Rapid7 (RPD) Q1 2020 Earnings Call Transcript

Rapid7 (RPD -0.95%)
Q1 2020 Earnings Call
May 08, 2020, 4:30 p.m. ET

Contents:

• Prepared Remarks
• Questions and Answers
• Call Participants

Prepared Remarks:

Operator

Ladies and gentlemen, thank you for standing by, and welcome to the Q1 2020 Rapid7 earnings conference call. [Operator instructions] Please be advised that today's conference is being recorded. [Operator instructions] I would now like to hand the conference over to your host for today's call, Sunil Shah, VP of investor relations. Sir, you may begin.

Sunil Shah -- Vice President of Investor Relations

Thank you, operator, and good afternoon, everyone. We appreciate you joining us today to discuss Rapid7's first-quarter 2020 financial and operating results in addition to our financial outlook for the second quarter and full fiscal-year 2020. With me on the call today are Corey Thomas, our CEO; and Jeff Kalowski, our CFO. We have distributed our earnings press release over the wire and it is now posted on our website at investors.rapid7.com, along with the updated company presentation and financial metrics file.

This call is being broadcast live via webcast. And following the call, an audio replay will be available at investors.rapid seven.com until May 15, 2020. During this call, we may make statements related to our business that are forward-looking under federal securities laws. These statements are made pursuant to the safe harbor provisions of the Private Securities Litigation Reform Act of 1995 and include statements related to our 2020 goals, the company's positioning, our financial guidance for the second quarter and full-year 2020.

The assumptions underlying such guidance, including the anticipated impact of COVID-19 on our financial guidance business, financial condition, results of operations and renewals and our assumptions on the timing for economic recovery in the global economy and the impact of the DivvyCloud acquisition on our future results of operations and product strategy. These forward-looking statements are based on our current expectations and beliefs and on information currently available to us. Actual outcomes and results may differ materially from the expectations contained in these statements due to a number of risks and uncertainties, including those contained in our most recent annual report on Form 10-K, the current report on Form 8-K we filed with the SEC on April 28 and the subsequent reports that we filed with the SEC, including our Form 10-Q for the quarter ended March 31, 2020. The information provided on this call should be considered in light of such risks.

Actual results and the timing of certain events may differ materially from the results or timing predicted or implied by such forward-looking statements, and reported results should not be considered as an indication of future performance. Rapid7 does not assume any obligation to update the information presented on this conference call, except to the extent required by applicable law. Our commentary today will be primarily in non-GAAP terms and reconciliations between historical GAAP and non-GAAP results can be found in today's earnings press release. At times, in our prepared remarks or in response to your questions, we may offer incremental metrics to provide greater insight into the dynamics of our business or our quarterly results.

Please be advised that this additional detail may be onetime in nature, and we may or may not provide an update in the future on these metrics. With that, I'd like to turn the call over to our CEO, Corey Thomas. Corey?

Corey Thomas -- Chief Executive Officer

Thank you, Sunil, and good afternoon, everyone. Thank you all for joining us today on our first-quarter 2020 earnings call. Before we dive into results, I would like to spend a moment on the current environment. The rapidly evolving situation with COVID-19 has created uncertainty for individuals and organizations across the globe.

We are no exception. As we adjust to this environment, our priorities remain the health and well-being of our employees and surrounding communities, while remaining responsive to the evolving security needs of our customers and prospects. To this end, we have actively monitored guidance from public health organizations, and we quickly and successfully transitioned to a remote working model in mid-March. We currently expect to remain in this mode until at least June and are closely tracking regional guidance and regulations as we plan ahead.

As we navigate this uncertain environment, we will do our best to remain thoughtful and transparent and share as much as we can about what we are seeing in our business. Finally, from everyone here at Rapid7, I'd like to share our thanks and gratitude to all the medical professionals and first responders who have worked tirelessly to care for our communities during these extraordinary times. Now moving on to our Q1 results. We are pleased once again that we exceeded our guidance for both revenue and non-GAAP operating loss for the quarter.

Rapid7 delivered Q1 total revenue growth of 29% year over year led by strong products revenue growth of 33%. Our quarter ending ARR of $351 million was up 31% on over the prior year, driven by continued customer demand for our Insight platform. We had a solid start to Q1 as we exited 2019 with sustained momentum in IDR and mid-market demand, though, we began to see modest impacts from COVID-19-related purchase delays late in the quarter. Our customer base grew 14% year over year in the first quarter as we experienced continued wallet share gains and ARR per customer increased to $38,900, a year-over-year increase of 15%.

We have also been pleased with our strong retention rates so far this year. Even amid uncertainty, these results reflect our long-standing commitment to innovation as we have built multiple market-leading products on an integrated platform. We remain bullish on our long-term opportunity to deliver enhanced value and outcomes to our customers, both through sustained organic innovation and via strategic additions, such as our recently announced acquisition of DivvyCloud. I would also like to highlight that while we, along with many others in the market, face a period of uncertain economic trends in the near term, I am confident in the resilience of our Rapid7 team.

Our strong balance sheet, stable subscription revenue model and secular growth market and security position us to weather the storm. Let me now share some context on how we are engaging with our customers and how that is influencing our current views. Entering the quarter, we saw sustained growth momentum in our IDR mid-market international segments. This positive business momentum continued until late in the quarter when we began to see a more acute shift in decision-making processes, particularly in Europe, as customers assess the impacts of the escalating COVID-19 situation.

