Rapid7 (NASDAQ:RPD) is a cash-rich, debt-free, fast-growing cybersecurity firm that is heavily exposed to the market for small businesses all the way up to larger enterprises and government sectors. The company derives roughly 90% of its revenue from its Nexpose software, a vulnerability management (VM) tool. IT professionals and cybersecurity auditors license the product to measure a client’s networks and systems exposure to cybersecurity vulnerabilities. RPD’s core product utilizes an annual subscription model with 90% retention rates reported in the last three quarters. RPD’s stock sold off after reporting a delay in several government contracts following its most recent earnings report.
RPD was founded in 2000 and went public in July of '15 at $16/share. The stock soared nearly 70% on its first day and reached a high of $27.50/share as a result of cybersecurity investment mania. Original venture investors Technology Crossover Ventures and Bain Capital Ventures each own slightly over 20% of RPD’s common stock. Neither VC investor sold shares in the IPO or since. In fact, Crossover purchased additional shares on the IPO at $16/share. RAM purchased shares in the $12 to $12.50 range with the added margin of safety that revenues grew 40% since the IPO.
Our RPD investment thesis is straightforward: M&A in the cybersecurity software space has been completed at 4x and greater revenue multiples with similar growth rates, while our RPD purchase was struck at roughly 2x enterprise value to revenue. Symantec’s (NASDAQ:SYMC) just announced purchase of LifeLock was done at 3.4x revenue and has an expected '17 growth rate of only 12%. RPD’s estimated ’17 growth rate is 23%.
The company is expected to generate cash in ’17 which begins to ramp in ’18 thereby maintaining its cash-rich, debt-free, balance sheet. Free cash flow is not the primary metric to consider when you have a company growing over 20% annually, coupled with a 90% retention rate on those software license revenues. The company is correctly focused on growing its subscription revenues while not jeopardizing its balance sheet.
Where did we find Rapid7? We asked to sit down with our firm’s long-time IT consultant, Alexander Chamandy of Envescent, to discuss his business, the products he uses and the ones he views as possessing a particularly strong competitive position. This meeting took place several months ago, and at that time, we identified two companies that met our criteria with the exception of price. When RPD’s sell-off occurred from the noted delay in anticipated government contracts in the fourth quarter, we were at the ready with capital. Alexander methodically walked us through why Nexpose is such a desirable product for the SMB IT marketplace, and his arguments were quite convincing. The company’s sales growth trajectory would certainly indicate it’s doing something right.
We feel fortunate to have gotten access to a fast-grower at a modest price. With over $200 million in revenue, we believe the company is well situated to provide cutting-edge upgrades to its now large installed base of customers or be acquired by a larger cybersecurity firm looking to build out its suite of security software.
Disclosure: I am/we are long RPD.
I wrote this article myself, and it expresses my own opinions. I am not receiving compensation for it. I have no business relationship with any company whose stock is mentioned in this article.
Additional disclosure: The specific security identified and described does not represent all of the securities purchased, sold, or recommended, and the reader should not assume that investment in the security identified and discussed was or will be profitable.