SecureWorks Corp. Q3 2023 Earnings Call Transcript

SecureWorks Corp. (NASDAQ:SCWX) Q3 2023 Earnings Call Transcript December 1, 2022

SecureWorks Corp. beats earnings expectations. Reported EPS is $-0.16, expectations were $-0.21.

Operator: Good morning. My name is Bailey and I’ll be your conference operator today. At this time, I would like to welcome everyone to the SecureWorks Third Quarter Fiscal 2023 Financial Results Conference Call. All lines have been placed on mute to prevent any background noise. A supplemental slide presentation to accompany the prepared remarks can be found on the company’s website. After the speakers remarks, there will be a question-and-answer session. . Thank you. At this time, I would like to turn the call over to Kevin Toomey, SecureWorks Vice President of Investor Relations. Mr. Toomey, you may begin your conference.

Kevin Toomey: Thanks, everyone, for joining us. With me this morning are Wendy Thomas, our CEO, and Paul Parrish, our CFO. During this call, unless otherwise indicated, we will reference non-GAAP financial measures. You will find the reconciliations between these GAAP and non-GAAP measures in the press release and presentation posted on our website earlier today. Please also note that all growth percentages refer to year-over-year changes unless otherwise specified. Finally, I’d like to remind you that all statements made during this call that relate to future results and events are forward-looking statements based on current expectations. Actual results and events could differ materially from those projected due to a number of risks and uncertainties, which are discussed in our press release, web deck and SEC filings. We assume no obligation to update our forward-looking statements. Now I’ll turn it over to SecureWorks CEO, Wendy Thomas.

Copyright: daviles / 123RF Stock Photo

Wendy Thomas: Thank you, Kevin. And welcome everyone. I am pleased to report that Taegis ARR grew more than 80% to a record $222 million in the third quarter. We doubled our Taegis customer base over the past 12 months, ending the third quarter with a total of 1,600 customers. Our Taegis ARR and customer count growth rates continue to be among the highest in the XDR and MDR space. And we’ve only just started to scratch the surface of the emerging market opportunity. In addition, our business model transition is accelerating. Taegis represents 65% of our overall subscription ARR and is now expected to be approximately 80% of ARR by the end of this fiscal year. We extended the reach and performance of our platform in the third quarter with the launch of a localized version of the Taegis platform in Japan, a significant step in both the global expansion of Taegis and the strategic repositioning of our business.

Since our initial market entry into Japan nearly a decade ago, we’ve had the privilege of securing some of the most innovative multinational organizations in the world. The launch of Taegis marks the next era for SecureWorks and its customers across the Japan market, bringing access to unified prevention, detection and response in a single, localized and global platform, with an added layer of support available to customers and partners via ManagedXDR. It was an honor for me to meet so many prospects and customers, top companies and their CEOs while in Japan for the launch, as well as to invest time in forging new partnerships. In the short period of time since the launch, we’ve seen great traction with a growing pipeline and key new logo wins.

For example, I spent time with the security leaders of a $9 billion multinational retail company headquartered in Japan. And they were looking to create global consistency and streamlined management of their security operations teams across regions. They selected Taegis to consolidate SOC management of more than 170 business applications and to align global security teams across time zones with the ability to secure regional systems with multiple service providers, the open and collaborative design of Taegis to work seamlessly across global teams and disparate technologies and then they could secure their organization at the speed of their digital transformation. We also recently announced our partner first go-to-market approach. Customers want choice and the ability to work seamlessly with trusted partners and advisors.

Since launching our partner program in mid-2020, we have established strategic relationships within the partner community to support customers’ preferred buying approach and to widen our access to market opportunities. Year to date, more than half of the new Taegis business was sold through partners and the scalability of the Taegis platform and operating efficiency enabled us to deliver growth with a sound partner led business model. So the time was right to take the next step in the evolution of our partner led go-to-market program to capitalize on the momentum in our partner relationships and sales, a milestone we’ve been building towards since we began our journey to a SaaS company. Prospective customers come to us with a consistent set of security pain points.

