Rapid7 Revenue & Funding (2024)

hello everyone my guest today is corey thomas he's the ceo of rapid7 and chairman of its board of directors he has extensive experience in leading technology companies to the next stage of growth and innovation before rapid seven he worked with microsoft and deloitte he graduated from vanderbilt university and had and his mba from harvard business again now building rapid seven playing in the security analytics and automation space corey you ready to take us to the top absolutely exactly we were chatting with you all right man all right so tell us about rapid seven what's the company do and are you a pureplace sas model we're a peer play sas model we're in the security analytics and automation market at the core we actually help people understand what's happening in their environment from a security perspective using a massive data collection engine and figure out are they vulnerable are they compromised and if so helping them quickly remediate those issues and are you kind of a kind of a malwarebytes bottoms up model where you're selling six dollar a month plans to employees and then before you know the cto is buying a big enterprise license or are you going kind of top down enter you know you know what i mean yeah no absolutely so we sell to teams within our in organizations so it's typically much larger transactions than having sort of like a couple dollars a month all of our revenue is recurring based revenue but most of our deals actually come from selling to fairly large teams within enterprises okay so if someone's listening right now and they're looking for such a a platform like yours on average what's the customer going to pay you per year to use your platform yeah so we make it really easy to get started so customers can get started you know in the tens of thousands of dollars range then we of course have customers that go up to the millions of dollars okay um per year range but we try to make it as easy as possible for people to actually start building out their security program okay so i mean would it be fair to say someone you know you know a team size have caught you know 30 40 people is gonna maybe pay fifty thousand dollars a year or something like that to get going that's it that's started and what you find is we actually have four core sets of products vulnerability management um incident detection response and sim uh application security and the um and our last one is the security or automation orchestration and so that 20 to 50 000 is typically sort of for one team one of those projects and as they deploy more projects to cover more in their environment it's more tonight corey can i ask you one of the key things to any sas company expanding rapidly is obviously driving expansion revenue year every year it sounds like you are nicely set up to drive expansion revenue with multi-product lines probably a multi-seat approach and some probably usage-based metric as well so an account that starts with you let's just make the math easy at you know 50 000 per year typically from year one to year two how much will you expand them by you double them or triple them or what yeah so you know our expansion rate is roughly 120 on a year-over-year basis so we focus on life study expansion over time and that's really you know our view the thing i love about the sas model is you don't pre-buy like it's based on your usage uh and so if you think about what the inherent bottleneck in security is right now it's that people have to staff up their teams they have to have capacity we draw productivity but they actually pay more and buy more as they actually are getting more value and more usage yep so a cohort that signs up with you a year ago you're saying you'll expand that cohort on average by 120 um that means you obviously have expansion and churn built in there so so what do you see if you peel back ignore expansion for a second your gross churn on a revenue basis annually are you kind of sub 10 percent in the healthy stages are you more or less yeah no so it so it is uh in the healthy state the thing that we've reported publicly engine rate is 90 the last time that we actually quoted our expiring um revenue retention rate and really that's the mix of two things is mid market customers which actually as you can imagine have higher term rates corey real quick sorry you cut out what was that 90 number that's your net revenue retention or your gross retention no that's the expiring so you we have two sort of like renewal rates one is the expiring oil rate deals that are up this year and so like how many customers say from a dollar perspective that's 90 if you look at our overall renewal rate includes upsells and cross sales that's 120 percent uh and so i'll say the 90 is a mix of some smaller customers that actually have slightly higher um churn rates and then larger enterprise customers that have more established programs that actually have a much much higher retention rate yep yep so just repeat that back to make sure i got it you know 90 stay or said differently 10 of your revenue churns annually but you expand that same cohort by 30 so your net revenue retention is 120. yep you got it 30 perfect amazing all right let's let's put this back on a timeline i want to get the back story here when did you launch this company what year so the company was actually founded in 2000. i joined the company uh as the head of operations in 2008 and i became the ceo in 2012. okay 2012. now was this part of a round of funding and avicii said we want corey leading otherwise you're not getting our money or or what how did you come in and see yeah so it's the i joined in when bain originally yeah i wanted i joined when um bain capital ventures uh did the initial investment and i joined as the head of operations um and then subsequently as the company was plotting out its next stage of growth they asked me to become the ceo okay so how much raised so far oh so we're public today yep and so before we had actually gone um public we had raised um a little under 100 million dollars around 90 million dollars um and then we've done a couple different public races and some um subsequent races after we became public when we're rhyming again sorry what year do you guys ipo 2015. 