

The customer spending environment in the first quarter was broadly in line with our expectations shared on the February earnings call. Despite ongoing complexity in customer budgets, including elevated levels of deal inspection, we saw strong underlying demand or our insight platform to start the year. Our solutions solve a critical set of needs for security teams for working through a complex threat landscape, constraints on talent and worsening consequences from cybersecurity incidents.

While overall demand trends were consistent with our expectations, I'm pleased to share that our teams are demonstrating the ability to execute in an environment with higher budget scrutiny and ongoing macroeconomic uncertainty. A few positive themes continue to resonate in our business throughout the first quarter.

The first is that we are benefiting from a clear customer preference for consolidated security offerings. There is a persistent and crucial need to gain visibility and assess risk across traditional and cloud environments and security teams are laser focused on improving both the effectiveness and efficiency of their programs while maximizing their budget dollars. Our solutions lean into this dynamic by offering best-in-class automated capabilities across cloud security, detection response, and vulnerability management, while being delivered through new and differentiated pricing and packaging models.

As a result of this approach, we are at times seeing less competition for critical capabilities, given the unique scope of our offerings, which in many cases customers aren't able to consolidate on a single platform with other vendors. These dynamics highlight our unique competitive position as we look to capture rate wallet share in a consolidating security operations market.

As customers gravitate towards vendor consolidation and our sales team ramps up on the new offerings, we are seeing the clear benefit in ASPs for our Threat Complete and Cloud Risk Complete deals, which average more than two times our overall ASPs in the first quarter. Our marketing enablement efforts around these offerings were largely competed in the first quarter, and so far over one-third of our sellers have sold at least one of our consolidation offerings.

Another theme that continued in the first quarter was the growing traction with our differentiated cloud security solutions. Insight cloud set provided customers real-time visibility into their cloud environments with a breadth of features including posture management, agentless cloud vulnerability assessment, workload protection, cloud detection response, and automated remediation. The ability to bring these capabilities onto a cohesive platform offering is increasingly resonating with customers, particularly as usability and time to value have long been core differentiators for Rapid7.

Cloud security has evolved over the last few years from a niche complex market into the one we see today where mainstream enterprises show increase in demand for solutions that can solve their cloud challenges in an accessible, efficient, and automated action. Our approach to the market through a consolidated platform focused on accessibility and ease of use is making cloud security more accessible to a broader customer base.

In addition, Cloud Risk Complete packages the breadth and depth of our top rank cloud technology alongside our enterprise grade vulnerability management, which provides visibility to traditional environments. This comprehensive risk visibility across cloud and hybrid environments combined with the compelling package pricing structure is driving a strong value proposition for organizations of all sizes.

A great example of the value we're bringing to customers through Cloud Risk Complete is a recent six figure ARR deal with a mid-cap technology company. The customer was unhappy with their vulnerability manage provider and searching for a placement standalone VM solution. Our sellers were able to expand the conversation to include cloud security and application security as part of our new Cloud Risk Complete package offering. Rapid7's robust product features combined with real-time event-driven data harvesting stood out as competitive differentiators, as well as ability to unite vulnerability data with cloud security data for more actionable alerts and more automated remediation. Ultimately, our sellers were able to bring together the customers on premise and cloud security teams to win this deal by combining three silo solutions into a unified platform with a single cost efficient contract.

Another first quarter example of our expanding value proposition for customers is a six-figure ARR deal with a regional healthcare company. The customer is struggling to use a legacy SIEM solution managed by MSSP due to the complexity of the data and reports as well as the quality of the alerts. They needed a way to identify user behavior in one unified way and defined automated solutions that reduced manual work. Our managed detection and response offering combined with InsightConnect automation allowed us to win the deal based on strong underlying technology, amplified by the security expertise of our best-in-class SOC analysts.

As part of our continued focus and commitment to customers, I'm thrilled to welcome Larry D'Angelo to Rapid7 as our Chief Customer Officer. This is a newly created role that oversees our sales organization and all of our customer success teams across advisory, onboarding, and support. Larry's extensive background at various software companies and private equity firms, and some of you may remember that he served as Chief Sales Officer for LogMeIn for over eight years, helping the company scale from $100 million to $1.4 billion in revenue. We're excited to have Larry on our team and believe that customers will benefit from having a cohesive customer organization to support their growth throughout the end to end customer life cycle.

As we look out over the remainder of the year, we are encouraged by the underlying demand for our cloud native insight platform, our ability to execute in a tighter budgetary environment and our unique position in the customer driven consolidation wave for security operation solutions. We're on track to meet our growth and profitability targets for 2023 and believe we're well-positioned for long-term growth as we execute on our strategic vision to bring Rapid7 to the center of customer security operations programs.

