SecureWorks (Class A) (SCWX) Q1 2019 Earnings Conference Call Transcript

SecureWorks (Class A) (SCWX)
Q1 2019 Earnings Conference Call
Jun. 6, 2018 8:00 a.m. ET

Contents:

• Prepared Remarks
• Questions and Answers
• Call Participants

Prepared Remarks:

Operator

Good morning and welcome to the SecureWorks first-quarter fiscal 2019 financial results conference call. Following prepared remarks, we will conduct a question-and-answer session. [Operator instructions]. At this time, all participants are in a listen-only mode.

We are webcasting this call live on the SecureWorks Investor Relations website. After the completion of the call, a recording of the call will be made available on the same site. Now I will turn the call over to Teri Miller, VP and chief accounting officer. You may begin.

Teri Miller -- Vice President and Chief Accounting Officer

Good morning, everyone, and thank you for joining us today to review SecureWorks' financial results for the first quarter of fiscal 2019. This call is being recorded. This call is also being broadcast live over the internet and can be accessed on the Investor Relations section of SecureWorks website at investors.secureworks.com. The webcast will be archived at the same location for one year. This morning, SecureWorks issued a press release announcing results for its fiscal quarter ended May 4, 2018.

You can access this press release on the Investor Relations section of the SecureWorks website.During this call, management will make forward-looking statements within the meaning of the Private Securities Litigation Reform Act of 1995. These forward-looking statements include but are not limited to guidance with respect to GAAP and non-GAAP revenue and net loss per share, as well as adjusted earnings before interest, taxes, depreciation, and amortization.Our forward-looking statements involve risks and uncertainties that could cause actual results to differ materially from those anticipated by these statements. You can find a description of these risks and uncertainties in this morning's earnings press release and in the company's annual report on Form 10-K for the year ended February 2, 2018, which is also available on our Investor Relations website and on the Securities and Exchange Commission's website.All forward-looking statements made on this call are based on assumptions that we believe to be reasonable as of this date, June 6, 2018. We undertake no obligation to update our forward-looking statements after this call as a result of new information or future events. Some of the financial measures we use on this call are expressed on a non-GAAP basis.

These non-GAAP measures exclude stock-based compensation, the impact of purchase accounting, amortization of intangibles, and the related tax effect of these items. We have provided reconciliations of the non-GAAP financial measures to GAAP financial measures in today's earnings press release available on our website. Non-GAAP measures are not intended to be considered in isolation from, a substitute for, or superior to, our GAAP results, and we encourage you to consider all measures when analyzing SecureWorks' performance. Also, as a reminder, all financial information discussed is non-GAAP and growth rates are compared to the prior-year periods unless otherwise stated.With us on today's call are Michael Cote, president and chief executive officer of SecureWorks, and Wayne Jackson, chief financial officer. Following their prepared remarks, we will take your questions.

We would appreciate you limiting your initial questions to two so that we may allow as many of you to ask questions as possible in our allotted time. In the event you have additional questions that are not covered by others, please feel free to requeue and we will do our best to come back to you.Thank you for your cooperation on this. Now I would like to turn the call over to Mr. Cote.

Michael Cote -- President and Chief Executive Officer

Thank you, Teri, and thank you, everyone, for joining us this morning for our first-quarter 2019 earnings call. I am pleased to report that we've had a strong start to fiscal 2019. Revenue in the first quarter was $126 million, which was above our expectations and up 11% year over year. Our monthly recurring revenue also grew 11% year over year to $35.5 million.After a very strong Q4, we had the best first-quarter sales in our history, up 50% over the prior year, evidence of the total team effort put forward to help our clients combat evolving threats.

I would like to thank the entire team for their focus on protecting and serving our clients and executing on our objectives.In the first quarter, we saw strong demand across the board, a 94% year-over-year increase and the total value of deals closed greater than $1 million. Our leadership position in the industry, allows us to continue this trend, as we compete across the global market. Our momentum internationally continues to accelerate, growing 57% year over year. As a reminder, the EU's General Data Protection Regulation, or GDPR, went into effect May 25. Over the past year and a half, we implemented the necessary steps to enhance our global privacy program to address GDPR requirements.

We also saw increased demand for incident response engagements, as the number of high-profile breaches grows and the shortage of security talent in the market continues.As a result, the mix of our sales in the first quarter was more weighted toward our strategic risk and consulting business, than our subscription business compared to historical levels. Over the last four quarters, approximately 50% of our signed business represents clients who purchased both consulting and subscription solutions in the same quarter. This represents a 25% increase over the same metric in the prior four quarters.We deliver benefits to our clients in many ways, including simplifying the clients' ability to buy complete security solutions from us. We've recently launched the SecureWorks Managed Detection and Response offering, a powerful solution, that brings together several of our advanced detection and response solutions to form a comprehensive security offering, all in a simply priced package, providing predictability and scalability.Streamlining the detection and response functions, SecureWorks' MDR pinpoints real security threats, lightens the burden of investigation for staff, and give clients enough context to timely take the right action to stop and remediate threats.

Clients continue to place their trust in us and as a leader in our industry, our value proposition remains strong.We've made notable progress and I want to recognize the impressive results delivered during a period of transition as our new chief revenue officer, Jeff Hayden, joined the team at the beginning of the first quarter. The continuity of the regional sales leadership team remains the key growth driver in the first quarter as the EMEA and APJ teams converted strong demand into solid results. In North America, we had good results in both our small and medium business and our state local education teams, while our enterprise team nearly doubled its prior-year production. The sales engineers and solution architects a key investment area during fiscal 2018 also played a pivotal role in advising enterprise clients on risk effective solutions. From a market perspective, as clients continue to develop their strategies to operate in a digitally connected world, cloud technology is playing an important role. Our unique ability to secure clients across environments, including on-premise and public, private and hybrid clouds presents a continued market opportunity for us.Last year we've launched our AWS and Office 365 monitoring capabilities and we've seen encouraging year-over-year growth in these solutions.

