Good morning. My name is Joe and I will be your conference operator today. At this time, I would like to welcome everyone to the SecureWorks First Quarter Fiscal 2023 Earnings Conference Call. All lines have been placed to prevent any background noise.

A supplemental slide presentation to accompany the prepared remarks can be found on the company's website. After the speaker's remarks, there will be a question-and-answer session. [Operator Instructions] Thank you. At this time, I would like to turn the call over to Paul Parrish, SecureWorks' CFO. Mr. Parrish, you may begin your conference..

Thanks, everyone, for joining us. With me this morning is Wendy Thomas, our CEO. During this call, unless otherwise indicated, we will reference non-GAAP financial measures. You will find the reconciliations between these GAAP and non-GAAP measures in the press release and presentation posted on our website earlier today.

Please also note that all growth percentages refer to year-over-year changes unless otherwise specified. Finally, I'd like to remind you that all statements made during this call that relate to future results and events are forward-looking statements based on current expectations.

Actual results and events could differ materially from those projected due to a number of risks and uncertainties, which are discussed in our press release, web deck and SEC filings. We assume no obligation to update our forward-looking statements. Now I'll turn it over to Wendy..

Thank you, Paul, and welcome, everyone. We executed against our first quarter plan and the structural growth drivers of our business remain strong. The end market for XDR is growing, and our transition allows us to build a stronger recurring revenue business designed to capture growth.

We continue to build deep relationships with customers and invest in the Taegis platform, and we see benefits from accelerating Taegis adoption, new use cases and upsell opportunities. And this gives us confidence in the sustainability of future growth over the long term.

Because the opportunity for Taegis, a true open XDR platform is tremendous, our open XDR approach as customers choosing Taegis as a way to future-proof their security.

They tell us [ph] Taegis is their long-term cybersecurity solution because it easily evolves to secure their changing technology infrastructure and Taegis is expanding threat detection and response capabilities enable them to stay ahead of the threat.

From the onset, we developed Taegis with a unique and purpose-built architecture, designed to be flexible and enable seamless innovation, ensuring our customers achieve their best security outcomes now and in the future.

And the conversations we're having today with both customers and prospects are notably different from just a year ago, as we see a growing understanding that XDR is the right answer to today's security challenges.

In fact, Forrester found in the recent survey of over 400 security decision makers that XDR is their number one security priority in the next 12 months and 60% of those had plans to invest in XDR solutions in the next 12 months.

Why? What security professionals recognize is that securing endpoints or networks individually in a siloed approach does not work. Plain solutions leave critical gaps in visibility and aggregating multiple logs often fails to yield critical detections or very security professionals in a sea [ph] of alerts.

Fred actors have learned to weave between point solutions, staying out of sight. XDR is the clear solution to this. But even with XDR, companies are faced with another key choice. Do they go with a proprietary or open XDR model? To our customers the choice is clear.

In their view, an XDR solution that only operates on a proprietary stack, removes optionality with vendor lock-in and introduces risk in a forced rip and replace approach. The head of security operations at one of our customers set at best. By leveraging SecureWorks Open XDR approach, we won't have to lock ourselves into vendors.

In short, SecureWorks' approach to XDR future-proofs our customer security program. And that's reflected in our changes numbers, which continue to demonstrate one of the fastest customer and ARR growth rates in the market, with the addition of 900 customers since Q1 of last year and the addition of over 100 million of Taegis ARR.

That represents nearly 150% year-over-year growth, and we ended first quarter at $180 million in Taegis ARR. Our focus this year remains on delivering high-value security solutions to the market and making targeted investments in Taegis to capitalize on the market transition to XDR.

In terms of our strategic transformation, we remain on track as we continue to resolution our Counter Threat Platform customers to Taegis and manage out non-strategic services and resale revenue. In first quarter, we arrived at a key inflection point in this transformation journey.

We ended the quarter with nearly 50% of total subscription ARR on Taegis, an important milestone for us. In parallel, we continue to drive gross margin expansion. Our combined CTP and Taegis subscription gross margins were 69.9% this quarter, an increase of over 200 basis points versus first quarter last year.

