Good day everyone. My name is Alice and I will be your conference operator today. At this time, I would like to welcome you to the Q3 2026 Rapid 7 earnings call. All lines have been placed on mute to prevent any background noise. After the speaker's remarks, there will be a question and answer session. If you would like to ask a question during this time, and if you have joined via the webinar, please use the raise hand icon, which can be found at the bottom of your webinar application. At this time, I would like to turn the call over to Ryan Flanagan with ICR. Please go ahead.

Thank you, Operator, and good afternoon, everyone. We appreciate you joining us. Today, we'll be discussing Rapid7's third quarter fiscal 2026 financial results. We've distributed our earnings press release over the wire, and it can be accessed on our investor relations website. With me on the call today are Wael Mohamed, CEO, and Rafe Brown, CFO. As a reminder, all participants are in listen-only mode, and a question-and-answer session will follow our opening remarks. Before I hand the call over to Wael, I'd like to remind everyone that certain statements made during this conference call may be considered forward-looking statements under the federal securities laws. These statements are made pursuant to the safe harbor provisions of the Private Securities Litigation Reform Act of 1995 and include, among other things, our outlook for the fourth quarter and full year 2026, our expectations regarding fiscal periods beyond 2026, our transformation and restructuring initiatives and their expected costs and benefits, Our strategy, priorities, and capital allocation, including our evaluation of non-core offerings and plans to repay our convertible notes due in March 2027 and the anticipated financial effects, anticipated operational improvements, investments in our core platform and AI capabilities, including the development, anticipated launch timing, adoption, and expected benefits of new products and AI-first services, including autonomous SOC, and our expected growth drivers and financial performance. These forward looking statements are based on our current expectations and beliefs and information currently available to us. While we believe any forward looking statements we make are reasonable, actual results could differ materially due to a number of risks and uncertainties, including those contained in our filings with the SEC. Reported results should not be considered as indicative of future performance. We do not undertake and expressly disclaim any obligation to update or alter our forward-looking statements, whether as a result of new information, future events, or otherwise, except to the extent required by applicable law. Further information on these forward-looking statements and risk factors are included in the filings we make with the SEC, including the section titled Cautionary Language Concerning Forward-Looking Statements in our earnings press release. Additionally, over the course of this call, we'll reference non-GAAP measures to describe our performance. Please review our earnings press release and filings with the SEC for a rationale behind the use of non-GAAP measures and for full reconciliation of these GAAP to non-GAAP metrics. These documents, in addition to a replay of this call, will be available on the Rapid7 Investor Relations website. Lastly, I'd like to note that Wael's prepared remarks today are being delivered using an AI-generated version of his voice, and he will respond to questions live during Q&A. And with that, I'd like to turn the call over to Wael.