Recent activity in the cloud space includes the addition of Microsoft Azure monitoring to our cloud security solutions portfolio. The launch of our managed detection and response package, which includes cloud security monitoring helping provide a unified view of a client's environment and keeping clients safe across their endpoints, network, and cloud deployments. And the development of a new managed solution that leverages VMWare's app defense technology to protect applications running on VMWare vSphere-based virtualized and cloud environments.Leveraging app defense, we are able to properly respond to a threat, whether that be blocking malicious behavior, quarantining the application, or taking a snapshot of the virtual machine. In addition, the technology's runtime learning and behavioral modeling capabilities make tuning policies smarter and more efficient over time.

We continue to see organizations grapple with measuring the risk and effectiveness of their security program as they strive to prioritize their security investments in the most effective manner. We help our clients through this challenge by delivering technology-led solutions that prevent attacks, detecting those that cannot be prevented, responding rapidly and predicting where the threat actors are going next. We recognized that velocity is critical in our industry. Our technology innovation is focused on continually improving speed and context that directly translate to better client security outcomes. We've launched our first set of automated playbooks, and are encouraged by the powerful effect these automation efforts have in a variety of areas, including higher fidelity detections, increased investigative context, reduced time to remediate, and increased security analyst productivity. I look forward to updating you on our progress in this area, as early indications show this will be a step-function increase in the efficiency and effectiveness of detecting and remediating threats. As I previewed last quarter, we are also prototyping a security applications framework that enables a rapid creation of high-value security applications leveraging machine learning across diverse data sources.Initially, we are focused on the development of a set of applications that enables end-to-end threat detection and response.

The technology allows us to leverage localized data, while also leveraging both our proprietary technology and best-of-breed technologies to power faster, higher-fidelity, and more accurate detection, investigation, and response. There is a lot to do but I am encouraged by our progress to date. At SecureWorks, we are uniquely positioned in the industry. Our solutions are based on years of cyber-attack data and machine learning-based solutions that are the foundation of our counter threat platform. Investment and technology innovation allows us to stay ahead of the threat actors and protect our clients, which is key to continued top-line growth.

Growth that enables us to realize the significant operating leverage in our business module.I will now turn it over to Wayne to talk about our performance in the first quarter in more detail. Wayne?

Wayne Jackson -- Chief Financial Officer

Thanks, Mike and good morning, everyone. In the first quarter, revenue was $126.2 million, a 10.8% increase over Q1 FY 2018 and a 4.2% increase sequentially. Our average annual subscription revenue per client increased to $98,000 this quarter, an 11.7% increase over the prior year and a 1.3% increase sequentially.As Mike noted, sales results for contracts greater than $1 million were up 94% year over year, as we continue to reap the benefits of our sales investments in the enterprise space, as well as in our international markets. A couple of notable examples of new large deals that we signed in the first quarter include a $4.2 million three-year agreement with a global lighting-solutions company.

This win is a prime example of coordinate security solution package providing the protection and intelligence the client needed to enhance their security position.A second notable example was a $2.9 million two-year deal with a large global diversified industrial company. This win is representative of our solutions aligning to the growing market demand, as this client is expanding more into the internet of things space with an increased focus on how to secure their operations as they evolve. This win is also an example where our relationship with Dell Technologies played an important role in the sale.We exited the quarter with monthly recurring revenue or MRR of $35.5 million, an increase of 11.3% over the prior year and 0.6% sequentially. As previously mentioned, we have strong demand this quarter for consulting services and our SRC revenue comprised 21.8% of total revenue.

We anticipate our consulting to subscription revenue mix will remain at a similar level for Q1 for the next few quarters. Over time, we expect the mix to revert to our historical norm of MSS representing approximately 80% of the total.In the near term, we are leveraging our SRC capabilities as an important component of a comprehensive security solution for our client. Revenue retention in the period was 100% versus 96% in the fourth quarter and 99% in the first quarter of last year. As a reminder, revenue-retention measures how well we have maintained revenue for clients we had on the first day of the year.

This metric reflects only subscription revenue as of the beginning of the year and excludes backlog.For the quarter, revenue outside of the year the U.S. grew to 20% of total revenue for the quarter, up from 14% last year on this consistently strong growth in the U.K., Middle East, and Japan. Gross margin was $69.3 million in the first quarter of fiscal 2019, or 54.9% of revenue, compared with $64.5 million, or 53.3% of revenue, in the fourth quarter.The fourth quarter of last year included an approximately 150-basis-point impact for severance and higher incentive compensation expense due to fourth-quarter performance metrics.Prior-year first-quarter gross margin was $53.9 million, or 55.9% of revenue. On a year-over-year basis, gross margin as a percentage of revenue is lower, primarily due to the impact from the consulting business. Moving down the income statement, our first-quarter operating expenses totaled $75.2 million, compared to $73.8 million in Q4 and $71.9 million last year.