Our diversified product strategy provides a number of unique opportunities to manage COVID-19-related risks and focus on areas that provide the best opportunities for growth. We are optimizing around customer needs and aligning our focus to the most active product areas and customer segments. We continue to have a broad industry diversification with our largest vertical representing approximately 15% of our ARR. In terms of customer segmentation, over 50% of our ARR today comes from enterprise customers, defined as organizations with over $1 billion in revenue.

When further accounting for our mid-market customers, defined as organizations with greater than $100 million of revenue, this total mix grows to approximately 80% of our ARR. This frames a high level of durability we see in our business as we navigate the current environment. We have included further detail on this in our investor deck online. But I would note that based on our segmentation, less than 10% of our ARR is exposed to SMB segment, defined as organizations with less than $10 million of revenue and less than 100 employees.

Across all segments, as digital initiatives accelerate, customers continue to prioritize security. We have seen healthy pipeline growth start the year but the timing of this pipe is increasingly uncertain as organizations adjust midstream. The result is a wider range of outcomes as we look ahead to Q2 and beyond, which is reflected in our revised guidance range on which Jeff will provide more details shortly. Customers and prospects have voiced the critical nature of their security programs while acknowledging they are subject to shifting budgetary constraints around them.

At the same time, these customers face unprecedented security challenges as organizations adjust to fully remote workforces, they must contend with increased asset exposure and decreased visibility. Rapid7 is enabling our customers to adjust quickly with our new Flex Program. Flex offers the ability for customers to temporarily expand their asset coverage in no charge in an effort to help maintain the security posture as they adjust to the ongoing work from home dynamic. I am pleased to say that customers are leveraging Flex across our Insight platform products, helping them more effectively manage risk to deliver improved security outcomes.

This enablement is a reflection of our commitment to help close the security achievement gap on behalf of our customers. As we navigate this unique period with our customers, one thing remains constant. Security professionals are challenged to keep up with the increasing complexity amid escalating risk and more acute resource constraints. Our vision of Rapid7 is to build a leading cloud-based SecOps platform to address this need across our core platform pillars.

We do this by helping customers lower the cost of visibility and time to value and accelerate their remediation capabilities. We have maintained a leadership position in vulnerability management for some time. And in Q1, we saw further validation of our vision as Rapid7 was named a leader in the Gartner Magic Quadrant for Security Information and Event Management. Moreover, Rapid7 is the only full-stack VM vendor to be recognized in Gartner's recently released Magic Quadrant for Application Security Testing and was the highest-rated vendor for Dynamic Application Security Testing.

These achievements are also further validation of our best-of-breed platform strategy built through a combination of both organic and inorganic investment. Our recent acquisition of DivvyCloud fits squarely into this strategy. As cloud accelerates, security teams must grapple with new and emerging threat vectors, security must further account for the greater influence DevOps teams bring to the process. DivvyCloud sits at the intersection of security and DevOps, solving the security stakeholders' need to manage risk, compliance, and governance, while meeting the DevOps team where they are in the cloud, allowing them to accelerate innovation securely.

The acquisition of DivvyCloud will extend the cloud security capabilities of Rapid7's Insight platform, accelerating our ability to address the foundational elements of customers' cloud programs by helping them secure their cloud assets. With the combination of DivvyCloud, InsightAppSec, and tCell, Rapid7 will be positioned to offer a leading set of solutions in the fragmented cloud and application security space. Now let's turn to some updated perspective on our 2020 goals. Rapid7 remains focused on delivering sustained top-line growth, optimizing customer economics, and driving leverage in our business as we look ahead.

With that backdrop, I would like to take a moment to reframe our 2020 goals within the context of our business priorities today. Our first goal is to reorient our focus around customer needs tied to the cloud and a more distributed workforce. It is clear that both the near-term and long-term trends support a broader and more accelerated shift to the cloud. Our ability to address customers' needs in this area will be a key driver of our opportunity to deliver sustained top-line growth as we look forward.

Our second goal is to accelerate our platform distribution engine in partner momentum and by leveraging our unique best-of-breed technology platform advantage. This will enable us to drive improving customer economics over time. Our third goal is to rationalize around the demand environment through strong expense controls that optimize for high ROI investments, minimize near-term free cash flow loss, and deliver sustained organic leverage in the business. Our commitment to profitable growth remains top of mind, and our guidance anticipates that we will return to operating income profitability in the fourth quarter of this year after absorbing the additional expense of DivvyCloud in the third quarter.

Additionally, while it remains early in our planning cycle for next year, I will note that we currently expect to deliver free cash flow positive for full-year 2021. In conclusion, Rapid7 is adjusting to our customers' needs in the current environment, and we will remain well-positioned to help solve the cybersecurity challenges facing resource-constrained organizations as they accelerate into the cloud. With that, let me turn the call over to our CFO, Jeff Kalowski. Jeff?

Jeff Kalowski -- Chief Financial Officer

Thanks, Corey, and good afternoon, everyone. We're pleased to report healthy performance for the first quarter of 2020, with revenue and profit results exceeding our guidance amid the shifting economic landscape. Before I begin, a few reminders. Except for revenue, all financial results we'll discuss today are non-GAAP financial measures, unless otherwise stated.

