Rapid7: Securing The Shift To The Cloud
Summary
- Rapid7's SIEM and SOAR solutions comprise less than 40% of revenue generation and serve as strong future catalysts.
- Total ARR growth of 76% in the past 8 quarters serves as a promising indication of the company's growth opportunities.
- Future revenue streams will be a function of International and Enterprise expansion along with successful penetration of the SIEM and SOAR markets.
Editor's note: Seeking Alpha is proud to welcome Jackson Fogarty as a new contributor. It's easy to become a Seeking Alpha contributor and earn money for your best investment ideas. Active contributors also get free access to SA PREMIUM. Click here to find out more »
In an increasingly digital world, cybersecurity is becoming more and more essential to large and small businesses alike. At the center of this transition is Rapid7 (NASDAQ:RPD). With ~28% Revenue growth over the last three years, Rapid7 is a promising company in a broad and expanding cloud-based market. The cybersecurity company is focused on enhancing resolve and efficiency for customers who face constantly evolving cybersecurity challenges. With its diverse portfolio of products, Rapid7 is uniquely positioned to be a leader in the cybersecurity market for years to come.
Product Overview
The company's main revenue driver is in the Vulnerability Risk Management (VM) space. According to the 2019 Forrester Wave Report, Rapid7's InsightVM saw a potential 342% ROI within three years. In addition to this astonishing number, customers also saw a decrease in cybersecurity spending and incident volume. This is evidently a compelling argument for Rapid7 as a leader in the Vulnerability Management space where it competes with Qualys (QLYS) and Tenable (TENB).
Rapid7 also has products in:
- Security Information and Event Management (SIEM)
- Application Security
- Security Orchestration and Automation Response (SOAR)
The company's SOAR solution is called InsightConnect. This product allows customers to customize workflows and tools with over 290 plugins. On the company's 4Q 2019 Earnings Call, CEO Corey Thomas mentioned plans to accelerate investment in this solution in 2020. While in the early stages of its development, he views it as an emerging product in North America.
InsightIDR is the company's SIEM solution, which currently makes up more than 20% of revenue. InsightIDR's competitive advantage lies in its ease of use and seamless cloud capabilities. Thomas noted on the 1Q 2020 earnings call, it is one of the few solutions that natively collects endpoint data from the cloud no matter where people are staffed in the world. This solution saves customers the pain of setting up core infrastructure and seamlessly gathers key end to end data points. This end to end solution is specifically advantageous as companies move toward an increasingly remote work environment.
To sum up the exciting opportunity of these two products, here is what Thomas had to say on the 4Q 2019 Earnings Call regarding new market penetration:
"So you saw that dynamic, especially with IDR last year as for the first year that really became much more of a global business and we think there is lots of growth in IDR over the next couple of years and that's a catalyst. Likewise with SOAR...we do expect some momentum if we continue to see progress on a global basis."
Addressable Market
Shown below is the company's breakdown of its Target Addressable Market (TAM) in the 1Q 2020 Earnings Call Presentation. 
Source: 1Q 2020 Earnings Presentation
As seen above, both SIEM and SOAR represent underpenetrated markets, and Rapid7 claims the solutions to be a leader in both. Less than 25% of the company's TAM has been tapped, leaving ample room for opportunity. To further reference this opportunity, see below for SIEM market research by Gartner, the world's leading research and advisory firm.
Sources:(2018 Gartner Magic Quadrant for SIEM) (2020 Gartner Magic Quadrant for SIEM)
These two studies from October 2018 and February 2020 rated companies based on their completeness of vision and ability to execute within the SIEM vertical. Rapid7 has risen quickly from a "Visionary" to a "Leader" via an increased ability to execute. This is most likely due to increased headcount and Sales/Marketing efforts for their InsightIDR product. The company has already seen some expansion in the enterprise market due to its acquisition of Netfort in April 2019. Top management mentioned in the 4Q 2019 Earnings Call they expect this momentum to accelerate in 2020 and 2021. This will be something to watch in the upcoming months in order to project market share over the next few years.
Revenue Growth Drivers
Annual Recurring Revenue (ARR) is Rapid7's leading revenue indicator and has shown healthy growth over the years, growing from ~90MM in 2015 to over ~330MM today. Top management has recognized ARR as a strength of the company and specified that the growth strategy lies in customer acquisition. Thomas made light of this on the 1Q 2020 Earnings Call, citing the company's strong ability to up-sell and cross-sell to existing customers. Shown below is ARR over the past 8 quarters, which has grown an impressive 76% in two years.
Q2 2018 | Q3 2018 | Q4 2018 | Q1 2019 | Q2 2019 | Q3 2019 | Q4 2019 | Q1 2020 |
$198.6 | $217.4 | $251.8 | $268.2 | $290.0 | $310.2 | $338.7 | $350.9 |
Source: Gridlex SAAS Metrics Data & Analytics
Given this more than capable ARR, it will be important for the company to land with both International and Domestic enterprise customers.
Competition
Qualys and Tenable both serve as strong competition in the Vulnerability Management space. When compared with it's VM competitors, Rapid7 is right in the middle. They are growing at a faster pace than both companies, but Qualys is the only one boasting strong positive free cash flow. The company boasts a 33% EBITDA margin while Rapid7 and Tenable lag with -10% and -22% respectively. It should be noted that Qualys has historically derived roughly 70% of its revenue from its VM product. Thus, its impact on Rapid7 will diminish as the latter company continues to build out market share of its SIEM and SOAR products. Below is a chart of stock prices for each company since the lows of mid-March. The market has preferred Qualys, and for good reason.
