SecureWorks Corp (SCWX) Q2 2022 Earnings Call Transcript

Image source: The Motley Fool.

SecureWorks Corp (SCWX -6.34%)
Q2 2022 Earnings Call
Sep 2, 2021, 8:00 a.m. ET

Contents:

• Prepared Remarks
• Questions and Answers
• Call Participants

Prepared Remarks:

Operator

Good morning and welcome to Secureworks Second Quarter Fiscal 2022 Financial Results Conference Call. Following prepared remarks, we will conduct a question-and-answer session. [Operator Instructions].

At this time, all participants are in a listen-only mode. We are webcasting this call live on the Secureworks Investor Relations website. After the completion of the call, a recording of the call will be made available on the same site.

Now I will turn the call over to Andrew Storm, Vice President of Investor Relations. You may begin.

Andrew Storm -- Vice President of Investor Relations

Thanks, everyone, for joining us. I'm Andrew Storm, VP of Investor Relations at Secureworks. And with me are Wendy Thomas, our CEO as of tomorrow; and Paul Parrish, our CFO.

During this call, we will reference non-GAAP financial measures, including non-GAAP revenue, gross profit, gross margin, operating expenses, operating income, net income, earnings per share, EBITDA, adjusted EBITDA and cash flow from operations. A reconciliation of these measures to the most directly comparable GAAP measures can be found in our web deck and press release, which are available on our IR website. Please also note that all growth percentages refer to year-over-year change unless otherwise specified.

Finally, I'd like to remind you that all statements made during this call that relate to future results and events are forward-looking statements based on current expectations. Actual results and events could differ materially from those projected due to a number of risks and uncertainties, which are discussed in our press release, web deck and SEC filings. We assume no obligation to update our forward-looking statements.

Now I'll turn it over to Wendy.

Wendy Thomas -- President of Customer Success

Thank you, Andrew, and welcome, everyone. I first want to say what a privilege it is to serve as the CEO of Secureworks. This Company has a remarkable history in the security industry, constantly evolving to secure an ever-changing technology landscape by outpacing and outmaneuvering the adversary. Our approach is grounded in solving customer security pain points. And the three themes that we always hear is that they're looking to reduce overall risk to their organization while optimizing their security investments and navigating the shortage of security talent. To reduce their risk, customers need a grid of security controls to protect their data and applications, and they need the technology to enable the prevention, detection and protection capabilities to respond to today's security threats efficiently and effectively across their entire technology environment.

Listening to our customers, we developed Taegis, an integrated cloud -native security platform that provides customers with both the security controls and the operational enablement they need to achieve superior threat prevention, vulnerability reduction, rapid detection across the full range of threats, and the fastest time to remediation. Solving these pain points for our customers creates significant opportunity for us and the emergence of XDR, extended detection and response and MDR, as security categories validates this vision. In our view, XDR will become the primary security offering with the current suite of stand-alone security tools and applications, becoming features that we offer, enhancing our TAM to over $40 billion by 2025 as the endpoint protection, SIEM, vulnerability assessment and other products become features of holistic XDR solutions. While competitors are making claims in the market every day, there are three clear reasons CIOs and CISOs are choosing us.

First, our software was purpose-built to be an XDR solution. XDR at its core is really a big data challenge, an opportunity to use data science to solve security problems and what you design software for, the architecture you build to support it matters a lot. We architected, designed and developed Taegis XDR from day zero with the XDR vision in mind. Our solution takes all the relevant security telemetry from our own proprietary data sources as well as third-party sources, across our customers' entire IT ecosystem;, endpoint, network, cloud and business systems for comprehensive and timely visibility. Taegis supports both streaming and batch data ingestion, enabling advanced detectors to identify malicious activity as it's received. This provides analysts timely detections, coupled with one click response actions to drive efficiency and faster time to remediation.

