SecureWorks Corp (SCWX) Q2 2023 Earnings Call Transcript

SecureWorks Corp (NASDAQ: SCWX) Q2 2023 earnings call dated Sep. 01, 2022

Corporate Participants:

Paul Parrish — Chief Financial Officer

Wendy Thomas — President and Chief Executive Officer

Analysts:

Mike Cikos — Needham — Analyst

Hamza Fodderwala — Morgan Stanley — Analyst

Presentation:

Operator

Hello, and welcome to today’s Secureworks Second Quarter Fiscal 2023 Earnings Conference Call. My name is Bailey, and I’ll be your moderator for today’s call. All lines will be muted during the presentation portion of the call with an opportunity for questions-and-answers at the end. [Operator Instructions]

I would now like to pass the conference over to today’s host, Paul Parrish, CFO. Please go ahead when you’re ready.

Paul Parrish — Chief Financial Officer

Thanks, everyone for joining us. With me this morning is Wendy Thomas, our CEO. During this call, unless otherwise indicated, we will reference non-GAAP financial measures. You will find the reconciliations between these GAAP and non-GAAP measures in the press release and presentation posted on our website earlier today. Please also note that all growth percentages refer to year-over-year changes unless otherwise specified.

Finally, I’d like to remind you that all statements made during this call that relate to future results and events are forward-looking statements based on current expectations. Actual results and events could differ materially from those projected due to a number of risks and uncertainties, which are discussed in our press release, web deck and SEC filings. We assume no obligation to update our forward-looking statements.

Now I’ll turn it over to Wendy.

Wendy Thomas — President and Chief Executive Officer

Thank you, Paul, and welcome everyone. Our transformation into a leading XDR solution provider with a strong recurring revenue model is accelerating. I’m pleased to report that we crossed the $200 million mark in Taegis ARR in the second quarter. Taegis ARR reached the $100 million milestone 10 quarters after launch. And now just four quarters later, we’ve doubled to $200 million. Taegis ARR and customer count numbers continue to put us among the fastest growth rates in the industry with triple-digit growth in both areas, reflecting the addition of 800 customers since 2Q of last year to a total of 1,500 Taegis customers.

In terms of our business model transition, Taegis now represents 56% of our overall subscription ARR. And we remain on track for Taegis to be approximately 75% of ARR by the end of this fiscal year. So why is Secureworks approach to XDR resonating in the market? Our Taegis platform is unique in four ways, one, superior detection, which means accuracy and speed with complete attack surface visibility and applicability. We ingest more than 486 billion events daily, including events across more than 100 integrations, which we enrich with industry-leading threat intelligence and 10s of 1000s of expert curated signatures.

Across our current customer implementations, 60% of the data we ingest through Taegis comes from sources other than endpoints. This speaks loudly to the value and economy of Taegis XDR that combines data from endpoints with data from cloud environments, e-mail, network, identity systems, business applications and more. We leveraged 27 petabytes of diverse data with our machine-learning models combined with industry-leading threat intelligence to produce best-in-class detection speed and efficacy. And we have a growing suite of proprietary advanced detectors like our Hands-on-Keyboard Detector that was trained on more than three trillion events.

Using the power of machine learning, this detector recently identified a malicious post-exploit activity with an initial access vector never seen before. It’s a perfect example of where we focus on machine learning research on the new techniques, tactics and procedures where we do not yet have deployable threat intelligence or signatures but that can be deployed with a high signal-to-noise ratio. For customers, this means we only alert when it matters, leading to a significant savings of valuable SecOps resources when leveraging Taegis.

In short, Taegis lowers our customers’ risk across their enterprise at a lower total cost of ownership delivering the highest return on investment. Two, unmatched response. The second way our XDR platform is unique is the SOAR capabilities native to Taegis provide one, rapid and automated high security value response actions, things like host isolation or automated re-authentication prompts. And two, orchestrated workflows that quickly kick off customer remediation workstreams made easier with out-of-the-box integrations with providers like ServiceNow, Zendesk, PagerDuty, Jira and many others, maximizing efficiencies for our customers.