Reconciliations between our GAAP and non-GAAP results can be found in today's earnings press release. Also, as we discussed in our last call, going forward, we will be reporting products and maintenance and support revenue together under products revenue as we believe this is a more useful way to look at our business. Turning to results, total ARR ended the first quarter of 2020 at $350.9 million, growth of 31% year over year. First-quarter total revenue of $94.3 million exceeded the high end of guidance, growing 29% over the prior year.

This strength was driven by solid year-over-year product revenue growth of 33%, which benefited from strong renewal trends in the quarter. Recurring revenue constituted 90% of total revenue, compared to 85% a year ago. Our quarter-end customer count of over 9,000 increased 14% year over year and was approximately flat sequentially. This sequential result was driven by continued healthy growth in our platform customer base, which grew by over 200 customers sequentially, offset by fewer Metasploit and Nexpose transactional deals, legacy NetFort end-of-life churn and a slower pace of new customer additions late in the quarter due to impacts of COVID-19.

ARR per customer increased to approximately $38,900, up 15% year over year. Looking at the business geographically. North America grew first-quarter revenue by 27% year over year, representing approximately 83% of total revenue. Rest of world saw continued strong growth of 40% year over year, representing approximately 17% of total revenue.

Turning to margins, recall last quarter, we spoke about front-loading of certain onetime expenses in Q1, such as our global kickoff event, which will impact year-over-year comparisons for certain expense lines for the first quarter. Total non-GAAP gross margin was 73% in the quarter, down from 75% last year was driven by lower professional services margin versus the prior-year period, as well as continued increase in the mix of our Insight platform products. Sales and marketing expenses were 47% of revenue in Q1 2020, up compared to 45% in Q1 2019 as a result of increased headcount costs and allocation of previously mentioned onetime expenses. R&D expenses were 21% of revenue, within our expected range and up slightly, compared to 20% in Q1 2019, also due to allocation of onetime expenses.

G&A expenses in the first quarter were 10% of revenue, consistent with the prior-year period. We reported a non-GAAP operating loss of $3.9 million in the first quarter, better than our guidance range, driven by overachievement on revenue, T&E savings, and timing of marketing program spend. Adjusted EBITDA for the first quarter was a loss of $0.8 million and non-GAAP net loss per share was $0.09, also ahead of guidance. We ended Q1 with cash, cash equivalents, and investments of $253.6 million.

This is before approximately $131 million paid at closing for the acquisition of DivvyCloud does not reflect net proceeds of approximately $196 million related to our convertible notes offering and cap call, which we completed last week. Taking into consideration the acquisition of DivvyCloud and a convertible offering only, our current cash levels exceed $300 million. Average contract length for Q1 2020 was 16 months, in line with last quarter. Operating cash flow for the quarter was negative $7.2 million, an improvement over negative $13.6 million in the prior-year period.

Now turning to guidance. Please note that our revised guidance includes the impact of the DivvyCloud acquisition for the second-quarter and full-year 2020. As we shared last week, we have spent considerable time over the past months, speaking with customers and working to understand COVID-19 related impacts to our business at the industry and micro-vertical level. In constructing our revised guidance, we have performed both bottom-up and top-down analyses looking at financial stress and spend durability across sub-industry segments that we are exposed to.

Our analysis leveraged both internal and third-party data to frame risk across our customer base as it relates to both new businesses and churn and contemplated various economic recovery scenarios. This includes a U-shaped recovery, as well as L-shaped and V-shaped scenarios that account for our best estimates of the COVID-19 related impact by subindustry. The revised guidance range reflects our best assumptions across these scenarios with a baseline U-shaped recovery at the midpoint and assumes that: one, there are no new or recurrent shocks to the global economy; two, Q2, we'll see the highest negative impact of economic growth; and third, it is a long and steady road to economic recovery over a 12 to 24-month period. These assumptions are based on what we are experiencing today, which we are approaching as a moderate but sustained recession through the balance of the year.

We do not control the primary set of drivers, which will be how long the economy remains closed and at what pace it recovers when it reopens. We updated our guidance on April 28 with this framework in mind. For the full-year 2020, we lowered and widened our ARR guidance range and now anticipate ARR in the range of $387 million to $407 million or 14% to 20% growth. We now anticipate revenue for the full-year 2020 to be in the range of $388 million to $395 million, growth of 19% to 21%, and non-GAAP loss from operations to be in the range of a loss of $3 million to a loss of $1 million.

This anticipates the impact of the acquisition of DivvyCloud and note that we will be required to record a fair value adjustment to DivvyCloud's deferred revenue, which will reduce revenue recognized in 2020. We anticipate non-GAAP net loss per share to be in the range of a loss of $0.15 per share to a loss of $0.19 per share. This is based on 51 million basic weighted average shares outstanding for the full-year 2020 given our projected non-GAAP net loss. We now expect cash flow from operations for the full-year 2020 to be a loss of approximately $25 million.

This reduction in cash flow relative to our prior expectation of positive $10 million contemplates the lower billings associated with our reduced ARR estimates for the year, absorption of the DivvyCloud business and slightly higher assumed base billings outstanding due to current economic environment. Our full-year guidance anticipates that our visibility in the fourth quarter is particularly low and anticipates lower renewal rate trends despite solid trends to date. As Corey shared earlier, and I will reiterate, with our major facilities expansion behind us and a sustained focus on driving leverage in the business as we look ahead, assuming a U-shaped recovery, we currently expect that we can deliver positive free cash flow for the full-year 2021. Moving now to quarterly guidance, as we reported on April 28, we anticipate total revenue for the second quarter of 2020 to be in the range of $94.6 million to $96.2 million, growth of 20% to 22%.

