Rapid7 (RPD) Q3 FY2026 Earnings Call: Kern-ARR stabilisiert sich

Wichtigste Erkenntnisse

• Rapid7 schloss das 3. Quartal des Geschäftsjahres 2026 mit 820 Mio. US-Dollar an ARR ab, was 8 Mio. US-Dollar über der eigenen Quartalsprognose lag. Der Gesamt-ARR sank im Jahresvergleich um etwa 2 %, während der Kern-ARR im Vergleich zum Vorquartal unverändert blieb.
• Der Umsatz sank im Jahresvergleich um etwa 3 % auf 212,4 Mio. US-Dollar. Das operative Ergebnis auf Non-GAAP-Basis erreichte 46,2 Mio. US-Dollar, was einer operativen Marge von 21,7 % entspricht.
• Auf Kernplattform-Lösungen entfielen rund 85 % des ARR, der im Jahresvergleich um etwa 1 % zulegte. Der ARR im Bereich Detection and Response stieg um etwa 5 %, während der ARR im Bereich Exposure Management um rund 6 % zurückging.
• Nicht-Kernprodukte machten etwa 15 % des ARR aus und gingen im Jahresvergleich um rund 19 % zurück. Rapid7 evaluiert den langfristigen Weg für diese Angebote und hat den Vertriebsstopp für ausgewählte Standalone-Versionen angekündigt.
• Das Management bestätigte die Prognose für den freien Cashflow für das Gesamtjahr von rund 130 Mio. US-Dollar. Rapid7 plant, vorhandene liquide Mittel zur Rückzahlung von Wandelanleihen im Wert von 600 Mio. US-Dollar zu nutzen, die im März 2027 fällig werden.
• Das Unternehmen strebt die erste allgemein verfügbare Version seines autonomen Security Operations Center rund um die RSAC 2027 an und betont zugleich, dass die Kundenakzeptanz und ein nachhaltiges ARR-Wachstum zukünftige Ziele bleiben.

Wichtigste Finanzdaten

Geschäfts- und operative Entwicklung

Rapid7 konzentriert neue Wachstumsinvestitionen auf Detection and Response sowie Exposure Management. Laut Management trugen ein verbesserter Vertriebsfokus, klarere Zuständigkeiten und eine engere Ausrichtung auf das ideale Kundenprofil des Unternehmens zu einer höheren Produktivität des Vertriebspersonals und einer besseren Umsetzung sowohl bei Neubuchungen als auch bei gefährdeten Vertragsverlängerungen bei.

Detection and Response blieb die stärkste Kernkategorie und hielt ein ARR-Wachstum von rund 5 % im Jahresvergleich aufrecht. Exposure Management schrumpfte weiter, obwohl das Management über eine gute Akzeptanz von Exposure Command berichtete, da Kunden von älteren Produkten zur Schwachstellenverwaltung migrieren.

Rapid7 reduziert den Fokus auf Nicht-Kernangebote. Standalone-Produkte für Cloud- und Anwendungssicherheit werden in den Status End-of-Sale überführt, bleiben jedoch über Exposure Command verfügbar. Digital Risk Protection steht ebenfalls vor dem Vertriebsstopp. Bestandskunden können diese Produkte weiterhin verlängern und erweitern.

Der Großteil der zusätzlichen Investitionen fließt in Produktentwicklung und Engineering. Zu den Prioritäten gehören KI-fokussierte Softwareentwicklung, neue Führungskräfte und technische Talente, Kenzo-gestützte Funktionen, KI-Rechenkapazitäten und Sicherheitsprodukte der nächsten Generation.

Das Unternehmen entwickelt zudem ein KI-zentriertes Servicemodell, das seine Plattform, Security Intelligence, Agenten und menschliche Experten kombiniert. Ziel des Managements ist es, Ergebnisse im Bereich der Sicherheitsabläufe mit einer softwareähnlichen operativen Skalierbarkeit zu liefern. Erste Kenzo-Funktionen werden nach Angaben des Unternehmens von einer wachsenden Zahl von Kunden genutzt.