As we refine our go-to-market strategy and invest support innovation, we are focused on delivering better security outcomes to the large market opportunity in front of us while maintaining a deliberate focus on expanding the efficiency and profitability of our business.

With that, thank you for joining us on the call today. I will now turn the call over to our CFO, Tim Adams, to share additional detail on our financial results and outlook. Tim?

Tim Adams

Thank you, Corey, and good afternoon to everyone on today's call. Thank you for joining us.

Before I turn to the results, a quick reminder that except for revenue, all financial results we will discuss today are non-GAAP financial measures, unless otherwise stated. Additionally, reconciliations between our GAAP and non-GAAP results can be found in our earnings press release.

Rapid7 ended the first quarter of 2023 with $728 million in ARR, representing growth of 16% year-over-year, and consistent with our expectations. We continue to see year-over-year growth driven in large part by our anchor offerings of detection and response, cloud security and vulnerability management, which represent the foundational capabilities of our Threat Complete and Cloud Risk Complete consolidation offerings. The breadth and effectiveness of our insight platform, along with our ability to drive value with our complete offerings are resonating with customers as they continue to navigate an evolving budgetary environment.

We see ARR growth coming from both new and existing customers, with ARR per customer that grew 9% over the prior year to $66,000. While our global customer base grew 6% year-over-year to over 11,000 customers. As Corey mentioned earlier, over 20% of our new ARR in the first quarter was driven either by a Threat Complete or Cloud Risk Complete offering. We see traction here both with landing new customers and expanding with our current customers with new ARR for complete deals, seeing healthy contributions from each type of customer.

First quarter revenue of $183 million grew 16% over the prior year and exceeded the high end of our guidance range. Over 95% of revenue in the quarter was recurring, and product revenue grew 17% over the prior year to $174 million. International revenue grew 21% year-over-year and represented 21% of total revenue, while North America grew 15% over the prior year.

Turning to our operating and profitability measures for the quarter. Product gross margin was 76% in the first quarter, and overall gross margin was 73%. Both were within our stated range of expectations, which is mid 70s for product gross margin and low 70s for overall gross margin.

Sales and marketing expenses represented 39% of revenue compared to 43% in the prior period. R&D and G&A expenses were 20% and 8% of revenue, respectively compared to 23% and 9% in the first quarter of last year. We delivered strong first quarter operating income of $11 million above the high end of our guided range. Our adjusted EBITDA was $17 million in the quarter and diluted net income per share was $0.16.

Moving to our balance sheet and cash flow statement. We ended the first quarter with cash, cash equivalents and investments of $270 million. Cash flow from operations was $6 million and free cash flow was ahead of our expectations and just below breakeven.

This brings us to our outlook. We continue to believe that the largest drivers of ARR growth performance this year will be related to executional improvement, including continued momentum for our consolidated offerings, as well as the impact of the broader macroeconomic environment on customer buying behavior.

We are pleased that our first quarter results track to the plan across all metrics despite a noisy environment. Therefore, we are reiterating our full year 2023 ARR guidance of $815 million to $825 million representing year-over-year growth of 14% to 16%. We are raising total revenue guidance for the full year to $773 million to $779 million, reflecting outperformance in the first quarter. This range represents growth of 13% to 14% with high single digit growth contribution from our professional services revenue.

On profitability, we are also raising our operating income guidance of $59 million to $63 million for the full year, which represents operating margin expansion of at least 300 basis points. The increase reflects the portion of the first quarter outperformance that was unrelated to timing of spend.

We expect full year net income per share in the range of $0.83 to $0.89 based on an estimated 67.6 million diluted weighted average shares outstanding. And for free cash flow, we continue to expect approximately $80 million for the full year, which is approximately double our 2022 level and reflects over 400 basis points of free cash flow margin expansion.

Moving to our outlook for the second quarter of 2023. We expect total revenue in the range of $187 million to $189 million. We expect non-GAAP operating income for the second quarter in the range of $7 million to $9 million and non-GAAP net income per share of $0.09 to $0.12, which is based on 67.4 million diluted weighted average shares outstanding.

Thank you for taking time to join us on the call today. And with that we will open the line for questions. Operator?

Question-and-Answer Session

Operator

[Operator Instructions]

Thank you. Our first question comes from Matt Hedberg from RBC Capital Markets. Please go ahead. Your line is open.

Matthew Hedberg

Great. Thanks for taking my question. Keep it to one here. I guess, maybe for Corey, the success on the complete offerings is really great to see. Obviously, there's clearly I think a security efficacy benefit there when customers select one of those bundled offerings. But I'm wondering if you could talk to the ROI element from a customer's perspective when they consolidate. It seems to be a big part of the narrative here. I wonder if you could talk to that part.

