Time4VPS - VPS hosting in Europe

Rapid7 Fails To Take Advantage Of Long-Term Tailwinds

Investment thesis

IT trends come and go, but cybersecurity is poised to stay as every company is turning into a software company. A name that will benefit from this mass migration is Rapid7. But is it a wise investment?

Founded in 2000, it has been growing at a steady pace and developed cybersecurity solutions across the entire IT environment. Today, it is a leader in vulnerability risk management (‘VRM’), rubbing shoulders with Qualys (QLYS) and Tenable (TENB), and also in security information and event management (‘SIEM’), competing with FireEye (FEYE) and Splunk (SPLK).

While the market is hyper-competitive, the pie grows rapidly. To capture further growth, Rapid7 has recently acquired DivvyCloud (May 2020). This move promises to solidify its position within Cloud Application Security and helps to multiply its total addressable market to $34B from $9B. From the macro perspective, major opportunities abound.

Despite the top position accolades and apparent tailwinds, we wonder if Rapid7 will sustain its 30%+ growth, or achieve economies of scale quickly enough to stay at the top. Having been around for 20 years, it is still a relatively small company with $350M in annual sales. It has grown over 30% in the past five quarters but has started to slow down. The management has guided near-term growth down to 20% until COVID-19 problems go away.

What’s more, at the core, its customer retention rate is also slowing down. ARR growth (annual recurring revenue) halved to 15% in FY2020. Thus, despite the rapidly expanding market, Rapid7 is underachieving.

We want to select the best SaaS company in our portfolio in this seemingly frothy market. But with Rapid7, we need to take a big leap of faith to start a position. On balance, we believe the market is rational to value the company at 8x sales, in the middle of the cybersecurity cohort. For now, we would stay on the sideline and may start a position at a significant dip.

Optimistic macro and industry trend

Before COVID, businesses were digitalizing steadily. During COVID-19, the migration has gone en masse.

‘Software is eating the world’ Marc Andreessen, a19z, 2011

However, the rampant shift to digital and migration to the cloud presents complex security risks and expose everyone to unpredictable attack avenues.

Unquestionably, recent research has pinpointed security/cyber risks as the most important initiative for 2020, stating that more than a third of all companies will engage a service provider to mitigate this risk. Only 5% of all companies surveyed are shunning/deferring action.

The trend is a huge tailwind for Rapid7. The management forecasts that Rapid7’s total addressable market will grow from $9B to $34B in the near future.

Source: Rapid7 Q1 2020 results earning call presentation

A large part of the expansion of the total addressable market is expected to come from the recent acquisition of DivvyCloud, in combination with InsightAppSec, and tCell, adding $7B alone.

Company analysis

Now, the question is, will the company be able to take advantage of the expanding market?

We would not be so sure.

Let’s review the most recent financials. The company reported Q1 FY20 earnings on May 9th. The snapshot below shows that Rapid7 executed exceptionally.

Revenue grew 33% YoY, continuing the strong momentum for 5 quarters.

Source: Rapid7 Q1 FY2020, 10-Q

Importantly, 90% of its revenue is recurring, and this portion improved rapidly in Q1 (+31% YoY).

This shows that more customers renewed Rapid7’s service, backing up the company’s strong claims as a leader in VRM and SIEM, both are also validated by external sources.

The Gartner Magic Quadrant shows that Rapid7 scores top positions in VRM and SIEM segments.

Gartner Magic Quadrant

Altogether, Q1 FY2020 was a success, capping off a strong run of 5 quarters and showing solid growth stretching back from 2015.

However, the future is not as rosy.

In the short term, Rapid7 is likely to experience reduced revenue and ARR growth (14%-20%). Additionally, this year will also mark another year of unsuccessful attempt to break even. The management is cautiously optimistic that it can start to generate free cash flow in 2021.

Rapid7 Guidance

This goes to show that the rapidly growing market does not necessarily mean the pie is up for grab. Rapid7’s strong product adoption rate in the past four years has yet to translate into profitability and cash generation. The latter is crucial, especially for companies that are showing signs of slower growth.