Prognose des Managements

Das Management erwartet, dass der kombinierte ARR aus Detection and Response sowie Exposure Management im 4. Quartal im Vergleich zum Vorquartal annähernd unverändert bleibt. Es wird erwartet, dass anhaltende Rückgänge bei den Nicht-Kernprodukten den Gesamt-ARR von 820 Mio. US-Dollar auf rund 812 Mio. US-Dollar reduzieren werden.

Rapid7 rechnet im Zusammenhang mit der im August angekündigten Restrukturierung mit Gesamtkosten von etwa 11 Mio. US-Dollar. Diese Aufwendungen werden aus den Non-GAAP-Ergebnissen ausgeklammert. Das Unternehmen hat eine detaillierte Finanzprognose für 2027 auf die nächste Telefonkonferenz zu den Quartalszahlen verschoben.

Risiken und Beobachtungspunkte

• Der Kern-ARR hat sich im Vergleich zum Vorquartal stabilisiert, ist jedoch noch nicht auf einen Wachstumskurs zurückgekehrt.
• Der ARR im Bereich Exposure Management sank im Jahresvergleich um etwa 6 % und liegt weiterhin unter dem vom Management angestrebten Niveau.
• Der ARR bei den Nicht-Kernprodukten dürfte kurzfristig eine Belastung bleiben; das Management wies darauf hin, dass sich der Rückgang nach aktueller Sicht des Unternehmens fortsetzen wird.
• Es wird erwartet, dass sich die Bruttomarge abschwächt, da die AWS-Nutzung, die KI-Rechenkosten und die Investitionen in die Produktentwicklung steigen.
• Die Rückzahlung der im März 2027 fälligen Wandelanleihen wird die Zinserträge aus den liquiden Mitteln von Rapid7 verringern.
• Das autonome Security Operations Center befindet sich weiterhin in der Entwicklung. Das Management arbeitet auf eine erste allgemeine Freigabe rund um die RSAC 2027 hin und beschrieb dies als ersten Produktionsschritt und nicht als fertiggestellte Plattform.

Highlights aus der Fragerunde für Analysten

Stabilisierung des Kerngeschäfts: Das Management führte die sich verbessernde Stabilität auf eine fokussiertere Vertriebsorganisation, klarere Produktprioritäten, ein stärkeres Kundenengagement und eine engere Überwachung großer Vertragsverlängerungen zurück. Die Entwicklung habe sowohl von einem besser als erwartet ausgefallenen Neugeschäft als auch von positiven Ergebnissen bei einigen gefährdeten Kundenkonten profitiert.

Weg zurück zu Wachstum: Laut Rapid7 hängt die Strategie zur Rückkehr zu Wachstum von der kontinuierlichen Umsetzung bei den Kernprodukten, der Ausrichtung auf Kunden mit einer stärkeren Wettbewerbsposition und der Einführung neuer KI-gestützter Angebote ab. Das Management nannte keinen genauen Zeitrahmen für ein positives Gesamtwachstum beim ARR.

Nicht-Kernportfolio: Das Management erklärte, dass die Nicht-Kernprodukte weiterhin gesunde Geschäftsbereiche mit treuen Kunden seien, aber nicht in jene Bereiche passten, in denen Rapid7 nach eigener Einschätzung die klarsten Wettbewerbschancen sieht. Das Unternehmen rechnet damit, nach weiteren Evaluierungen mehr Klarheit über die langfristige Struktur des Portfolios zu schaffen.

KI-Investitionen und Wirtschaftlichkeit: Die meisten Ausgaben fließen in Produktentwicklung und Engineering, einschließlich Personal, KI-gestützter Entwicklungsprozesse und Recheninfrastruktur. Das Management geht davon aus, dass die neue Servicearchitektur im Laufe des Jahres 2027 erste Infrastruktureffizienzen bringt, während Kundenbetreuungs- und Entwicklungskosten während der Übergangsphase weiterlaufen.