Corey Thomas

Yeah. You're right, Matt. I think there's two things. There's one, customers are more interested in consolidation because they have to do more. I remind you that budgets are still growing. They're just growing at a slower rate that they were in the past with a little bit more uncertainty. And so what customers are trying to figure out by and large is really two separate things, is one, they want to figure out how do they actually continue the security improvements that they've committed to, that are necessary, that are critical, in a more, I would just say a tighter budgetary environment going forward. But they also importantly want to figure out how they boost the productivity of their team. Because remember, it's not just the budgets that we talk about, it's also their teams and their teams' effectiveness and their team's productivity.

The value proposition around our both the Threat Complete and the Cloud Risk Complete is really focused on how do you actually solve the problem of either managing threats or managing risk, but really doing that at high levels of efficacy and high levels of productivity. And one of the side benefits of that is that it's also cost effective to leverage spend on a common platform. But the primary benefit is that we're driving productivity and efficiency. And the way that we actually do that with Threat Complete is providing the complete SOC stack and solution around how people collect all the data across a hundred percent of the environment to detect the tax and then the analytics to respond, and then the automation to make sure that that response is robust.

And on the Cloud Risk Complete, it's really that integration of looking at the best-in-class across both the traditional VM, but also increasingly people are migrating to the cloud and they want to find a way to actually manage the risk in their cloud environment holistically. So again, it's a productivity boost in about how do they get more outta their talent and their staff, but also by consulting the platform, they get a direct economic boost that gives them scale by investing with us.

Matthew Hedberg

Thanks Corey.

Corey Thomas

Thank you very much.

Operator

Our next question comes from Saket Kalia from Barclays. Please go ahead. Your line is open.

Saket Kalia

Okay. Great. Hey, guys. Thanks for taking my question here. Corey, just to make sure that this question is asked publicly. I was wonder if you just comment at all on just the public headlines earlier this year around a sale process. Of course, the same question I asked last quarter. But also maybe as part of that comment on whether that is a process that's still ongoing [technical difficulty].

Corey Thomas

Saket, you broke up a little bit towards the end, but I believe that you were -- apologies. We had a little technical difficulty, little technical difficulty. Saket, I believe you broke up towards the end, but I believe you were asking about the rumors that I addressed on the last call. And I'll just say it, it's still the same comment. We don't really comment on rumors. That said, we have a pretty exciting opportunity in front of us. We have momentum that I think is demonstrated by our results this quarter, and so we understand why people would actually talk about us in that lens, but we're squarely focused on continuing to drive our performance in the business, deliver results for our customers, and we think that's going to deliver a great return for shareholders.

Saket Kalia

Got it. Fair enough. Thank you.

Corey Thomas

Thank you.

Operator

Our next question comes from Rob Owens from Piper Sandler. Please go ahead. Your line is open.

Rob Owens

Yeah. Good afternoon. Thanks for taking my question. Wanted to focus in a little bit around net new ARR, and obviously it's been under pressure for the last year. And I think given your holding ARR guidance for the year, does require some acceleration in the back half. So, is that a function of sales productivity? Is that a function of where the pipeline sets up at this point? Just some color to be appreciated. Thanks.

Operator

Ladies and gentlemen, we are experiencing technical difficulties. Please stay on the line.

Corey Thomas

I'm sorry, I might been -- we have a couple technical difficulties. Rob, can you hear me okay?

Rob Owens

I can hear you. Corey. Can you hear me?

Corey Thomas

Yes.

Tim Adams

Yeah. We can now.

Corey Thomas

We can now. Sorry. Apologies for that. Did you hear the answer that I gave?

Rob Owens

I did not. It went completely dark after my questions, so I don't think I stumped you. So, go ahead and maybe -- start from the beginning. Sales productivity, net new ARR, just put into context for us.

Corey Thomas

Yeah. Thanks for that, Rob. And so the -- look, our outlook was present -- was really based on two common things, is one is execution of the Salesforce transformation, which I think, look, we're well underway. I would just say we're ahead of schedule and that's going to trend exactly as we expected to. The second thing is, could we actually build the critical pipe in the platform consolidation areas that we were looking for, which we are ahead of schedule and the pipeline bills continue space.

The third thing is are the conversion rates for those areas where we expected them to be. And again, the conversion rates are quite strong in those areas. So, as we sit here today with the pipeline build, the Salesforce adoption being not just deep, but also broad and the conversion rates continuing to be strong, we're set up well for the second half of the year and it's really predicated on those trends continuing. So, not really a shift in the trends, it's just a continuation of those trends that's based into our core model.

Rob Owens

Thank you.

Corey Thomas

Thank you very much.

Operator

Our next question comes from Shrenik Kothari from Robert Baird. Please go ahead. Your line is open.

Tim Adams

Hey, Shrenik, go ahead. We cannot hear you.

Operator

Sorry, your line is open.

Shrenik Kothari

Sorry. Can you guys hear me now?