While an increase in absolute dollars we continue to leverage our operating expenses as opex decreased 350 basis points year over year.Research and development expenses increased to 16.9% of revenue in the quarter, up from 16.4% last year as we continue to invest in innovative technologies to meet our clients' evolving needs. We will continue to make incremental R&D investments in fiscal 2019 to further advance our automation and new applications framework, Mike mentioned. We do however expect our investments to taper back down in the second half of the year.Sales and marketing expenses this quarter were approximately 27.8% of revenue, down from 31.6% last year as we leveraged investments and organizational changes made in fiscal 2018.General and administrative expenses totaled 15% of revenue, compared to 15.2% last year. We anticipate that we will continue to gain some additional leverage related to G&A expenses in the second half of the year.Our adjusted EBITDA loss narrowed to $2.6 million, or 2% of revenue for the quarter, from $5 million, or 4.4% of revenue last year.

Our net loss for the quarter also narrowed to $4.5 million from $5.5 million last year. As the margin on higher revenue offset the increased R&D investments, I just highlighted. Non-GAAP net loss per share was $0.06 for the quarter, compared to $0.07 last year.Moving on to cash flow and balance-sheet items, cash used in operations was $18.4 million in the first quarter, compared to $19.7 million use of cash last year. Recall that first-quarter cash flow from operations is negative, due to the payment in the quarter of annual bonus compensation.

We finished the quarter with cash of $77.3 million.Our net accounts receivable totaled $146.8 million at the end of the quarter, down from $157.8 million in the prior quarter. DSO decreased 10.9% sequentially. We invested $2.2 million in the first quarter in capital expenditures to support our growth.Now for FY 2019 guidance, which reflects the impact of ASC-606 and its related standards, which SecureWorks adopted for its fiscal year ending February 1, 2019, using the full retrospective option.As a reminder from our last call, as most of our subscription revenues have always been recognized over the life of the underlying contract, there was an immaterial impact on revenue of adopting ASC-606. However, with the application of this new standard, we will have lower expenses due to the requirement to defer and amortize client acquisition costs, including sales commissions and certain installation cost.As it relates to guidance, a significant portion of a contract with our largest client is up for renewal at the end of our second quarter.

Our guidance reflects our current view of the outcome of these discussions. For the second quarter of fiscal 2019, we expect both GAAP and non-GAAP revenue to be in the range of $127 million to $128 million and we expect a non-GAAP net loss per share to be in the range of $0.05 to $0.06, based on approximately 80.8 million weighted average shares outstanding.We have updated our full-year fiscal 2019 guidance and now anticipate the following. We expect GAAP and non-GAAP revenue to be in the range of $515 million to $518 million, we expect our adjusted EBITDA loss to be in the range of $3 million to $7 million. We expect our non-GAAP net loss per share to be in the range of $0.15 to $0.19 per share, with 80.8 million weighted average shares outstanding.

All improved measures compared with prior guidance, reflecting our higher Q1 revenue and EBITDA performance and continued sales momentum.Additionally, we expect GAAP net loss per share to be in the range of $0.59 to $0.63. This represents an increase in our net loss per share compared with our original guidance for the year, due to a lower tax benefit now anticipated, based on a fuller understanding of the impact of the new tax laws.For modeling purposes, we estimate that the tax benefit rate will be approximately 23% for each of the next three quarters and when combined with the first-quarter tax benefit, the overall rate for the year is about 22%. We expect our MRR to be in the range of $38 million to $39 million at the end of the fourth quarter of fiscal 2019.We are introducing cash flow guidance for the first time, and expect cash flow provided by operations to be in the range of $15 million to $20 million for the full fiscal year 2019, up from roughly $1 million in fiscal 2018.I will now return the call to Mike.

Michael Cote -- President and Chief Executive Officer

Thanks, Wayne. This quarter's positive performance shows we continue to make progress in our plan to accelerate our growth trajectory. Our clients trust us. It is a core value and foundational to all we did, and we will fight to keep their trust and confidence every day.We have a strong executive leadership team, positive momentum and I am eager to continue executing against our fiscal 2019 plans.

I look forward to providing further details on our progress next quarter.Before I turn it over to the operator for questions, I want to again express my gratitude for the hard work and dedication our team members bring to the table every day to keep our clients safe in a digitally connected world. I'd also like to thank our clients for allowing SecureWorks to serve as their trusted cybersecurity partner and our other stakeholders for their continued support.Chelsea, you can now open the line for questions.

Questions and Answers:

Operator

I will now open the call for questions. [Operator instructions]. We'll take our first question from Jonathan Ho with William Blair.

Jonathan Ho -- William Blair & Company -- Analyst

Hi, congratulations on the strong quarter. Just wanted to start out with your commentary around some of the large deals and the 94% growth year over year. Can you give us maybe a sense of what drove that? Was it more sort of the client composition or more products being selected? Just wanted to get a better understanding of what that dynamic is?

Michael Cote -- President and Chief Executive Officer

So, Jonathan, this is Mike. Thank you for the question. The real underlying answer to your question is the sales transition work that we began last year, which Jeff and his team, I should say, he brought in a couple of new leaders in the existing team that's in place really focusing on executing from a sales perspective. The primary focus that we're leading toward is or we are working on is regarding people, the right folks and the right sales leaders and solutions architect and sales support.So productivity, that really falls into the three big buckets -- let me back up -- talent, coverage, and quality of sales.

So talent being the people, coverage being the appropriate coverage in the area, productivity, and the sales things, and the things we can do to help support them and then messaging and methodology.So, as I mentioned, we continue to see strong performance in EMEA and APJ. Our state, local and enterprise team and our SMB team performed very well in the quarter and our enterprise group, which was the group that had been struggling historically, actually doubled its productivity in Q1.So our basic hope and belief and now sort of put two dots together between fourth-quarter performance on the sales perspective and first quarter are that we can continue this trend going forward. So we've got a good geographic diversity, good industry diversity and holistic security programs and solutions for our clients.

