Hello and welcome to today's SecureWorks Second Quarter Fiscal 2023 Earnings Conference Call. My name is Bailey and I'll be your moderator for today's call. All lines will be muted during the presentation portion of the call with an opportunity for questions-and-answers at the end.

[Operator Instructions] I would now like to pass the conference over to today's host, Paul Parrish, CFO. Please go ahead when you're ready..

Thanks everyone for joining us. With me this morning is Wendy Thomas our CEO. During this call unless otherwise indicated, we will reference non-GAAP financial measures. You will find the reconciliations between these GAAP and non-GAAP measures in the press release and presentation posted on our website earlier today.

Please also note that all growth percentages refer to year-over-year changes unless otherwise specified. Finally, I'd like to remind you that all statements made during this call that relate to future results and events are forward-looking statements based on current expectations.

Actual results and events could differ materially from those projected due to a number of risks and uncertainties, which are discussed in our press release, web deck and SEC filings. We assume no obligation to update our forward-looking statements. Now I'll turn it over to Wendy..

Thank you, Paul, and welcome everyone. Our transformation into a leading XDR solution provider with a strong recurring revenue model is accelerating. I'm pleased to report that we crossed the $200 million mark in Taegis ARR in the second quarter. Taegis ARR reached the $100 million milestone 10 quarters after launch.

And now just four quarters later, we've doubled to $200 million. Taegis' ARR and customer count numbers continue to put us among the fastest growth rates in the industry with triple-digit growth in both areas, reflecting the addition of 800 customers since 2Q of last year to a total of 1,500 Taegis customers.

In terms of our business model transition, Taegis now represents 56% of our overall subscription ARR and we remain on track for Taegis to be approximately 75% of ARR by the end of this fiscal year.

So why is SecureWorks approach to XDR resonating in the market? Our Taegis platform is unique in four ways; one, superior detection, which means accuracy and speed with complete attack surface visibility and applicability.

We ingest more than 486 billion events daily, including events across more than 100 integrations, which we enrich with industry-leading threat intelligence and tens of thousands of expert curated signatures. Across our current customer implementations, 60% of the data we ingest through Taegis comes from sources other than endpoints.

This speaks loudly to the value and economy of Taegis XDR that combines data from endpoints with data from cloud environments, e-mail, network, identity systems, business applications and more.

We leveraged 27 petabytes of diverse data with our machine-learning models combined with industry leading threat intelligence to produce best-in-class detection speed and efficacy. And we have a growing suite of proprietary advanced detectors like our hands on keyboard detector that was trained on more than three trillion events.

Using the power of machine learning this detector recently identified a malicious post-exploit activity with an initial access vector never seen before.

It's a perfect example of where we focus on machine learning research on the new techniques, tactics and procedures where we do not yet have deployable threat intelligence or signatures but that can be deployed with a high signal-to-noise ratio.

For customers this means we only alert when it matters, leading to a significant savings of valuable SecOps resources when leveraging Taegis. In short, Taegis lowers our customers' risk across their enterprise at a lower total cost of ownership delivering the highest return on investment. Two, unmatched response.

The second way our XDR platform is unique is the SOAR capabilities native to Taegis provide one, rapid and automated high security value response actions, things like host isolation or automated re-authentication prompts.

Two, orchestrated workflows that quickly kick off customer remediation work streams maybe easier with out-of-the-box integrations with providers like ServiceNow, Zendesk, PagerDuty, Jira and many others, maximizing efficiencies for our customers.

It also means live access in under a minute to an expert stock analyst via the live chat feature in our Taegis UI. We believe we lead the industry in speed and quality of response with the fastest time to detect, label, notify and investigate among XDR providers. Three, we are open without compromise.

Transparency and open interoperability have always been first-order principles for Taegis. Our platform was built from the ground up to integrate market-leading technologies and deliver incremental security value on day 1. It's not about raw data aggregation. It's value delivered through actionable security relevant insights.

And SecureWorks is committed to rapidly expanding integrations for Taegis with market-leading technologies. So our customers get better, more comprehensive detection with less time and effort to get to security value.

For example, with the recent additions of Netskope and SCADAfence to our technology alliance partnership, we've expanded the reach of Taegis' Open XDR to include additional solution areas being used by our customers including SASE, CASB and OT. We don't approach these partnerships as simple data exchange projects.