Corey Thomas

Yes, we can hear you now.

Shrenik Kothari

Great. Great. Thanks a lot. Yeah. So, very quickly on the traction that you guys highlighted on inside DR and cloud security, it's kind of driving multi-product adoption for you guys. Can you -- I mean, and you guys also highlighted kind of this gravitation towards vendor consolidation? And this is something which we have been hearing from your peers and rivals as well. And the benefit that you're seeing in ASP. So, can you just comment quickly on the win rates and the competitive environment, that you're seeing right now? I know there's a lot of noise out there, but would appreciate some comment there.

Corey Thomas

Yeah. I mean, look, I think we're well positioned if you think about consolidation and security operations space. There's few folks that actually spray -- cover this span of security operations. You look at us, we're at VM. We're a cloud security -- multiple aspects of cloud security, CSPM, cloud vulnerability management, workload protection. We also have a quite impressive SIEM technology that forms the core of our security operations platform for managed detection response along with security automation. So, if you look across security operations, I think we're set up better than anyone else I can think of to actually really drive consolidation in that space. So we don't have lots of direct competition.

When you think about end-to-end security operations, how do you manage risk across both the cloud on-prem endpoint environments from a risk visibility and management perspective and how do you detect and respond to attacks across the environment from a security analytics and automation orchestration perspective. And so that the win rates is extraordinarily high. And what our Salesforce has, and again, it's really because they're not challenged in that space. And what our Salesforce has actually learned is frankly to actually make that the primary focus with our consolidation offerings. Because when we actually shift it to how do you actually think about accelerating your security operations momentum at the best efficacy and the lowest possible long-term cost, that really differentiates the dynamic for our sales team. And so that's what we're seeing in the space. What we see competition is primarily in the point solution space, not the consolidation space of security operations.

Tim Adams

Corey, I just add, we know it's still early with our consolidation offerings. But in Q1, over 20% of the new ARR came from the new packages and we're seeing more and more of our sellers engage and be successful getting that sale. So that's up from what we saw in Q4. So, it's two data points that are looking very positive, but as you said, this was always intended to really gain full momentum towards the second half of the year.

Corey Thomas

Thank you for the question.

Shrenik Kothari

Thanks Corey.

Operator

Our next question comes from Michael Turits from KeyBanc Capital Markets. Please go ahead. Your line is open.

Eric Heath

Hey, guys. This is Eric Heath on for Michael. Corey, just wanted to make sure I understand just kind of high level, just curious, it sounds like go-to-market execution is progressing better than you expected. And then on the macro sounds like maybe it got a bit worse in the quarter, but no more than you were kind of already factoring in 90 days ago. So, just one, curious if that's right? And then, kind of secondarily to that, if that kind of gives you some more confidence in that ARR guide for the year.

Corey Thomas

Yeah. I think that's the right descriptor. I would say we factored in -- a little bit of pressure this year and I would say the pressure materialized largely in line with what we expected. And so that's why I say the market expectations in line with our expectations, which frankly we feel good about at this stage.

And then, to your questions about the Salesforce, the two things that actually give us confidence as we actually look out to the year are, one, the breadth of participation on the Salesforce, the retention of the Salesforce. But also look, Salesforce is live and breathe on confidence. And the fact that we actually have people both building the pipe and the pipeline converting while it's still early because the pipe's relatively fresh in the cycle, that actually gives the broader team confidence and it also gives us better visibility and more predictability as we go forward. So, I would say incrementally because we've executed against the plan so far this year that yes boosts our confidence. You have a plan. It's a high confidence plan when you start off, but you want to see that you're executing against that plan. And we made study execution against that plan as we've gone forward.

Eric Heath

Great. Thanks Corey.

Corey Thomas

Thank you.

Operator

Our next question comes from Gregg Moskowitz from Mizuho. Please go ahead. Your line is open.

Gregg Moskowitz

Hey, thank you for taking the question. It's great to hear about the traction with Threat Complete and Cloud Risk Complete including that ASPs have been showing more than a 2x uplift. Is it fair to assume that you're seeing more of an uptake for these packages from enterprises as opposed to mid-market?

And secondly, now that you have a few more months of data, do you have a sense of whether or not this strong ASP uplift could be sustainable? Thanks.

Corey Thomas

Yeah. It's a great question. As you would expect, yes. We do see early on, a bit more of the bias around the consolidation offerings come from more enterprise oriented or larger customers in the mix. That said, we do expect that to change. We have high residents and excitement on our mid-size team. From an expectations perspective, the mid-market is in line with what we expected, but our team has lots of excitement about the pipeline that they're actually building there. The conversion rates while very early are healthy there. And so, we do expect that to span and we actually think the case for consolidation is extraordinarily strong, not just in the enterprise, but also in the mid-market space.