Jonathan Ho -- William Blair & Company -- Analyst

Got it. And then you've talked a little bit about GDPR being a driver inside of EMEA. Can you talk about how GDPR is maybe impacting your business either from a willingness-to-spend perspective or some of the actions that you took to I guess prepare your systems for that transition?

Michael Cote -- President and Chief Executive Officer

So thanks, Jonathan. In my prepared remarks, what I was really trying or what I really referred to is that SecureWorks is GDPR compliant and had a lot of focus internally over the prior 18 months to ensure that we were compliant internally. From a market perspective, it has clearly been a key part of the conversation with every client in Europe. And I think it has helped put the focus on security.

Our ability to represent and tell them that we're compliant and actually being in a good position from that perspective, we've helped a lot of our clients and advise them on the things that they can do from our experience and expertise in that area. And it's resulted in a lot of interest on the sales perspective and discussion. So I would say it was clearly been a help for us in Europe and was a net positive.

Jonathan Ho -- William Blair & Company -- Analyst

Thank you.

Operator

Your next question comes from the line of Saket Kalia with Barclays.

Saket Kalia -- Barclays -- Analyst

Hey guys, thanks for taking my questions here. How are you?

Michael Cote -- President and Chief Executive Officer

Good, and you?

Wayne Jackson -- Chief Financial Officer

Hi, good morning.

Saket Kalia -- Barclays -- Analyst

Not bad, not bad. Hey, morning. Hey, maybe starting with you Wayne. Nice bounce-back in the revenue-retention rate. You touched on it a little bit in your prepared remarks but can you remind us how that formula works? And what were some of the puts and takes and what drove that improvement whether it was an improvement in service churn, perhaps an improvement in customer churn. Maybe a little bit more detail on what drove that improvement in revenue retention?

Wayne Jackson -- Chief Financial Officer

Sure, good morning Saket, thank you. So for this quarter 100% as I discussed in the prepared remarks. And just to remind you it is the book of business as of the beginning of the year and that stays constant and then there are two things that impact that similar to same-store sales. It's either additional cross sales into a client or it's not renewing that client.

And in Q1, we had both our renewal rate was probably not where we wanted it to be but not too far off for first-quarter results. First quarters generally we see in dollar terms a bigger impact on our book than in the Q2 through Q4. So, to answer your question directly, the primary reason is we have strong cross sales into our existing client base. That was the driver.

Saket Kalia -- Barclays -- Analyst

Yes, got it.

Wayne Jackson -- Chief Financial Officer

And we would happy to see that because we had discussions over the prior several quarters that the sales momentum impacted both new sales and cross sales. So we were happy to see an increase in cross sales.

Saket Kalia -- Barclays -- Analyst

Very helpful. For my follow-up maybe for you Mike, a question I like to ask you quarter to quarter. In your conversations with customers, how are they sort of balancing the decision of doing more security in-house versus leveraging in MSSP like SecureWorks, I mean, based on 94% growth and $1 million-plus deal, it feels like maybe the scale is starting to tip one way versus the other but I am curious about what you're hearing from customers on that trade-off of in-house versus an MSSP generally.

Michael Cote -- President and Chief Executive Officer

So thanks for the question, Saket. A couple of things. When we talk about this, let's first think about clients as they do it for me was typically tend to be sort of the smaller clients those were the smaller securities that not necessarily smaller in revenue. And that is a part of the market in the do it with me sort of segment of the market, which is a big market, that part of the market is basically going to look in balances between how much of an investment they want to have internally, as we work with them.And the value associated with our network effect, with our intellectual property around our machine learning and our algorithms with our ability in some of my prepared remarks I touched on to help them orchestrate and actually take the appropriate actions.The other kind of key component that's come into this and again I kind of alluded this in my prepared remarks, that's becoming more and more of a conversation is, clients are looking in the industry I think as a whole is looking to understand and measure the effectiveness of their security program.

Are they really for their spend reducing their risks and how are they reducing it to protect the appropriate assets. And we end up coming into play a role with showing them, if you will, the efficacy of the technology that they are using and helping advise them on how to optimize their security spend in the best manner.

Saket Kalia -- Barclays -- Analyst

Makes a lot of sense. Thanks very much.

Operator

Your next question comes from Rob Owens with KeyBanc Capital.

Rob Owens -- KeyBanc Capital Markets -- Analyst

Great, thank you guys for taking my question this morning. You mentioned that the industry remains resource constrained overall from a headcount perspective. And so, I guess, my first question is really around pricing and given the lack of qualified headcount out there. How is that impacting your pricing, I guess on a year-over-year basis if you were either to look at deal size or any metric you can give on that front?

Wayne Jackson -- Chief Financial Officer

So, good morning, Rob, this is Wayne. From a pricing perspective, it really touches a little bit on what Mike just talked about. We have different prices for the do with me and do it for me. And then in the enterprise space the pricing as we move up and deal with procurement, CFO offices, the pricing gets a little bit different as well but, just we take into account what the value we bring and then we look at our investments and how efficient we can be and those investments in either in orchestration or automation and that helps drive from our perspective how we price in the marketplace.

Does that answer your question?

Rob Owens -- KeyBanc Capital Markets -- Analyst

Not really. Yes.

Wayne Jackson -- Chief Financial Officer

Sorry, Rob. Go ahead.