2015. okay so you had joined uh i guess you were there for what four or five years uh before that yeah i joined in oh eight yeah and yeah exactly so i joined in oa and then we went public a little bit later yeah so so walk me through that transition because there's a lot of companies that you know the founder is not the one that goes from zero to one is not the right guy also or gal to take it public right so what's the relationship like with the actual original founders were they supportive of this move was it more hostile how did it work incredibly supportive i mean the one thing that i actually learned is alan matthews and natasha kanakas and a guy named chad loader who was the founding team um they had this great model of what in retrospect i thought about is sort of like stewardship um and they were saying like their core purpose is the mission of the organization so our core purpose was how do we actually take the complexity of security so how do we simplify security overall um through analytics and automation and their whole mission was that listen you need the right people in the right jobs at the right time and so when they made me see ceo allen became chairman toz is still here as our cto um and then chad went on to go start another set of ventures but when i became ceo allen's feedback to me was just like hey take the company to the next level but also have the self-awareness to recognize when you're a steward for a period of time and to actually inhibit the mission and if you're not supporting the mission or someone else can do a better job of it then it's your job to actually find them and help bring them in uh and i think that's just such a great mentality about how to think about things that's interesting so you you closed out i believe uh 2018 in terms of arr at somewhere around i think like 240 250 million around that people can look it up but 240 250. but i do remember the growth rate year over year was something like 30 in terms of ar growth rate year over year is that right so our ar growth rate actually ended the year last year over 50 percent and so we had really accelerated our overall um ar growth rate uh 53 percent yep exactly let me ask you a question being a publicly traded uh kind of ceo we've had maybe seven or eight others in the sessions that are publicly traded i always like to ask this question do you believe public markets understand like deeply what expansion revenue means and if all your growth over the next 12 months you didn't add a single new customer but you grew 53 again year over year off from expansion would they value higher or lower because of that it's a good question depends on what evolution i would say public companies uh and public investors um have different levels of sophistication when it actually comes to this in fact you know one of the interesting things for me is that i found different types of investors have different levels of depth and understanding this transition what i would say for where we are right now our investors very much are looking for and are invested in rapid 7 because of the expansion um because of the expansion capability and so if you think about what most of our investors are talking about is they're like you've actually steadily grown your um renewal rates and your retention rates over 90 and you're expanding at a quite healthy rate and you actually have big market opportunity in front of you so our investors really understand that the thing i'll tell you though is it took a while for us to actually find those investors and the company was undervalued for a while as we were actually both delivering the proof points around the things that we talked about and as we were finding those investors who are actually going to do the homework and understand what was happening yeah uh you got almost 100 million bucks on the balance sheet according to the financial report at the end of december 2018 you know know before malwarebytes these are companies that are getting closer to the 80 90 100 if not north already 100 million arr marks on the cyber security space maybe they go public here shortly if they put out a public announcement they're planning to go public do you try and move in quickly and take them off market before they list no we're we're no we're very disciplined so we do m a uh most of our uh most of our acquisitions have been technology tuck-ins but you know i have a couple of simple things one is you should actually have a clear vision and clear direction about what you want to do um you should have some ideas about how you're going to do it and then we have a set of things that we consider strategic accelerators and if they actually become available at the right price then we'll absolutely look at them um but i think it's fair at least for me it's undisciplined to actually jump in just because um something's actually coming available that's not saying we won't do it if it's actually highly strategic yeah but most of the time if you actually take a longer term perspective you can find stuff that works how many customers have you scaled to today yeah we are a little bit under 9000 customers okay nine thousand customers uh the reason and sorry what's what p e ratio are you trading at last last time you checked you remember yeah it's a little over uh well so it's not we we trade on a revenue basis yep um and so it's a little over 7x on a revenue basis last time i checked so so let me let me ask you a question if if you came across a deal where the tech made a lot of sense but really you you saw a good deal in the sense that you could get a company maybe they'd raise 20 million bucks but they didn't get growth and you could go you know buy them at like a 1x ar multiple so there's like essentially a 5x arbitrage there right if assuming the transition is smooth have any of your past acquisitions followed that strategy where again solid tech slow growth but ar arbitrage um yes we didn't think about it as ar arbitrage others [Laughter] is that the you know we bought this great application security company that had great tech growth and what we thought um we brought it in we did some minor updates to the technology it made it more cloud-centric uh and that thing took off um that's a perfect example where it had been stalling for a bit you know those tend to be smaller deals because what we're really doing is we're actually thinking about buying core great technology but we believe that we can actually accelerate the growth so the reason i say for us it's not just the arbitrage is that all of our core tech m a when we look at it it's primarily driven to actually accelerate growth uh and so we think about in terms of like okay someone might have been growing it sort of at flat or sort of sub 10 percent but what can i do with it and that sort of like takes you know some confidence to actually really understand what your team can do with asset versus what that asset and what that technology has done by itself yeah what's your team says today how many people um we are a little over 1300 people in the company 1300 and then last