SecureWorks Corp. (NASDAQ:SCWX) Q4 2023 Earnings Call Transcript

SecureWorks Corp. (NASDAQ:SCWX) Q4 2023 Earnings Call Transcript March 23, 2023

Operator: Good morning everyone. My name is Bruno and I will be your conference operator today. At this time, I would like to welcome everyone to the SecureWorks Fourth Quarter and Full-Year Fiscal 2023 Financial Results. All lines have been placed on mute to prevent any background noise. A supplemental slide presentation to accompany the prepared remarks can be found on the company’s website. After the speakers remarks, there will be a question-and-answer session. Thank you. At this time, I would like to turn the call over to Kevin Toomey, SecureWorks Vice President of Investor Relations. Mr. Toomey, you may begin your conference.

Kevin Toomey: Thanks, everyone, for joining us. With me this morning are Wendy Thomas, our CEO, and Paul Parrish, our CFO. During this call, unless otherwise indicated, we will reference non-GAAP financial measures. You will find the reconciliations between these GAAP and non-GAAP measures in the press release and presentation posted on our website earlier today. Please also note that all growth percentages refer to year-over-year changes unless otherwise specified. Finally, I’d like to remind you that all statements made during this call that relate to future results and events are forward-looking statements based on current expectations. Actual results and events could differ materially from those projected, due to a number of risks and uncertainties, which are discussed in our press release, web deck and SEC filings. We assume no obligation to update our forward-looking statements. Now, I’ll turn it over to SecureWorks CEO, Wendy Thomas.

Wendy Thomas: Thank you, Kevin. And welcome everyone. SecureWorks continues to deliver strong growth from our Taegis XDR solutions. Taegis revenue grew 120% year-over-year during fiscal 2023 with full-year revenue reaching 188 million. 2,000 Taegis customers are now seeing the benefits of our XDR-based approach to manage detection and response, up 400 from third quarter. Taegis annual recurring revenue grew 58% year-over-year to 261 million. As an important indication of the acceleration of our business transformation, Taegis ARR now represents over 80% of our total ARR up from 42% of the total at the end of the previous year. And we expect the mix of other MSS ARR to be minimal by year-end, approximately 5% of the total, primarily in Japan.

Reflecting in our business transition, when we began building Taegis, the XDR market didn’t exist. We were building a technology platform to enable solutions that solved pressing customer needs, better security for their spends, with fewer vendors to manage, and a step function reduction in the SecOps burden on their teams from and a lack of automated containment. As the possibilities of XDR become clear to the market, our to be the XDR platform that is fundamentally open, one that evolves seamlessly with customers technology changes, and one that provides superior detection and unmatched response to prevent damaging security breaches, all-in an industry leading return on investment, and Taegis’ unique approach to drive superior security outcomes is resonating with the market.

Since launching Taegis in 2020, we’ve delivered a 3-year compound annual growth rate of 156% in Taegis ARR. Let me dive in a bit more on what makes Taegis distinct in addressing customer security challenges across four categories. The first pillar that differentiates Taegis from other solutions is its superior . Detection is more than finding everything that poses a threat. It’s about finding and prioritizing the most potentially impactful threat. We refer to this as finding the signal despite the alert noise. Over the last year, Taegis filtered 99% of the high and critical alerts generated from as false positives. And while Taegis is a powerful filter of noisy point solutions with a full coverage approach to XDR, Taegis regularly find malicious activity that other point products missed.

Taegis’ telemetry normalization techniques and proprietary algorithms detect threat actor behavior based on our proprietary knowledge of their tactics and techniques. In fact, this past quarter, we shared details of our approach through the CTU threat crash. Our proprietary data warehouse with detection algorithms powered by more than 400 billion unique threat and knowledge nodes continuously updated by our in-house team of threat researchers. Much of the industry threat intelligence is published in a way that is difficult for most organizations to apply to their protection with machine readable threat intelligence updating our Taegis detectors every hour. Taegis power superior detection with unmatched speed. To share a real world example of how this resonates, a global manufacturing customer with a small in-house security team recently licensed Taegis.