Thank you all for joining. Last quarter, I said the actions we announced were a focused reset. The actions were not the strategy. They gave us focus and room to execute. I also said this would be a multi-quarter journey. Q3 was another step. My read is simple. We delivered what we said. The company is operating with greater focus and discipline. But one quarter of execution is not a return to growth. That work remains ahead. We met our Q3 ARR guidance, and core ARR was flat from Q2. That is an early sign of greater stability. It is not yet growth. We also continue to expect to exit 2026 at approximately 20% non-GAAP operating margin. Rafe will take you through the quarter, the year-end outlook and our balance sheet plan. Last quarter, I asked you to measure us in three ways. First, cash generation. Our cash outlook for the year remains on track, and we are reaffirming our guidance for approximately $130 million of free cash flow. Cash is not the finish line. Durable growth is. But cash tells you whether the operating model is becoming healthier and whether we have the capacity to keep investing. We intend to use cash on hand to retire our convertible notes due in March 2027. I will leave the detailed 2027 framework to Rafe and our normal guidance process. Second, execution in the core, especially exposure management. The major investment choices are made. We continue to support customers across our products while placing new growth investment behind detection and response and exposure management. Thank you for watching. Thank you very much. Thank you very much. In Q3 we took the first step by announcing the end of sale for selected standalone versions. We will continue to support existing customers responsibly and give them clear paths forward. 3. How we reinvest As we enter 2027, we will keep shaping the business around the core. The quarters will not all look the same. We will continue to invest behind growth. But the discipline should remain. Discipline creates capacity. Strategy decides where it goes. One place we are investing is the service layer. Growth starts with winning in our core. The service layer lets us extend that position and deliver the outcome, not only the product. Cybersecurity cannot stop at software that generates more alerts. Customers want continuous monitoring, investigation, validation, response and resolution. This is not a traditional people-heavy service business, and it is not a choice between product and service. Product builds the capability. Intelligence informs it. Service delivers the outcome. Agents provide scale. People remain accountable. We are building an AI-first service model where software, agents, intelligence and experienced security experts come together as one system. People decide, agents do. Transcription by ESO. Translation by — Customers consume the outcome, while automation and agents help our experts serve more customers and complete more work without cost rising one for one with demand. That creates a path to stronger service economics over time. Mel Stone's role matters. As Chief Global Services Officer, she brings our Global Security Operations Center, MDR, service delivery and intelligence under one leader. Our product and technology team builds the platform and agent foundation. Mel's organization turns that capability into a repeatable service outcome. Under MEL, threat intelligence, vulnerability research, attacker research, and labs come together as Rapid7 Intelligence. It closes the loop, turning what we learn into better detections, better service, and better protection. Rapid7 Intelligence is not a standalone product. It is the intelligence engine for the command platform, our service layer, and our autonomous security operations center. Research should not end when it is published. It should end when protection changes. Last quarter, I said AI needs a foundation, not another feature. Today, I want to introduce the next R in Rapid7. Reasoning. The outcome must be resolution. Detection without reasoning creates volume. Response without context creates motion. Resolution creates value. More and more, the next cyberfight will be machine against machine. Defense must move at machine speed, but inside clear human boundaries. At our Boston Customer Summit, we walked customers through the model we are building. 3 colors, 1 mission Red agents probe like an attacker Blue agents investigate and respond like a defender Orange agents reason across both and help guide the safest path to resolution People set the mission, policy, and limits People remain accountable Kenzo is moving from acquisition to adoption. A growing number of customers across our base are now using early Kenzo-powered capabilities, giving us real-world feedback as we build toward our autonomous security operations center. As we design and build it, the Autonomous Security Operations Center is a governed system where people, intelligence, and red, blue, and orange agents work together. The service model is designed for different ways to consume it. Run by Rapid7, operated with the customer, or added as an assurance layer above the customer's own Security Operations Center. One service mission. Different ways to consume it. AI first, vendor neutral and sovereignty aware. The summit was an important checkpoint. We showed what is operating today, what is in proof and what remains ahead. We tested where agents should act, where people must remain involved and what evidence is required to trust the outcome. That work is shaping the capability, the guardrails, and the service model. Based on our current progress, we are working toward our first generally available release around RSAC 2027. We view that as version 1.0. Not the finish line, but the first production step in a long and exciting journey toward increasingly autonomous security operations. We are also working with leading partners across cloud architecture, advanced models, and accelerated computing. Together, we are testing how the system performs before customers depend on it. Measure us across quarters, by our cache generation, by execution in the core, including clear progress in exposure management. Thank you for watching. My commitment remains the same. Clear words, fast action, long-term thinking. And we own the result.