Instead, we do so from our rich heritage and long experience running security operation centers where data from each source must work in concert to provide incremental security value.

And one last important point on our approach to being open without compromise, Taegis customers use the same UI as our security experts, which enables seamless collaboration and rich context for security events, allowing us to work with customers of any scale and security depth.

And finally, Taegis is priced for predictability and clear value for customers. Taegis is priced on a per endpoint basis with no hidden data overage charges providing customers with predictability of spend.

And for an easily comparable per endpoint price, we provide more covering a customer's entire security estate, including endpoint with an industry-leading one year of data retention as our standard offering.

That's far beyond the typical 30 days that other XDR and EDR solutions include natively, largely because their data architecture was not designed to scale to big data in addition to fast data.

How can we do this at scalable margins? Our data architecture, the security operations use cases we've experienced over decades have informed the unique data architecture that gives Taegis a powerful competitive advantage in terms of speed, scale and security value.

Evidence of this unique approach to data, includes, superior data labeling and normalization to feed higher fidelity detections and filter out noisy alerts. We optimize our approach to streaming for real time versus batch processing in support of detection analytics, and machine learning use cases.

This allows us to develop new detectors quickly to prove out their security value, while providing industry-leading time to detection, for our most sophisticated analytics. We also optimize our use of search designed for speed, when warranted and for cost efficiency, for longer-term storage and retrieval.

Innovations like these, drawn directly from our security expertise, enable us to price our solution on a predictable, per endpoint basis, while still supporting a full spectrum of other cloud network and business system telemetry, with more favorable data retention options, and scalable margins a distinct market advantage.

In addition to more customers seeking XDR, we are seeing customers displace their SIMs for XDR. While the SIM market is worth close to $5 billion, we increasingly hear from prospective customers that our SIMs are essentially noise engines. They're effective and expensive.

A recent new customer win, selected SecureWorks over their SIM for the following key reasons. First, predictable endpoint pricing versus their SIMs data volume-driven pricing, which disincented them from securing their entire environment. Taegis standard 12-month data retention was key to this customer's threat hunting objectives.

And they gained value from the incident response built into the Taegis offering rather than requiring incremental investments in challenge. And while the endpoint detection and response market is $9 billion and growing, we've heard from prospective customers and we know from our XDR visibility that EDR alone misses much of a threat.

We recently alerted one customer to an exploited confluence server, monitored by a third-party ADR product, where the threat actor ended up downloading scripts and running cryptominers. Yet, there were no native EDR alerts, but we detected the activity with Taegis XDR from the native EDR source telemetry.

We also saw the same exploit on a different server from that customer's DNS logs, where there was new agent installed, demonstrating the real power of XDR.

When customers have XDR deployed across the enterprise, it's common for our threat intelligence to flag network traffic to command and control addresses, and then be able to tie that back to the endpoint being exploited.

While maintaining 100% visibility of the entire enterprise is always a challenge, with XDR, our customers are more likely to gain early visibility into a part of the kill chain to enable them to quickly take action.

With the Taegis platform, SecureWorks is delivering the most transparent interoperable and open XDR solution, with EDR natively included. The adversary will not get complacent and neither will we. This past quarter, we've been joined by Mike Aiello, as Chief Technology Officer of SecureWorks.

With more than 20 years in security Mike is shaping the next horizon for Taegis, and bringing this customer and industry experience to our leadership team. Prior to SecureWorks, Mike was the Chief Product Officer for HUMAN Security.

And prior to that served as the CEO of AppGate; the Product Management Director for Google Cloud Security; and as the Chief Information Security Officer for Goldman Sachs Consumer and Commercial Bank.

We are bringing the best of everything to the table, decades of security operations experience and open and interoperable XDR platform, with a unique data architecture and the best security talent the industry has to offer.

Today's markets are turbulent, driven, shaped and reshaped by many forces, but we remain focused on keeping our customers secure, on defining the future of threat detection and analysis and on driving superior long-term and sustainable growth and value creation for investors, as we execute on our strategy and complete our transformation, as an industry-leading XDR provider.

I want to thank our customers and partners, for joining forces with us and thank our teammates for their hard work and commitment, to realizing SecureWorks mission to secure human progress. With that I'll turn the call over to Paul Parrish, our CFO. .