With their previous security services provider, they had no visibility into the effectiveness, and they knew that their vulnerability management had not been keeping pace. They were concerned about the risk of a breach. After deploying Taegis, the platform quickly detected suspicious remote access activity to a specific device. This immediate detection coupled with proactive monthly threat hunt included in the Taegis subscription, quickly demonstrated the value of our integrated approach, the detection of malicious activity that other solutions missed, and customer confidence in their ongoing security with Taegis. Second, we continue to hear from customers that Taegis provides an unmatched level of response. The majority of security response actions across cloud, identity, network, and endpoint infrastructure occur automatically through the native SOAR capabilities in the Taegis platform.

These capabilities are augmented and curated by our team of SecOps experts on behalf of partners and customers and are informed by the thousands of incident investigations and responses performed via the Taegis platform each year. As an example, customers benefit from automated workflows that can simultaneously disable user logins in AWS, while isolating relevant endpoint hosts when a critical risk is detected. SecureWorks has been using machine learning to maximize the performance of our detectors for several years. We’ve found that over time, the quantity and quality of data drives machine learning model performance. The good news is, we have more than we need with 650 billion real world events per day and thousands of incident responses each year.

The proven combination of Taegis’ holistic detection and automated response capabilities led to a deal recently won with an international healthcare company that was frustrated with their existing SIM solution. With the burden of maintaining integration for security monitoring, and a lack of automated investigation, their small team was stretched beyond capacity. Taegis enabled them to focus on real cyber threats, without adding to their security team while addressing their log management needs for less total spend. The added capability of platform to help them proactively and continuously understand and optimize their security posture in comparison to industry peers was a key selling point to their executive team. Three, Taegis is open without compromise.

We designed Taegis to address the reality and complexity of customer technology environments. Many customers come to us with end-point technologies from multiple vendors, deployed simultaneously across their organizations. Additionally, we see teams who manage across hybrid and multi-cloud environments. Unlike other XDR or EDR platforms, we designed Taegis to excel in detections across these mixed environments, with the proven ability to automate sophisticated response actions, all from a single pane of glass. This means better, faster protection, with scaled use of security resources, continue to make investments to protect even more customer tax services. For example, we recently announced enhanced integrations with Google Cloud Platform and Google Workspace.

Extended support for Google environments enhances alert visibility and traceability, delivering a simplified workflow for SOC analysts. I’ll share a story from a recently signed deal with a financial services firm who had found gaps in their endpoint centric solution during a security assessment. And also had a small in-house IT team that was overburdened with alerts. Taegis not only provided better protection for their entire technology estate, including endpoint, network, and cloud, but also answered their need for retention and centralization of log data. With the ease of deployment and the valuable MDR partner that SecureWorks brought to the table, they were quickly able to optimize their spend, provide relief to their team, while delivering better security outcomes to their business.

Finally, customers choose Taegis for the measurable and superior return on investment. To help customers demonstrate the value of security investments to their leadership team, SecureWorks launched a new security posture dashboard in Taegis. The dashboard is dynamic, enabling customers to regularly monitor, maintain, and improve their readiness in the face of ongoing security alerts and do so in real-time comparison to others in their industry. Let me share a customer story. We recently signed with a global provider of insurance and reinsurance solutions. This customer needed to defend itself and its clients’ data by proactively anticipating cybersecurity threats protecting their brand from reputation damaging breaches. But they were also excited about the opportunity to drive new revenue opportunities by developing safe and secure cloud applications offered as a service to their existing customers.

They shared with us that Taegis enabled them direct savings of at least $750,000 per year and potential cost avoidance of up to $100 million from a breach and that their productivity was enhanced by approximately $375,000 a year, due to an increase in their team’s productivity. And as a provider of cybersecurity insurance, the customer is looking ahead to the benefit of increasing revenue and reduce cyber breaches from Taegis based offerings license to their customers. As we look at the security challenges that organizations face, we see that technology alone cannot solve all of the challenges. Many organizations struggle with a shortage of security talent, and the diversity of skills needed to effectively manage security programs. Our product, Taegis XDR was created to address these challenges.

Taegis has embedded orchestration and a collaborative interface and workflow designed to enable transparency and collaboration across customer teams, our partners, and our security experts. This allows everyone to work together in real-time and see the same information making the security program more effective no matter how it is delivered. Our unique open approach allows us to bring customers XDR based MDR across multiple go-to-market paths. First, we partner with solution providers to sell Taegis with SecureWorks provided MDR. Second, managed services providers sell and deliver Taegis powered MDR to their end customers under their brands. We now have multiple MSSP partners who are building their business on Taegis because we have demonstrated a compelling return on investment.