Rob Owens -- KeyBanc Capital Markets -- Analyst

That's OK. I only get two questions. I hope this still counts as No. 1.

I guess if I am looking on a year-over-year basis, and the industry remains more and more resource constrained, are you able to find any price leverage within the customer base? Or do you feel you are still a price taker at this point?

Wayne Jackson -- Chief Financial Officer

We do find price leverage, as you see our ARPU is up 12% year over year, we find price leverage when we provide solutions that the client looks at and says this helps me in my overall security position. So, yes.

Rob Owens -- KeyBanc Capital Markets -- Analyst

OK. Let me sneak a second one in then, it's just maybe third, maybe second.

Michael Cote -- President and Chief Executive Officer

Go ahead.

Rob Owens -- KeyBanc Capital Markets -- Analyst

Relative to the large deals and the success you are seeing there, are these greenfield opportunities in and around expansion are they replacement opportunities as you spoke to people who might have been doing it themselves that are switching over or are they competitive displacement opportunities maybe if you can characterize what you are seeing at the higher end of the market?

Michael Cote -- President and Chief Executive Officer

Thanks, Rob. It's Mike for your second question. I don't have the actual specifics on the deals that I referred to in the first question but I would tell you anecdotally, I would tell you that it's probably more greenfield and say a little more greenfield where it's mostly new clients, with all new clients that we're getting in from the growth perspective, most of its new clients that are doing most of this in-house.And are really looking to figure out as I kind of referred to when I mentioned earlier to Saket, the industry for the first time over the last 12 months is beginning to look at their spend from a security perspective and ensure that they are spending in the right areas depending upon where the hackers are going, where their risk is and their base of assets and trying to make sure that they are measuring the reduction of risk that they are spending in the various areas.So, I think that is driving some of the clients we're picking up, there are displacements, there are probably plus or minus a third of the new growth we're getting is displacement of competitors.

Rob Owens -- KeyBanc Capital Markets -- Analyst

All right, thanks for your answers.

Operator

Your next question comes from Howard Smith with First Analysis.

Howard Smith -- First Analysis -- Analyst

Yes, good morning. Thank you for taking my questions. First question I have to do with the Dell sales force, if I remember correctly their ability to get quota altered a little bit this year to your benefit and you do reference their help in one of your major sales but more broadly, I'm just curious, do you feel you are getting the full benefit of that or is that something that ramps over several quarters. Maybe you could just address that dynamic a little bit.

Michael Cote -- President and Chief Executive Officer

Howard, this is Mike, thanks for the question. I'd summarize it at a high level and say we made progress and it was better but it's not where it needs to be. So, it has the focus from the top of the Dell Technologies organization across all of Dell Technologies and I think we were pleased in Q1, there were more deals and a larger percentage of our overall close deals but it's no way, near where it should be for the opportunity that lies ahead.

And I would answer the second part of your question that I would expect it to continue to ramp up and take a little bit of time before on a global basis we're really beginning to feel the full impact.

Howard Smith -- First Analysis -- Analyst

OK. And the second question deals a little bit, and you hinted a little in the prepared remarks but you've talked about automating and getting more efficiency in some of your remediation efforts. And where do you stand on those processes in getting the gross margin on that line of business if you will to where you ultimately think it can get to?

Michael Cote -- President and Chief Executive Officer

This is Mike again and thanks for the question. We basically partnered with the Ansible and the Red Hat team and rolled out the first few playbooks and it's not just under remediation part there is something that we're going to do and are working on from a detection perspective.And we are very excited about the early results relating to that, I wouldn't tell you that you can see it in the gross margin today but that it will basically be a big key to our scale and allow us to get faster and better client results. And I would expect the margin to go up over time into the future as we continue to make the investments in that area.

Howard Smith -- First Analysis -- Analyst

OK, thank you.

Michael Cote -- President and Chief Executive Officer

I am sorry, Howard. I was just going to say the good news there is I think what we've been excited is that we've seen some real results there working with clients and substantial productivity improvements. It's just going to now mean continuing to roll it out across a lot more playbooks and across the organization.

Howard Smith -- First Analysis -- Analyst

OK, sounds promising. Thanks for taking my questions.

Operator

Your next question comes from Sterling Auty with J.P.Morgan.

Ugam Kamat -- J.P.Morgan -- Analyst

Hey hi, guys. This is actually Ugam Kamat on for Sterling this morning. You mentioned in your prepared remarks that you had some incident response engagement this quarter, which increased your SRC revenue. Just wondering whether this was with the new or existing customers? And if they were new, is there a potential to convert them into MSS clients?

Michael Cote -- President and Chief Executive Officer

So, great question. And this is Mike responding. I would tell you that I don't have an answer across the full spectrum of our incident response engagements because we do probably somewhere in the neighborhood of 300 or 400 a quarter I'm guessing but there were some big incident response engagements, in particular, that were all with new clients. And most of them as I mentioned in the prepared remarks 50% of our sales in the quarter were both consulting and subscription.

So most of the incident response engagements do lead to the ability to pick up subscription business as well.

Ugam Kamat -- J.P. Morgan -- Analyst

That's great. And as a follow-up, if you look at the competitive landscape, we are seeing more product vendors in security overlay managed services, case in point there is like FireEye. Can you throw some color around how it changes your conversations with customers and if there is any impact on the business at all from that particular transition?