Rafe, over to you. Thank you, Wael, and good afternoon, everyone. As a quick reminder, unless otherwise noted, all numbers except revenue and balance sheet items mentioned during my remarks today are non-GAAP. Please refer to our earnings release and SEC filings for additional details regarding the presentation of our results and guidance metrics. In the third quarter of 2026, I'm pleased to report that we exceeded expectations across all guided metrics. We ended the third quarter with total ARR of $820 million, $8 million above our guidance for the quarter. We reported non-GAAP operating income of $46.2 million. Free cash flow came in at $26.5 million. As of the end of the quarter, we had total cash, cash equivalents, and short-term investments of $732 million. We are particularly pleased with these results as the team remained incredibly focused on our customers and executing against our plan, even as the company undertook a significant restructuring in the quarter. I want to begin by taking a closer look at ARR as of the end of the quarter. As a quick reminder, our long-term strategy is focused on our core platform solutions, comprised of our detection and response business, which includes our managed detection response offering, and our exposure management business. Our core platform solutions now represent approximately 85% of overall ARR, reflecting the gradual mix-shift of our business towards our core products, which on a year-over-year basis grew approximately 1%, led by our detection response business, which at over 55% of total ARR, maintained its growth rate at approximately 5% on a year-over-year basis. Our exposure management business declined approximately 6% year-over-year, offsetting some of the growth of our DNR business. Within the exposure management segment, we continue to see healthy adoption of our exposure command solution as customers upgrade from older vulnerability management solutions. In contrast to the growth of our core solutions, our non-core products, which as a reminder are approximately 15% of total ARR, declined approximately 19% year over year, driving the approximately 2% year over year decline we saw in total ARR. This drop in non-core ARR was in line with our expectations as we have de-emphasized the sales of many of these non-core solutions. As we plan for the remainder of 2026 and beyond, each of the non-core solutions are being carefully evaluated, ensuring we optimize margins as well as seeking opportunities to migrate customers to core platform offerings where possible. Our favorable ARR performance in the third quarter reflects our strategic focus on building and selling our core solutions and focusing our go-to-market efforts on customers within our ICP. This effort, led by our Chief Commercial Officer, Allan Peters, is demonstrating tangible results as we saw productivity per rep show notable improvement over the prior year. Beyond the numbers, we saw demonstrations of this strategy paying off in key wins during the quarter, such as a new logo win from a global facilities management and property support services company who turned to Rapid7 for both MDR and exposure command out of frustration with their incumbent provider for a lack of innovation and limited AI strategy. In Europe, a large religious organization recognized the benefits of consolidating their cyber needs across a single platform and purchased MDR, Exposure Command, and our cybersecurity compliance solution. In a third example, a national U.S. manufacturer came to Rapid7 looking for a provider that could understand its business and security environment and restore confidence in running a managed SOC after a failed prior implementation with a competitor. We positioned our MDR, exposure command and vector command solutions for a comprehensive end-to-end solution. These wins, and more like them, demonstrate our product and go-to-market team's focus on selling our core solutions into our target market. Within the product organization, our new Chief Product and Technology Officer, Dan Deklich, now five months into his role, is making sweeping changes and has started making investments across the product and engineering organization. He's accelerated his investments into our products by rebuilding his leadership team with experienced product and AI leaders, deploying and training the team on a modern AI-focused SDLC, and launching the development of our next-generation solutions. These efforts are core to the anticipated 2027 launch of the AI-enabled solutions needed to address the dramatically more dangerous cyber environment our customers are facing. Returning now to our financial statements. Total revenue of $212.4 million declined approximately 3% year-over-year, reflecting the declines in non-core product ARR we saw earlier this year. We finished the quarter with approximately 11,800 customers and an average ARR per customer of approximately $69,000. Turning to third quarter profitability, we delivered total non-gap gross margins of 72.2%, which we expect to moderate in Q4 and beyond as AWS and AI charges ramp. We reported non-GAAP operating income of $46.2 million, or a margin of 21.7% favorable to our guidance. This upside to profitability drove non-GAAP earnings of $0.60 per diluted share. Free cash flow totaled $26.5 million in the third quarter. Our GAAP financial statements also include a $5.5 million non-cash charge for the full write-down of a minority investment made in a prior year. The charge appears in our GAAP income statements under Other Income and Expense. From a balance sheet perspective, we ended the third quarter with $732 million in cash, cash equivalents, and short-term investments. Combined with our continued free cash flow generation and a $200 million undrawn credit facility, we are well positioned to repay our $600 million convertible notes due in March of 2027. Turning to the restructuring announced last quarter. This restructuring marked a strategic shift in our business operations to drive efficiency and focus across the organization, aligning resources and investments to our core platform solutions. We also created capacity to increase our investments in cutting-edge AI-driven solutions that will improve customer experience and increase competitiveness in the marketplace. As noted above, this investment is underway, but it will continue into 2027 as we build out our leadership and team within the product and engineering organization, as well as ramp AI-related compute costs. Thank you for watching. This brings us to guidance. We expect to end the fourth quarter with ARR of approximately $812 million, and on a sequential basis, we expect that ending ARR for our combined core platform solutions of DNR and exposure management will be approximately flat quarter on quarter, with expected continued sequential ARR decline coming from our non-core offerings. For the fourth quarter, we expect total revenue in the range of $208 to $210 million, a year-on-year decline of approximately 4% at the midpoint. This would bring our full-year 2026 revenue to $841 to $843 million, a decline of approximately 2% at the midpoint, and continuing to reflect the decline in ARR we have seen year-to-date. Fourth quarter non-GAAP operating income is expected to be in a range of $40 to $42 million, even as we have accelerated some product and engineering hires into the quarter. This would bring our full year 2026 non-GAAP operating income to $140 to $142 million, an increase of approximately 4% at the midpoint, or a full year non-GAAP operating margin of 17% at the midpoint. Fourth quarter, non-GAAP earnings per share expected to be in the range of 53 to 55 cents per share on approximately 82.1 million fully diluted shares. We continue to expect free cash flow of approximately $130 million for the full year. To sum up, we executed well in Q3 and are doubling down on our prioritization efforts to invest in and improve our core product offerings, even while we maintain our focus on opportunities for cost management and improved efficiency, all of which gives us confidence in where Rapid7 is headed in its transformation. And with that, I'd like to turn the call over to the operator for Q&A.