This is a growing opportunity for our business and a focus of our long-term strategy. Third, enterprise customers who have their own thought capabilities or who intend to grow their teams over time to a full-time SOC, use Taegis to filter the signal from the noise, automate investigations and response capabilities, hunt and manage . These customers know that Taegis lets them automate the mundane and focus on adding value security experts. In summary, our strategy is for our XDR platform to power industry leading MDR capabilities, allowing us to grow our customer base, and be the platform of choice as the XDR market matures. Let me change gears. And talk about our path to profitability as we near the end of our business model shift. For the past few years, we have effectively been managing two distinct businesses, making investments in a growing higher margin SaaS subscription business, while winding down our other MSS and outsourcing services lines of business.

Den Rise/Shutterstock.com

With the acceleration last year in our transformation, we have also been actively managing down our cost structure as we sunset those lines of business. With the end of life in other MSS services outside of Japan effective February 3 of this year, we announced a workforce reduction of approximately 9%, a key step in aligning our expense base to our go forward business. With the continued growth and scale that our Taegis platform brings and our ability to reduce the remaining duplicative cost structures over the course of this fiscal year, we expect to exit fourth quarter of fiscal 2024 near breakeven EBITDA setting us up for growing profitability in our go forward business in fiscal 2025. I want to thank our customers and partners for joining forces with us.

And I thank our teammates for their hard work and commitment to the SecureWorks mission of securing human progress. In addition, I’d like to thank Paul, our CFO, who last month, announced his intent to retire from SecureWorks. Paul joined SecureWorks shortly after we launched Taegis, bringing highly relevant experience in the SaaS space, leading similar business transformations. He’s led our finance and accounting team with absolute integrity in our financial reporting and business operations with a lasting impact on our transformation and team, that we can all be proud of. We have an active search underway and expect to announce an appointment prior to Paul’s retirement to ensure a smooth transition. Paul has been a valued partner and I’m grateful for his leadership.

And with that, I’ll turn the call over to Paul Parrish, our CFO, to discuss our fourth quarter results and outlook for the first quarter and fiscal year 2024.

Paul Parrish: Thanks, Wendy. After nearly 41 years in industry, I made the decision to retire and I’m looking forward to the next chapter in my life. It’s been an honor to have served as CFO of SecureWorks during such a pivotal time in the security industry, and I thank all of my teammates and peers at SecureWorks for this opportunity. Taegis showed continued strong growth in the quarter. Taegis subscription revenue was $60.2 million for the fourth quarter, up 106% year-over-year. For the full fiscal year 2023, Taegis revenue was $188 million growing 120% year-over-year. ARR increased $97 million year-over-year to end Q4 at $261 million, representing year-over-year growth of 58%. Taegis ARR was driven partly by stronger resourcing, upsell, and cross-sell.

We added 800 customers since Q4 of last year to end the year at 2,000 total Taegis customers. An average revenue per Taegis customer was approximately $132,000 a meaningful premium to the overall industry average. It is important to note also that ARPC is similar for new Taegis customer additions and re-solution customers. An important milestone we set out this year to achieve ARR from the Taegis platform contributing more than 75% of total subscription ARR. We’re happy to report that we ended the fourth quarter at 82% of ARR from our Taegis platform, up from 42% at the beginning of FY 2023. Approximately 5% will remain by the end of FY 2024, enabling us to address our duplicative cost structure over the course of the year. Total revenue was $115 million in Q4, which was above the high-end of our guidance of $110 million to $112 million, driven by outperformance in both subscription and professional services revenues.

In Q4, our total gross profits decreased, due to the revenue declines associated with the end of life for our non-strategic services. We were able to keep gross margins relatively flat by continuing to scale Taegis as the other MSS business descales into . Subscription gross margins including both Taegis and other MSS were 69.4% better than Q3 subscription gross margins of 68.3% with the mix shift to Taegis. Q4 professional services adjusted gross margins of 42.8% were down slightly from Q4 in the prior year. As we continue to focus our professional service offerings on Taegis adjacent services, our professional services revenue now represents only 21% of our total revenue in-line with our revenue mix objectives. Sales and marketing expense in Q4 was similar to the prior year quarter.