Gregg Moskowitz

Yeah. That's helpful. Thanks Corey.

Corey Thomas

Thank you.

Operator

Our next question comes from Brian Essex from JP Morgan. Please go ahead. Your line is open.

Brian Essex

Hi, good afternoon. Thank you for taking the question. Maybe Corey, just maybe if we can dig in and understand the setup for the second half of the year, both from a macro as well as a sales productivity standpoint in terms of like what your expectations are embedded in the guidance for the rest of the year. So, I guess on the sales front, are you assuming any kind of -- I guess, maybe what was the linearity of hiring last year and is there a certain maturity baked into your assumptions that you need to see from the Salesforce? And then from a macro perspective, is it stay the same deteriorate? Like what are the -- what's look the setup?

Corey Thomas

Yeah. That's a great question. So, I will sort of like break down the balance. So, one on the Salesforce side, I would say look, our biggest assumption was that we would be able to retain the critical parts of the Salesforce and that they would actually be able to continue to be productive. We retain the productivity as a [technical difficulty] building is where we expect and would need it to be. So, I would say the Salesforce piece is set up well. Keep in mind that we actually have a good setup. When you think about a year-over-year comparative basis, we have a more experienced sales team. They've had sort of a ramp period of the new offerings. The offerings are competitive, the conversion rates are stable. And so from a Salesforce setup, we feel extraordinarily strong about the setup for the back of the year. There's work to do, but both on a comparative basis and an outlook basis, we actually feel relatively good there.

The second part of the assumption for the first, second half of the year is what's predicated on the first half of the year that we could actually build the right pipe. And I would say we're still building the pipe, but the pipeline build that we're actually doing is actually increasing at the rate that we actually have. And so we think we'll have enough things even in this pressured environment for the back half of the year. And we expect the conversion rates to stay consistent with what we've seen in the recent quarter.

Now all that tees up to our expectations for the back half of the year is a continuous to be a pressured environment. We are not expecting the economic outlook to actually get better. We're still expecting volatility. We're still expecting pressure. And what gives me confidence that our sales team has shown that they can actually deal with that environment. That's a little bit of why we actually are having higher pipeline requirements because we expect more things to be noisy and cycle. It's a little bit why our sales teams have to learn how to navigate. I would say changing deal cycles. We expect longer sales cycles, but all of that's baked into our assumptions. And so, I would say our trends as we're set up today are for what we're seeing to continue forward for what we saw in Q1 and continue forward Q2 and Q3 and Q4.

Tim Adams

Corey, it's worth underscoring that point because our sellers are really adapting to this environment. We know there's budget scrutiny across -- customers across the board and I think they really appreciate and they're understanding how to sell better in that environment.

Corey Thomas

Absolutely. Thank you for the question.

Brian Essex

Super helpful color. Thank you.

Corey Thomas

Thanks.

Operator

Our next question comes from Brad Reback from Stifel. Please go ahead. Your line is open.

Brad Reback

Great. Thanks very much. Corey, last quarter you talked about international retention rates being a bit of a headwind. Maybe you can talk to where they were this quarter and what the expectations are for the rest of the year? Thanks.

Corey Thomas

Yeah. I'll tag team that with Tim, but what I would say is that in general, from our expectations are the international team is performing in lines even slightly better than what I expected. And so, we feel pretty good about the outlook for the year going forward as far as our international teams go.

Tim Adams

Yeah. No, Corey, that's right. Look, we've made that investment internationally. We're starting to see signs that it is paying off. Internationally, the retention is improved, let me say modestly in Q1. Overall retention is in line with our expectations and continues to be stable in North America. But something that's very important. We put a lot of effort into it and pay a lot of attention to it.

Corey Thomas

Thanks for the question.

Brad Reback

Thanks very much.

Operator

Our next question comes from Matt Saltzman from Morgan Stanley. Please go ahead. Your line is open.

Matt Saltzman

Hey, team. Good afternoon. Thanks for taking the question. So, fully appreciate the ARRs, the key top line metric that we want to focus on here. But just in thinking about how that all flows through the model, can help but notice that billings were a little bit lighter than expected in Q1. So, I'm curious what was the drive -- what the driver of that was? And kind of where you expect to make that up over the course of the year to still achieve the updated revenue guide? Thanks.

Tim Adams

Yeah. Hey, Matt. No, I appreciate the question. Look, ARR is the core metric that we share with everyone, which is in embeds a lot of different things to get to that number, the new, the expand, retention, et cetera. I think you do have to be a little careful when you're looking at a quarterly billings number. We do look at that, but I do think a better way to look at it is on the last 12 months worth of billing. And if you do that, you'll see that that growth rate is more in line with the growth rate that we're seeing in ARR. There can be some anomalies. There's not a lot of those in terms of timing of billings with certain customers, but I would encourage you maybe to take that longer term view and I think it's probably the more indicative view that's going to link to ARR.