So why now and why SecureWorks? From our customers' perspective, Taegis helps future-proof them in three ways. First, Taegis was designed from the ground up with a purpose-built, big data architecture that delivers a new holistic way to see, analyze and act upon security data.

And to do so, it leverages all the data, not just data from endpoints, not just data from networks, nor from just a single public cloud provider. Taegis was designed to gather petabytes of data and apply its unique detection capabilities to find and prioritize security alerts.

For example, this quarter, we signed an international law firm who came to us from a competing XDR provider that was network-centric.

The customer initially thought to implement a SIM with the lack of automated response capabilities, coupled with high data retention costs, enabled us to demonstrate that the SIM implementation would be too complex and costly to maintain.

With Taegis, they quickly ramped up an efficient and economical security program with round-the-clock threat tracking and protection. The company now has time to develop its internal team over time, partnering with SecureWorks to build a stronger security stance than ever before.

Second, Taegis future-proofs our customer security through broad and deep threat detection, detection that is powered by an optimum mix of machine learning and applied security expertise.

This quarter, we introduced enhancements to our detection capabilities, adding more threat context and customization options, which drive investigation efficiency and speed to response.

I'd highlight particularly the expanded capabilities of our unique detection engine, which we call Tactic Grass [ph] We codify threat actor behavior patterns into the Taegis platform continuously.

We leverage our findings from about 3,000 into the response and adversarial testing engagements each year, together with the proactive research insights of our counter threat unit.

Taegis's ability to correlate observations from multiple telemetry sources and security controls at scale across petabytes of data allows Tactic Grass to detect threat actor movements with high precision.

As we open up development on Tactic Grass to partners and customers, we expect the detection capabilities of the platform to only accelerate further. Third, Taegis was designed from the outset as an extensible platform for collaboration and innovation.

It gives our customers direct access to our security experts so that they can actively collaborate on investigations. It's also an extensible platform, the Taegis community can share integrations, playbooks and more. This is all backed by the security operations expertise that we bring to the table.

Simply put, there are not a lot of players with a combination of XDR capability and the security services pedigree, an area where we have dominated that SecureWorks offers. This powerful combination helps customers scale their security team with a high degree of effectiveness.

One example from this quarter was a newly signed customer, a preeminent services firm in North America. They have multiple SIM and point technologies that were causing SecOps and efficiencies and security misses.

This left them both exposed to threat actors and exposed to spiking cyber insurance traits and ISO audit challenges, with SecureWorks they had day one, both security visibility and threat detection across their entire environment, plus they benefited from Taegis's playbooks for automatic and proactive threat hunting.

Their team has since been collaborating with SecureWorks experts, augmenting their capabilities and restoring some balance to their overwork SecOps team.

These differentiators are open purpose-built XDR platform designed for collaboration and automation of work for security analysts, backed by deep security expertise that we infuse into our platform and solutions. These are the things that SecureWorks customers value most.

A final thought I'd like to touch on today is the opportunity that Taegis affords our customers through flexibility, particularly for customers who are looking to maximize the return on their security investments for the long run.

Taegis's future-proof tend not just against the evolving threat landscape, but empowers them to maintain continuous security across future changes in their technology estate, while optimizing their security spend. I'll share an example. We have an existing retail industry customer that resolution to the Taegis platform in Q1.

They had close 250 one-off security point solutions that were overwhelming their security team with portals and complexities, forcing them into a continuous state of reaction.

With SecureWorks Taegis, they were able to displace duplicative spend by leveraging existing Taegis's capabilities through new several point solutions and do so with a higher standard of security, a gain full coverage of their environment, while relying on Taegis XDR to eliminate alert noise.

And importantly, their total spend on security has declined, while their spending with SecureWorks has increased fourfold. This industry has seen a lot of investment in security companies and growing customer spend on security. But what we haven't seen is a reduction in damages from Taegis. Taegis was built to fix this.

The holistic and open nature of Taegis XDR puts us in a more strategic conversation with our customers about protecting their mission-critical workloads and driving better business outcomes. We're able to take their current security investments and make much more of them.

And Taegis XDR can analyze more data with better accuracy and greater speed than our competitors, ultimately providing more security and more value to our customers. Taegis XDR's unique open and purpose-built platform can help turn the tide in the battle against the adversary.