Let’s put Rapid7’s financials to a bigger test, SaaS ‘Rule of 40’ and Magic Number, and see what the numbers tell.

SaaS ‘Rule of 40’ unachievable

Unsurprisingly, Rapid7 failed the holy grail benchmark ‘Rule of 40′ for SaaS companies. A measure used widely to predict SaaS companies’ future success at various stages of the product life cycle.

We can broadly divide a product life cycle into (i) product-market fit, (ii) growth, (iii) maturity & optimization, (iv) decline. Rapid7 already found product-market fit, so we’ll assess how it performs in the latter 2 stages.

Product Life Cycle

Source

At the growth stage of the product life cycle, Rapid7 is expected to ramp up sales, thus it would be unreasonable to expect Rapid7 to be profitable. However, when comparing to companies like Splunk, CrowdStrike (OTC:CRWD), or Slack (WORK), it is clear that the peers’ growth rate is in a different league, recording 50%+ growth. Yes, they are still not profitable (and burning cash), but they are investing correctly to achieve hyper-growth, displacing incumbents, and are rewarded with much higher valuations than Rapid7 (see next section).

If we place Rapid7 at the optimization stage of the product life cycle, we would not expect Rapid7 to record a CAGR of 30% over a long period; however, it would need to be modestly profitable at the very least. As mentioned, the company is forecasted to grow at 20% and burn cash for at least the next three quarters. From this vantage point, Rapid7 is underperforming.

Companies that are in this stage (<40% growth) such as VMware (VMW) and Veeva Systems (VEEV) are printing cash (30%+ yield). Their growth rate has slowed and stabilized, but they more than compensate in economies of scale (moderating R&D investment, optimizing SG&A for growth vs. retention) and/or in leveraging their existing customer base (up-selling and cross-selling, and exploring new business models).

Unfortunately, Rapid7 is moving towards neither of these categories.

SaaS Magic Number failed

SaaS Magic Number is widely used to measure sales efficiency. Rapid7 scores 0.22. It means that for every dollar spent on sales and marketing (S&M), the company is generating only $0.22 of sales, thus, very little ARR.

As a rule of thumb, anything lower than 0.5 and the company should pause its investment in S&M. To put this in context, CrowdStrike scores 1.2 during the same period.

SAAS Magic number

Source

Valuation

The table below shows that the market rewards companies that can demonstrate hyper-growth in the early stage of the life cycle or/and generate high profitability in the latter stage. Rapid7 is performing strongly in neither, hence, it is being valued right in the middle of the cohort.

Quote

Growth

Operating Margin

P/S

RDP

21%

-15%

8.3

CRWD

85%*

-25%

40.9

VMW

10%

15%

5.4

TENB

28%

-23%

8.1

QLYS

15%

24%

14

Source: Authors’ working, company financials.

*ARR (Annual Recurring Revenue) growth was 88% in Q1 FY21

Summary

Macro tailwinds from digital transformation projects appear to be the biggest driver in the short term. Investors rushed in flocks to this space, driving up valuations to levels not seen since 1999. We are not saying that a bubble is forming, some of the SaaS companies are duly deserved with premium valuations; however, it is becoming more difficult to pick out winners in this space.

Our analysis shows that Rapid7 is one of the main beneficiaries of this long-term trend. Unfortunately, it is not guaranteed that it will succeed. In the short term, it faces slower topline growth and customer retention. Meanwhile, the company didn’t shine in either spectrum of the ‘Rule of 40’ benchmark, failing to grow fast and/or generating high profit. The low Magic Number also shows that its S&M is highly inefficient.

As it stands, we believe the market does recognize Rapid7’s underachievement and values the stock fairly. Maybe the recent acquisition, DivvyCloud, is just the wildcard it needs. We will have to wait and see.

Disclosure: I am/we are long CRWD. I wrote this article myself, and it expresses my own opinions. I am not receiving compensation for it (other than from Seeking Alpha). I have no business relationship with any company whose stock is mentioned in this article.

Leave a Reply