We anticipate non-GAAP operating income for the second quarter to be in the range of $1 million to $2 million, and non-GAAP net income per share to be in the range for a loss of $0.02 to breakeven for the second quarter, which is based on an anticipated 50.7 million basic weighted average shares outstanding, given our projected non-GAAP net loss. In conclusion, Rapid7 remains focused on innovation and execution, while continuing to help our customers and prospects deliver positive security outcomes through these uncertain times. With that, we appreciate your time and support, and we'll now open the call for any questions. Operator?

Questions & Answers:

Operator

[Operator instructions] Our first question comes from Michael Turits with Raymond James. Sir, you may proceed.

Michael Turits -- Raymond James -- Analyst

Hey, guys. Good evening. So Corey and Jeff, first, can you perhaps parse for us a major factors behind the revenue and ARR reduction. And in particular, whether it's retention, churn, reduction in ARR per customer, sector or particular sector impacts, anything you can do to parse the biggest to the smallest factors.

And maybe tell us -- show us why the ARR reduction, which is more of a leading indicator, is so much steeper than revenue.

Corey Thomas -- Chief Executive Officer

Yes. You're right. First, Michael, diving deep -- and you're right. It is a leading indicator.

So the first thing I'll highlight is to reiterate the results, our results in Q1 were fairly strong. I think Jeff and I had both indicated that retention was at the upper end of the range, which as you remember, is 88% to 90%. And we had a very strong start to the quarter, and we saw some limited impact of COVID-19 late in the quarter. The second thing I'll also say is that our April is off to a very solid start.

Still very early in the overall year. Now I guess your core question is with those factors, why sort of the reduction in ARR and it's driven by a couple of factors. The first is that if you think about the macro environment, we anticipate sort of like the economy severely impacted in both Q2 and Q3. And so even if you just take out of the impacted both regions and the impacted industries, you just see a slowdown in spending that typically occurs when there's uncertainty about the overall macroeconomic environment.

And so what you find is that we anticipate sort of more impact in both Q2 and Q3, and we intact sort of like more visibility. So, therefore, things picking up in the Q4 time line. And that affects sort of the overall environment, every aspect of our customer base, even the ones that are healthy, by the way, because people are trying to figure out what's going on. And we hear that from even our healthy customers that, by the way, are buying and have bought -- they're, I would say, buying with some anxiety and trepidation because they're trying to figure out how it impacts their business overall.

The second thing that we actually factored in is Jeff's team does a very detailed, I would say, micro-segment and micro-vertical analysis that went through both all of the segments of the economy by size. And they're not just verticals but actually micro verticals where instead of looking at healthcare, you looked at large hospitals different than smaller hospitals, and you looked at that different than providers and you look at that different than distributors in the healthcare ecosystem. And we looked at the players that were likely to be impacted and not impacted along that. We compared that to our pipe and we made some adjustments to our expectations based on where we think where spend was likely to happen in the year.

The other thing that I'd say is that when it comes to when you think about our overall expected renewal rates or retention, again, we start off the year fairly strong. We see strong intentions from our customers. It just did not feel like the right decision or responsible for us to reflect the strength that we've seen in the renewal base all the way throughout the rest of the year. So we did put in a factor of expecting the churn to increase as the economy washed through.

And that was just -- it seemed like a reasonable way to do based on the total macro-environment that was happening. The last thing I'd actually just say is that there are areas that we actually factored in core strength because we do see areas of strength in the overall business. Specifically, when you think about monitoring a distributed workforce in a more complex environment when you think about cloud and application security overall. Those are areas that we saw strength in and we reflected that in our model.

But that was the primary driver. Sorry. That was a long-winded answer, Michael, but I wanted to make sure I cover it all.

Jeff Kalowski -- Chief Financial Officer

Yes, Michael. I'll just add two points on your question on the revenue. If you compare the midpoint our guidance on ARR versus where we were at the beginning of the year, excluding the Divvy acquisition, it was about a $36 million drop. The reason the revenue does not drop as significantly is because of the ratable model because that will come in later, and we have to take it over the course of one year.

So that's why you're seeing a bigger drop in ARR than revenue.

Michael Turits -- Raymond James -- Analyst

And then I'm sorry. Just in case I missed it, did you quantify your exposure to what people might consider to be the impacted protocols within -- by COVID, travel, etc.?

Jeff Kalowski -- Chief Financial Officer

Yes. We did. We've looked at our pipeline. We did an analysis of all the verticals and sub-verticals that were under financial stress.

And so we looked at our pipeline, as well as our renewal base, and that's all been baked into our guidance.

Corey Thomas -- Chief Executive Officer

Yes. And I think the rough approximation of that, when you look at it, especially the highly impacted areas of hospitality, transportation and retail, that impact is roughly 10%. Right.

Michael Turits -- Raymond James -- Analyst

Ten percent exposure?

Corey Thomas -- Chief Executive Officer

Base, yes, of these exposures. I mean, again, you'll still -- and we still see both deals and activity happening in those areas, but that will be the highly, highly exposed environment.

Michael Turits -- Raymond James -- Analyst

Thanks, guys.

Corey Thomas -- Chief Executive Officer

Thank you very much, Michael.

Operator

And our next question comes from Matt Hedberg with RBC Capital.