The increase to 35% of revenue from 29.9% in Q4 of FY 2022 is due to the change in total revenue associated with the end of life for our non-strategic services. Our investments in sales and marketing have increased our recognition as a leading XDR platform and MDR provider and supported our transition to a partner first model. R&D expense was 29.8% of revenue, up from 22.6% in the fourth quarter of last year. Our changes in investments reflect the launch of integrations, capabilities, and features, align directly to feedback from our partners and customers. Total G&A expense as compared to the prior year Q4 reflects the impact of the benefit realized in Q4 FY 2022 from the timing of expense accruals during FY 2022. G&A was 17% of revenue, up from 12.3% in Q4 last year, which also reflects the decline in revenue affecting the percentage.

Adjusted EBITDA loss was $19.7 million, compared to a $2.1 million gain in prior year Q4. The overall change was driven by a combination of lower gross profits of $8 million and the remainder is related to operating expense items I’ve just discussed. In Q4 of FY 2023, adjusted EBITDA excludes $15.5 million of one-time re-organization costs, consisting primarily of severance and other termination benefits and real estate reduction related expenses. Cash flow provided by operations in Q4 FY 2023 was $6 million, compared with $19 million, provided by operations in prior Q4, which primarily reflects the impact of lower adjusted EBITDA. CapEx was $1 million for the quarter, relatively flat with the prior year. We finished the quarter with a strong balance sheet, a $143.5 million of cash, no debt, and an untapped credit facility.

Turning to our guidance for FY 2024. We expect Taegis ARR to end FY 2024 at $300 million or higher. We expect other MSS ARR to represent approximately 5% of total ARR at the end of FY 2024. We expect full-year total revenue to be $380 million to $400 million with the first quarter revenue of $96 million to $98 million. Keep in mind, we had a 53-week year in FY 2023 compared to 52-weeks in FY 2024. We expect full-year Taegis revenue to be $270 million to $280 million. Taegis subscription gross margins are expected to increase in FY 2024 and beyond. The benefit of that within total gross margin will be offset by the duplicative, fixed, and transition cost as we for our other MSS services. Full-year adjusted EBITDA range is expected to be between negative $29 million to $39 million.

This guidance reflects the following expectations. Sales and marketing as percent of revenue is expected to decline modestly in FY 2024. Our investment in R&D will remain flat as a percentage of the lower revenue base as we continue to lower our engineering support costs for our other MSS business. G&A spend will decline and expect it to remain flat as percentage of revenue year-over-year. Operating expenses in FY 2024 should decrease on an absolute basis as we manage the cost and proportionate to the revenue opportunity. We estimate there is approximately $25 million of duplicative, fixed, and transition related costs that we are incurring with $15 million in cost of revenues and $10 million in OpEx. As we turn down our other MSS services, we will manage the related cost out positively impacting FY 2024 and FY 2025.

As we accelerate the sunset of other MSS and benefit from scale in our Taegis, centric, and go forward business, we expect to be near breakeven EBITDA in the fourth quarter of FY 2024. As we exit this year, our business will have the transition behind us with a path to EBITDA profitability in the following fiscal year. Finally, EPS loss is expected to be in the $0.26 to $0.35 range. In summary, FY 2023 was a year of significant milestones in the company expansion of its Taegis XDR platform and FY 2024 is the year that we will begin to reflect shift in our business mix and growth potential from our go forward business. Wendy will now join us again as we begin Q&A. Operator, can you please introduce the first question?

See also 10 Best Cryptocurrencies to Invest In and Jeff Bezos’ Investment Portfolio.

Q&A Session

Operator: Our first question comes from Saket Kalia from Barclays. Saket, your line is now open. Please go ahead.

Saket Kalia: Okay, great. Hey, it’s Saket from Barclays. Good morning. Thanks for taking my questions here. And Paul, congrats on your next chapter.

Paul Parrish: Thank you.

Wendy Thomas: Good morning, Saket.