Thanks, Wendy. Taegis continues to gain traction in the market. ARR increased $100 million year-over-year to end Q2, at $201 million, another triple-digit growth rate over prior year Q2. We've added 800 customers since Q2 of last year, up 114% over the prior year to end the quarter at 1,500 total Taegis customers.

Taegis subscription revenue was $42.8 million for the quarter, up 131% year-over-year. And average revenue per Taegis customer, were approximately $136,000, up sequentially from $130,000 in Q1 and remaining a premium to our non-Taegis customer revenue, which averages $85,000 per customer.

As we continue to resolution customers and grow new business on the platform, we ended the second quarter with 56% of total ARR on Taegis. We continue to see Taegis expanding to about three quarters of total ARR by the time we exit this fiscal year, as we continue transitioning from non-strategic services to our Taegis-led business model.

On an overall basis, total revenue was $116 million in Q2, which was consistent with our expectations despite an approximately $3 million FX headwind. We continue to scale our cost structure and benefit from our Taegis-led solution mix shift. Overall Q2 gross margins expanded from prior year Q2 to 61.3%.

As we continue raising our voice and profile in the market, with targeted investments in sales and marketing sales and marketing costs have increased to 33.8% of revenue, up from 25.1% in Q2 of FY 2022 and 31.1% in Q1.

We also continue working closely with our customers, to innovate and deliver new features that align with their strategic priorities and our development road map further differentiating Taegis in a fast-growing market.

Accordingly, R&D has increased to 26.7% of revenue, up from 21.5% of revenue in the second quarter of last year and 25.3% of revenue in Q1. G&A expenses were slightly down in dollars compared to Q2 of the prior year, on lower employee-related expenses, professional service and consulting-related costs.

Adjusted EBITDA loss was $14.3 million compared to a $3.6 million gain in prior year Q2. The overall swing of $18 million was driven by a combination of reduced revenue and gross profit, as we actively exited non-strategic lower-margin services and continued investments focused on our long-term growth strategy.

Cash flow used by operations in 2Q fiscal 2023 was $17 million compared with $17 million provided by operations in prior year Q2. CapEx was $2 million for the quarter, relatively flat with the prior year. We finished the quarter with a strong balance sheet $167 million of cash, no debt and an untapped credit facility.

Turning to our guidance for FY 2023. As both Wendy and I detailed earlier, we saw healthy growth in our Taegis solutions, which are helping drive better outcomes for customers on their most urgent security challenges and our business model transformation continues to accelerate.

In midst of this progress, the strength of the dollar has resulted in FX headwinds and we expect to see a lower level of professional services revenue than reflected in our previous guidance.

Given these dynamics, we now expect full year revenue to be in the $458 million to $465 million range, with FX impacting around 50% of the change in guidance and the remaining reduction, primarily driven by lower professional services. Taegis' ARR guidance remains unchanged. We continue to expect Taegis' ARR to end FY 2023 at $265 million or higher.

Organic growth to contribute approximately $50 million of the incremental Taegis ARR. Sales should accelerate through the second half as we get the full benefit of our first half investments, carrying through to FY 2024 and beyond.

We're accelerating investments in global awareness and global distribution with the returns expected to be more meaningful in the back half of the year and into FY 2024. We have updated the other MSS ARR component to now end FY 2023 below $70 million.

Of approximately $70 million of ARR remaining at year-end, we continue to expect resolution to be largely complete in FY 2024, enable us to eliminate duplicative costs to support CTP platform and services. Additionally, we have narrowed the following guidance ranges from our previous guidance.

Full year non-GAAP net loss to be in the $55 million to $59 million range with full year EPS loss in the $0.64 to $0.70 range.

Full year adjusted EBITDA in the negative $63 million to $68 million range, which includes our investments in sales and marketing and R&D reflecting our continued management of spend to revenue and cash flow used in operations in the $60 million and $65 million range.

Regarding Q3, we expect revenue of $111 million to $113 million and an EPS loss in the $0.20 to $0.22 range.

In closing, FY 2023 continues to be an inflection point in the company's transition as we shed non-strategic services and complete the resolution of our base to Taegis with a significant majority of customers completing that transition by FY 2023 year-end.

We are optimistic about our unique opportunity to capture XDR spend with our Taegis solutions while helping customers consolidate their security budgets to drive better efficiency of their spend. We're making consistent progress against our transformation with continued improvement in our business mix and growth potential.