The need to consolidate sprawling cyber estates, moving away from disparate point solutions that are costly, don’t work together, and overwhelm their short-staffed teams with noisy alerts. The first principles behind the design of the Taegis XDR platform addressed this challenge from the perspective of customers in four areas. An open platform approach that meets them where they are and can evolve seamlessly with their technology transformation, one that provides superior detection and unmatched response to prevent damaging security breaches, all at an industry-leading return on investment. Our results show that SecureWorks is delivering on these priorities. Let me share some of the proof points in the voice of our customers. First, Taegis offers superior detection.

Detection is more than finding everything that poses a threat. It’s about finding the right things, so that the headline is not buried in the noise. Taegis now ingests nearly 550 billion cybersecurity events daily, including events across hundreds of purpose-built integrations. We are able to use these events, combined with our proprietary threat intelligence, to better train our machine learning models to detect known and unknown threats. Our renowned counter threat unit tracks more than 175 active threat groups and handles over 3,000 incident response and adversarial testing engagements annually. The threat intelligence and the hunting and detection techniques distilled from their work are infused into the Taegis platform to accelerate detection efficacy and efficiency.

Year-to-date, Taegis XDR has filtered nearly 99% of point security product alerts, which would have been noise to our customers. This difference was clear in a deal we recently signed with a large auto parts manufacturer who was facing an overwhelming number of alerts from a leading endpoint provider. This company’s security leader had been challenged to improve the level of security visibility and effectiveness to be in a better position to support the constant competitive innovations and new technologies his company was introducing, all while showing cost savings. After a short proof of value deploying Taegis, we were able to quickly show the ability of Taegis to sort the signal from the noise in a way that demonstrated the business case for their teams improved scale and effectiveness.

And the ability of Taegis to work across their OT and IT environment was critical to protecting their revenue and reducing their business risk from ransomware and other attacks. And Taegis regularly finds malicious activity that other products miss, with our unique capabilities to detect threat actor behavior based on our knowledge of threat actors tactics and techniques. For example, Taegis recently identified a business email compromise in a third-party cloud environment and email application where a threat actor was able to steal credentials and create a malicious inbox rule to hide emails from the primary owner. The security controls in the email application and cloud provider did not alert around the compromise of the user nor around the creation of the malicious rules.

The second way our XDR platform solves a key customer pain point is through unmatched response. Our vision remains to automate detection, threat hunting, security investigations, and response actions to the greatest extent possible, always moving the line forward to free up security talent to focus on the things only humans can solve. The SOAR capabilities native to Taegis enable this. And this is not a bolt-on that customers have to build and tune, but rather are designed and curated by our security experts and software developers. Automated response matters so much because the pace required of security has accelerated. The median dwell time for ransomware attacks is about four days compared to 55 days just three years ago. Taegis prevents threat actors from lingering in blind spots, and by enabling rapid response is key to preventing costly breaches.

In third quarter, a multibillion dollar holding company with numerous operating units in the sports and entertainment industry asked us to assess all of their disparate systems to determine if a threat was lingering in their environment. Leveraging the capabilities of Taegis, we demonstrated the value of the speed of visibility of compromise in their environment and its capabilities for automated response actions in real time. With the additional benefit of the ability to access a security expert in less than one minute via the Taegis UI chat feature, the customer subscribed to Taegis XDR to maintain their security posture going forward and added ManagedXDR to complement their team with additional security expertise. Three, we are open without compromise.

Why is this important? Because the one constant in technology is change. And security has to stay ahead of the curve while being a business enabler. Transparency and open interoperability have always been first order principles for Taegis. And this is resonating with our customers and our partners. For example, EDR technology choice is one of the differentiators of Taegis. Unlike with other XDR providers, Taegis customers can leverage leading third party endpoint solutions or our own endpoint agents included natively with pages. But EDR or EDR centric XDR is insufficient for holistic security visibility and effectiveness. Year to date, less than half of the investigations on Taegis leveraged any endpoint telemetry. Point security solutions are no longer the answer to holistic visibility and effective security.

Another important difference in our open without compromise approach is that we designed Taegis to be used collaboratively and transparently across customer teams, our MSSP partners and security experts at SecureWorks. All have the same visibility into the efficacy and actions in the platform, the detection sources, threat context, investigation steps and more, working interoperable in real time. Black box MDR solutions make it difficult for organizations to hold their vendor accountable because it’s opaque as to how they’re making decisions about threats in an environment. You’d never let your investment advisor send you only occasional reports with your returns without access to your underlying investments and trades. Why would anyone except that from their MDR security provider?