Our second advantage is the powerful combination of a security platform with analytics and detections fueled by the deep security expertise that comes from staying in the fight with our customers each day. Security is one of the few arenas where you regularly face a highly motivated human adversary, empowered with technology and collaborating among themselves to hone their craft. We do the same. We constantly enhance our detection and prevention capabilities by leveraging what we learn about the threat actor behavior, their techniques, tactics, and procedures each day. We see adversarial behavior from every angle through our daily security investigations, incident response engagements and adversarial testing opportunities. Further, our Counter Threat Unit and data science teams conduct proactive research on threat actors and their changing targets and tools to ensure we're keeping our customers aware of and prepared for the latest, most relevant threats.

All of this knowledge is turned into machine-readable software that accelerates the protections for all of our customers. And the end result is an incredible breadth and depth of automated detectors and threat context to help our global customer outpace and outmaneuver the adversary at scale. And if a customer needs an expert opinion, they can simply use the intuitive built-in chat functionality we provide that makes it easy to collaborate with experts, 24/7 for live personal help.

And lastly, our fundamental understanding of how to manage and efficiently run a security operation at scale is a powerful, powerful differentiator. Secureworks has efficiently run first-class security operations as an industry-recognized leader for over two decades. With Taegis, we are putting that expertise in the hands of our customers and partners. As one example, we continue to expand our library of orchestration playbooks and connectors in Taegis XDR. These playbooks and connectors enable our customers, partners and our own security analysts to work efficiently by integrating with a variety of third-party tools and automating what would otherwise be manual tasks. These capabilities enable us to deliver services at higher margins than peers and we are sharing this knowledge with partners.

Customers are looking to optimize their investment in security with a platform that integrates with their security controls, unified visibility across their entire environment and that enables highly efficient and effective security workflows to optimize limited security resources and partners see that we can help them build a profitable quality business around security services. To bring this all to life, let me give an example.

Recently, an employee at a large manufacturing customer was prompted to run what turned out to be a fake update to their Google Chrome browser designed to allow the adversary to collect information about the system and its users to send back to their command and control node. Taegis detected this pattern of activity within minutes and sent an alert showing the expected attack chain. By quickly isolating the host and resetting the credentials of impacted users, we were able to prevent the script from installing cobalt strike, a popular tool often used to set up future ransomware deployments. Taegis enabled the rapid shutdown of the entire attack early in the kill chain.

Here's another important part. This very same customer also had endpoint protection from another vendor in place that did not prevent the attack and the customer didn't hear about it from them until about 10 hours later.

While some believe endpoint protection is enough, marrying our holistic visibility with our breadth and depth of detections is table stakes in today's security environment. Detecting attacks earlier in the kill chain is the key to preventing costly breaches. To translate this to success in the market, we're proud to share that Taegis just two years after its launch has crossed the $100 million in ARR front, tripling from a year ago.

I'd like to put that in the context of our total business for you. Our total revenue and gross margin reflect; one, our success in shifting our CTP MSS customer base to Taegis; and two, the shift away from some non-strategic offerings. First, shifting CTP customers to Taegis. We call this resolutioning because Taegis is fundamentally different, a more holistic approach to security that extends from detection to automated investigations and response capabilities.

When a Secureworks customer resolutions, they upshift their entire security posture. They expand to full coverage of their estate, gain access to the best security run books for detection and response, and they can easily collaborate with our security experts. We make the planning and implementation, the overall transition an upgrade experience and we typically gain higher average revenue per customer or ARPC.

Our overall ARPC, including the subscription services on our Counter Threat platform is $117,000. Our Taegis resolution customers spend $156,000 on average with us. I'll share a recent example of resolutioning. We've historically secured firewalls for this large, well-known public company for several years. And when the Colonial Pipeline attack happened, they made the decision to invest in expanding security across their entire environment, particularly for endpoints.

During an evaluation process that engaged and assessed the top endpoint and security providers, they test drove Taegis and were impressed not only with our endpoint security, but also how easy our product was to use and our ability to secure their entire environment. No one else can compete on that front and the result was a multiyear, multimillion dollar deal for us. Plus as part of the engagement, we connected them with one of our service partners to provide them with managed firewall services, a solution we no longer offer. The end result is that we have a customer getting a great security outcome, and we've improved the quality of our revenue mix.