Matt Hedberg -- RBC Capital Markets -- Analyst

Hey, guys. Thanks for taking my -- Yeah. Thanks, guys. Thanks for taking my questions.

Corey, first of all, thanks for the color on the 200 sequential Insight customer adds. That was a helpful disclosure. I'm curious now. You noted April is off to a strong start.

I wonder if you could dig into that a little bit more. Is it that once customers got comfortable in a work-from-home setting, they were just more comfortable making purchases? I'm just sort of curious if you could maybe give a little insight on why April is trending better?

Corey Thomas -- Chief Executive Officer

Well, I think I'd characterize it as a solid start. We feel good. It's still very early in the quarter, so I don't want to get too far ahead. But we feel good about April and felt like we should disclose that because of everything that's happening, we are biased toward a little bit more transparency now.

My observation right now for what's actually happening is I think you see a couple of different things happening. First and foremost, security is a priority. One of the things I find interesting is these are areas that are impacted when you look at education or hospital to other areas, when I go out and I talk to those people, they're prioritizing security higher because of their increasing reliance on technology, which I find interesting overall. And what that means is that they're less likely to churn existing investments in security.

Again, I think you have to assume that some businesses have got to be under severe duress, bankruptcy, other banks, so you have to factor that at some level. But it seems like when the business has the choice, they're prioritizing the existing investments. The second thing that I'm seeing is that when it comes to projects that are both funded and have the staffing around that, by and large, for security, we're even seeing those projects move forward there. The ones where we're seeing more slowdown oddly enough is not related to security.

What I'm seeing as I'm talking to customers, it's the ones where they actually have significant staffing associated with that. So it's both having to spend money on our platform and our technology, as well as having to go hire a team. I think companies are trying to rationalize how much headcount they're adding and their priority there. And that's where you see a little bit of the pressure in the slow down.

Matt Hedberg -- RBC Capital Markets -- Analyst

That's helpful. And then maybe as a follow-up, regarding your ARR guide, I think the midpoint on an organic basis is close to the mid-teens. I'm just curious if you can remind us how quickly you think the VM market is growing and if, in fact, you're outpacing that growth, would be helpful.

Corey Thomas -- Chief Executive Officer

Yes. I'll make a comment, and this is just based on the data we reviewed so far. That one, I think in Q1, we continue to take share in the overall market, and we've grown well. The second thing is that we see VM as still a durable growth driver as we go forward.

Now in this pandemic environment, I think all growth for most things is less. And so if we looked at VM as the mid-teens growth sort of like before, in this current environment, again, we do believe that we will get out of the environment at some point, our expectation is that that comes down to the 5% to 10% range. I would say also, we have the benefit. And we think that in that environment, we're still growing faster than the overall vulnerability management market, and we're still taking share on an apples-to-apples basis.

The other benefit that we do have is an ability to actually make our sales force efficient in this environment because we do have areas that are in high demand. And we think that that's a net benefit to our ability to navigate the current environment.

Matt Hedberg -- RBC Capital Markets -- Analyst

Super helpful, guys. Thank you very much.

Operator

And our next question comes from Saket Kalia with Barclays. You may proceed.

Saket Kalia -- Barclays -- Analyst

OK. Great. Hey, guys. Thanks for taking my questions here.

How are you? Corey, maybe first for you. Can you just dig a little bit into how you're handling the NetFort sort of customer base right now, both as a stand-alone base, just as importantly as part of InsightIDR? And what I mean by that is, I guess, how much did that end-of-life there sort of impact the customer count this quarter? And somewhat strategically, how is this going to sort of enhance the value for your InsightIDR base, if you will? Does that make sense?

Corey Thomas -- Chief Executive Officer

Yes. Absolutely. And I'll remind people that a little over -- roughly a year ago, we acquired NetFort to provide network visibility, which was a core detection capability that allowed us to actually move more into the enterprise market. And what I would say is that, first and foremost, you've seen that we actually got moved to the leader in the Gartner Magic Quadrant earlier in the year.

We see great demand, IDR and especially our first data collection mechanism in IDR are an area that's providing solid demand even in this environment because we are one of the few solutions that natively out of the box collect endpoint data no matter where people are staffed in the world that allows you to visibility. We have network data collection. So in this case, what you have with the NetFort technology is it feeds into our network detection capability that allows us to actually, one, get an additional data feed into the overall environment, and most importantly, do a higher level of forensics for our customers. And this is especially important as our teams move more and more into the enterprise space.

Now I'll say, we just launched it. So far, the interest that we've seen from the additional customers has been very good. The beta customers where our teams are starting to actually feel it, we're very optimistic about it. But it's a key part of our strategy to continue to grow and expand in the SIEM category, and we're seeing great demand there.

As far as the impact of customers, it was expected anyway. So I would say it was a modest impact. It was all expected because, again, we acquired NetFort, not for the customer base that they actually had, we acquired them to actually be an extension of our core Insight platform, and that's where we're just starting the journey on.

Saket Kalia -- Barclays -- Analyst

Got it. That makes a lot of sense. Maybe for my follow-up for you, Jeff. On that net revenue retention, it feels like you've got a couple of sort of puts and takes.

I think we talked about an 80% number in terms of the ARR that's coming from the larger sort of non-SMB base, but then we also talked about sort of a prudent assumption of maybe increased churn through the rest of the year. And of course, the other variable in there is cross-sell upsell. Can you just sort of talk kind of qualitatively about how you're thinking about that net revenue retention number and how that could trend in the coming quarters?