Finally, customers choose Taegis for the measurable and superior return on investment. We demonstrate return on security investments across three primary areas. Streamlining of security vendors and spends, the value of uptime of business operations and revenue streams, and the ability to optimize investments in internal security teams. To make this point concrete, we recently won a global aviation manufacturing customer that was looking to reduce their overall risk with a more effective cyber defense program. This customer was able to reduce total direct security spend by approximately $500,000 annually by leveraging Taegis to drastically reduce false positives and by implementing a roadmap to rationalize other vendors and unify their security operations functions.

They had the added benefit of another $1.8 million in reduced cyber insurance and recovery costs, all while demonstrating, for the first time, a security posture protecting all of the 75 product lines driving their revenue. While it’s clear that the market cannot solve security challenges with either people or point solutions alone, the XDR and even MDR markets are still early in the emergent stage, but awareness and momentum are accelerating. A recent study by Forrester showed that 47% of buyers were actively assessing and planning for an XDR implementation, while another 25% were interested, but needed to further research XDR’s capabilities. Taegis XDR is the unification and automation answer to today’s security challenges. But the majority of the market lacks the security expertise to fully manage XDR independently.

We see customers choosing ManagedXDR as the better MDR solution, putting them on a path to achieve the benefits of XDR while addressing their security challenges. With the Taegis platform, SecureWorks and our partners are delivering the most transparent, interoperable and open XDR and MDR solution. Customers will increasingly demand better security at the same or lower total spend levels, with fewer vendors to manage and fewer operational burdens on their team. Taegis is well positioned to accomplish this for customers. As we keep our customers secure and do this at the highest possible ROI for them, our customers and the broader market joining forces with us and thank our teammates for their hard work and commitment to realizing the SecureWorks mission to secure human progress.

With that, I’ll turn the call over to Paul Parrish, our CFO, to discuss our third quarter results and the outlook for the fourth quarter and fiscal year of 2023.

See also 15 Good Stocks To Invest In and Ray Dalio’s Long-Term Stock Picks.

Paul Parrish: Thanks, Wendy. Taegis continues to gain traction year-over-year to end Q3 at $222 million, representing year-over-year growth of 80%. We’ve added 800 customers since Q3 of last year, doubling over the prior year to end the quarter at 1,600 total Taegis customers. Taegis subscription revenue was $47.9 million for the quarter, up 100% year-over-year, and average revenue per Taegis customer was approximately $139,000, up sequentially from $136,000 in Q2 and remains a premium to our non-Taegis revenue per customer, which averages $77,000 per customer. As we continue to grow our new business and resolution other MSS customers on Taegis, we ended the third quarter with 65% of total ARR on Taegis and now see Taegis expanding to nearly 80% of total ARR by the time we exit this fiscal year as we accelerate the transition from non-strategic services to our Taegis-led business model.

On an overall basis, total revenue was $111 million in Q3, which was in our guidance range, despite an approximately $1.5 million FX headwind. Overall, Q3 gross margins at 63.3% were roughly flat from the prior-year Q3. We have been raising our voice and profile in the market this year, with targeted investments in sales and marketing as we reposition the company in the security market. Sales and marketing costs have increased to 35.8% of revenue, up from 25.1% in Q3 of FY 2022 and 33.8% in Q2. We also continue to differentiate our Taegis platform through innovation, working closely with our customers to deliver new features aligned to their security needs. R&D was 29% of revenue, up from 22.8% in the third quarter of last year and 26.7% of revenue in Q2.

G&A expenses were down in dollar terms compared to Q3 of the prior year as we continue to manage G&A in relation to our revenue. Adjusted EBITDA loss was $17.2 million compared to a $4.7 million gain in prior-year Q3. The overall change of $22 million was driven by a combination of reduced other MSS revenue as we actively exit non-strategic services and make targeted investments in support of our growth strategy. Cash flow used by operations in 3Q fiscal 2023 was $27 million compared with $11 million provided by operations in prior-year Q3 and primarily reflects the impact of lower adjusted EBITDA. CapEx was $1 million in the quarter, relatively flat with the prior year. We finished the quarter with a strong balance sheet, $139 million of cash, no debt and an untapped credit facility.