I want to thank our customers and our partners for joining forces with us and thank our teammates for their hard work and commitment to realizing SecureWorks mission to secure human progress. And with that, I'll turn the call over to Paul Parrish, our CFO..

Thanks, Wendy. Taegis continues to gain traction in the market. ARR increased $108 million year-over-year to end Q1 at $180 million, a 149% growth rate over prior year Q1. We've added 900 customers since Q1 of last year, up 180% over the prior year to end the quarter at 1,400 total Taegis customers.

And Taegis subscription revenue was $37.2 million for the quarter, up 167% year-over-year. Average revenue per Taegis customer was approximately $129,000, remaining a premium to our non- Taegis customers, which averaged 88,000 per customer.

As we continue to resolution customers and grow new business on the platform, we ended the first quarter with nearly 50% of total ARR on Taegis. As Wendy mentioned, this is an important milestone for SecureWorks as it means we've arrived at a key inflection point in our multiyear business strategy.

We continue to see Taegis expanding to about three quarters of total ARR by the time we exit FY '23 as we continue transitioning from non-strategic services to our Taegis-ed business model. On an overall basis, total revenue was $121 million in Q1, which was consistent with our expectations.

We continue to scale our cost structure and benefit from our Taegis-led solution mix shift. Overall, Q1 gross margins expanded 120 basis points from the prior year first quarter, with subscription gross margins at 69.9%, up 210 basis points year-over-year.

We continue to raise our voice and profile in the market with targeted investments, resulting in sales and marketing costs increasing to 31.1% of total revenue, up from 25.6% in Q1 of FY '22 and 29.9% in Q4.

We are continuing to work closely with our customers to innovate and deliver new features that align with their strategic priorities and our development road map, further differentiating Taegis in a fast-growing market.

Accordingly, R&D has increased to 25.3% of revenue, up from 19.4% of revenue in the first quarter of last year and 22.6% of revenue in Q4. G&A expenses were down slightly in dollars compared to Q1 of the prior year on lower professional service and consulting-related costs.

Adjusted EBITDA loss was $7.8 million compared to an $8.1 million gain in prior year Q1. The overall swing of $16 million was driven by a combination of reduced revenue and gross profit as we actively exited non-strategic lower-margin services and continued investments focused on our long-term growth strategy.

Cash flow used by operations in 1Q fiscal FY '23 was $25 million as compared to a $30 million use of cash in prior year Q1. Note that Q1 is typically impacted by our annual performance payout. While the adjusted EBITDA differential swung approximately $16 million year-over-year, we improved use of cash year-over-year on lower DSOs.

CapEx was $2 million for the quarter, relatively flat with prior year. We finished the quarter with a strong balance sheet, $186 million of cash, no debt and an untapped credit facility. Turning to our guidance for FY '23. We reiterate our guidance and continue to expect the following for full year fiscal '23.

Taegis ARR to end FY '23 over $265 million, demonstrating our confidence in end market growth opportunities and in our ability to win deals and execute. Organic growth to contribute approximately $50 million of incremental ARR. Sales should accelerate through the year as we get the full benefit of our investments carrying through to FY '24 and beyond.

We're accelerating investments in brand awareness and global distribution with returns expected to be more meaningful in the back half of the year and into FY '24. Other MSS ARR to end FY '23 below $80 million.

Of the approximately $80 million of ARR remaining at year-end, we expect a significant portion to be eligible for resolutioning with the most done in FY '24, enabling us to eliminate duplicative cost of the CTP platform, total revenue to be $475 million to $490 million.

Full year adjusted EBITDA to be in the negative $58 million to $68 million range, which includes our investments in sales and marketing and R&D. Finally, full year EPS loss to be in the $0.61 to $0.70 range. Regarding Q2, we expect revenue of $115 million to $117 million with an EPS loss in the $0.15 to $0.17 range.

FY '23 continues to be an inflection point in the company's transition as we shed non-strategic services and complete the resolutioning of our base to Taegis, with a significant majority of customers completing that transition by FY '23 year-end. The resolution of our base is positioning Taegis for future organic growth.