Jeff Kalowski -- Chief Financial Officer

Yes. So in Q1, it was 106%. We had a little headwind from our nonplatform customers this quarter. If you look at our platform customers, it was higher than the 106%.

We expect it to go down in our estimates based on the higher churn rates in lower -- less cross-sell and upsell and less renewals from that portion of the base, we expect it to go down over the course of the year.

Saket Kalia -- Barclays -- Analyst

Got it. Very helpful. Thanks, guys.

Operator

And our next question comes from Rob Owens with Piper Sandler. You may proceed.

Rob Owens -- Piper Sandler -- Analyst

Great. Thanks for taking my question. Good afternoon, guys. Corey, could you talk a little bit about InsightIDR, the strength you're seeing there? And I guess, as priorities have shifted at this point in time, help us understand why this is highlighted in this environment, number one.

And number two, just what a typical implementation looks like? How hands-on it has to be and what a cycle might be there?

Corey Thomas -- Chief Executive Officer

Yes. Thank you, Rob. It's a great question. So the strength, I think, that we're seeing in InsightIDR is really, I think, centered on two factors.

One, as people rely more on technology if you think about what COVID is doing in many ways, is if you were contemplating a digital strategy that's accelerating and in a world where you know hackers aren't furloughed, you have to actually take security into account. And so for InsightIDR, what people are typically looking for is, a, how do I make sure that I'm protecting my technology environment in a higher margin? Now part of the reason that we think that InsightIDR got more favorable from a competitive position in this environment is that people now are acutely sensitive to the need to integrate data from distributor endpoints all over the world, of which that's a native capability of InsightIDR. The second thing, I think, Rob, to your question about like what does the typical deployment looks like, look, it varies based on the size and skill complexity of the technology environment. But what I would say, first and foremost, is we're one of the few leading cloud-based SIEMs for detection and response in the category.

And what that means is that people have to spend a lot less time doing the core infrastructure, getting it up and running. In this environment where people can't go in the office, having a cloud-based SIEM is a huge, huge advantage. And so from my perspective, the fact that it's a cloud-based SIEM, the fact that it actually has native agents built into the core platform out of the box that communicates directly to the cloud all give a time to value and productivity for a sophisticated environment. And that's sort of like as we're highly optimistic, and we actually see the momentum overall.

The last thing that I'd say is that think about the expectations -- we are a little bit more transparent in this time frame, is this is an area that we do see the opportunity to continue to grow at that hyper-growth rate above 40% as we go forward throughout the rest of the year.

Rob Owens -- Piper Sandler -- Analyst

Great. And then second, you mentioned it in your prepared remarks, but could you expand a little bit on your Flex program? How many customers actually took advantage of that, and does that lend to a backlog as you kind of look down the road as they might start monetizing those incremental assets that are being monitored?

Corey Thomas -- Chief Executive Officer

Yes. It's a great question. It's too early for the account. And frankly, I just don't have it in front of me right now.

But we are having a good customer uptake. And not just discussion, the customer actually applying it. Rob, we did the program to actually make sure that we were there for our customers when we're needed. That was the primary focus of the program overall.

What I'd actually say is that the goodwill that is actually generated and the feedback that we're hearing from customers, does actually give us some optimism that as our customers make through this process, their preference for Rapid7 is increasing. And so that's the hope in the operation. We're definitely seeing that from some of our customers, but that's not the primary reason that we actually put these programs in place.

Rob Owens -- Piper Sandler -- Analyst

All right. Thank you very much.

Operator

And our next question comes from Gur Talpaz with Stifel. You may proceed.

Gur Talpaz -- Stifel Financial Corp. -- Analyst

Great. Thanks for taking my questions. Corey, I wanted to ask, first, what you're seeing in terms of your conversations around AppSec. It's something you're clearly investing in, especially here with DivvyCloud.

And I think more importantly, you touched on this in the prepared remarks, but as customers are migrating more workloads to the cloud, it seems like this would be a pretty important area. So maybe you could give us some color on what you're seeing out there these days?

Corey Thomas -- Chief Executive Officer

Specifically to the cloud, Gur? I just want to make sure I got the question right.

Gur Talpaz -- Stifel Financial Corp. -- Analyst

To cloud as a broader AppSec.

Corey Thomas -- Chief Executive Officer

OK. AppSec in general. Yes. So it's interesting.

So one, I would say, look, over time, and this is part of the reason we are very -- not just optimistic. We have a high belief in the core strategy around the visibility, analytics and action-based automation is because people desire to actually get a handle and scale their management of their technology from a cybersecurity perspective is increasing. And that's going to continue to increase. What I would say is that for the period that we're in right now and the acute period that we're in right now, almost every -- and by the way, I think this is independent of function.

But in security, too, everyone's asking the question is, what's most essential and what must I do right now? And where do I need to expand my focus? Where do I need to expand the coverage? And so I would say, in general, people are trying to actually get a better understanding of their technology environment in general. But right now, people are acutely aware about like what are the risk areas that I have to manage more. And what we see as the core assets that people are focused in on in this period of time is really cloud-based assets and managing a more distributed environment. Yes.

I think that that will change and that will go back to the steady pace that people are on where they would try to and generally expand their visibility and their understanding about the assets and the risk and the exposures in the overall environment on a more general basis. But for right now, I think they are highly, highly focused on the things that represent the most risk to the business for them.