It also means live access in under a minute to an expert stock analyst via the live chat feature in our Taegis UI. We believe we lead the industry in speed and quality of response with the fastest time to detect, label, notify and investigate among XDR providers. Three, we are open without compromise. Transparency and open interoperability have always been first-order principles for Taegis. Our platform was built from the ground up to integrate market-leading technologies and deliver incremental security value on day one. It’s not about raw data aggregation. It’s value delivered through actionable security relevant insights.

And Secureworks is committed to rapidly expanding integrations for Taegis with market-leading technologies. So our customers get better, more comprehensive detection with less time and effort to get to security value. For example, with the recent additions of Netskope and SCADAfence to our technology alliance partnership, we’ve expanded the reach of Taegis’ Open XDR to include additional solution areas being used by our customers including SASE, CASB and OT. We don’t approach these partnerships as simple data exchange projects. Instead, we do so from our rich heritage and long experience running security operation centers, where data from each source must work in concert to provide incremental security value.

And one last important point on our approach to being open without compromise. Taegis customers use the same UI as our security experts, which enables seamless collaboration and rich context for security events, allowing us to work with customers of any scale and security depth. And finally, Taegis is priced for predictability and clear value for customers. Taegis is priced on a per endpoint basis with no hidden data overage charges providing customers with predictability of spend. And for an easily comparable per endpoint price, we provide more covering a customer’s entire security estate, including endpoint with an industry-leading one year of data retention as our standard offering. That’s far beyond the typical 30 days that other XDR and EDR solutions include natively, largely because their data architecture was not designed to scale to big data in addition to fast data.

How can we do this at scalable margins, our data architecture. The security operations use cases we’ve experienced over decades have informed the unique data architecture that gives Taegis a powerful competitive advantage in terms of speed, scale and security value. Evidence of this unique approach to data includes superior data labeling and normalization to feed higher fidelity detections and filter out noisy alerts. We optimize our approach to streaming for real-time versus batch processing in support of detection analytics and machine learning use cases. This allows us to develop new detectors quickly to prove out their security value, while providing industry-leading time to detection for our most sophisticated analytics.

We also optimize our use of search designed for speed when warranted and for cost efficiency for longer-term storage and retrieval. Innovations like these drawn directly from our security expertise enable us to price our solution on a predictable per endpoint basis, while still supporting a full spectrum of other cloud network and business system telemetry with more favorable data retention options and scalable margins, a distinct market advantage. In addition to more customers seeking XDR, we are seeing customers displace their SIEMs for XDR. While the SIEM market is worth close to $5 billion, we increasingly hear from prospective customers that their SIEMs are essentially noise engines, they’re ineffective and expensive.

A recent new customer win selected Secureworks over their SIEM for the following key reasons. First, predictable endpoint pricing versus their SIEMs data volume-driven pricing, which disincented them from securing their entire environment. Taegis’ standard 12-month data retention was key to this customer’s threat hunting objectives. And they gained value from the incident response built into the Taegis offering rather than requiring incremental investments in talent. And while the endpoint detection and response market is $9 billion and growing, we’ve heard from prospective customers and we know from our XDR visibility that EDR alone misses much of a threat.

We recently alerted one customer to an exploited Confluence Server monitored by a third-party EDR product where the threat actor ended up downloading scripts and running cryptominers. Yet, there were no native EDR alerts, but we detected the activity with Taegis XDR from the native EDR source telemetry. We also saw the same exploit on a different server from that customer’s DNS logs, where there was new [Phonetic] agent installed, demonstrating the real power of XDR. When customers have XDR deployed across the enterprise, it’s common for our threat intelligence to flag network traffic to command and control addresses and then be able to tie that back to the endpoint being exploited.