We will now move to our question and answer session. If you have joined via the webinar, please use the raised hand icon, which can be found at the bottom of your webinar application. When you are called on, please unmute your line and ask your question. We kindly ask that you limit yourself to one question and one follow up. We will now pause a moment to assemble the queue. Your first question comes from Brian Essex with JP Morgan. Please unmute and ask your question.

Hi, good afternoon, and thank you for taking the question, and congrats on the better results. It's great to see the stability in the operations. I guess maybe to start, well, could you maybe walk us through, I guess, the profile of the sales organization, the changes that you've made there, how it was affected by the restructuring, and do you have the The retention there that you need to build the maturity that's required to put yourself in a better position for growth next year.

Thanks, Brian. Great question. As you are aware, as I mentioned last call, I've been in the board for over a year prior to me taking the CEO job. And I was part of the team that actually did the search and the appointment of Allan. Peters, our CCO. So we actually been working in the background, making sure that we have a sales organization that both stable and it can be able to actually help us through growth. So I feel very good about what we have right now or what Alan's been doing. Prior to me joining as a CEO and been working very closely the last few months as we evaluate the resources, what is the best way to utilize them, and most importantly, as Dan basically catch up with all the great work he's doing on his end, that we'll be ready with the expertise to be able to take that to market. We have a big base of customers. That's really our focus right now, making sure that these customers are served, understand exactly where we're heading. We had actually a customer summit in October where we brought in a sample of our customers here in Boston, around 50 customers from all over the world, to be able to test our story, our roadmap, also get some really frank feedback about where we are and where we're heading. We showed them what we have right now, what we're building, and our vision, and it was extremely positive. It was not only positive for our customers, but it was very positive for our team, and I feel very good about how the team is actually organized right now.

If I could follow up on that too, how does that reflect to what you're seeing in the pipeline? Do you have a building pipeline in your core business right now that gives you confidence in growth next year? Or do you feel like maybe it's reliant on the products that you need to deliver, like what you're planning for RSAC 2027?

That's a great question. And, you know, sometimes the apple to apple is something like this is my first year here. Allan has been a little bit over a year. He feels very good about basically building the pipeline. I think we will always try to be able to put more investment in the area that we believe we can get more return. but the discipline, the skills process he and his management team have put in place, it gives us really a good feeling of confidence that we have the system we need to be able to basically lean on.

Okay, thank you. Very helpful. Thanks so much.

Your next question comes from Mike Kikos at Needham. Please unmute and ask your question.

Hey, thanks for taking the questions here, guys. And I'll look at the comments as far as the stability that you guys are starting to demonstrate here. Wael, if we could just come back to the prepared remarks. Can you just peel back the layers on the services component that you were speaking to as far as what the investments are that are required, how we should be thinking about those initiatives as far as execution and how that's expected to transpire in the model?

Absolutely. One of the great things as I came to the company, I was telling the team the other day, the more I dig, the more gold I find. And we have an abundance of data. And as you know, we're not only providing our product as a software, we provide a service layer in the form of our SOC, where customers entrust us with all the form of data so we can be able to help them define that needle in the haystack. and we've done a very good job servicing plenty of customers that basically we process, I want to say in the tune of maybe 250,000 alerts a day over a terabyte of data that would crunch. And we know that as we move to the agentic layer, this data will be definitely what we need. But one of the things I needed Mike to do is, as I was sitting with my top team, I'm surrounded with an incredible team, Rafe, my CFO, and Alan, my CCO, Dan, our CPTO, and Katie, my chief people officer, I knew that I needed to have another senior person that always think about how we're going to deliver the service layer at a software economics. That's extremely important. And I believe that's the future, not only for our company, but actually in our industry. Cybersecurity wanted to be delivered as a service. There's always a problem how to be able to do that with the right margins. and that's really a major focus to the team. So that's why the addition of Mel, Mel has many years of basically experience in high-scale service delivery in the U.S. military in the command center and bring her to our team and bring that deep expertise and the focus, if you will. So that's basically when you peel the onion, this is the layer that I'm very excited about at the The data fabric, and on top of that, the service layer that we can be able to deliver it as a software economics, if you will.