Corey Thomas

Thanks for the question.

Operator

Our next question comes from Adam Tindle from Raymond James. Please go ahead. Your line is open.

Adam Tindle

Okay. Thanks. Good afternoon. Hey, Corey. Coming off of RSA, cloud security was certainly a big theme. And on one hand, kind of viewed as a hidden asset within the Rapid7 model. On the other hand, there was some private companies with very healthy funding suggesting that they're taking share in cloud security and coming out with hybrid and runtime capability in the back half of this year that'll go after some of the more traditional vulnerability management players like Rapid7. So I just wanted to give you the floor, the truth behind some of those fears and competing with Wiz and how you're thinking about potentially defending that threat in the back half of this year. Thanks.

Corey Thomas

So, first of all, I actually think it'll be great. It'll help market for customers that the way they should think about it across their complete environment. And when you have customers that say, I want to look at risk across on-prem endpoint and the cloud, we will actually dominate in that space. And there's a couple different reasons is one, I think we as there any other player will find us an incredibly long tail on vulnerability management. You can do some of the easy windows pieces, but when you think about what customers are looking for enterprise grade vulnerability management, you have to be able to collect all the data, look at all the content, assess that and look across that. That's not a 12-month engineering effort. If it was this market would've been disrupted a long time ago.

Most importantly is we've been investing in the maturity of the cloud security. We've been under marketing and underselling it. So from a head-to-head perspective, we actually have a quite a compelling capability in cloud. And now we've been ramping up in our focus on these sales and marketing of that. Now, when you combine all that together, it benefits us to actually have the market, think about the way that we think about it is that you should manage your risk holistically, whether it's hybrid, whether it's on-prem, whether it's at the endpoint, or whether it's at the cloud. And the faster that the market thinks about that, the easier it'll be for Rapid7 to actually execute a strategy. And in that model, I think that we will be anyone head-to-head from a technology comparison basis. So, we welcome any competitor in the market helping us frame the way that customers should think about it holistically from an end-to-end perspective, because these think that benefits us. And we're certainly going to be investing in helping customers understand that they should be investing in those end-to-end risk management platforms.

Adam Tindle

Great point. Thank you.

Corey Thomas

Thanks.

Operator

Our next question comes from Joel Fishbein from Truist. Please go ahead. Your line is open.

Joel Fishbein

Thanks for taking my question. Corey, one for you. Just, I know it was a small acquisition, but Minerva, you did a little while ago. I know it wasn't very big, but I'd love to understand how that fits into the overall theme going forward. What the -- whether it'll be fully integrated and whether you know how it'll be sold going forward? Thanks. Appreciate it.

Corey Thomas

Great question. It's a tech and team deal and it really enables us to unlock our Threat Complete strategy. As you're aware is that we have lots of demand for customers to actually help them manage from the endpoint to the cloud, the ability to detect, respond, and remediate threats. Now, one of the things that our customers asked us for is that they had a wide range of endpoint technologies and antivirus. The ones that could actually sort of like afford to or focused or had advanced endpoint protection technologies. We integrate with those, we'll continue to integrate with those and we're happy with a partnership or cooperation approach.

But for those that actually truly just had simple AV, and they relied on us to provide their end-to-end detection and response capability, Minerva allows us to actually do advanced in-memory protection on those endpoints. That allows us to make sure that when we detect the threats, those customers are empowered to stop those. The same way our automation and our SOAR technology allows them to actually orchestrate the across the environment and stop, the same way that we actually are able to stop processes, isolate resources, contain users. That same mentality is what actually has us actually helping our customers respond to their need for cost effective detection response. And frankly, customers shouldn't have to make the trade-off between spending lots of money to actually have a highly effective and efficient end-to-end detection response capability. So again, our focus is meeting customers where they are, endpoint to the cloud and providing the capabilities that they're asking for to deliver a robust detection response platform.

Joel Fishbein

Great. Thank you.

Corey Thomas

Thank you.

Operator

Our next question comes from Gray Powell from BTIG. Please go ahead. Your line is open.

Gray Powell

Great. Thanks for taking the question. So, yeah, it was good to see the increase in the complete mix to 20% of net new ARR. I think that number was 10% last quarter. And then, can you maybe just -- was that more on the cloud security side, or is that more the Threat Complete products? Just be curious what drove that improvements?

Corey Thomas

No, we got traction on both sides of the equation there and the pipeline build has been healthy for both. And so, we'll continue to focus on both. We don't -- I can't recall, we don't do the line item reporting here on it, but we actually have gotten traction across both of those portfolios.

Tim Adams

Yeah. Gray, and you're right, it was 10% of new ARR in Q4, so it's up significantly in Q1.