Michael Cote -- President and Chief Executive Officer

So another good question. It's interesting that they're looking to move into our model where the first thing we do from a sales perspective will be to pull out the Gartner Magic Quadrant to show them the leadership position that we sit in but I think once you take the next level down from that and have the conversation with the client, or the prospect either way. The next thing that's important is that we are vendor-neutral, like how we can give them the efficacy of the various security products that they now want to work with because we see a lot of that across our client base.And we come in with this being a focus on all that we do working across the spectrum of their security devices. So I think from over 15 years of creating the intellectual property to do this we can clearly show clients the incremental value or at least when people asked about FireEye, we've not seen them competitively on the MSS side of the business or the subscription side.

Ugam Kamat -- J.P. Morgan -- Analyst

Awesome. Thank you, guys.

Operator

Your next question comes from the line of Alex Henderson with Needham.

Alex Henderson -- Needham & Company -- Analyst

Thanks. So I think you said on the call that you expect that your consulting business, which has obviously increased as a percentage of your business in recent orders to roll back over. And I was wondering if you could talk a little bit about the timing of that and the magnitude impact that would have on the quarterly results if it were to revert back toward the prior 25% of purchases being down from the 50% of the purchases that you're currently seeing?

Wayne Jackson -- Chief Financial Officer

Hi, Alex. Good morning. This is Wayne, I'll take that. So there are two phenomena there as SRC becomes a larger mix.

One is our margins in the managed security space is greater than it is in the consulting space so that obviously impacts in terms of our gross margin and our EBITDA in a breakup here. And then, secondly, from a sales-mix perspective, it goes in our recurring base, which we like as well. So it helped our MRR and the subscription model.As far as time, I know your question was around timing. We expect it to improve later this year as our sales efforts get back to more of the traditional mix that we've seen over the last two years.

Michael Cote -- President and Chief Executive Officer

So, this is Mike. Let me just make sure because you have stated some numbers that I am not sure we were aligned on. So when you mentioned 25% and 50%, the SRC our consulting business has historically been around 20% of our revenue and this quarter I think it was 22%, Wayne.

Wayne Jackson -- Chief Financial Officer

That's correct.

Michael Cote -- President and Chief Executive Officer

So it was up a little bit from a sales perspective, part of what we mentioned is this is the first statistic we have given at this stage, in the last four quarters approximately 50% of the signed contracts had both consulting and the subscription business in it and that 50% is up 25%. So it's 25% higher than it was a year ago for the same thing, meaning a year ago we were selling more consulting business as a percent of what we sold in sales. So we're selling more contracts with just one solution in it.In this quarter from a sales perspective, there was a higher mix that will turn into revenue but there is a higher mix that related to consulting or had a consulting component. Does that help?

Alex Henderson -- Needham & Company -- Analyst

Just to be clear, when you say 25% improvement, is it going from 25% of contracts sold with consulting services into 50% with controlled consulting practices, which is actually a doubling of that percentage or is it a 25% increase?

Wayne Jackson -- Chief Financial Officer

No, no, it went from 40% to 50%.

Alex Henderson -- Needham & Company -- Analyst

Went from 40% to 50%. That's better clarification. Thank you. Just going back to the point of the original question, should we anticipate some softening of the top line as that rolls back down to more normalized environment? Is that causing offset on the top line?

Wayne Jackson -- Chief Financial Officer

No, it's all about the mix. It's not softening of the top line at all.

Alex Henderson -- Needham & Company -- Analyst

OK, great. And just one other question, if I could. So, you talk a lot about the lack of available security employees out there and you guys have had a very great retention rate on your employees because of the programs you have established around that but I was wondering if you could talk about wage rate versus your pricing pass-through of increasing wages. Have you seen wages increasing for security employees at a faster rate than you are able to pass through or at a slower rate? Can you give us some sense of that, I know you have automation as an offset to it but if you could help us on that it'd be great.

Michael Cote -- President and Chief Executive Officer

Yes, so this is Mike. I would say that we have employees that are here for a host to reasons and probably the most important of which is they have a vested interest in wanting to protect our clients and there is a clear pass for them here because this is all we do. And for example, in the technical route, we have fellows that we have in the security area that are moving up from a technical perspective.We do have a comprehensive plan or program in place to ensure that we are compensating folks well, both from a cash perspective and the other variables that tie in of a compensation perspective. To answer your question directly, I would say that we have not overall seen wage increases in excess of the price increases we're putting in place.And you are right in the last part of your statement that the real excitement that we have and the opportunity is the automation of the things that we can do to make it so that both our front line employees that are working in our security operation centers to protect our clients and our security center of excellence focused on spending their time in areas they have the both largest impact and are working with our clients in their respective security operation centers to have the biggest impact.

And I think the automation as this industry continues to see more and more threat is really the key effort, you're not going to be able to do this with people.

Alex Henderson -- Needham & Company -- Analyst

Thank you very much for your answers.

Operator

Your next question comes from Gabriela Borges with Goldman Sachs.

Gabriela Borges -- Goldman Sachs -- Analyst

Good morning, thanks for taking the question. Mike, I wanted to revisit the commentary you made on some of the new leadership in the sales organization. Now that Mr. Hayden and the two leaders in sales ops and enablement have been on the ground for a few months.

Could you just give us an update on whether they're making any incremental changes to optimize the go-to-market and try to get the productivity to be a little bit better? Thank you.

Michael Cote -- President and Chief Executive Officer

So, Gabriella, thanks for the question and good morning. The answer to your question is, yes, they are making incremental improvements from a productivity perspective in particular. The packaging that we mentioned was a joint effort with the new sales enablement leaders across product management organization and our marketing organization.We're doing a lot of work in revamping our sales enablement and training and really putting some best practices in place. I would tell you that culturally Jeff and his two new hires in sales ops and sales enablement along with the sales leaders that I've mentioned over time in North America and EMEA and APJ have really come together as a unified team.