Turning to our guidance for FY 2023. As both Wendy and I detailed earlier, we saw healthy growth in our Taegis solutions, which are helping drive better outcomes for customers on their most urgent security challenges and our business model transformation continues to accelerate. We experienced incremental FX headwinds of $1.5 million in Q3, which assuming it repeats in Q4 will be a total impact of $3 million to revenue for the second half of FY 2023. In addition, non-strategic revenue for our other MSS and other professional services revenues have transitioned slightly faster than previous guidance. Given these combined impacts, we now expect full-year revenue to be in the $456 million to $460 million range. Regarding Taegis ARR, we now expect to end FY 2023 at $245 million or higher, reflecting the longer sell cycles and scrutiny on spending that has occurred with the macroeconomic uncertainty.

We have updated the other MSS ARR component to now end FY 2023 below $65 million. Of the approximately $65 million of ARR remaining at year-end, we continue to expect resolution to be largely complete in FY 2024, enabling us to eliminate duplicative costs to support other MSS platform and services. We are holding our full-year non-GAAP net loss in the $55 million to $59 million range, with EPS loss in the $0.63 to $0.69 range. Additionally, we have narrowed the following guidance ranges from our previous guidance. Full-year adjusted EBITDA in the negative $64 million to $68 million range, which includes our investments in sales and marketing and R&D, reflecting our continued management of spend to revenue. We now expect cash flow and operations to be in the $64 million and $68 million range.

Regarding Q4, we expect revenue of $108 million to $112 million and EPS loss in the $0.24 to $0.28 range. Please recall our fourth quarter of fiscal 2023 contains one extra week this year, worth approximately $8 million of revenue. I expect you have questions around FY 2024. And while we will provide guidance with our fourth quarter results, I will highlight some of our current high level thoughts. We expect ongoing global macroeconomic factors, including slowing economic growth, inflation, rising interest rates and currency pressure to weigh on our customers and, as a result, potentially their security spending intentions. These dynamics are creating a broader range of financial outcomes for our upcoming fiscal year. With what we know today, we will enter next year with a beginning overall quarterly revenue run rate not too different from our exiting Q4 run rate adjusted for the extra week.

We expect Taegis and other MSS to continue to diverge from an overall revenue component perspective as Taegis grows, while we wind down other MSS and non-strategic parts of our professional services portfolio. We are committed to actively managing our costs in proportion to our top line growth. We are making changes to our cost structure to align with our go forward lines of business as we reach the end of life for the majority of the other MSS business in February 2023. In closing, FY 2023 was a year of significant milestones in the company’s expansion of its Taegis XDR platform and the acceleration of our business model transition. And our customers are clear that Taegis XDR is the right answer to address today’s security challenges with an open platform approach that evolves seamlessly with their technology transformation, provides superior detection and unmatched response to prevent damaging security breaches, and does at an industry-leading return on investment.

Wendy will now join us again as we begin Q&A. Operator, can you please introduce the first question?

Operator: The first question comes from the line of Saket Kalia from Barclays.

Saket Kalia: I was wondering if you could just talk about how customers are approaching their MSS engagements in this macro. Clearly, the resolutioning effort there is going well, we mentioned the February 2023 end of life, but I wonder if the macro backdrop is affecting that decision at all to adopt solutions like Taegis, just given the uncertainty around macro and the ease with solutions like MSS. Curious if you have any thoughts.

Wendy Thomas: We definitely see the market shifting, sort of view it as both a challenge that turns into an opportunity for us, in particular given the way Taegis is structured for customers. So what we see is that there are many more consolidation conversations that that we view as an opportunity for us. And that’s in terms of consolidation of vendors where there are elements of Taegis that are inherent features and capabilities that don’t require secondary spend and therefore don’t require secondary management. The other piece is clearly around operational efficiency and being able to create some optionality around their team as they can see through proof of values, the ability for them to drastically reduce the time wasted on sort of false positives and wasted alerts, their ability to optimize their investment in talent, whether through a partner or on their own team, on Taegis is pretty powerful.

So, the environment, while it is not great in terms of a lot of prospects and customers are seeing a budget pressure just across their entire organizational functions, it is an opportunity for us to demonstrate an accelerated roadmap toward towards security savings with higher efficacy that we think Taegis plays into nicely.