While maintaining 100% visibility of the entire enterprise is always a challenge, with XDR, our customers are more likely to gain early visibility into a part of the kill chain to enable them to quickly take action. With the Taegis platform, Secureworks is delivering the most transparent, interoperable and Open XDR solution with EDR natively included. The adversary will not get complacent and neither will we. This past quarter, we’ve been joined by Mike Aiello as Chief Technology Officer of Secureworks. With more than 20 years in security, Mike is shaping the next horizon for Taegis and bringing his customer and industry experience to our leadership team.

Prior to Secureworks, Mike was the Chief Product Officer for HUMAN Security. And prior to that served as the CEO of AppGate, the Product Management Director for Google Cloud Security, and as the Chief Information Security Officer for Goldman Sachs Consumer and Commercial Bank. We are bringing the best of everything to the table, decades of security operations experience, and open and interoperable XDR platform with a unique data architecture and the best security talent the industry has to offer.

Today’s markets are turbulent, driven, shaped and reshaped by many forces, but we remain focused on keeping our customers secure on defining the future of threat detection and analysis and on driving superior long-term and sustainable growth and value creation for investors as we execute on our strategy and complete our transformation as an industry-leading XDR provider. I want to thank our customers and partners for joining forces with us and thank our teammates for their hard work and commitment to realizing Secureworks’ mission to secure human progress.

With that, I’ll turn the call over to Paul Parrish, our CFO.

Paul Parrish — Chief Financial Officer

Thanks, Wendy. Taegis continues to gain traction in the market. ARR increased $100 million year-over-year to end Q2 at $201 million, another triple-digit growth rate over prior year Q2. We’ve added 800 customers since Q2 of last year, up 114% over the prior year to end the quarter at 1,500 total Taegis customers. Taegis subscription revenue was $42.8 million for the quarter, up 131% year-over-year. And average revenue per Taegis customer was approximately $136,000, up sequentially from $130,000 in Q1 and remaining a premium to our non-Taegis customer revenue, which averages $85,000 per customer.

As we continue to resolution customers and grow new business on the platform, we ended the second quarter with 56% of total ARR on Taegis. We continue to see Taegis expanding to about three quarters of total ARR by the time we exit this fiscal year as we continue transitioning from non-strategic services to our Taegis-led business model. On an overall basis, total revenue was $116 million in Q2, which was consistent with our expectations despite an approximately $3 million FX headwind. We continue to scale our cost structure and benefit from our Taegis-led solution mix shift. Overall, Q2 gross margins expanded from prior year Q2 to 61.3%.

As we continue raising our voice and profile in the market with targeted investments in sales and marketing, sales and marketing costs have increased to 33.8% of revenue, up from 25.1% in Q2 of FY ’22 and 31.1% in Q1. We also continue working closely with our customers to innovate and deliver new features that align with their strategic priorities and our development roadmap, further differentiating Taegis in a fast-growing market. Accordingly, R&D has increased to 26.7% of revenue, up from 21.5% of revenue in the second quarter of last year and 25.3% of revenue in Q1. G&A expenses were slightly down in dollars compared to Q2 of the prior year on lower employee-related expenses, professional service and consulting-related costs.

Adjusted EBITDA loss was $14.3 million compared to a $3.6 million gain in prior year Q2. The overall swing of $18 million was driven by a combination of reduced revenue and gross profit as we actively exited non-strategic lower-margin services and continued investments focused on our long-term growth strategy. Cash flow used by operations in 2Q fiscal 2023 was $17 million compared with $17 million provided by operations in prior year Q2. Capex was $2 million for the quarter, relatively flat with the prior year. We finished the quarter with a strong balance sheet, $167 million of cash, no debt and an untapped credit facility.

Turning to our guidance for FY ’23, as both Wendy and I detailed earlier, we saw healthy growth in our Taegis solutions, which are helping drive better outcomes for customers on their most urgent security challenges and our business model transformation continues to accelerate. In midst of this progress, the strength of the dollar has resulted in FX headwinds and we expect to see a lower level of professional services revenue than reflected in our previous guidance. Given these dynamics, we now expect full-year revenue to be in the $458 million to $465 million range, with FX impacting around 50% of the change in guidance and the remaining reduction primarily driven by lower professional services.