question here on economics before we talk more about product and future product kind of story um to get a new customer right that's paying you i'm gonna make up fifty thousand dollars in year one how aggressive are you willing to be on cac yeah so i would say that the we are quite willing to actually make an upfront investment especially if you think about the so just to be clear so our average error per customer is um around a little over thirty thousand dollars for a customer so just to be clear and so the fifty thousand was more based on the customer size that you and i were talking about earlier the way that we actually think about it is on average we have the potential if a customer if that same customer was to fully deploy our products for that thirty thousand dollars to actually be two hundred uh thousand dollars and we in fact we've been steadily growing the ar per customer over time and so really the way that we actually think about it is um what's the investment we make today and what's the payback period now we haven't published that number so i can't actually talk okay right uh and what those rates and what those conversion rates were but what i would say is that as long as we're seeing healthy expansion which is the thing you actually brought up earlier it actually gives us confidence to actually um go out and make investments in our customer base don't tell me what's actually occurring in the business but talk about what you would be comfortable with in the future i mean with the analysis you just gave me right the confidence and retention expansion things like that i mean would you be comfortable going up to a 24 month payback period in the future um so um absolutely if you look at it is that if you say you have confidence actually let's just keep it relatively simple sure to triple something over three years um would you actually sort of like have a 21 month payback period in an ar model yeah that's a that's a no-brainer so just from a math perspective um and so that's exactly the type of stuff that we're looking at on an ongoing basis is you know how much does it cost to actually keep the customer having a great experience the one thing i would say that we do slightly differently is that we're not just looking at the retention rate we're also looking at like what does it cost for a customer to have a great experience because the more customers that are actually recommending us it actually lowers the cac in the future so we're constantly sort of assessing is the best investment in the upcoming acquisition or is the best investment actually improving the customer experience and recently we've actually shipped in more of the investment to proven the customer experience because um the income and the revenue and our success that actually comes from our customers being happy and successful it's just worth its weight in goals yeah yeah one customer turns into two which then splits your cac essentially exactly so you know if you look at what we and we've talked about this publicly we've been much more focused about like how do we actually um have customers be phenomenally successful more than just sort of the upfront application cost yep yep no this all makes great sense corey i want to wrap up here with the famous five number one what's your favorite business book oh my favorite business book is um i think it is going and i'm going to butcher the name because i just made my daughter re-read it um it's actually seth carman's book it's about investing um oh wow it's not even in print anymore seth harman seth tarman he has a book about investing um but he's a great um he's just a great um value investor that helps you think about sort of like how you actually think about value and if i can do a second one i would actually say team of rivals by doris goodwin kearns which is actually while it's not a business book it actually does talk about the complexities of managing teams when things aren't perfect and they're messy i think sometimes what i find with lots of business books is that they teach you how to deal with a simple world um you know for me at least the world is quite messy all the time that's simple i appreciate books that i come exactly i appreciate books that actually help me understand number two uh what is it is there a ceo you're following or studying right now cory yes one of my mentors is a guy named aaron ain um who leads the company chronos he just wrote a book himself um but like he just you know i get to spend time with him a few times a year uh and he's just a phenomenal guy with a deep perspective about how to build a growing business but also how to actually really think about um making great investments in people uh and developing people in talent yeah number three is there a favorite online tool you've got for building your company oh a favorite online tool this is gonna get me you're gonna give me lots of trouble with lots of different friends yeah pick your best pick a baby exactly i'm gonna have to and so i i have to tell you we have offices all over the world and i am using and loving zoom quite frequently right now um for the ability to actually connect with our team members and our moves we call them moose all over the world there you go eric eric is loving you even though he thinks they're overpriced right now in the public markets we'll see what happens there guys number four how many hours of sleep you get every night uh i try to get six it's typically between five and six and what's your situation married single kiddos i am a merit with kiddos how many kids two two okay and how old are you yeah i am 43. last question what do you wish your 20 year old self knew oh um 20 year old self yep take us back 23 years yeah jesus by 20 year old self the one thing that i wish that i knew was to actually as i made friends to you know keep working hard do all that stuff but actually stay in touch like don't lose connections um as you actually go along and get busy with working family guys stay in touch with early friends coming from corey public company rapid 7 playing in a cyber security space north of 240 million bucks in ar growing 53 year-over-year again impressive at those numbers and the reason is because he's really dialed in expansion revenue right 90 retains are then expanding so 10 churns but they're expanding by 30 so 120 net revenue retention as he looks to continue driving that up uh plenty of cash on the balance sheet in terms of m a again looking at things that make a lot of sense they've been aggressive in the space already maybe some more deals in the future but in the meantime corey thank you for taking us to the top thank you so much i've enjoyed it