Saket Kalia: Paul, maybe for you, a bit of a minutia question. Clearly, the shift to SaaS ARR and away from MSS speaks for itself. But I wonder from a billings and invoicing perspective, as the shift to Taegis continues, can you talk about how that profile changes, if at all, between the two? I’m just curious if that’s different from a billing and invoicing perspective for Taegis versus MSS as we maybe model billings and deferred and cash flow.

Paul Parrish: As you’re describing, as billing becomes simpler, is it better under €“ or Taegis versus MSS? And it is simpler. Our customer is excited about how simple. We present the invoicing now. Our percent collected upfront is better. Now, customers are more willing with a product such as Taegis to pay upfront. And our overall average customer life remained roughly the same on the €“ not the customer life, but the billing term, invoicing term between the two and the contract term, average contract term as disclosed in our 10-Qs, 10-K is roughly two years. So we’re seeing that still play out for Taegis. So, from a back office standpoint, we’re pretty excited about it and customers, how they look at our billings and invoicing, see it simpler and understandable.

Operator: The next question today comes from the line of Mike Cikos from Needham.

Mike Cikos: I wanted to circle up on the ARR guidance here. I know that we’re taking down the Taegis ARR for the year as well as the other MSS ARR. And I know that you guys don’t guide to it on a quarterly basis. We have those annuals, right? But can you provide some additional color for us? How much of the ARR guidance reduction that we’re seeing for both Taegis and other MSS is coming from 3Q not meeting your internal expectations versus what you’re seeing in 4Q versus layering in any additional conservatism when we think about 4Q? Can you help us separate those three buckets as we look at the ARR guidance that we have today?

Paul Parrish: As we laid out the original $265 million for Taegis and we laid that out with our Q2 call and now as we’re positioning at the end of Q3, there is a portion relates to a little bit less performance in Q3. We saw as we ended the €“ toward the tail end of our end of life for other MSS decisions being made, are somewhat being delayed by customers, may end up with some exiting of those customers versus decisions made to resolution or move over to the Taegis product. So there’s a component of this that is made up of our existing customers with a willingness to move, given the dynamics of what’s going on in the economy. FX continues to be an issue and that becomes a component of this. So, it’s roughly $5 million of this $20 million change is FX.

And then, just for new logos, that piece of this equation, which we’re all focused on, we’re growing that piece of the business, we just see that reluctance given what’s going on in the economy, customers delaying decisions. And so, that’s a chunk of this too. And that’s accelerating as we get further into the tail end of this year.

Mike Cikos: Just want to make sure I’m doing the math right and would be interested if you have the metrics handy. But for MSS specifically, so to exit the year, MSS ARR was, call it €“ I’m sorry, to exit the quarter, MSS ARR was around $119 million. So I wanted to sanity check that. And then second, do you have the MSS customer count handy?

Paul Parrish: It’s roughly the same number of customers at end of Q3, 1,600 for other MSS and 1,600 for Taegis. The average revenue per customer for other MSS is $77,000 and for Taegis $139,000.

Operator: The next question today comes from the line of Hamza Fodderwala from Morgan Stanley.

Hamza Fodderwala: Paul, maybe to start with you just as a clarification. I’m sorry if I missed this earlier, but of the guidance cut, could you just clarify how much of that is FX, macro or any other factors that I may have missed?

Paul Parrish: Let’s make sure the guidance you’re referring to are our ARR guidance. That’s what you’re focused on?

Hamza Fodderwala: Yeah.

Paul Parrish: Because on our revenue guidance, the narrowing of the band on that. So ARR, at $245 million. And we have previously said $265 million. We’d exit greater than $265 million. So we’re now $245 million or greater. So, that $20 million reduction, about half of it relates to the existing migration of customers off of other MSS to the product. There’s some delays, some hesitancy, some customers deciding not to from our previous projections. Then there’s FX and put that as maybe $5 million-ish for FX impacts. Because as we know, from what’s going on in the world, FX continues to have some drains in certain geographic areas of the world. And then the last piece of this is our focus on new logos. And we believe we have momentum, but there’s delays caused by what’s going on in the economy. And that’s another $5 million-ish issue of .