Preisgestaltung und Wettbewerb: Das Management gab an, dass bei Kundengesprächen zunehmend Sicherheitsergebnisse, die KI-Strategie und langfristige Produktfähigkeiten statt des Preises im Vordergrund stehen. Zudem sei der Wettbewerbsdruck im Bereich Exposure Management leichter zu handhaben gewesen, da die Kunden mehr Klarheit darüber gewonnen hätten, wo die Produkte von Rapid7 größere Sicherheitsplattformen ergänzen.

Vollständiges Transkript der Telefonkonferenz

Vollständiges Transkript der Telefonkonferenz

Ausführungen des Managements

Operator

Good day, everyone. My name is Alice, and I will be your conference operator today. At this time, I would like to welcome you to the Q3 2026 Rapid7 Earnings Call. [Operator Instructions]

At this time, I would like to turn the call over to Ryan Flanagan with ICR. Please go ahead.

Ryan Flanagan

Thank you, operator, and good afternoon, everyone. We appreciate you joining us. Today, we'll be discussing Rapid7's third quarter fiscal 2026 financial results. We've distributed our earnings press release over the wire, and it can be accessed on our Investor Relations website. With me on the call today are Wael Mohamed, CEO; and Rafe Brown, CFO. [Operator Instructions]

Before I hand the call over to Wael, I'd like to remind everyone that certain statements made during this conference call may be considered forward-looking statements under the federal securities laws. These statements are made pursuant to the safe harbor provisions of the Private Securities Litigation Reform Act of 1995 and include, among other things, our outlook for the fourth quarter and full year 2026, our expectations regarding fiscal periods beyond 2026, our transformation and restructuring initiatives and their expected costs and benefits, our strategy, priorities and capital allocation, including our evaluation of noncore offerings and plans to repay our convertible notes due in March 2027 and the anticipated financial effects, anticipated operational improvements, investments in our core platform and AI capabilities, including the development, anticipated launch timing, adoption and expected benefits of new products and AI-first services, including autonomous SOC and our expected growth drivers and financial performance.

These forward-looking statements are based on our current expectations and beliefs and information currently available to us. While we believe any forward-looking statements we make are reasonable, actual results could differ materially due to a number of risks and uncertainties, including those contained in our filings with the SEC. Reported results should not be considered as indicative of future performance. We do not undertake and expressly disclaim any obligation to update or alter our forward-looking statements, whether as a result of new information, future events or otherwise, except to the extent required by applicable law. Further information on these forward-looking statements and risk factors are included in the filings we make with the SEC, including the section titled cautionary language concerning forward-looking statements in our earnings press release. Additionally, over the course of this call, we'll reference non-GAAP measures to describe our performance. Please review our earnings press release and filings with the SEC for a rationale behind the use of non-GAAP measures and for full reconciliation of these GAAP to non-GAAP metrics. These documents, in addition to a replay of this call will be available on the Rapid7 Investor Relations website. Lastly, I'd like to note that Wael's prepared remarks today are being delivered using an AI-generated version of his voice, and he will respond to questions live during Q&A.

And with that, I'd like to turn the call over to Wael.

Wael Mohamed

Good afternoon, and thank you all for joining. Last quarter, I said the actions we announced were a focused reset. The actions were not the strategy. They gave us focus and room to execute. I also said this would be a multi-quarter journey. Q3 was another step. My read is simple. We delivered what we said. The company is operating with greater focus and discipline, but one quarter of execution is not a return to growth. That work remains ahead. We met our Q3 ARR guidance and core ARR was flat from Q2. That is an early sign of greater stability. It is not yet growth. We also continue to expect to exit 2026 at approximately 20% non-GAAP operating margin. Rafe will take you through the quarter, the year-end outlook and our balance sheet plan.