This example also illustrates the second area of transformation in our business. We've chosen to move on from certain bespoke and outsourcing type security services and we've been reducing our exposure to non-integrated third-party resales. These revenues are simply not strategic to us long term and have been typically lower margin contracts for us. We're moving apace to both transition CTP customers to Taegis and exit non-strategic service lines. Our expectation is that Taegis ARR will eclipse CTP ARR and mix next year and that by the end of next year, we will have transitioned the substantial majority of our current CTP ARR off of that platform.

Finally, as the XDR and MDR markets come into their own, industry analysts are evaluating the competition and Taegis is consistently showing up as a market leader. Frost & Sullivan awarded us the 2021 Customer Value Leadership Award for the global XDR market with special recognition for our meaningful degree of automation. We were referenced as number eight in the Top 100 software companies of 2021 and the highest ranked security software pure play by the Software Report. Recently, Forrester named us a leader in their first MDR wave assessment as did IDC for their first US MDR assessment. These are proof points of the agile and customer-driven way Secureworks is transforming. As part of that transformation, I'd be remiss if I did not recognize, congratulate and thank our incredible employees for their tremendous execution and their unwavering commitment to our mission.

Now I'll turn the call over to Paul Parrish, our CFO.

Paul Parrish -- Chief Financial Officer

Thanks, Wendy. As noted, 2Q marked an important milestone for us with Taegis ARR crossing $100 million and representing approximately a quarter of total ARR. We added $28.2 million ARR this quarter, up from $17.5 million last quarter and we're raising our full year guidance to at least $155 million Taegis ARR. Taegis revenue was $18.5 million, up 33% sequentially.

To help understand the relationship of Taegis revenue to Taegis ARR, resolution customers' revenue is classified as Taegis once a customer converts to the Taegis platform. This conversion creates a lag between ARR and revenue. The average revenue per Taegis customer was approximately $149,000 versus $102,000 for managed security services customers, showing our transition continues to result in broader customer relationships. Taegis customers increased from 500 to 700 sequentially, offsetting declines in our managed security subscription customer base.

This quarter, we increased our disclosure, providing a breakout of subscription and professional services revenues and cost of sales. 2Q total revenue was down 3%. Subscription revenues were down 3.6%. This is primarily where we're intentionally reducing certain nonstrategic areas of the business while we're growing Taegis. Professional services revenues were flat though revenues were lower sequentially following a surge in short-term engagements in Q1.

Gross profit margins were 61.1%, up 140 basis points year-over-year. The year-over-year pickup in margin was primarily driven by improved cost in subscription revenues. Since the start of last fiscal year, subscription gross margins have expanded by approximately 400 basis points, while total revenue has been flat, evidence that our transformation is working.

Moving to operating expenses. We're investing in key areas of the business to capture the opportunities ahead of us. R&D increased to 21.5% of revenue, up from 16.6% last year and we capitalized $1.4 million in incremental R&D spend as we accelerate investments in our security platform. Sales and marketing was 25.1% of revenue, consistent with last year. We'll invest in sales and marketing over the second half to continue accelerating growth in Taegis. Adjusted EBITDA margin was 2.7%. Cash flow provided by operations was $17.3 million for the quarter. Capex was $2 million for the second quarter, including $1.4 million of capitalized R&D investments in Taegis. We ended the quarter with $197 million of cash and an untapped credit facility.

Moving to guidance. There's additional detail in the press release, but the big picture is we're raising Taegis ARR, lowering the total revenue range and tightening the high and low end of adjusted EBITDA guidance. We are rapidly transforming the business and our guidance is reflective of our successful execution.

Wendy will now join us again as we begin Q&A. Operator, can you please introduce the first question?

Questions and Answers:

Operator

[Operator Instructions] We'll take our first question from Saket Kalia with Barclays.

Saket Kalia -- Barclays -- Analyst

Okay, great. Hey. Good morning, folks. Thanks for taking my questions here.