Gur Talpaz -- Stifel Financial Corp. -- Analyst

That's helpful. And then, Jeff, maybe one for you. Corey touched on this in the prepared remarks, with the notion of being free cash flow positive in 2021. Maybe you can walk us through the inputs and where the confidence threshold for that sort of initial outlook comes from.

Jeff Kalowski -- Chief Financial Officer

Yes. First off, I'll say that we have strong expense controls, and we can manage our expenses in light of changing revenue conditions. Well, I don't want to give any specific guidance on 2021 ARR revenue targets. I think if you look at our implied growth rates in ARR toward the fourth quarter, you could look at that as an idea of how we would lever off of that.

But it's still too early to really give you any specifics on what the ARR growth rates would be and the revenue growth rates would be for 2021. And I'll preface this by also saying that it would be based on a U-shaped recession and looking at the Q4 exit rates as we come out of it.

Gur Talpaz -- Stifel Financial Corp. -- Analyst

Thank you.

Operator

And our next question comes from Brian Essex with Goldman Sachs. You may proceed.

Brian Essex -- Goldman Sachs -- Analyst

Hi. Good afternoon, and thank you for taking the question. I guess, Jeff, maybe we can start with you a little bit. As I look at the guidance and where you've progressed so far in 1Q in terms of profitability.

When we look at kind of where we need to get and where you're guiding for Q2, it seems as though that implies kind of breakeven performance for the last few quarters or the back half of the year. I guess how do you think about spending in that over the course of those few quarters, what levers do you have for better profitability? And how do you balance spending for growth versus profitability? Just kind of getting it -- trying to get an understanding of changes you might make in this macro environment while still maintaining our focus on growth.

Jeff Kalowski -- Chief Financial Officer

Right. You're correct in that. We are going to show a profit in the fourth quarter. So you're right about the layering to this second half of the year with a profit in Q2.

We are increasing expenses each quarter nominally. We've adjusted our discretionary spending, like T&E, we are still hiring and making high ROI investments in critical areas where we need to hire people. But we've adjusted the overall expenses in line with our ARR and revenue reductions.

Corey Thomas -- Chief Executive Officer

Yes. And I think the only thing I would actually add to that, if you look at how we manage it, one, is we tend to take the mid to long-term view. And so I think, as Jeff said, that we're going to exit the year in a positive note. The second thing is, I would just keep in mind, is that we have curtailed expenses.

But Divvy, which is strategic and has high demand as we see around it, does put us into a loss for the third quarter. And so just going back to that so that this quarter, you deal with the environment. Next quarter, we're sort of like addressing Divvy. In the fourth quarter, things turn around and go positive.

I think that's a reasonable track record and that also gives us confidence as we go into a model next year, both profitability and free cash flow.

Brian Essex -- Goldman Sachs -- Analyst

Got it. That's super helpful. And maybe just a follow-up, I guess, this for either Corey or Jeff, is have you spent on sales and marketing, obviously, that spend has accelerated over the past 12 months or so. What is sales productivity like? What position is the sales force in to become fully productive? And how do you think about spend there as we kind of walk through the choppy environment, keeping in mind that it seems as though last year, you're more focused on logo adds? This year, perhaps more kind of expansion within customers?

Corey Thomas -- Chief Executive Officer

Yes. I think the high-level view of just how we're approaching it more than anything else, which probably is in the comments, is that the approach that we actually have is that really it has to be sustainable. And so what I mean by that is we're really focused on the sales productivity as we exit Q4 and expect the productivity as we go into Q1. So when Jeff talks about the good expense controls that we actually have in place.

We will ensure that we actually match the expenses with the sort of like the incoming ARR, but we're going to actually make that determination really based on the exit rate of this year. And as we go into next year, not based on the massive uncertainty now. And the reason for that, again, is that we've had something to be more positive than we would have expected. So we have made a knee-jerk reaction, it would have been an over-response.

So we're being very thoughtful and calculated in the near term, and we're really optimizing our model around both the exit rate and most importantly, what that implies for both next year and as we enter next year.

Brian Essex -- Goldman Sachs -- Analyst

Very helpful. Thank you.

Operator

And our next question comes from Sarah Hindlian with Macquarie. You may proceed.

Calvin Patel -- Macquarie Research -- Analyst

Hi, everyone. Good afternoon. This is Calvin on for Sara. I was wondering if you could kind of comment a little bit on seasonality and potential upshift, what areas you would see that as we start to open back up and as employees start to return back into the office?

Corey Thomas -- Chief Executive Officer

Yes. I mean -- so that's why they're probably -- I'm not going to comment because I don't have any special knowledge there. It's that, look, our model has come to the U-shaped recovery in the 12 to 24-month frame. And the one thing that we actually just don't know is sort of like -- is it going to immediately sort of like open up sometime this quarter as people move in.

Is that going to be Q3? I would say, if you look at the midpoint of our model, we do assume sort of like at the midpoint, but that's why we give a wider range, a bottoming out sometimes at the end of the Q3 and then start to pick back up in Q4. But again, that is something that we just don't know. That's much more sort of like a macroeconomic and a health question. And so what we're looking at is sort of like how do we actually manage through an environment where we don't control either the health or the macroeconomic and how do we actually match the ARR and the expenses and how do we exit the year at the right way instead of, well, for the next year.