Last quarter, I asked you to measure us in three ways. First, cash generation. Our cash outlook for the year remains on track, and we are reaffirming our guidance for approximately $130 million of free cash flow. Cash is not the finish line. Durable growth is, but cash tells you whether the operating model is becoming healthier and whether we have the capacity to keep investing. We intend to use cash on hand to retire our convertible notes due in March 2027. After that, the interest income tied to that cash will fall away. Our job is to replace it with more cash generated by the business and carry the discipline behind our year-end margin into 2027. I will leave the detailed 2027 framework to Rafe and our normal guidance process.

Second, execution in the core, especially exposure management. The major investment choices are made. We continue to support customers across our products while placing new growth investment behind detection and response and exposure management. The core is becoming more stable. The operating model is leaner. Ownership is clearer. In exposure management, the work is underway, but it is still not where it needs to be. We will let the evidence speak before we call it progress. We will stay focused on the heart of the enterprise market, customers that need enterprise-grade security, but also need fewer tools, less complexity and faster outcomes. Our strength in the mid-market is proof of what we can do. It is not a limit on where we can win. As I said last quarter, we are changing the path of the company toward durable growth, not managing for one quarter. We also need to be clear about the noncore portfolio. Our noncore businesses have strong technology, loyal customers and efficient operations. The issue is not quality. It is strategic fit. They are good businesses, but they are not the races where Rapid7 has the clearest right to win or where we will place the next dollar of growth investment. We are reviewing the best long-term path for each business under our new strategy. In Q3, we took the first step by announcing the end of sale for selected stand-alone versions. We will continue to support existing customers responsibly and give them clear paths forward.

Third, how we reinvest. As we enter 2027, we will keep shaping the business around the core. The quarters will not all look the same. We will continue to invest behind growth, but the discipline should remain. Discipline creates capacity. Strategy decides where it goes.

One place we are investing is the service layer. Growth starts with winning in our core. The service layer lets us extend that position and deliver the outcome, not only the product. Cybersecurity cannot stop at software that generates more alerts. Customers want continuous monitoring, investigation, validation, response and resolution. This is not a traditional people-heavy service business, and it is not a choice between product and service. Product builds the capability, intelligence informs it. Service delivers the outcome. Agents provide scale. People remain accountable. We are building an AI-first service model where software, agents, intelligence and experienced security experts come together as one system. People decide, agents do. Automation helps us move faster today. Agents let us do more across more data, more steps and at much greater scale. Our ambition is to deliver security operations center outcomes as a service with software-like leverage.

Customers consume the outcome, while automation and agents help our experts serve more customers and complete more work without cost rising one-for-one with demand. That creates a path to stronger service economics over time. That is why Mel Stone's role matters. As Chief Global Services Officer, she brings our global security operations center, MDR, service delivery and intelligence under one leader. Our product and technology team builds the platform and agent foundation. Mel's organization turns that capability into a repeatable service outcome. Under Mel, threat intelligence, vulnerability research, attacker research and labs come together as Rapid7 Intelligence. It closes the loop, turning what we learn into better detections, better service and better protection.

Rapid7 Intelligence is not a stand-alone product. It is the intelligence engine for the Command Platform, our service layer and our autonomous security operations center. Research should not end when it is published. It should end when protection changes.

Last quarter, I said AI needs a foundation, not another feature. Today, I want to introduce the next R in Rapid7, reasoning. The outcome must be resolution. Detection without reasoning creates volume. response without context creates motion, resolution creates value. More and more, the next cyber fight will be machine against machine. Defense must move at machine speed, but inside clear human boundaries. At our Boston Customer Summit, we walked customers through the model we are building, three colors, mission. Red agents probe like an attacker. Blue agents investigate and respond like a defender. Orange agents reason across both and help guide the safest path to resolution. People set the mission, policy and limits. People remain accountable. Kenzo is moving from acquisition to adoption. A growing number of customers across our base are now using early Kenzo-powered capabilities, giving us real-world feedback as we build toward our autonomous security operations center.