Wendy Thomas -- President of Customer Success

Good morning.

Saket Kalia -- Barclays -- Analyst

Hey. Good morning. Hey. Wendy, maybe just to start with you. Great to see the improving growth in Taegis ARR. I think you alluded to this a little bit in your prepared remarks, but can you just talk about how much of this is coming from those CTP/MSS customers that are shifting? And sort of how you see that path kind of going forward as that shift continues?

Wendy Thomas -- President of Customer Success

Sure. So we do, as we have, see both of those contributing to the ARR growth in a balanced way. The important element, which I mentioned in terms of the resolution customers, it is not just dollar for dollar moving over to the Taegis platform, but creating incremental average revenue per customer as they make that transition where they're getting more value and we're getting a greater share of their wallet. So, there's benefit from that too. We also see, as new customers are on the platform, they too have average -- higher average revenue curve just like resolution customers simply because of that same state coverage opportunity. And so we expect, as I mentioned, to see the substantive majority of the CTP transition complete by the end of next year. So that will obviously continue to be an important contribution to the ARR growth. And then, of course, toward the end of next year and after that, it will be primarily new and upsell on existing Taegis customers that contribute.

Saket Kalia -- Barclays -- Analyst

Got it. That's very helpful. Paul, maybe for my follow-up for you. Can you just touch on gross margins a little bit sequentially? I know they were up very nicely year-over-year. But I was just wondering if there was just anything to consider from a pro-serve or a subscription perspective with gross margins, maybe just down slightly sequentially, how do you sort of think about some of the puts and takes there?

Paul Parrish -- Chief Financial Officer

Yeah. Excellent question. And this is the reason why we're giving our new disclosures around our margins. And so when you drill into the overall gross margin, within that, our subscription gross margin is actually continuing to improve, which quarter-over-quarter, we increased. Q2 was 67.8% in subscription margins, Q1 was 67.6%. So slightly up quarter-over-quarter. Professional services, as I mentioned in my comments, were -- total revenue slightly down from first quarter, and we had a surge in our work during the first quarter. So, that contributed to the overall gross margin actually declining from Q1 to Q2, the professional services.

Saket Kalia -- Barclays -- Analyst

Great. Very helpful. I'll get back in queue. Thanks, guys.

Operator

Our next question comes from Sterling Auty with JPMorgan. Sterling, your line is open. Please check your mute button. All right. Sterling, if you can hear me, please get back in the queue. Our next question is from Mike Cikos with Needham & Company.

Mike Cikos -- Needham & Company -- Analyst

Hey. Thanks for the time, guys. I really do appreciate it here. Just two quick questions from me. First, I know that you guys had disclosed the resolution customer average. I think they're spending -- I want to make sure I got that right, it was $156,000 with Secureworks versus the overall average revenue per customer is $117,000. So that was the first. And then second, I guess, building on that, that $156,000 from Taegis resolution customers, how has that trended over recent quarters? I'm trying to get a sense of what it was last quarter or even a year-ago to see how that $156,000 I guess, data point has changed over time?

Paul Parrish -- Chief Financial Officer

Yeah. So Taegis average revenue per customer, Q2 was actually $149,000.

Wendy Thomas -- President of Customer Success

Total.

Paul Parrish -- Chief Financial Officer

Total Taegis.

Wendy Thomas -- President of Customer Success

$156,000 for resolution.

Paul Parrish -- Chief Financial Officer

Resolution. So resolution portion of that has been trending around the $156,000, it's kind of up and down a little bit quarter-to-quarter, and we'll see that kind of bobble around that number, but not much change from that, some quarters slightly higher. This has been a good median number.

Mike Cikos -- Needham & Company -- Analyst

Great. Thanks for that. And then one more, if I could. If I'm thinking about the services that you guys are intentionally walking away from there, just lower margin, not considered strategic to you guys, how much of that is left from where we stand today? I'm just trying to see how much we've already, I guess, walked away from and then what's coming down the pipe?