Gray Powell

Got it. All right. Thank you very much.

Corey Thomas

Thank you.

Operator

Our next question comes from Jonathan Ho from William Blair. Please go ahead. Your line is open.

Garrett Burkam

Hi. Thanks for taking my question. And this is Garrett Burkam for Jonathan Ho. So, you mentioned the sales transition is ahead of schedule, ahead of your expectations, so can you just expand on that a little bit? Maybe what specifically is progressing well there and maybe where there's still room for improvement? Thanks.

Corey Thomas

Yeah. Well, I think there's room for improvement in this as we have to hit the plan. So, we're ahead of scheduling the plan, but because you're ahead of schedule, you still have to manage the plan. And so that's the big -- there's no big gap on sort of like where we expect it to be. And then specifically, what's ahead and what's the next steps in the plan is, there's a couple elements that we've actually emphasized. One is that could you do the transition and retain the sales team and check? We've actually done a very good job of actually doing the transition and retaining the sales team with confidence.

The second part is could you actually get pipeline billed, not just across a few people, but across a broad base of people. And nicely we're seeing pipeline build continually starting to actually ramp increase across a broader and broader selection of the Salesforce. And then thirdly, I think Tim highlighted this in his remarks is that is not just a few reps, but is a larger and larger cross section of reps landing deals. This is why that's sort of moving from 10% to 20%, over 20% matters, is because you need the success to actually follow it. And so, in Q1 we actually saw that progress that was ahead of where we wanted to be and we need to continue to see that progress in Q2.

Now, our outlook for Q2 presumes that that progress continues, because that's the setup that we have both in the pipeline, and the conversion rates that we've seen. But those are the elements of the Salesforce is are they there, are they motivated? Are they building the pipe in the right areas? Are they converting that pipe and are they closing deals? And so far versus plan, it's at or better than what we expected across all of those metrics.

Thank you for the question.

Garrett Burkam

Got it. Thank you. Yep, thanks.

Operator

Our next question comes from Joshua Tilton from Wolfe Research. Please go ahead. Your line is open.

Joshua Tilton

Hey, guys. Thanks for taking my question. I know there's been a lot on it, but I kind of just want to come back to the guidance. It does imply that you guys have to kind of triple your net new ARR by 4Q. So assuming that this all does go to plan and you achieve that, what percentage of net new ARR by the end of the year is going to come from these complete consolidated offerings? And I'm only asking because it does feel like in addition to just these bundles ramping, you sort of see need to see a pretty meaningful improvement in the rest of the business. So one, am I looking at this the right way? And two, can you maybe just unpack for us the other 80% of net new ARR, what's driving that and how will that trend for the rest of the year?

Corey Thomas

Yeah. So one, the primary drivers of the other part of the business AR is what you would expect it to be. It is our traditional detection response that doesn't have the compete consolidation factors around it. So think about that. The standalone SIEM category, it's vulnerability management and it's standalone cloud. And really what you actually have there is, I would say it's less efficient. You can clearly see that from the ASP dynamics than the packages. So, you get efficiency as you actually build out the packages.

But to clarify a couple things for you, one in no meet way do we expect it to be a hundred percent of our sales that are in the platform consolidations. We don't assume it's not in our base model. It's not remotely close to it. We still have to execute on ensuring that we actually are successful in landing, in closing the traditional SIEM, MDR, vulnerability management, cloud security, those elements, we still have to do upsell and cross-sell. So we have to add threat intelligence on, we have to add [indiscernible]. All of those things are part of the business. So the way that I would actually just think about sort of like the backdrop of the year is one, I would just think about the backdrop in the setup. It's not just how it relates to this year, it's also what's the comparative basis to last year.

Keep in mind, we actually had -- we talked about sort of like the challenge at the end of last year, but we actually have those year-over-year comparables with a much stronger sales team that's actually more mature and in process with a stronger product portfolio. So, one, if you just think about the setup, it's actually a much more favorable setup than the headline. I think analysis that you actually gave would indicate.

The second thing is that we have to have a robust pipe. We're building that we're trending towards the pipe that we actually need for the back half of the year, and then we have to execute on the packages. It's clearly going to be above 20%, but we still have to execute on the other aspects of the business. But we are executing on those other aspects of the business. Cloud is actually -- our performance in cloud is actually getting better. We -- even though VM is where we expected it to be, and I think we're in line with the market there. We still will close business. But most importantly, we're still going to be executing on the cross-sell and upsell. So the expansion in the install base, which again, is still a material part of the business, we'll be executed on that. So, if you take that total setup, the setup, the packages, the upsell and the cross-sell, and then executing run rate against the parts of the business that we've already been executing against, I think we're set up quite well for the second half of the year and Q4. So I agree with the analysis that you actually gave from a numeric perspective.