In summary, we're making consistent progress against our transformation with continued improvement in our business mix and growth potential. The end of our business model transition is now in sight, and we believe it is increasingly clear we have the right product at the right time to lay the foundations for growth and profitability for the company.

Wendy will now join us again as we begin Q&A.

Operator, can you please introduce the first question?.

[Operator Instructions] The first question is from the line of Saket Kalia with Barclays. You may ask your question..

Okay. Great. Good morning, folks. And thanks for taking my questions here..

Morning..

Good morning. Wendy, maybe just to start with you. A lot of great customer examples in your prepared remarks. I was wondering if you could just double-click a little bit on the idea of SIM replacement. And more specifically, to what extent do you find Taegis is replacing SIM installations at your customers versus coexisting with SIM at your customers.

Does that make sense?.

It does. And I'm going to talk about that in probably two different ways in terms of SIMs and then what I would call more IT observability platforms. So when we think about traditional SIMs, even next-gen SIMs, there's not a coexistence model. It doesn't make sense, right? Taegis can do all that they do and more.

So it's got the detections that you don't have to maintain reporting that's either standardized or customizable. So you can - you have that angle. You have the log retention included, we include 12 months standard with options to extend.

And what we have that they don't, obviously, is the automated response capabilities and much lower cost to maintain its cloud native. And we're doing the heavy lifting on maintaining and building out the detections and response automations. So from that perspective, it economically and from a security efficacy standpoint doesn't make sense to coexist.

Where we do see some coexistence again, is where the core system, if you will, is really around IT observability or IT use cases. And in those cases, XDR fulfills the security aspect of that.

And from our seat that, in many cases, that can be a pretty powerful partnership opportunity to work with those platforms who potentially ingest a good bit of data in order to fulfill their use cases, and we can leverage that data mutually to add a much more effective security program on top of that.

Does that answer your question?.

Yeah, that does. That's super helpful. Paul, maybe for my follow-up for you. You touched on this a little bit in your prepared remarks.

But can you just dig into the conversion opportunity a little bit or resolution opportunity, maybe I should call it, for the - for counter threat customers over to Taegis and sort of how you're thinking about the timing of that conversion and what you're doing to encourage that conversion, if you will..

So as Wendy mentioned in her opening comments, we see the XDR market is hot. It's growing. And so that is encouraging our customers to take a look at our solutions as we talk to them about the resolution.

So as we set our guidance this year, we had a perspective on how we would exit this year with the balance on our remaining counter threat platform, which we gave guidance of $80 million or less. And so we still see all this sinking together how we set guidance. So we're still feeling very good.

We believe our customers are looking at our call favorably. And as a matter of fact, when they do resolution, we're still seeing that positive uplift when they exchange out of the older product to the new product and still hovering somewhere around that 20% uplift as they exchange that product. So we still feel very good about that progress..

Got it. Very helpful. Thanks, guys.

Thank you. The next question is from the line of Mike Cikos with Needham. You may proceed..

Hi, team. Thanks for getting me on the call this morning, and good morning..

Morning..

I wanted to ask you guys about – thanks. I wanted to ask you guys about the ARR spend behavior that you're seeing with existing Taegis customers. It's probably still a little too early to start calling trends just based on the nascency of the product or maybe the cohort of customers that we had a year ago.

But I'm curious, can you provide any detail or color how customers Taegis spend has changed over the course of the year if they're coming up on 12 months? What's the behavior like within that cohort?.

Sure. So let me sort of level set on the average revenue per customer on Taegis relative to CTP and talk about new [ph] and resolutions first and then we can talk about sort of expansion of those customers with multiple modules. So the average revenue per customer on Taegis this quarter was 130,000, pretty close to what it was in fourth quarter.

And we see that average is pretty consistent now across both new - newly signed customers and resolution customers. We did have a tick down in average revenue per customer in 4Q with just the resolution customers as we moved deeper into the base of smaller customers historically.

What we see though is that our target remains, especially as we continue to move up into the enterprise space, a 200,000 average revenue per customer model based on our current target market. And part of the way that we get there is the opportunity to upsell our customers on additional modules.

So you already see us with a higher average revenue per customer than many of our competitors in the space, which is both a function of the market that we play in as well as what's included versus additional modules. We include much more in the core XDR product than competitors who try to monetize those separately.