Wendy will now join us again, as we begin Q&A. Operator, can you please introduce the first question..

Thank you. The first question for today's call comes from the line of Mike Cikos from Needham. Please go ahead. Your line is now open..

Hi, guys. Thanks for getting me on and thanks for all the color. I do appreciate it. I wanted to ask about the fiscal 2023 revenue guidance reduction that we're seeing today. And just for clarity here, so you guys in Q2 came in line with your revenue guide, despite the $3 million FX headwind.

Can you remind us, I guess, what was management anticipating in Q2 from an FX perspective just to see whether – how much of a headwind it was versus what you guys previously assumed?.

Yeah. So currencies moved, primarily Japan and British pound a large part in Q2. So as we entered into that quarter, we were looking at similar FX rates to what we saw at year-end at the end of first quarter. So we didn't have a lot FX impact in Q2 as we gave guidance..

Okay. Okay. And if I think about, I'm looking at the full year revenue guide today. So I think at the midpoint, we're taking down full year revenues by about $21 million. And I just want to make sure I'm clear here. So we're saying that 50% of that cut is tied -- sorry go ahead. I don't want to keep going on top of you..

That's correct. $21 million cut and roughly 50% is the... .

Right. 50% from FX.

And can you explain to me the remainder coming from lower professional services? I just wanted to make sure I understand what was the driver behind that lower demand for that PS?.

Yeah. So as we took a look at the growth in our strategic professional services for this year, we saw a trend up as we put together our guidance. We of course in our professional services have what we refer to as nonstrategic that's coming down and the growth pattern there is not developing at the rate that we saw in the guidance.

And so that's why we're bringing down the professional services side of that..

Okay. Okay. And then just one more if I could. Wanted to see can we give any color on what the total customer base was for MSS or the company's total subscription customer base? I know that we cited the 1,500 customers for Taegis today.

I just wanted to see how quickly customers are migrating or what that MSS base is like as we stand at the end of this quarter?.

Yeah. So as you'll find when you get our Q, it will be 1,900 other MSS customers and combined we've got a total of 3,100 customers..

Terrific. Thank you very much. I'll turn it over to my colleagues. Appreciate it..

Thank you. The final question for today's call comes from the line of Hamza Fodderwala from Morgan Stanley. Please go ahead. Your line is now open..

Great. Thank you for taking my question and good morning, everyone. Wendy, maybe a couple of questions for you. A lot of really great detail on the XDR offering. It seems like you're really ingesting a lot of threat telemetry from a variety of different vectors. I'm just curious around just general market awareness around XDR.

It does seem like there's a lot of marketing out there, yet bottlelogs are still coming through these traditional SIMs.

So what would you attribute that to? Do you think there's just a lot of food in the marketplace if you will and customers will start to understand this technology better as the education of this starts to increase, or is this something that will take time for customers to fully migrate their security analytics approaches towards XDR?.

Yeah, it's a great question. Because if you look at really MDR and XDR, they're still fairly early in the proverbial hype cycle, if you will. So there's a combination of stage of length of time and market and therefore awareness is growing but nowhere close to what it is for more mature established markets like SIM or such.

There's a couple of things that we look to, to see the movement in customer awareness or prospect awareness of what XDR and MDR really mean. And one of those is that the content of RFPs actually naming XDR or MDR instead of SIM or MSSP or those types of things. So that's a good indicator for us that the awareness is growing.

And the second is that we see the customers or prospects joining things like our webinars about how to actually make an easy transition from a SIM to XDR being one of our most subscribed sets of content. So there's definitely now awareness that it is an opportunity in security. I think people are very much in the investigation mode.

And when you show them what it means in terms of effectiveness of security, lower cost to implement maintain and manage the case is getting pretty compelling. And so we are seeing now more customer shifts -- customer acquisition shifts from SIM in fact displacing multiple SIMs in a lot of cases to Taegis. So it's on its journey..

Got it. Got it. And I was wondering if you could just speak around the demand environment. Obviously, Taegis is doing quite well. I think Paul did mention maybe a little bit lower demand for some of the non-strategic services. We've heard from a number of security companies that there were instances of longer sales cycles particularly midway through Q2.

So just curious what you're seeing and maybe what contributed to that lower demand for the non-strategic portion of the business?.