Excellent. And for the follow-up for you or for Rafe here, but I know that you were talking about the restructuring and how it's freeing up capacity to make additional investments. Some of those investments are obviously already underway. Others expected to begin in calendar 27. Can you help us think a little bit more about... Where those investments are going to be taking place, is it more on product and getting product ready in preparation for RSA, as an example, or is it feet on the street and reorienting the go-to-market? Can you just help us think about those AI-driven investments that you guys are alluding to? Thank you so much.

Yeah, you bet. Thank you. You know, the majority is really within the product and engineering organization. You know, I touched on some of the work Dan's doing, making changes on the leadership level, bringing in new talent to really build this modern AI-enabled SDLC, right? And that's some different players, that's some different leaders, but it's also putting AI to work for us in a lot of ways. So there's certainly an element to that throughout the R&D organization where there's investment on that side of it. But then the products we're talking about here, even if it's Kenzo from the acquisition last year, as we're getting ready to roll that out, but also the new products that Wael has referred to earlier, Both of those take investment from the team. It's people working on them, but it's also the technology and the compute, if you will, the AI-driven compute to make them come to life. And so there is investments going on in that area, but the quick summary is really within the product and engineering is where we're seeing the bulk of it.

Thank you again.

Your next question comes from the line of Eric Heath at KeyBank. Please unmute and ask your question.

Hey, thanks for taking the question while I'm writing. Well, maybe just to ask on the non-core business, if I could, I know you're evaluating some options and thinking about it carefully, but just any further call you can share on how you're thinking about that non-core business, some options, and maybe the timeline you're thinking of when you'd like to be able to come to a resolution on that and and once we get past kind of that decision or that timeline then we could see kind of the growth start to re-accelerate from there.

Thanks, Eric. That's a great question. Look, I always tell my team is actually, as we set the strategy, it's what's harder than basically deciding what to do is deciding what not to do. So the first few months, I spend a lot of time with customers, with partners, with my team, talking to basically some advisors to try to figure out what we have and what we need to be able to focus on and we feel we have a very very strong understanding of the interconnectivity and all the connected issues of our platform and our products so we have a set of what we call non-core Thank you very much. It's a big part of the business that I'm considered a leader. I have the right to be invited and I have the right to win. And I need to put every single dollar of investment behind that so I can get my fair and in some cases my unfair share. The non-core, it is basically a set of products that we do not have the right to win those races. Not because we do not have a good product, but we don't have the size and the invitation to put us in the top three at the selection level. So that's kind of basically the definition. So that phase one was done. The end of sale announced to the customers. We spent a lot of time making sure that these customers understand why we did it. Thank you very much. but we're hoping in a short order we will basically have a better answer for the best way to manage that non-core.

That's great and then quickly one for Rafe, sorry if I missed it but last quarter I believe we were talking about growth and free cash flow dollars in 27 so I'm just curious if that was still the guardrails that you're thinking about. Thank you.

Yeah, thank you. We're going to defer all 27 guidance to our next earnings call.

Your next question comes from the line of Saket Kalia with Barclays. Please unmute and ask your question.

Okay, great. Thanks, guys, for taking the questions here. Wael, maybe for you, just in the core business, it feels like based on the guide for Q4, it feels like the retention rates there might be starting to stabilize or churn, maybe improving set a different way. What do you find is working there?

The focus and the clarity to the team, and you probably saw it from Rafe's script, where you can see the shape of the business is moving from 80-20 approximately last quarter to an 85-15. So our sales team, our sales organization has basically got their marching orders. It's already been moving in the right direction, all hands on deck. Our precious customers, we are basically providing them with clarity, with a roadmap, where we're going to be in the future, and most importantly, how we're making sure that the outcome they're expecting from us is fulfilled and basically get closer. So that focus is really helping, and we feel good about basically our efforts now is moving the needle for sure.

The one thing I would add there is that, as Wael mentioned, the organization has been extremely focused. That move, we've been calling out the last couple quarters more than 80%. I wanted to update people on the current blend. And you also saw the growth rate of our DNR business was the same last quarter to this quarter. So we're feeling like we're pleased with the work the team is doing. That focus paying off, I think, is really helpful.

Yeah, no, it makes a lot of sense. Rafe, maybe if I follow up for you, you know, we mentioned some end-of-life products. I know we're not talking about 2027 again, but just to sort of contextualize, you know, when that end-of-life would start to impact ARR, could you just remind us, what are the products that are going to be end-of-life? When will they be end-of-life? And roughly how much in ARR do they contribute to our labor?