Taegis ARR guidance remains unchanged. We continue to expect Taegis ARR to end FY ’23 at $265 million or higher, organic growth to contribute approximately $50 million of the incremental Taegis ARR, sales should accelerate through the second half as we get the full benefit of our first half investments carrying through to FY ’24 and beyond. We’re accelerating investments in global awareness and global distribution with the returns expected to be more meaningful in the back half of the year and into FY ’24. We have updated the other MSS ARR component to now end FY ’23 below $70 million. Of the approximately $70 million of ARR remaining at year-end, we continue to expect resolution to be largely complete in FY ’24, enable us to eliminate duplicative costs to support CTP platform and services.

Additionally, we have narrowed the following guidance ranges from our previous guidance. Full-year non-GAAP net loss to be in the $55 million to $59 million range, with full-year EPS loss in the $0.64 to $0.70 range. Full-year adjusted EBITDA in the negative $63 million to $68 million range, which includes our investments in sales and marketing and R&D, reflecting our continued management of spend to revenue and cash flow used in operations in the $60 million and $65 million range. Regarding Q3, we expect revenue of $111 million to $113 million and an EPS loss in the $0.20 to $0.22 range.

In closing, FY ’23 continues to be an inflection point in the Company’s transition as we shed non-strategic services and complete the resolutioning of our base to Taegis with a significant majority of customers completing that transition by FY ’23 year-end. We are optimistic about our unique opportunity to capture XDR spend with our Taegis solutions while helping customers consolidate their security budgets to drive better efficiency of their spend. We’re making consistent progress against our transformation with continued improvement in our business mix and growth potential.

Wendy will now join us again as we begin Q&A. Operator, can you please introduce the first question.

Questions and Answers:

Operator

Thank you. The first question for today’s call comes from the line of Mike Cikos from Needham. Please go ahead. Your line is now open.

Mike Cikos — Needham — Analyst

Hi, guys. Thanks for getting me on and thanks for all the color. I do appreciate it. I wanted to ask about the fiscal ’23 revenue guidance reduction that we’re seeing today. And just for clarity here, so you guys in Q2 came in line with your revenue guide despite the $3 million FX headwind. Can you remind us, I guess what was management anticipating in Q2 from an FX perspective just to see whether — how much of a headwind it was versus what you guys previously assumed?

Paul Parrish — Chief Financial Officer

Yeah. So currencies moved, primarily Japan and British pound, a large part in Q2. So as we entered into that quarter, we were looking at similar FX rates to what we saw at year-end at the end of first quarter. So we didn’t have a lot of FX impact in Q2 as we gave guidance.

Mike Cikos — Needham — Analyst

Okay, okay. And as I think about — I’m looking at the full-year revenue guide today. So I think at the midpoint, we’re taking down full-year revenues by about $21 million. And I just want to make sure I’m clear here. So we’re saying that 50% of that cut is tied — sorry, go ahead. I don’t want to keep going on top of you.

Paul Parrish — Chief Financial Officer

That’s correct. $21 million cut and roughly 50% is from FX [Phonetic].

Mike Cikos — Needham — Analyst

Right. 50% from FX. And can you explain to me the remainder coming from lower professional services? I just wanted to make sure I understood what was the driver behind that lower demand for that PS?

Paul Parrish — Chief Financial Officer

Yeah. So as we took a look at the growth in our strategic professional services for this year, we saw a trend up as we put together our guidance, we, of course, in our professional services have what we refer to as non-strategic that’s coming down and the growth pattern there is not developing at the rate that we saw in the guidance. And so that’s why we’re bringing down the professional services side of that.

Mike Cikos — Needham — Analyst

Okay, okay. And then just one more, if I could. Wanted to see, can we get any color on what the total customer base was for MSS or the Company’s total subscription customer base? I know that we cited the 1,500 customers for Taegis today. I just wanted to see how quickly customers are migrating or what that MSS base is like as we stand at the end of this quarter?

