Rapid7: Comprehensive And Top-Of-Mind Offering

Summary

• Despite the slowdown in 2020, the comprehensive offering will reaccelerate growth to +30%.
• Metasploit remains a hidden asset that will consistently drive long-term awareness.
• Given the profitability and cash-flow-positive guidance in Q4 and 2021, Rapid7 is undervalued at ~7x P/S.

Overview

We maintain our overweight position in Rapid7 (NASDAQ:RPD). In our most recent coverage about Rapid7 last December, we highlighted the company's strong growth in its VRM (Vulnerability Risk Management) business and its open-source Metasploit project, which will continue to be a long-term hidden asset as Rapid7 navigates the rapidly-changing cloud security industry. In Q1 2020, Rapid7 continued maintaining its solid growth despite the near-term slowdown due to the COVID-19 situation, and it will guide towards profitability and being cash-flows positive beyond Q4 and 2020. In our view, Rapid7 will remain as a top-of-mind choice in the cloud cybersecurity market longer term, due to its strength across all core categories and the continuing global awareness of its offerings driven by the Metasploit project.

Catalyst

We identify two key catalysts that we believe will drive long-term growth for the business:

Rapid7's comprehensive and market-leading cloud cybersecurity offerings remain a unique selling point. While it has been well-known for its insightVM VRM offering, which has received various leadership awards from leading IT solution research firms such as Gartner and Forrester, Rapid7 has also expanded into SIEM & IDR, AppSec, and Automation spaces in recent times. Except for its emerging Automation offering InsightConnect, all Rapid7's offerings, such as InsightIDR, insightAppSec, and recently-acquired DivvyCloud, have gained meaningful tractions and become co-category leaders with those of Splunk (SPLK), Qualys (QLYS), Tenable (TENB), or Micro Focus (OTCMKTS: MCFUF).

(Source: company's Q1 earnings call slide)

Rapid7 is also one of the only few vendors with a strong, comprehensive, and unified go-to-market approach and offerings. In our view, this will increase the mission-criticality of the combined offering and further boost the growth in mid-size and enterprise install base expansion rate and ARR per customer. At present, mid-size and enterprise clients already make up 50% of ARR.

(Source: Q1 2020 earnings call slide)

Despite the COVID-19 situation in Q1, the company still saw a solid 31% ARR growth YoY, driven by the 15% growth in ARR per customer. In Q1, the company has also guided a long-term ~5x increase in ARR to $200,000, which still did not account for DivvyCloud expansion, hence conservative. As a result, though the company will expect the full-year ARR and revenue growth to decay to 17% and 20% consecutively, we think that the long-term prospect remains very attractive.

Rapid7's open-source Metasploit project is a hidden asset that will continue to drive long-term awareness and relevance in the rapidly-changing cloud cybersecurity industry. While Rapid7 will continue to onboard and expand new mid-size and enterprise clients through its high-touch, unified go-to-market approach which often involves security and IT consultations provided by its channel partner, inside sales, and field sales teams, its open-source Metasploit project continues to serve as a complementary bottom-up approach to the primary go-to-market that will drive overall awareness of Rapid7's business.

(Rapid7 and Metasploit vs Qualys vs Tenable. Source: google trends)

Rapid7 has owned the well-known open-source Metasploit for over ten years, through which it has helped increase community-driven awareness about Rapid7. Based on the Google search trends, Rapid7 and Metasploit combined have had more popularity than Qualys and Tenable, which both provide equally competitive penetration testing offerings.

(Source: github.com)

The fact that Metasploit is an open-source project will also help Rapid7 stay competitive and relevant in the cybersecurity market. The active open-source community continually updates and improves the code base regularly, as it has been forked over 10,000 times and actively discussed by over 20,000 developers. With this continuing awareness, we expect the company to eventually reduce the overall marketing expense as a percentage of revenue from +45% today to approximately 35% to 40% in the long run. Over the last two years, the figure has also declined from 50% to 47% in Q1 2020, while gross margin has also been steady at +70%, despite the continuing push for market leadership across all categories.

Risk

The outlook for 2020 will not be as initially expected, given the guidance for slower revenue growth of +20%. Despite the COVID-19 in Q1, the delayed deals across the IDR category, which outperformed until Q4 last year, seem to reflect the lower mission criticality of the offering. This remains temporary, however. As the company continues its investments into unifying its go-to-market approach around its comprehensive, end-to-end offerings, we expect growth to reaccelerate to +30%.

Valuation

Rapid7 possesses all the characteristics for success in the rapidly-changing, yet highly attractive cloud cybersecurity market, including continuing investments in R&D, end-to-end offering, and community-driven insights and growth. Driven by these factors, Rapid7 can deliver both an attractive growth and profitability profile. In Q1, the management also reiterated the intention to achieve a cash-flow positive in 2021 and profitability this Q4. Since our first coverage last December, the stock has been down ~10%, though it previously had a +16% run to ~$63 per share in January. The COVID-19 situation has put pressure on the stock as it is now trading at ~$49 per share, creating a good entry point.

(Source: stockrow)

Rapid7 is currently trading at ~7x P/S. Together with Tenable, which has a similar ~8x P/S and growth rate, Rapid7 is still not a cash-flow-positive company. Both companies also do not pass the rule-of-40. Qualys, which trades at ~13x P/S, has satisfied both rule-of-40 and cash flow profitability, though its growth rate is only half as much as those of Tenable and Rapid7. Considering the management's guidance to push for profitability through more disciplined expense management in Q4 and the long-term upsides, Rapid7 is undervalued at ~7x P/S in our view. The company can potentially trade at 9x - 10x as a company with a positive operating or cash-flow margin. Conservatively, given the maintained 7x P/S, ~50 million outstanding shares, and the expected $319 million of revenue, we set a price target of ~$56 per share.

Analyst’s Disclosure: I am/we are long RPD. I wrote this article myself, and it expresses my own opinions. I am not receiving compensation for it (other than from Seeking Alpha). I have no business relationship with any company whose stock is mentioned in this article.