Yeah, thanks, Zach. And just to clarify, because it's hotly detailed around here, it's end of sale. So one of the things that we have in our non-core, non-core is not one thing. It's quite a large range of offerings. But for example, our cloud and our AppSec solutions are, are into sale as standalone solutions, but they are still available when you buy an exposure command solution where they're part of this overall set. And so that's one of the subtle distinctions here. What we want the team to be doing is selling the bundled solutions, if you will, or the combined solutions, because that's where the customer gets much more value, and that's where we differentiate to really stand out. So cloud and AppSec are two pieces in there. Within the threat intelligent, and many more. And so we've announced that it'll take a few months before it becomes official. But even this year, when we look into it, the comp plan was already favoring our core solutions. You know, the comp plan, of course, set back in January. We'll continue that push, right? We can move a lot of it. So it's relatively small number of new sales that were going to these products this past year. We're just going to be real crisp and clear with everybody about our go-to-market efforts, how we focus on that core product solutions.

Makes a ton of sense. Really just simplifies the price list is how I read it. And thanks for clarifying that it's an end of sale and not an end of life.

Your next question comes from the line of Josh Tilton at Wolf Research, LLC. Please unmute and ask your question.

Hey guys, can you hear me? Yes, thanks, Jeff. Awesome. Maybe just two quick ones for me. Rafe, I preface my first question with I really appreciate all the disclosure and the color that you give us into the moving pieces behind ARR, but if you kind of take away, you know, The segments, the categories, what they're called, and we simplify it down here. Are you outperforming ARR more than you did last quarter because things that are good are getting better? Or are you outperforming ARR more this quarter than last quarter because things that have been a drag have been less of a drag?

That's a great question. I think especially if you look relative to our guide, you know, as I called out in the prepared remarks we went into the quarter knowing we're doing this restructuring and knowing that is a tremendous distraction to the team yet we saw the team execute well and it was split frankly between the new booking side of the house it's still not the answer we want a few quarters from now but we did better than we thought we would on new we also had some notable gaps Thank you very much.

Okay, and then maybe just my follow-up. I couldn't help but notice the guidance for Q4 ARR is kind of in line with how you guided this quarter. Maybe signaling aside and all that, what gives you the confidence to guide in a way that kind of makes us feel like we could see the end of ARR declining on a sequential basis?

It wasn't centered around that. I will just tell you straight away. We are calling out that we will see a decline from the 820 that we finished at down to the 812 that we guided to. That said, it's more just the way the math worked out that it happened to be the same number, in all fairness. We go through really exhaustive efforts with the team, with the RevOps team, with the sales leaders to make sure we have just as much visibility as we can about how bookings are going to come in, how renewals are going to come in, to really do our best to form our guidance. And that's the hard work that goes into this to try to do our best and provide insight wherever we can. I did call out in the script that we expect that core will be approximately flat sequentially and non-core will be what pulls the ARR down as we go forward. And frankly, we do expect that pattern is going to continue into the near future that we have visibility to. That's a key element where the business is just as we really focus everybody on core and get these new products out and hope to build growth there. But that non-core drag is going to continue for a little bit.

Makes sense. Thank you, Rafe.

Your next question comes from the line of Shrenik Kathari at Baird. Please unmute and I'll ask your question.

Yeah, thanks a lot for taking my question. So while you had previously highlighted this particularly attractive customer segment of 100k plus opportunity, and today you and Rafe pointed to improving productivity and focusing on this ideal customer profile is beginning to produce these results. just wanted to unpack like how is that actually developing in practice are you seeing these so average deal sizes in that range holding up as you become more more selective and larger proportion of the the new logos coming from from these customers or not then I could follow

Yeah, as I mentioned, when we basically start focusing on the core, we also wanted to tune our ICP and the area that is very natural to us and we have a very, very positive impact. Basically, customer pool. So as we are aligning this, we're feeling good about basically the shape of the business. We're very natural in what they call the heart of the enterprise. Companies that basically want to rely on us to take complex security jobs and simplify provide them with a 724 around the world basically solution that they can be able to digest and ensure that they are basically more secure with us. We see that all the time. We see it even when we When we go and get into a side-by-side with one of our competition, how it's very natural when we are in our ICP that the deal can happen faster and quicker and our value proposition is more clear. So as a team seeing that, I think our shifting is becoming easier and it gives us the confidence to actually put the wood behind the arrow, if you will.

But very helpful, Wael. And Paul, for Rafe, you had previously acknowledged some near-term cloud cost pressures with Kenzo development testing, and today you did mention the stock efficiency is still largely ahead, and Wael also expanded on This AI first service model to allow agents to support more customers without rising costs. I know you plan to provide more formal guidance in the coming quarter around that transition. Just how should we think about the manager and the timing of the transition if we can just highlight the progress there?