As we design and build it, the Autonomous Security Operations Center is a governed system where people, intelligence and red, blue and orange agents work together. The service model is designed for different ways to consume it, run by Rapid7, operated with the customer or added as an assurance layer above the customer's own security operations center. One service mission, different ways to consume it, AI first, vendor-neutral and sovereignty aware.

The summit was an important checkpoint. We showed what is operating today, what is in proof and what remains ahead. We tested where agents should act, where people must remain involved and what evidence is required to trust the outcome. That work is shaping the capability, the guardrails and the service model. Based on our current progress, we are working toward our first generally available release around RSAC 2027. We view that as version 1.0, not the finish line, but the first production step in a long and exciting journey toward increasingly autonomous security operations.

We are also working with leading partners across cloud architecture, advanced models and accelerated computing. Together, we are testing how the system performs before customers depend on it. Measure us across quarters by our cash generation, by execution in the core, including clear progress in exposure management, by how we reinvest and by whether that work becomes customer adoption, ARR growth and stronger long-term value. We are not declaring victory. We are building proof. We delivered what we said. Now we must turn that work into durable growth. My commitment remains the same, clear words, fast action, long-term thinking, and we own the result.

Rafe, over to you.

Rafeal Brown

Thank you, Wael, and good afternoon, everyone. As a quick reminder, unless otherwise noted, all numbers, except revenue and balance sheet items mentioned during my remarks today are non-GAAP. Please refer to our earnings release and SEC filings for additional details regarding the presentation of our results and guidance metrics.

In the third quarter of 2026, I'm pleased to report that we exceeded expectations across all guided metrics. We ended the third quarter with total ARR of $820 million, $8 million above our guidance for the quarter. We reported non-GAAP operating income of $46.2 million. Free cash flow came in at $26.5 million. As of the end of the quarter, we had total cash, cash equivalents and short-term investments of $732 million. We are particularly pleased with these results as the team remained incredibly focused on our customers and executing against our plan even as the company undertook a significant restructuring in the quarter.

I want to begin by taking a closer look at ARR as of the end of the quarter. As a quick reminder, our long-term strategy is focused on our core platform solutions comprised of our detection and response business, which includes our managed detection response offering and our exposure management business. Our core platform solutions now represent approximately 85% of overall ARR, reflecting the gradual mix shift of our business towards our core products, which on a year-over-year basis, grew approximately 1%, led by our detection response business, which at over 55% of total ARR maintained its growth rate at approximately 5% on a year-over-year basis. Our exposure management business declined approximately 6% year-over-year, offsetting some of the growth of our D&R business. Within the Exposure Management segment, we continue to see healthy adoption of our Exposure Command solution as customers upgrade from older vulnerability management solutions. In contrast to the growth of our core solutions, our noncore products, which, as a reminder, approximately 15% of total ARR declined approximately 19% year-over-year, driving the approximately 2% year-over-year decline we saw in total ARR. This drop in noncore ARR was in line with our expectations as we have deemphasized the sales of many of these noncore solutions.

As we plan for the remainder of 2026 and beyond, each of the noncore solutions are being carefully evaluated, ensuring we optimize margins as well as seeking opportunities to migrate customers to core platform offerings where possible.

Our favorable ARR performance in the third quarter reflects our strategic focus on building and selling our core solutions and focusing our go-to-market efforts on customers within our ICP. This effort led by our Chief Commercial Officer, Allan Peters, is demonstrating tangible results as we saw productivity per rep show notable improvement over the prior year. Beyond the numbers, we saw demonstrations of this strategy paying off in key wins during the quarter such as a new logo win from a global facilities management and property support services company who turned Rapid7 for both MDR and Exposure Command out of frustration with their incumbent provider for a lack of innovation and limited AI strategy.

In Europe, a large religious organization recognized the benefits of consolidating their cyber needs across a single platform and purchased MDR, Exposure Command and our cybersecurity compliance solution. In a third example, a national U.S. manufacturer came to Rapid7 looking for a provider that could understand its business and security environment and restore confidence in running a managed SOC after a failed prior implementation with a competitor. We positioned our MDR, Exposure Command and Vector Command solutions for a comprehensive end-to-end solution. These wins and more like them demonstrate our product and go-to-market team's focus on selling our core solutions into our target market.