I was extremely excited and impressed as we rolled into, I'd say, the third month of Q1 and into the beginning of Q2 with regard to the cultural changes they are making and the excitement that exists in the organization.

So it's really bouncing off of the things or enhancing the things that we did and refining our model over the last year with a real focus and measurement and focused on the people, coverage and the quality sales from a training and execution perspective. So it really feels very different.

Gabriela Borges -- Goldman Sachs -- Analyst

Very good. The follow-up that I have is on your comment on prototyping applications around the counter threat platform and on the unique IP that you have there. Could you just give us a little bit of a sense of the timeline that how close do you think you are to being able to monetize that? What is the monetization model look like? And how can we try to start thinking about the size of the opportunity? Thanks.

Michael Cote -- President and Chief Executive Officer

Gabriela, thanks for the question. And we are right now in the process where we'll be bringing on some data clients in say over the next 90 to 120 days that we will work with. And the plan is to be GA in the back half of this year. And I think as we get to that point, we'll give you a little more insights on how we think it will change our business model and hit the financial model.

Gabriela Borges -- Goldman Sachs -- Analyst

Thank you very much.

Operator

Your next question comes from the line of Fatima Boolani with UBS.

Fatima Boolani -- UBS -- Analyst

Good morning. Thank you for taking the questions. One for Mike and one for Wayne if I may. Mike, if my math is correct, the U.S.

business was up 2% to low-single-digits. I'm wondering if you can kind of talk through some of the challenges and opportunities you're seeing domestically?

Michael Cote -- President and Chief Executive Officer

Fatima, great question. As I mentioned in the prepared remarks, the Europe and APJ market grew and our performance there was very good. We have had struggles over the last 18 months or so with execution in particular in the enterprise space. And we were excited about the performance.

And again as I mentioned in the prepared remarks that the SMB space and the state, local and education performed very well in Q1 and the enterprise space actually doubled its performance in the quarter.

So we are optimistic at the continued production and having an ability to improve our productivity in North America and the current momentum we put in place and the opportunity that exists for us there.

Fatima Boolani -- UBS -- Analyst

That's helpful. And maybe for Wayne, as I think about the business mix maybe even temporarily shifting to SRC incremental investments in sales and marketing. How should we A, think about the gross margin leverage over the next couple of quarters? And then B, your path to going EBITDA positive that timeline or a path there would be really helpful. Thank you.

Wayne Jackson -- Chief Financial Officer

OK, thank you for that. So the mix, the sales mix short term does impact the margin as I've said in my prepared remarks for this quarter. I think, Fatima, as two things, on the sales side, sales motion, we believe we'll get back to the normal mix we see in the marketplace. And then secondly, I think the timeline is to the path of EBITDA positive, we guided $3 million to $7 million for the year, we had the results, we had this quarter.So we are very focused on that, I don't want to come out and say which quarter yet, but we're very focused.

And the reason I don't is very simple, once we roll out the EBITDA positive path, the next question in our mind is how do we sustain it and then how quickly do we grow it. So we will stick with the guidance for now and talk about that a little bit more in the third quarter.

Fatima Boolani -- UBS -- Analyst

Thank you.

Operator

Your next question comes from the line of Walter Pritchard with Citi.

Walter Pritchard -- Citi -- Analyst

Hi, thanks. Question for you Mike, on the endpoint security market. We haven't heard about Red Cloak little bit, could you update us on that offering and how that is driving demand or is that a market that's more challenging on your end? Both from the sort of your own IP, as well as services your offering around the general market?

Michael Cote -- President and Chief Executive Officer

Walter, thanks very much for the question. I'd answer your question on a high level and basically say that demand in the endpoint has been very, very good. It's typically part of a larger solution. As you again look at the market and think about the market is doing it for me versus the do it with me and Red Cloak fits in parts of that market better as a stand-alone solution for them.

Whereas we partner with and work in a vendor-neutral manner where we can apply our Red Cloak analytics to more than just Red Cloak but other endpoint providers, which we'll probably be rolling out some others that we're going to work with on a vendor-neutral manner from client demand.

So to answer your question at a high-level Red Cloak continues to be a key component of our intellectual property and value proposition and the analytics that we're getting from Red Cloak and can drive both taking some of the analytics and driving across the network layer as well as the endpoint layer.

Walter Pritchard -- Citi -- Analyst

And then for Wayne, just on the automation side, a high level. How do we think about your interest in using automation to help you drive at more competitive price point long term versus using it to drive gross margin leverage? Do you feel like it leans in one way or the other there?

Wayne Jackson -- Chief Financial Officer

Well, I think it's both. So from a margin perspective, Mike touched on it earlier. The results from an efficiency perspective are very compelling, but from a pricing perspective and a go-to-market perspective, it allows us to offer so much more for an attractive price. So, first of all, it's incremental sales and then it's incremental sales at great margins.

So, we're pretty excited about both.

Walter Pritchard -- Citi -- Analyst

Great, thank you.

Operator

Your next question comes from Melissa Franchi with Morgan Stanley.

Angelo -- Morgan Stanley -- Analyst

Hi, this is Angelo [Inaudible] in for Melissa Franchi. Thanks for taking the question. I wanted to ask on international revenue, you spoke about it a little bit before, it was really, really strong as year-over-year quarters we have seen, would you able attribute this largely that mostly due to sales productivity or is it more of a function of just the overall demand environment and things such as GDPR driving conversations.