Yeah, so I think the best way to think about, you know, the investments that are going on there, they're going to, you know, we're in kind of early stages and we're in a little bit of, frankly, a time where we're developing that next generation or developing those products and solutions, but we still have to provide, you know, good support of our customers as we go through this, right? So, you know, I... We're building efficiencies in, and we'll start to see the fruits of that, we'd like to think, over the course of 2027. Wael mentioned in his prepared remarks, some of the Kinzo infrastructure, we're starting to move customers over that in the earliest stages, getting that up and running. So we're making very nice, tangible progress. But those offerings do a couple things. They They provide better service to the customer and then they're going to also help us build greater efficiencies into our infrastructure.

Thanks a lot.

Your next question comes from the line of Matt Hedberg at RBC. Please unmute and ask your question.

Great. Thanks for taking my question, guys. Just one for me. You know, there was obviously, you know, we all saw the PHP vulnerability a couple weeks ago. You know, I'm just sort of curious. I don't think you mentioned the prepared remarks, but any sort of comment on, you know, how, you know, something like that or other, you know, AI-based vulnerabilities, you know, might become a bit more of a tailwind for your business? Thanks, guys.

Sure. Absolutely. You know what? When I talk to customers every single day, I find myself have to answer those questions and really appreciate the efforts and the work we're doing to make sure that we're ahead. The amount of information we provide them, the partnership that we're doing right now with the Frontier Labs and making sure we're in the front end and working with them so we can basically be prepared. So We're having those conversations all the time and it's top of mind and I'm very excited that some customers actually seek us and ask us what we think and we basically have very constructive conversations about how we assist them.

In this incident, we were prepared, we had the advisory, we had the

Thank you very much.

Your next question comes from the line of Adam Borg at Stifle. Please unmute and ask your question.

Awesome. And thanks so much for taking the question. Maybe while on the changes that we've been making here, how do we think about the progress that you're seeing both in North America and international? Obviously, international is on a much smaller base, but you can see continued growth there with some more pressure in North America. I assume that has to do with some of the mix, but any color on kind of the drivers of the two and then the opportunities that you see. Thanks.

Yeah, for me, I can't wait to basically see international do what I'm used to and what I love. We're making huge progress in the US and I still think there's a lot of room. as we focus in our basically our ICP and our core area. So the team is definitely ultra focused to making sure we have the right investment in the right area and we have the right upside. We have a decent international business. but there is a lot of upside and we are starting to basically plan for next year what is the appropriate investment in what areas where we can basically get some low-hanging fruit and there is a lot of great conversations happening on that front.

Great, thanks again.

Your next question comes from the line of Greg Moskowitz at Mizuho. Please unmute and ask your question.

Great. Thank you very much. Rafe, you mentioned earlier that there was some good news with respect to some accounts that were perceived to be at risk this quarter. Anything that you can share anecdotally in terms of what it was that resulted in these accounts deciding to remain in the fold with Rapid7 as opposed to perhaps going elsewhere?

Yeah, and, you know, I think what I would point to is, like, the team is incredibly focused on making sure we're providing good services to our customers. You know, we have regular calls with the team where we go through all the accounts, you know, and on those calls, you've got Adam and his – no, not Adam. We've got Dan and – and his leaders on the call as well as Allan and his leaders on the call and we're looking at that several quarters ahead. We're just really trying to focus and that tends to be on the more senior level accounts or the bigger accounts but you know that focus of engagement and getting out in front of those accounts if somebody's having some struggles two three quarters before the renewals up gives us the flexibility to get in and make a difference and so you know some of that effort is stuff we started much earlier in the year but we're still meeting as a team on a regular basis where we're all there to rally around and I just think that kind of discipline but also just that focus on customer first makes a difference and you know You don't get them all, but you make a difference to some of those accounts and you're able to satisfy the customer and they appreciate the focus and you can get your rid of them all. Great. Thank you.

Your next question comes from the line of Gray Powell at BTIG. Please unmute and ask your question.

Great. Thanks for taking the question and congratulations on the better than expected results. So I think you may have hit on this already, but I just was hoping to get a little bit more color. So, I mean, it was good to see detection and response AR stable at 5% in Q3. It was growing mid-teens a year ago. So I guess my question is, do you think it can get back to that historical growth rate? What needs to happen? And is it more on the product side? Is it execution or something else that maybe we're not thinking about?