Paul Parrish — Chief Financial Officer

Yeah. So as you’ll find when you get our Q, it will be 1,900 other MSS customers and combined, we’ve got a total of 3,100 customers.

Mike Cikos — Needham — Analyst

Terrific. Thank you very much. I’ll turn it over to my colleagues. Appreciate it.

Operator

Thank you. The final question for today’s call comes from the line of Hamza Fodderwala from Morgan Stanley. Please go ahead. Your line is now open.

Hamza Fodderwala — Morgan Stanley — Analyst

Great. Thank you for taking my question, and good morning, everyone. Wendy, maybe a couple of questions for you. A lot of really great detail on the XDR offering. It seems like you’re really ingesting a lot of threat telemetry from a variety of different vectors. I’m just curious around just general market awareness around XDR. It does seem like there’s a lot of marketing out there, yet bottlelogs [Phonetic] are still coming through these traditional SIEMs. So what would you attribute that to? Do you think there’s just a lot of fudge [Phonetic] in the marketplace, if you will, and customers will start to understand this technology better as the education of this starts to increase, or is this something that will take time for customers to fully migrate their security analytics approaches towards XDR?

Wendy Thomas — President and Chief Executive Officer

Yeah, it’s a great question. Because if you look at really MDR and XDR, they’re still fairly early in the proverbial hype cycle, if you will. So there’s a combination of stage of length of time and market and therefore, awareness is growing, but nowhere close to what it is for more mature established markets like SIEM or such. There’s a couple of things that we look to, to see the movement in customer awareness or prospect awareness of what XDR and MDR really mean.

And one of those is that the content of RFPs actually naming XDR or MDR instead of SIEM or MSSP or those types of things. So that’s a good indicator for us that the awareness is growing. And the second is that we see the customers or prospects joining things like our webinars about how to actually make an easy transition from a SIEM to XDR being one of our most subscribed sets of content.

So there’s definitely now awareness that it is an opportunity in security. I think people are very much in the investigation mode. And when you show them what it means in terms of effectiveness of security, lower cost to implement, maintain and manage, the case is getting pretty compelling. And so we are seeing now more customer shifts — customer acquisition shifts from SIEM, in fact, displacing multiple SIEMs in a lot of cases to Taegis. So it’s on its journey.

Hamza Fodderwala — Morgan Stanley — Analyst

Got it. Got it. And I was wondering if you could just speak around the demand environment. Obviously, I could see Taegis is doing quite well. I think Paul did mention maybe a little bit lower demand for some of the non-strategic services. We’ve heard from a number of security companies that there were instances of longer sales cycles, particularly midway through Q2. So just curious what you’re seeing and maybe what contributed to that lower demand for the non-strategic portion of the business?

Wendy Thomas — President and Chief Executive Officer

Sure. I’ll actually separate those two a bit. I mean it is our goal to accelerate the transition of the business to shorten that tail, if you will, and to move some of those service — non-strategic services to partners more quickly while resolutioning the core business to Taegis. So that is not necessarily a bad thing from our seat [Phonetic]. In terms of sales cycles for Taegis generally, I think we’ve seen a similar impact from the market, which is you sort of look at the beginning of pipeline, healthy, good quality, the time cycle to what we call the technical win, we don’t see really being impacted.

What we see is the timeline from technical win to commercial close, that’s where we do see a lengthening in the cycle. And there’s really two factors typically we see contributing to that. One is additional layers, if you will, of either procurement or even C-suite review of deals or needing to sign off on things. I think there’s some tighter controls around budgets generally. And the second one is sometimes there’s turnover in the prospect as the deal is coming to a close and that can pause the process for a bit of a reeducation and a restart. So those are really the two things, turnover and extra scrutiny on the procurement side.

Hamza Fodderwala — Morgan Stanley — Analyst

Got it. Very clear. Thank you.

Wendy Thomas — President and Chief Executive Officer

Thank you.