And that's why we actually gave the ranges that we did.

Calvin Patel -- Macquarie Research -- Analyst

Right. As a follow-up, we were kind of wondering what do you really see as kind of the largest driver, just thinking larger term and longer-term, strategically, from getting your close $40,000 per customer and kind of going beyond that into the $45,000 to $50,000 range? Is it this customer shift into the large enterprise? Or do you think there's a part of the portfolio that's really going to drive that?

Corey Thomas -- Chief Executive Officer

It's a good question. So I'm going to look at it in 2 different lenses. The first if you step back and just take it at a macro lens. One, we're accelerating both digital transformation in the cloud, but mostly, we're becoming a more technology-dependent world.

So that's the first context. The second context is that we're becoming a more technology-dependent world in a world where security is a priority. So that's the second thing. And the third thing is that we have successfully built what I think about as a leading, best-of-breed platform for managing security operations end-to-end.

And that puts us in a good long-term dynamic. You don't find many platforms where you not just have sort of leading products in one category and a bunch of mediocre products. We have leading products across multiple categories. One that trends to actually be the top -- one of the top players in every category that we participate in.

And that combination plus the macro trends is the thing that actually still has our team, if you talk to our sales team and other folks, excited about what the long-term future holds outside of this post-COVID world.

Calvin Patel -- Macquarie Research -- Analyst

Thank you so much.

Operator

And our next question comes from Jonathan Ho with William Blair. Please proceed, Sir.

John Weidemoyer -- William Blair and Company -- Analyst

Hi. This is John Weidemoyer for Jonathan. Thanks for taking a question. You talked about controlling costs and headcount and such.

I'm wondering from the perspective of comparing this COVID environment to the pre-COVID world, from the perspective of new product introductions and international expansion, do you anticipate that it will be essentially at the same pace? Or do you think that would be -- how would you characterize those two elements if COVID were to be an extended environment like the next several months up to a year or more? Compare that to what you had been doing prior to that. I mean obviously, DivvyCloud is an element of augmenting your product suite. But that probably had been in your pipeline probably pre-COVID or as COVID was occurring. Could you talk about in general, new product development, and international expansion in a COVID world?

Corey Thomas -- Chief Executive Officer

Yes. Of course, I won't go into specific into, like, new unannounced technologies. Well, I'd say that, first and foremost, the pillars that we have or the pillars that we're actually still committed to, that hasn't actually changed, if you think about our core product strategy, that hasn't changed. The second thing that I'll actually point out is that, look, when the world changes, you have to make adjustments, and you have to be thoughtful, but you have to make adjustments quickly under uncertainty and then you have to respond to the feedback that you're actually getting in the market.

Because of that, we are prioritizing our spend in our investments in certain ways and in certain -- I don't think that there's -- so the way I see it, it will put a specific emphasis where we're reallocating dollars and investments at a -- so a higher level if you think about where our core focus is, it is helping people manage distributed complex environments from a technology perspective that impacts all of our products. But all of our products are also focused on managing that challenge and simplifying that challenge for our customers. It's focused on how people accelerate to the cloud because people actually are having to move to the cloud and deliver a new platform and new services faster and it's helping our customers augment and improve their operational efficiency. All of these were things that were sort of like in the hopper before, but we're putting specific emphasis on those areas because those are the areas that are the most meaningful to our customers.

And if we act quickly and decisively and provide value to our customers, then we actually think that sets up the best long-term dynamic.

John Weidemoyer -- William Blair and Company -- Analyst

OK. That's helpful. And similarly, in the area of IoT/OT, that's still a very nascent arena. Could -- has that been pushed off further into the background by customers, prospects and such because of the current environment? Or could IoT and such with the remote elements that are involved there and/or were being more remote, could that create more of an opportunity in the medium-term and kind of move that a little forward as a result of the current environment?

Corey Thomas -- Chief Executive Officer

So I said for us, we will focus at some point in time and deliver on the IoT/OT. I would say that it is not an urgent priority for customers right now. If you think about -- like if you look it off of any survey or you talk to customers, their urgent priority is around managing a complex distributed workforce and about how do they accelerate to the cloud. It's not that -- there's lots of areas that customers are not focused on right now.

It does not mean we won't do it at this point, it's just their focused right now on pressing items that are strategic and critical to their existing initiatives.

John Weidemoyer -- William Blair and Company -- Analyst

Thank you very much.

Operator

Ladies and gentlemen, this concludes our Q&A portion of today's conference. I would now like to turn the call back over to Corey Thomas, CEO.

Corey Thomas -- Chief Executive Officer

Thank you all so much, and I wish you all health and safety during this time. Thank you, again.

Operator

[Operator signoff]

Duration: 55 minutes

Call participants:

Sunil Shah -- Vice President of Investor Relations

Corey Thomas -- Chief Executive Officer

Jeff Kalowski -- Chief Financial Officer

Michael Turits -- Raymond James -- Analyst

Matt Hedberg -- RBC Capital Markets -- Analyst

Saket Kalia -- Barclays -- Analyst

Rob Owens -- Piper Sandler -- Analyst

Gur Talpaz -- Stifel Financial Corp. -- Analyst

Brian Essex -- Goldman Sachs -- Analyst

Calvin Patel -- Macquarie Research -- Analyst

John Weidemoyer -- William Blair and Company -- Analyst

More RPD analysis

All earnings call transcripts