Hamza Fodderwala: Makes total sense. And it’s being seen across the board, pretty much everywhere. So on that point, Wendy, just on the budgetary pressures, I’m curious as you talk to customers and/or partners, what sense you get about security budgets for next year? Do you see them still growing at a healthy rate? And is this sort of macro pressure that we’re seeing right now just a function of perhaps projects taking longer or is it outright maybe reductions in security budgets?

Wendy Thomas: I really don’t have a crystal ball. And frankly, a lot of these prospects don’t either. I’ll sort of characterize what we’re seeing right now, which is, interestingly, kind of the pipeline, the front end, the pipeline remains healthy in terms of that growth. The time period of the sales cycle to get to the technical win, the perspective of security teams that they want to make the transition toward a kind of centralized XDR approach, those pieces haven’t moderated. As we talked about last time, and we saw this increasingly this quarter, what we see is, it’s more on the back end of the sales cycle, additional layers of scrutiny. And I think what we’re really seeing in the market now is sort of budget absolutely freezing up kind of right towards the end.

And that reflects, I would say, more uncertainty as different businesses are sort of trying to sort through what their growth opportunities are, and therefore, what they can invest next year. And so, the answer is, I couldn’t say for certain with a great deal of evidence that those budgets are disappearing permanently right now. It feels more like they’re kind of in a holding pattern as they sort out their own broader budgets. But that is where €“ as we lean into sort of the economic calculators of Taegis and help them with roadmaps around vendor consolidation and operational efficiency, that’s the opportunity for us is to really lean into that aspect to give them that visibility to a better answer that’s a better answer for us as well.

Operator: . The next question today comes from the line of Tal Liani from Bank of America.

Madeline Brooks: This is Madeline on for Tal this morning. Just two quick questions for me. The first one, the average Taegis contract going up sequentially to $139,000. Just wondering in terms of the pipeline that you’re seeing and macro deterioration across the board and security, how is that number changing throughout the pipeline? I’m going to have one follow-up question as well.

Wendy Thomas: That number has remained strong and consistent and it is higher on average than a lot of our peers in the space. What we see there is that our approach to total coverage has helped us start with a higher average revenue per customer. And then, as we’ve been increasing the number of modules that the customers take on the platform, we’ve seen our cross sells actually be a bright spot. Our customers who know us and trust us see the opportunity and the risk reduction in their business, have been increasing their existing spend with us. So, we don’t see that moderating materially in the near term relative to our business model. It remains the same.

Madeline Brooks: And that leads me to my next question as well. So, if we just breakout the growth in Taegis, any chance you could break it out between new customer versus upsell and also how you’re thinking about modeling that out for next year as well?

Paul Parrish: As we’ve referred to in the past, the upsell on existing customers moving over have been in that 20-percent-ish range. So, we get 20% more from customers when they move from the other MSS to Taegis, and those numbers are continuing to hold. And as we continue to work our way through that bottom half or bottom end of this, portion of that other MSS is moving, of course, that’s always the hardest part of the move, the tail end, but we don’t see a dynamic playing out any different than we’ve already talked about. So, it’s playing out the same way. So, we haven’t put together our full thoughts here on next year, but we still see it playing out, at least for this year and into next year, playing out the same way. And then, as we look at the average between resolutioning and what’s coming from new logo, we’ve talked about, it’s slightly heavy to the customers moving from other MSS to Taegis right now versus new logo.

But we’re focused on that new logo being the go forward and the growth areas of business.

Wendy Thomas: And as we finish the resolutioning, not quite done-done, but largely complete outside of Japan at the end of this fiscal year, the account executives who have been working those customer transitions turn towards €“ actually, they already have new territories to start to build pipeline there. So that is part of that transition, is just a focus shift for experienced Taegis sellers to move towards new patches as opposed to moving existing customers. So that mix will shift as we head into next year.

Operator: Thank you. There are no further questions at this time. Mr. Toomey, I turn the call back over to you.

Kevin Toomey : Okay, thank you. That wraps the Q&A and today’s call. A replay of this webcast will be available on our Investor Relations page at secureworks.com along with our Q3 web deck and additional financial tables. Thanks again for joining us today.

Operator: This concludes today’s conference call. You may now disconnect your lines.