And for us, we are now seeing a substantive number of customers have at least one additional module from Taegis, which is helping us to continue to expand our spend. And frankly, we think that will help with renewal rates as well as they become stickier customers..

Thanks for that. I appreciate the color there. Just one follow-up and really on that last comment there. I think it was that you're seeing a substantive number of customers have at least one additional module, right? Maybe just square that away for a more apples-to-apples comparison.

But if I think about it even quarter-to-quarter or year-to-year, is that one additional module? How does that compare to where we were even a year ago? Are we seeing higher attach rates or more cross-sell in the current environment given the insuring platform that you guys have out there now?.

Yes, it's a good question. So it's definitely a material lift in that, so nearly 70% of our customers now have at least one additional module, and that could be an additional product or a services module like Elite threat hunting.

I would have to get the exact number from a year ago, but it definitely has expanded quite a bit in the last year, both as we've expanded the base and just over time, crossed back into the original customers and had additional modules to offer..

Very helpful. Thank you very much, guys, I'll turn it over to my other colleagues..

Thank you. The next question is from the line of Hamza Fodderwala with Morgan Stanley. You may ask your question..

Hey. Good morning, everyone. Thanks for taking my question..

Good morning..

Wendy, maybe first question for you. Just if you could just talk a little bit about what you're seeing in the security spending environment.

Obviously, it sounds like it's been pretty strong year-to-date, but I'm wondering if you're seeing any changes at all in a less certain macro environment? And then just a follow-up to that is when you constructed your guidance, did you factor in any changes around sales cycles or pipeline conversion at all?.

Sure. And I can just talk about what we're seeing in sales cycles and then let Paul speak a little bit to the guidance. So in terms of the economy, I was here at SecureWorks back in the 2008 time frame when there was a bit of a blip in the market, we were obviously a lot smaller in watching our cash.

And what we saw then is in your guess is as good as mine around the economy is probably what we're seeing right now, which is that the security spend is pretty mission-critical. It's really one of the stickiest areas of spend in enterprise budgets they may look to have some trimming but not necessarily full type cutbacks.

What we saw before and potentially could see now is a sales cycle lengthening as opposed to a precipitous drop in spend. That would be my best guess on that front. However, we haven't seen that yet. We've had a - a sales cycle of about a quarter for Taegis that is longer on the legacy platform for quite some time. So far, no big change there.

But if I had to make a guess, that would be the area I would look to..

And then as we said guidance, we looked at our trends and so we took that in consideration as we set guidance, as well as the continued growth and pace at the growth with our product in relation to the market growing. So all that was considered as we put our guidance on..

Just specifically, Paul, if I could follow up.

Did you assume perhaps a bit lower pipeline conversion or longer sales cycles in your guidance explicitly?.

We looked at what was occurring as we exited Q4. And to the extent there was a range that we could put our primary around, we included that in our guidance. So definitely, we captured a portion is at what could occur during Q2, Q3, and so forth out yet to be determined, but we have an element there in our guidance setting..

Got it. Makes sense. Just one last question on pages. I'm just curious how you get around avoiding some of the data ingest costs that we've seen from traditional SIM vendors have that make them obviously sometimes cost prohibitive from a customer standpoint.

How do you get around that with Taegis so that you can not only deliver effective security but also deliver it at a more efficient price point?.

Sure. And I'll talk about that from two angles. The most important angle is from the customer seat. And we very consciously made the decision to price Taegis based on endpoint count. And that way for customers, it is very predictable.

There are no additional data charges unless they decide to purchase longer storage than 12 months, but there is no variable data charges that catch customers by surprise and their ability to outlook their endpoints is their ability to outlook their spend with us.

So that's a real differentiator, not just against SIMs, but against some other XDR providers who do create that exposure for customers to charges.

And frankly, from my seat, create a disincentive to do the very thing that makes them more secure, which is to have all the data to be able to run highly correlated detections, find that needle in the haystack. So we do not want to disincent the security value of that data either.