Source: Gridlex SAAS Metrics Data & Analytics
As the recent stock prices indicate, investors are confident in Qualys' ability to fight through the COVID-19 pandemic due to its strong free cash flow and lack of debt on its books. Those two qualities are especially valuable in the current economic backdrop and explain why the company is valued at 12.5 EV/S. The negative earnings of Tenable and Rapid7 have deterred them from a bounce back like Qualys, although the tailwinds of cloud momentum have allowed both companies to trade around ~7.5 EV/S. Below is a table representing some key metrics for each business:
2019 Values | Qualys | Tenable | Rapid7 |
Revenue | $321M | $355M | $327M |
Revenue Growth (2018-2019) | 15% | 30% | 34% |
International Revenue (% of Total) | 30% | 37% | 16% |
Enterprise Customers | 'Majority of Global 100 and Fortune 100' | Over 50% of Fortune 500 | 47% of Fortune 100 |
Customer Total | 15,700+ | 24,000+ | 9,000+ |
ACV | $20,445 | $14,790 | $36,330 |
Source: Gridlex SAAS Metrics Data & Analytics
As is evident in the table, Rapid7 is trailing in both the Enterprise and International markets. Only 52% of its revenue is from large enterprises. This highlights an area of potential growth for the company. In addition to an aim at landing with enterprises, management is also focused on expanding International revenue generation. It has represented 15, 15, and 16% of revenue in the past three years, demonstrating room for growth in that area. With that being said, International revenue grew 46% YoY in 1Q 2020 and the company is still developing data centers overseas. Many overseas companies are unable to use data that doesn't exist within their borders, so these data centers are crucial to International expansion.
Risk
Although Rapid7 has shown genuine promise of significant future growth, there are still a few risks to watch out for. First, the company operates in a rapidly growing industry with many unknowns. M&A is particularly frequent among SaaS companies as they are always looking for synergies and other ways to increase efficiency. This represents a zero-sum game where Rapid7 could either gain or lose market share.
Another obvious risk is the impact of COVID-19. On the 1Q 2020 Earnings Call, CFO Jeff Kalowski revised ARR growth in the range of 14%-20% for FY2020. This makes sense as customers are cutting costs across the board due to increasing economic uncertainty. With that being said, companies simply cannot afford to cut all cybersecurity costs and the ongoing shift toward remote work plays favorably into Rapid7's product portfolio. Once customers are able to shore up their balance sheets and consumer confidence returns, Rapid7 should bounce back to mid-30's ARR growth.
Another potential risk is the entrance of new competitors into the verticals Rapid7 currently occupies. While the company is well-positioned in VM, the SIEM and SOAR sectors could become increasingly competitive and drive down price flexibility. These risks will have to be monitored over time, but Rapid7 finds itself in a strong position in the current SecOps environment.
Rule of 40
An often-used component of SaaS growth valuation is the rule of 40. The rule states that the addition of Revenue Growth and Profit Margin should be in excess of 40%. While the profit margin can be calculated in many ways, EBITDA is steady across all companies and thus used in this case. Rapid7 grew its revenue by 33% in 2019, while the EBITDA margin was a lowly -10%. The company fails the rule of 40 at 23%.
Valuation
Despite failing on the rule of 40, Rapid7 is undoubtedly poised for strong growth in the coming years, and well on its way to positive cash flow in 2021. The COVID-19 pandemic has accelerated reliance on the cloud and Rapid7 is well-positioned to benefit from this transition in the coming years. Using a DCF model to evaluate Rapid7's future cash flows, the company seems to be undervalued. The model assumed a 35% CAGR for ARR. This assumption was made due to the company's previous history (34% or more ARR growth in the previous 4 years) and promising momentum in the enterprise market. As for customer acquisition, the CAGR was 10% which represents the low end of the company's historical numbers (10%-20%). The long term growth rate was assumed to be 5%, in line with historical GDP growth. The model also assumed a 9% WACC, in line with SaaS averages.
DCF Assumptions | |
Annual Recurring Revenue CAGR | 35% |
New Customer Acquisition CAGR | 10% |
Long Term Growth Rate | 5% |
WACC | 9% |
Discounting the sum of all future cash flows back to net present value, the model returns a total market capitalization of ~3.18B. Using the current shares outstanding of 55.5M, the share price comes out to $57.37. This represents an upside of 15% from the current price. As previously mentioned, the company is currently traded at ~7.5 EV/S which is right around par for the industry as a whole. Assuming the aforementioned market cap of $3.18B, the company's fair value would be ~9.5 EV/S. This is a comfortable margin of safety for investors at the current price and the stock remains bullish amidst the shift to the cloud.
Conclusion
Though this valuation gives a considerable margin of safety, investors may still want to hold out for a better price. With a potential second wave of COVID-19 lurking, the market is volatile and may be due for a correction. Assuming a ~10% market plunge, Rapid7 could drop to the mid 40's, where it would be a tremendous bargain. Long term investors would be wise to wait out the economic uncertainty over the next few weeks and aim to buy at a price somewhere below $50.
This article was written by
Analyst’s Disclosure: I/we have no positions in any stocks mentioned, and no plans to initiate any positions within the next 72 hours. I wrote this article myself, and it expresses my own opinions. I am not receiving compensation for it (other than from Seeking Alpha). I have no business relationship with any company whose stock is mentioned in this article.
Seeking Alpha's Disclosure: Past performance is no guarantee of future results. No recommendation or advice is being given as to whether any investment is suitable for a particular investor. Any views or opinions expressed above may not reflect those of Seeking Alpha as a whole. Seeking Alpha is not a licensed securities dealer, broker or US investment adviser or investment bank. Our analysts are third party authors that include both professional investors and individual investors who may not be licensed or certified by any institute or regulatory body.
Recommended For You
Comments (2)