Saket Kalia: Sure. Hey, morning, Wendy. Maybe I’ll start with you. You had an example or two of SIM displacements in your prepared remarks. Maybe the question for you, Wendy is, how do you think about the velocity of SIM displacements in the industry right now? And related to that, do you feel like that Taegis is getting enough reference customers here? And cycles are maybe getting a little shorter or at the very least more predictable?

Wendy Thomas: Yes, it’s a great question. I think we’re just at the beginning edge of this opportunity of transition and displacement. I think there’s two questions that we’ve seen with customers as they’re going into this. The first one was, well, is XDR a better solution? What is this? How does it work? And I can talk a little bit about that. And the second one is, how do I transition smoothly with no risk, no gaps, no bad experience for the end user? And so, on the solution front, obviously, as the XDR market is getting much more recognition attraction, sort of third party validation, the elements of better economics, better security effectiveness, and better efficiency of SecOps teams is proven true. Right? Log retention included in the base price of XDR without any surprise, data overage’s, those types of things really hits the economics and predictability, the tune detections and the filtering of noise of Taegis in particular, speaks to the effectiveness and then the embedded orchestration investigation, hunt and response.

And within the workflows really drive the SecOps efficiency. So, I think that part is becoming pretty clear. The second part is where we have a unique advantage. And that’s because we have been re-solutioning customers to Taegis for the last couple of years. And the playbooks, the customer , the eye towards either the end user experience or in the case of MSSPs, their customer experience and we can demonstrate the ways that we make that an incredibly smooth and risk free and good experience transition has played well not just with SIM customers, but particularly with MSSPs who want to make that transition. And that’s where we are uniquely positioned in terms of those referenceable customers and frankly tactics that the customers can get comfortable with.

Saket Kalia: Got it. That makes a lot of sense. Paul, maybe for you. I think you touched on this a little bit at the end of your prepared comments, but just maybe ask the question slightly differently. Can we just talk about how big MSS revenue is expected to be in fiscal 2024? I know we said it’s going to be about 5% of ARR, but just remind us, how big MSS revenue should be here in fiscal 2024? I think it’s primarily going to be Japan. And maybe as part of that, I think you talked about, sort of I think a gross margin, sort of trajectory, right? But if you just look at the gross margins on Taegis versus other or actually if you just look at the gross margins and on Taegis, if MSS were to go to sort of zero right over time, what does that gross margin look like just in the Taegis business?

Paul Parrish: Yes. Thanks for the question. As I pointed out in the prepared remarks, Taegis revenue is going to be $270 million to $280 million for the year. And our overall revenue is $380 million to $400 million. So think of Taegis being about 70% of our overall revenue and our professional services are running somewhere close to 20%, plus or minus a couple of percentages points. And so that leaves the other MSS in that 10% range, plus or minus a couple of percent during the year. And see that ramping down that revenue during the year as non-strategic services and other MSS rolls-off. And gross margins in there, Taegis is running higher than other MSS, but we have the drag on our other MSS of our duplicative services, as well as just the descaling of our other MSS as it rolls toward the tail-end of this.

So, you’re going to see the true impact of our Taegis revenues as we excel out into FY, the following year FY 2025. So, we’re not providing specifically that individual guidance around gross margins between Taegis and other MSS, but see the benefit as we roll into FY 2025 of having Taegis margins.

Saket Kalia: Very helpful. Thanks, guys.

Operator: We have our next question from Mike Cikos from Needham. Mike, your line is now open. Please go ahead.

Mike Cikos: Great. Thanks, guys. And I had a question really first on housekeeping, but can you give us what the MSS customer count and the total subscription customer count was exiting fiscal 2023?

Paul Parrish: Yes. So total customer count is 4,500. Taegis customer count is 2,000. Other MSS is 700, subscription customer is 2,500.

Mike Cikos: Got it. Thank you. Thank you for that. One of the things that I’m trying to back into here, I guess if I look at the 96 million that Taegis just generated, the net new ARR over the course of fiscal 2023, is there a way for us to think about how much of that net new ARR was from migrating existing customers versus landing and addressing new customers that previously weren’t on the SecureWorks platform?