Sure. I'll actually separate those two a bit. I mean, it is our goal to accelerate the transition of the business to shorten that tail if you will and to move some of those service – non-strategic services to partners more quickly while re-solutioning the core business to Taegis. So that is not necessarily a bad thing from our seat.

In terms of sales cycles for Taegis, generally I think we've seen a similar impact from the market, which is you look at the beginning of pipeline healthy, good quality, the time cycle to what we call the technical win, we don't see really being impacted. What we see is the time line from technical win to commercial flows.

That's where we do see a lengthening in the cycle. And there's really two factors typically we see contributing to that. One is additional layers if you will of either procurement or even C-suite review of deals or needing to sign off on things. I think, there's some tighter controls around budgets generally.

And the second one is sometimes there's turnover in the prospect, as the deal is coming to a close and that can pause the process for a bit of a reeducation and a restart. So those are really the two things turnover and extra scrutiny on the procurement side..

Got it. Very clear. Thank you..

Thank you..

Thank you. We now have a follow-up question from Mike Cikos from Needham. Please go ahead..

Hey guys. Thanks for getting me back. I appreciate the fact that [indiscernible] playing here. But on the customer count, I just -- I did want to come back to it.

And I just want to hear your sense on the philosophy or the strategy, right? So, if I'm thinking about the total customer count for MSS today, we're still seeing those declines were down to about 1,900 customers. Taegis' customers are ramping, but on an aggregate basis, Taegis' total subscription customers are still leaking lower.

And I just wanted to see, can you provide us any color you have that offers conviction or confidence in the strategy as far as being able to attack a larger market opportunity or attract more customers to the SecureWorks platform longer term?.

Sure. It's a good question. The -- let me talk a little bit about the average revenue per because the demographic of the customer base is part of the answer on the customer count. So, if you look at the Taegis platform. We are specifically targeting customers who are a minimum of 500 end points or more.

That was not necessarily our approach with the MSSP business. And if you look at the number of customers that were turned from MSSP as opposed to transitioning to Taegis, they've been averaging -- and this is not just this quarter, but through the process on less than $30,000 per.

So there really aren't all ready to -- or have the capacity or willingness to spend the minimum amount for MDR, XDR coverage. So there is some shift in the customers that make sense for the Taegis platform. And you see that in the average across all of the MSSP customers in the mid-80s as Paul talked about and on Taegis being in the $130,000 range.

So we're definitely targeting up-market, up margin and customers who have the ability to expand with us in the future as well. So there is a mix shift in terms of the size that you're seeing in the count and the average revenue..

Got it. Thank you for that. And last one on my side. But just coming back to the gross margins for this quarter, I know that, we had a slight uptick when looking from a year-on-year basis, but it did leak lower from call it like 63% to 64% range, we've been in over the last two to three quarters.

And I just wanted to see at least on a sequential basis, what caused that degradation and how should we be thinking about gross margins for the rest of the year? Thank you..

Yeah. So – yeah. So as we talked about the year, this is the transformation year, and so we'll have certain costs coming in and as we're managing the cost in proportion to that revenue mix, as we bring down the older CTP to the going – Taegis going forward. So it will be certain quarters impacted for some of those costs.

So this quarter gross margins were impacted some of those costs..

Actually, really just a function of the revenue mix shift that's taking place, as well as some of the pressures with – the cost versus the shrinking revenue base in aggregate?.

Yes. .

Right. So, as you see Taegis continuing to expand, you start to get squeezed a bit as you come to the tail end of the CTP platform, and then that overhang, clearly, we've talked before about the $30 million, well $15 million in COGS, $15 million in OpEx of sort of fixed costs on CTP that were sort of duplicatively swallowing this year.

And as we head into next year, and get through the ARR transition, we will see that improvement in cost structure both on the OpEx and the gross margin side as the CTP overhang comes out..

Perfect. Terrific. Thank you. Makes a lot of sense. And I appreciate all the extra detail. Thank you guys..

Yeah. Thanks for the questions, Mike..

Thank you. There are no further questions registered at this time. So I'd like to pass the conference back over to Paul Parrish for closing remarks..

End of Q&A:.

Okay. That wraps up the Q&A in today's call. A replay of this webcast will be available on our Investor Relations page at secureworks.com along with our Q2 web deck with additional financial tables. Thanks again for joining us today. Have a good day..

Thank you..

This concludes today's conference call. Thank you all for your participation. You may now disconnect your lines..