Thank you. It's a great question. And I agree. This segment is growing and we need to do better to actually earn our fair share as we used to do before. I think that the main thing we needed to do and we're already doing is focusing on the ICP where we actually have the highest possibility of winning. As we move sometime, maybe in the ultra large, we basically have some headwind and that basically consumes some of our energy. Now, as we corrected that and going into the sweet spot, where we are designed and we have the right to win, we're seeing a lot of positive, basically, movement in the right direction. So that's the number one thing. As we also start talking to the customers more, as Dave said, we increase our engagement with our current customers basically about the future, the roadmap, what we're believing the future looks like, some of the work we're doing, and the exciting work in the agenting world and the investment we're making. I think that that definitely helped customers to see that not only we can serve them today and we should have our fair share, but we should be the right partner for them tomorrow as well.

That's really helpful. Thank you.

Your next question comes from the line of Joseph Gallo at Jefferies. Please unmute and ask your question.

Hi, this is Grant Darling on for Joe Gallo. Thanks for taking the questions. And I'll ask them as a two-parter. Maybe to start, there's been a lot of rhetoric from platforms in your entrance around expanding capabilities and exposure management. Are you seeing any change in customer buying behavior or sales cycles as that competitive landscape evolves? And then just to go ahead and follow that up, are you seeing any pricing pressure from privates, particularly impacting margins in MDRs?

Very good questions. So in the first part, yes, that was the case in the beginning of the year. And as reality hit, we're finding actually ourselves having more of a cooperative conversations with some of the big platforms and basically as customers realizing that what we do is an adjacent, is not an overlap. and we're seeing less pressure of that as basically more clarity, more engagement with customers, more explaining where we fit and what's our value proposition. We believe we have a pretty strong value proposition and as we engage with the customer, I think that's getting a lot easier. What was the second part? My apologies.

Yeah, just any pricing pressure coming from privates, just kind of when you think about your margins in the MDR, are you seeing anything there? Are things pretty steady?

As I said, our sales team now is focused on the core, and they basically have more of a clear ICP where we have a high level of winning. We have an incredible amount of reference customers. As you know, over 10,000 customers, we have a big scale revenue. When we get in there, I don't think customers really are as price sensitive as you were before. They're more looking for a partner that can address the day and the future. And they're more interested about what is exactly your AI strategy, how are you going to get there, and basically how you can be able to cover me. And what are you thinking about now, the agentic world, and some of the risks associated with it. So we'll find ourselves in the last mile. Talking about that more than talking about price. Got it. Thanks. Very helpful.

Your next question comes from the line of Rudy Kessinger at DA Davidson. Please unmute and ask your question.

Hey, this is Ben Smith on for Rudy. I was going to ask on the standalone products that you're doing end of sale on, have there been any customers that have expressed interest or purchased packages so they can still use those products? And then I had a follow-up.

Yeah, I would first say, you know, that part of the end of sale thing is they can keep utilizing the products, right? We're not taking anything away from them because we're not end of life enough. So, you know, customers can renew existing customers, you know, if they need more, you know, to expand. That's still a thing. So, you know, I think just that subtlety on that end of sale. And keep in mind, a good deal of our customers might... have the other products with us and also these standalone products that we have in the non-core bucket. So, you know, that was a long way of saying, yes, customers are still interested in buying it, the ones that are on many of these products. Got it.

Thanks. And then, yeah, maybe bigger picture, no, you're not giving 2027 color, but I want to ask, do you feel that core is now stabilized and you know what would give you what could you point to that's giving you confidence that that can drive maybe a return to positive ARR growth?

Yeah Look, I think it is nice to see the year-over-year growth rate being the same two quarters in a row, if you will. That's a sign of stabilization. I did call out that we expect it to be roughly flat on a sequential basis. That's clearly not where we want to be, but it's where we are and how we're looking at the numbers. We have confidence so that we can get to return to growth because we're focusing on our core like never before. We've got some really great things in the pipeline for new products that will be in the core, new product offerings and expansion. And just the way that this product team is digging in to focus on those core offerings, I think all of that adds up to a time where you feel better about the direction and the strength of the company and its focus combined with the fact that the world needs our products more than ever because of all the changes in the broader macro. That's what excites us and makes us think that we're sitting on top of an opportunity that's going to take work and it's going to take time, but we think we can turn that into growth down the road.

Excellent. Congrats on the nice quarter.

Thank you.

At this time, we have reached the end of our question and answer session. We thank you all for your questions and you can now disconnect your lines.