Wendy Thomas -- President of Customer Success

Sure. So our guidance for this year reflects the pace at which we'll be exiting those as well our guidance for next year which we haven't given yet. But we are moving to do that, obviously, as quickly as possible and will be, as I said, really substantially complete by the end of next year.

Mike Cikos -- Needham & Company -- Analyst

Okay. Is it fair to assume that the vast majority of that, I guess, intentionally churned over revenue will be done this year or is it more evenly spread between this year and next year?

Wendy Thomas -- President of Customer Success

I would say that we will probably be substantially complete with that toward the mid part of next year, but the guidance this year reflects the pace at which we want to push that fairly quickly.

Mike Cikos -- Needham & Company -- Analyst

Understood. Okay. Thanks for the time, guys. I'll get back in the queue. Good luck.

Operator

[Operator Instructions] Our next question is from Brian Essex with Goldman Sachs.

Brian Essex -- Goldman Sachs -- Analyst

Hi, good morning and thank you for taking the question. Maybe Paul, for you, I would like to see if you could give us maybe a little bit more clarity around the moving pieces within Taegis? I know you're just kind of starting to disclose some of this stuff. But in terms of the mix of XDR, MDR, DDR. What is the mix, maybe the total Taegis revenue, I apologize if I missed that. And how you anticipate that to trend over the next year or so?

Paul Parrish -- Chief Financial Officer

Yeah. So we gave guidance on the total revenue for this year, $90 million to $100 million for Taegis. We continues to climb as we have increased conversions over resolutions over to Taegis. So, we see that momentum continuing, and we're pretty happy with the momentum we're having and the growth we're having, which is reflected in our total ARR.

Brian Essex -- Goldman Sachs -- Analyst

Got it. That's helpful. Got it. That's helpful. Just trying to get a sense of the mix, though, like XDR, MDR, and DDR and what that might be within -- either revenue or ARR or whatever.

Paul Parrish -- Chief Financial Officer

Yeah. We're reporting as total Taegis. As we continue through this journey of the transformation, we'll consider additional disclosures along those lines. But right now, we're reporting it all together as total Taegis.

Brian Essex -- Goldman Sachs -- Analyst

Okay. Fair enough. And then maybe just a follow-up. Understand that the customers are kind of migrating over to the platform. I think you previously noted that you've also had other service providers that are kind of leveraging your technology on their platforms. Any traction there? And any indication of maybe the magnitude of that channel for Taegis?

Wendy Thomas -- President of Customer Success

Sure. I can take that one. We are really pleased with the traction we've had in the MSSP program so far. So we launched that formally in May and had some beta work with partners kind of toward the end of last year starting. So in terms of partners who have signed on to deliver services on the platform, US, Europe, Middle East, pleased with that traction. Obviously, with the launch in May, the sales are not going to be material to the total just yet. But we're looking at the early indicators of have their teams completed the certifications that we have available on the Taegis platform, the pipelines that they're building, and frankly just the go-to-market activities that we're doing jointly as leading indicators of traction there. So pleased with where we are and we'll take a little time before the total number start to move the topline.

Brian Essex -- Goldman Sachs -- Analyst

Got it. That's very helpful. Thank you very much. I appreciate it.

Operator

And I don't see any additional questions in queue.

Paul Parrish -- Chief Financial Officer

Well, thanks. That wraps up our Q&A in today's call. A replay of this webcast will be available on our Investor Relations page at Secureworks.com, along with our Q2 web deck with additional financial tables. Also a reminder, Secureworks is scheduled to present at the D.A. Davidson Virtual Investor Conference on September 9. Hope you'll join us there and thanks again for joining us today.

Operator

[Operator Closing Remarks]

Duration: 27 minutes

Call participants:

Andrew Storm -- Vice President of Investor Relations

Wendy Thomas -- President of Customer Success

Paul Parrish -- Chief Financial Officer

Saket Kalia -- Barclays -- Analyst

Mike Cikos -- Needham & Company -- Analyst

Brian Essex -- Goldman Sachs -- Analyst

More SCWX analysis

All earnings call transcripts