So of course, the flip side of that question is, well, how do you manage that in terms of your cost structure? And as you can see, even with the MDR services included in our subscription margins, we are just at 70% gross margin this quarter because we have a purpose architected XDR platform that is very conscious about the types of data that we need quickly, right, real-time search capabilities for security efficacy and those that we can have lower cost storage structures or things that you just want to search over time.

And the combination of that architecture with our kind of constant management of instances and such with AWS is how we're able to grow our margins at scale while still having a pricing model that is predictable for customers..

Thank you..

Thank you. The next question is from the line of Brian Essex with Goldman Sachs. You may proceed..

Hi, good morning. And thank you for taking the question. Maybe love to get a sense for what you're seeing so far with kind of adoption of the Taegis platform.

And I guess the question is more along the lines with where you see yourself fitting in relative to some of the other business models that are out there in terms of we have some managed service providers going through kind of an incident response related channel and kind of leading their XDR technology behind.

We have ETD vendors that are extending into XDR. How do you see yourself and obviously, totally get the ability to have an agnostic platform that's kind of open in nature.

But I want to see, right now, you've got a nice tailwind from the resolution, but we - where do you think this environment kind of ultimately ends up in terms of competitive dynamics versus the way that other vendors are kind of trying to penetrate the space?.

Sure. Good question. And I'll - the simplest way I think about it is really the ex the D and the R and XDR, what makes us different from different approaches to the market, and you really called out several of them. And the X truly is the extended piece, which is right, that is not just endpoint only.

And then it's not just a proprietary stack where you have to use their endpoint their firewalls, et cetera. So I think that's one of the fundamental differences. On the other end of the spectrum is the R. And so there are a lot of XDR players out there - there who do not have what I call the big R.

They may promise that come in with a low price point and then what customers find out is that they are truly on their own.

So when we think about being able to compete with a very well-regarded incident response program underneath that 40 hours a quarter included in our MDR program, which is a real differentiator from competitors that's truly big R and in the middle there, it's really around the detection, and that's where we win against all players who come from all angles because of the way that we don't just ingest data, which many XDR providers say, oh, we ingest everything.

It's really about the normalization of that data and the powerful detections across that data that we compete against those players in those three areas and no one has that combination of truly the ex the DMR..

Got it. That's super helpful. And I guess, maybe relative to some vendors that may come at this from an EPP angle and the catalyst of displacing a legacy endpoint vendor would be kind of your tip of the spear, so to speak, to go to market.

How do you envision the way that you might penetrate the market is primarily direct sales? Or are you getting traction with some of the solution providers that may be, I guess, architecting a more holistic solution around an EPP conversion? Like how do we think about your ability to get in front of customers to actually illustrate the benefit of your platform?.

So I'll take that in two pieces. One is kind of the EPP play generally. And then two is the partner play, which really goes beyond just that, particular displacement strategy. And the reason that we added, we have our own proprietary agent. We have next-gen AV capabilities to make it frictionless for customers to choose.

If they want a more economical approach to XDR, including EPP, we absolutely have that for partners to be able to offer to customers to run that play. And that was a conscious decision on our part. Do we require it? No. They have a leading endpoint product. We work with those products in order to prevent risk to customers of for strip and replace.

But we get in, we become the interface to the customer and show them economic models over time that they can shift into. The second piece is really around partners. And as we've stated before, it is a key part of our strategy to expand both with partners who resell SecureWorks products, as well as provide ancillary services on top of that.

We've very much been working to enable those partners with speed to market by sharing our bridge support around developing service models and security operation centers to do that. So we do see a continued increase in the percent of partner sales as a percent of our revenue. I would like to see that go faster.

I anticipate that's going to start to go faster as we've been building these relationships and getting partners ramped. But pleased on both fronts, and we want to give them more than just the EPP play, the Simplay [ph] and others for them to go in and seek opportunities to increase revenue with their base..

Got it. Very helpful color. Thank you..

Thank you. There are no further questions at this time. Mr. Parrish, I will turn the call back over to you..

Okay. That wraps up the Q&A on today's call. A replay of this webcast will be available on our Investor Relations page at secureworks.com, along with our Q1 web deck with additional financial tables. Thanks again for joining us today. Have a good day..

Thank you..

This concludes today's conference call. You may now disconnect..