Michael Cote -- President and Chief Executive Officer

So, this is Mike. Great question. I would tell you that it is more sales productivity the demand is there in my opinion across the globe. The U.S.

is clearly in the more mature of the market. Europe, I have said before would be catching up to the U.S. quickly and the APJ market is in the earlier stages or a little bit behind the U.S. and Europe from a market-maturity perspective but the growth in APJ and in EMEA, in particular, the Middle East and Europe is really a function of the sales leader that we have there, the sales training and enablement that were put in place a while ago and our sales productivity in that market.

So there is some good growth going on in the market and we're executing it very well in my opinion.

Angelo -- Morgan Stanley -- Analyst

Got it, thank you very much, that's super helpful. And just one modeling question. Thanks for providing cash flow from operations guidance. Just from a modeling perspective should we expect similar linearity seasonality versus last year or is there anything we should take note off?

Wayne Jackson -- Chief Financial Officer

That's seasonality compared to last year, that's correct. A very similar build backup of the bonus accrual, which provides this cash flow from ops in the cash flow model.

Angelo -- Morgan Stanley -- Analyst

Great.

Wayne Jackson -- Chief Financial Officer

And then secondly, as you recall from last year we've collected cash from Dell for the monetization of our tax attributes, that's the second half of the year as well. It's right now we have it in Q4.

Angelo -- Morgan Stanley -- Analyst

Q4. Got it. Thank you very much.

Operator

We'll now take our final question from Matt Hedberg with RBC Capital Market.

Matthew Swanson -- RBC Capital Markets -- Analyst

Thanks for taking my question. This is Matt Swanson on for Matt. I know MRR is a metric that's guided quarterly but can you give us a sense of how you feel about Q1 in relation to the full-year guidance?

Wayne Jackson -- Chief Financial Officer

So, Matt, thanks for the question. We actually guided annually. And our thoughts on Q1 MRR, so there are two things, one, first of all, year over year it over 11% growth that's we're pleased with that. The sequential growth not where we wanted it to be, a big driver of that was the mix, the sales mix this quarter.

As you know the SRC, this consulting part is not included in MRR.And then the seasonality, if you go back and kind of look at your models and our results, the sequential increase Q4 to Q1 over the last several years were not too far off from that, we would have liked it seen it a little better but the mix and seasonality would up at $35.5 million.

Matthew Swanson -- RBC Capital Markets -- Analyst

Thanks. And you might touch on this kind of in a few different ways but when talking about the incident response you mentioned customers trying to deal with the lack of cybersecurity talent on the market. Could you just talk about more generally how large of a driver this is for buying decision and how long of a tale do you see it having?

Michael Cote -- President and Chief Executive Officer

When you say how you are referring ... This is Mike. I'm sorry, Matt.

Matthew Swanson -- RBC Capital Markets -- Analyst

Yes, sorry. Well, more so the lack of cybersecurity talent on the market, just customers may be trying to use software solutions to address not being able to hire the way they want to?

Michael Cote -- President and Chief Executive Officer

Yes, so it's a great question. The market had statics out there, there is anywhere between 1.8 million and 2 million shortage of cybersecurity talented people. And the second part of your comment or question where you said trying to find a software solution to the problem, this is not a technology problem, right, this is a problem where you have human beings who are threat actors or bad guys using technologies a method of attack.

So there is not a way a product can evolve and respond on its own fast enough to obviate the need for expertise and visibility from a global perspective and take it from a client's perspective in the client-specific infrastructure.

So I think that the talent shortage, in fact, the threat actors are, there is more of them and they are growing faster is not something that will go away in the near term and I think we'll continue to drive growth and opportunity. And I think in particular, one of the questions that were asked earlier is that some of the product companies are moving more into our space, I think the reason they're moving more into our space is that clients are looking for specific expertise to help them figure out how to get the best return on investment in managing their security spend.

Matthew Swanson -- RBC Capital Markets -- Analyst

Thank you.

Operator

There are no further questions at this time. I now turn the call back over to the Teri for closing remarks.

Teri Miller -- Vice President and Chief Accounting Officer

Thank you, operator, and thank you again for joining us on today's call and for all of your questions. We appreciate your support and look forward to our second-quarter call in early September. If we did not get to your questions during the Q&A sections, please do not hesitate to reach out to us for a follow-up.

Operator

[Operator signoff]

Duration: 62 minutes

Call Participants:

Teri Miller -- Vice President and Chief Accounting Officer

Michael Cote -- President and Chief Executive Officer

Wayne Jackson -- Chief Financial Officer

Jonathan Ho -- William Blair & Company -- Analyst

Saket Kalia -- Barclays -- Analyst

Rob Owens -- KeyBanc Capital Markets -- Analyst

Howard Smith -- First Analysis -- Analyst

Ugam Kamat -- J.P.Morgan -- Analyst

Alex Henderson -- Needham & Company -- Analyst

Gabriela Borges -- Goldman Sachs -- Analyst

Fatima Boolani -- UBS -- Analyst

Walter Pritchard -- Citi -- Analyst

Angelo -- Morgan Stanley -- Analyst

Matthew Swanson -- RBC Capital Markets -- Analyst

More SCWX analysis

This article is a transcript of this conference call produced for The Motley Fool. While we strive for our Foolish Best, there may be errors, omissions, or inaccuracies in this transcript. As with all our articles, The Motley Fool does not assume any responsibility for your use of this content, and we strongly encourage you to do your own research, including listening to the call yourself and reading the company's SEC filings. Please see our Terms and Conditions for additional details, including our Obligatory Capitalized Disclaimers of Liability.