Operator

Thank you. We now have a follow-up question from Mike Cikos from Needham. Please go ahead.

Mike Cikos — Needham — Analyst

Hey guys, thanks, thanks for getting me back. And I appreciate the fact that me and Hamza are just playing ping pong here. But on the customer count, I just — I did want to come back to it. And I just want to hear your sense on the philosophy or the strategy, right? So if I’m thinking about the total customer count for MSS today, we’re still seeing those declines, we’re down to about 1,900 customers. Taegis customers are ramping, but on an aggregate basis, Taegis’ total subscription customers are still leaking lower. And I just wanted to see, can you provide us any color you have that offers conviction or confidence in the strategy as far as being able to attack a larger market opportunity or attract more customers to the Secureworks platform longer-term?

Wendy Thomas — President and Chief Executive Officer

Sure. It’s a good question. The — let me talk a little bit about the average revenue per, because the demographic of the customer base is part of the answer on the customer count. So if you look at the Taegis platform, we are specifically targeting customers who are a minimum of 500 endpoints or more. That was not necessarily our approach with the MSSP business. And if you look at the number of customers that were turned from MSSP as opposed to transitioning to Taegis, they’ve been averaging — and this is not just this quarter, but through the process on less than $30,000 per.

So there really aren’t all ready to — or have the capacity or willingness to spend the minimum amount for MDR, XDR coverage. So there is some shift in the customers that make sense for the Taegis platform. And you see that in the average across all of the MSSP customers in the mid-80s as Paul talked about and on Taegis being in the $130,000 range. So we’re definitely targeting up market, up margin and customers who have the ability to expand with us in the future as well. So there is a mix shift in terms of the size that you’re seeing in the count and the average revenue.

Mike Cikos — Needham — Analyst

Got it. Thank you for that. And last one on my side. But just coming back to the gross margins for this quarter. I know that we had a slight uptick when looking from a year-on-year basis, but it did leak lower from, call it, like 63% to 64% range, we’ve been in over the last two quarters to three quarters. And I just wanted to see at least on a sequential basis, what caused that degradation and how should we be thinking about gross margins for the rest of the year? Thank you.

Paul Parrish — Chief Financial Officer

Yeah. So — yeah, so as we talked about the year, this is the transformation year, and so we’ll have certain costs coming in as we’re managing the cost in proportion to that revenue mix as we bring down the older CTP to the going — Taegis going forward. So it will be certain quarters impacted for some of those costs. So this quarter, gross margins were impacted some of those costs.

Mike Cikos — Needham — Analyst

I see. So really just a function of the revenue mix shift that’s taking place as well as some of the pressures with the cost versus the shrinking revenue base in aggregate?

Paul Parrish — Chief Financial Officer

Yes.

Wendy Thomas — President and Chief Executive Officer

Right. So as you see, Taegis continuing to expand, you start to get squeezed a bit as you come to the tail end of the CTP platform, and then that overhang, clearly, we’ve talked before about the $30 million, well, $15 million in COGS, $15 million in opex, so sort of fixed costs on CTP that were sort of duplicatively swallowing this year. And as we head into next year and get through the ARR transition, we will see that improvement in cost structure both on the opex and the gross margin side as the CTP overhang comes out.

Mike Cikos — Needham — Analyst

Perfect, terrific. Thanks. Makes a lot of sense, and I appreciate all the extra detail. Thank you, guys.

Wendy Thomas — President and Chief Executive Officer

Yeah. Thanks for the questions, Mike.

Operator

Thank you. There are no further questions registered at this time. So I’d like to pass the conference back over to Paul Parrish for closing remarks.

Paul Parrish — Chief Financial Officer

Okay. That wraps up the Q&A and today’s call. A replay of this webcast will be available on our Investor Relations page at secureworks.com, along with our Q2 web deck with additional financial tables. Thanks again for joining us today. Have a good day.

Wendy Thomas — President and Chief Executive Officer

Thank you.

Operator

[Operator Closing Remarks]