Tim Adams

Yeah. Corey, I would just underscore. We know the market opportunity. It's over $30 billion, so it's huge. We know the demand environment is there. Yes, there are some challenges from macroeconomic budgets being tightened, but security is still critically strategic for all of our customers and our prospects. We see the pipeline, we see the conversion rates, we have the mature sellers, and we have the breadth of products, and we have the packages. And now it just comes down to execution, which we said will be heavily oriented toward the second half of the year. We're off to a good start, but we have more work to do.

Corey Thomas

Absolutely. Thank you for the question.

Operator

Our next question comes from Alex Henderson from Needham and Company. Please go ahead. Your line is open.

Alex Henderson

Great. Actually, pretty good follow up to the question that was just asked. And I thought that was a good question as well. But I was hoping you could give us some sense of what a success trajectory would look like for the new ARR from these packages. If it's 10% going to 20%, is it 35% or 40% next quarter and 50%, 60% in the out period, what portion of new ARR should be coming from it to hit your model as we go through 2Q, 3Q and into 4Q?

Corey Thomas

Yeah. So, it's a good question. It's directionally up. We're not going to provide a specific number at this time and at this stage. But what I would say is we would expect it to continue to expand. And most importantly, keep in mind it's not just the packages. We also expect to continue to be doing cross-selling and upselling. And so when we think about our ARR and expansion, there's a number of different elements that are involved there. But I would say we absolutely directly expect it to continue to expand, but it's too premature to provide you a specific number of what it's going to be like per quarter by quarter right now.

Alex Henderson

Yeah. Well, if you're not going to answer that one, maybe I could ask another one. Can you give us any sense of whether there was any disruption associated with the financial debacle, impacting the CFO behavior of your customers in late March with your -- the linearity? Or any hesitation?

Corey Thomas

Yes. I'll give you a very quick response there. So one, what I would say is like -- just like the whole world, I think lots of people took a moment and a breath to actually say like, what does this mean? So we definitely saw some impact and some customers actually slow down a little bit to say like, hey, what does this mean? Does this sort of an indicator of a future, so like banking crisis? But what I would say is both from our sales team perspective and our customer perspectives, that was only like a breath. It was a moment, and they got back to the business and we actually had a fairly strong close to the quarter overall. But there was -- it's a breath that actually happened there.

All right. Thank you for the questions and let's keep going.

Operator

Our next question comes from Mike Walkley from Canaccord Genuity. Please go ahead. Your line is open.

Unidentified Analyst

Hey, guys. Good afternoon. It's Daniel on from Mike. Thanks for taking the question. Yeah, I just wanted to see if you guys can provide some detail on how the productivity of your sales reps are trending, especially as they're now selling the two complete bundles. Is this -- I guess sort of in line with what you had previously been expecting, or are they ahead of progress?

Corey Thomas

It's in line with what we were expecting. And I would just say the progress goes a little bit to the earlier questions about the mix shift and the pipeline build. That's where we're actually ahead. And frankly, the sales of the new packages and bundles, that's where we're ahead. But I would say the overall productivity is in line to expectation. Again, our expectations assumed that there was going to be a ramp based on training, which we're seeing and we're expecting and we're delivering against. And we are seeing some of the larger deals that we actually talked about earlier, which do have slightly longer deal cycles in addition to the environment. So, I'll say productivity is exactly what we expect it to be. And so as we look forward, that actually gives us the confidence that we are building pipe tech actually close at the productivity rates we expect in the back half of the year.

Operator

Our last question will come from Shebly Seyrafi from FBN Securities. Please go ahead. Your line is open.

Shebly Seyrafi

Yes. Thank you very much. So, your 10-K showed that your sales marketing employee headcount grew by 16% in 2022. What kind of headcount growth in S&M do you expect in 2023?

Corey Thomas

Yeah. I think Tim sort of like conveyed earlier. I think we're looking for pretty modest growth there. I think we expect more productivity increases. We have the good benefit of actually having the people in place. It was allowing them to get more tenured, to get the training, the enablement, and the ramping. So I would expect modest and it's really a focus on the productivity. And I think we're trending well there.

Tim Adams

Yeah. Shebly, as you know, we've doubled our profitability guidance from a year-over-year and free cash flow, and we are certainly very committed to that. We got in front of the headcount hiring curve over a year ago, and it's something that we're just going to watch very carefully along with all of the expenses, the way we invest in the business.

Corey Thomas

Absolutely. Thank you for the question.

Shebly Seyrafi

Thanks.

Operator

We have no further questions. I would like to turn the call back over to Corey Thomas for closing remarks.

End of Q&A

Corey Thomas

Well, thank you all for spending time with us this evening. And I hope you all have the great rest of the day and a good week.

Operator

This concludes today's conference call. Thank you for your participation.