Paul Parrish: Yeah. So, it’s somewhere in that 40-ish percentile was the new logo cross-sell type activity. The re-solutioning side of that 60-ish percentage points, a little bit less than that was re-solutioning as we exited Q4 and we talked about that earlier quarters that that mix was slightly off of that 50-50 that we were projecting for the year, but slightly higher on re-solutioning Q4, but very similar to Q3. And as we project out into FY 2024, we’re seeing 85% of our growth coming from our new logo cross-sell, organic growth. And so, we still have a small portion, mainly Japan to re-solution and that’s going to be what make it about 15% of that growth.

Mike Cikos: Got it. And I think you’ve probably answered my next question already, but I just want to stress test it here. So, if I think about Taegis ARR guidance in the out year expected to be at least 300 million, and we’re seeing €“ which implies at the low-end, $40 million in net new ARR over the course of fiscal 2024, if I compare that 40 million in fiscal 2024 to the 96 million in fiscal 2023, the reason for that delta is really just because we’ve done a good job re-solutioning a large chunk of the customers and really the focus now is going to be much more on landing new logos with Taegis. Is that a fair characterization or is there anything else that I should be thinking through there?

Paul Parrish: You’re right. We’re focused on new customers and cross-selling. Our existing customer is selling more additional features to existing customers.

Mike Cikos: Got it. Got it. And then one more if I could. But on the revenue, I guess, you guys have delivered this outperformance in Q4. If I go back a quarter you guys had said you were expecting about a $1.5 million headwind from FX, can you just remind us, did that $1.5 million essentially play out? Or was there any movement there to think about when trying to diagnose the upside you delivered?

Paul Parrish: Yes, FX actually swung a little bit our favor. It wasn’t the big headwind we expected going into Q4. But it is continuing to blow the directions on FX. So, we don’t see it as a big tailwind coming into this year, but I’m not guessing what FX is doing.

Mike Cikos: Understood. Thank you. I’ll turn it over to my colleagues. Appreciate the color there, Paul.

Paul Parrish: Thanks.

Operator: Our next question comes from Madeline Brooks from Bank of America. Madeline, your line is now open. Please go ahead.

Madeline Brooks: Hi, Wendy and Paul. Good morning. Thanks for taking my questions. Just two here for me. I guess the first is the restructuring and I’m thinking about how we try and reaccelerate growth once the transition is complete? Do you feel comfortable that the staff that you have now, especially from a go to market perspective, will be able to deliver on growth once we do get past some of these economic headwinds? And my second question too is, just a follow-up on the net new customers. Is there any chance that you’re providing, you know, complete net new customers outside of cross-sell? Thank you.

Wendy Thomas: Let me take the first one and then I’ll let you take the second one. So, in terms of the restructuring think about €“ and then I’ll answer the sales kind of headcount. We have essentially two businesses that we are managing through. Obviously, the restructuring is related to the end of life date for our other MSS business outside of Japan, February 3. And so, obviously the staffing and the cost structure related to that, we had a set of restructuring actions related to manage our cost structure down relative to the sunset of many of those lines of business. And we will continue to manage that process as we end this year as Paul said, less than 5% of the ARR on the other MSS revenue line. When you then separate that out, there’s other parts of the business, of course, where we are growing the organization, different set of field sets.

Sales are certainly one of those. One of the key things for us on the sales and marketing side is that we had a number of sales professionals who were focused on re-solutioning. So, not quite a third of our quota-carrying headcount and we transition those at the end of the year again outside of handful in Japan to hunting to new territories where they also can benefit from cross-sell and up-sell opportunities as well, but their primary role is focused on new business from new customers. So, we get sort of a lift, if you will, in terms of from that transition as they ramp their territories, but in total, that’s remaining about the same as it was before the total sales quota-carrying headcount.

Paul Parrish: And then for the split of new logo and cross-sell, we’re thinking about half and half between the new logo’s and cross-sell and that’s how we’re getting our site set for FY 2024.

Madeline Brooks: Great. Thanks so much.

Operator: We currently have no further questions. I would like to hand back to Mr. Toomey for final remarks.

Kevin Toomey: Great. Now that wraps the Q&A and today’s call. A replay of this webcast will be available on our Investor Relations page at secureworks.com along with our Q4 supplemental deck with additional financial tables. Thanks again for joining us today.

Operator: Ladies and gentlemen, this concludes today’s call. You can now disconnect your lines. Thank you.