Within the product organization, our new Chief Product and Technology Officer, Dan Deklich, now five months into his role, is making sweeping changes and has started making investments across the product and engineering organization. He has accelerated his investments into our products by rebuilding his leadership team with experienced product and AI leaders, deploying and training the team on a modern AI-focused SDLC and launching the development of our next-generation solutions. These efforts are core to the anticipated 2027 launch of the AI-enabled solutions needed to address the dramatically more dangerous cyber environment our customers are facing.

Returning now to our financial statements. Total revenue of $212.4 million declined approximately 3% year-over-year, reflecting the declines in noncore product ARR we saw earlier this year. We finished the quarter with approximately 11,800 customers and an average ARR per customer of approximately $69,000.

Turning to third quarter profitability. We delivered total non-GAAP gross margins of 72.2%, which we expect to moderate in Q4 and beyond as AWS and AI charges ramp. We reported non-GAAP operating income of $46.2 million or a margin of 21.7%, favorable to our guidance. This upside to profitability drove non-GAAP earnings of $0.60 per diluted share. Free cash flow totaled $26.5 million in the third quarter. Our GAAP financial statements also include a $5.5 million noncash charge for the full write-down of a minority investment made in the prior year. The charge appears in our GAAP income statements under other income and expense. From a balance sheet perspective, we ended the third quarter with $732 million in cash, cash equivalents and short-term investments. Combined with our continued free cash flow generation and a $200 million undrawn credit facility, we are well positioned to repay our $600 million convertible notes due in March of 2027.

Turning to the restructuring announced last quarter. This restructuring marked a strategic shift in our business operations to drive efficiency and focus across the organization, aligning resources and investments to our core platform solutions. We also created capacity to increase our investments in cutting-edge AI-driven solutions that will improve customer experience and increase competitiveness in the marketplace. As noted above, this investment is underway, but it will continue into 2027 as we build out our leadership and team within the product and engineering organization as well as ramp AI-related compute costs. We continue to expect to incur total charges related to the restructuring announced in August of approximately $11 million. In addition, the company continues to evaluate opportunities for further efficiency. These restructuring charges will be excluded from our non-GAAP P&L results.

This brings us to guidance. We expect to end the fourth quarter with ARR of approximately $812 million. And on a sequential basis, we expect that ending ARR for our combined core platform solutions of D&R and Exposure Management will be approximately flat quarter-on-quarter with expected continued sequential ARR decline coming from our noncore offerings. For the fourth quarter, we expect total revenue in the range of $208 million to $210 million, a year-on-year decline of approximately 4% at the midpoint. This would bring our full year 2026 revenue to $841 million to $843 million, a decline of approximately 2% at the midpoint and continuing to reflect the decline in ARR we have seen year-to-date. Fourth quarter non-GAAP operating income is expected to be in the range of $40 million to $42 million, even as we have accelerated some product and engineering hires into the quarter. This would bring our full year 2026 non-GAAP operating income to $140 million to $142 million, an increase of approximately 4% at the midpoint or a full year non-GAAP operating margin of 17% at the midpoint. Fourth quarter non-GAAP earnings per share are expected to be in the range of $0.53 to $0.55 per share on approximately 82.1 million fully diluted shares. We continue to expect free cash flow of approximately $130 million for the full year.

To sum up, we executed well in Q3 and are doubling down on our prioritization efforts to invest in and improve our core product offerings, even while we maintain our focus on opportunities for cost management and improved efficiency, all of which gives us confidence in where Rapid7 is headed in its transformation.

And with that, I'd like to turn the call over to the operator for Q&A.

Operator

[Operator Instructions] Your first question comes from Brian Essex with JPMorgan.

Fragen und Antworten

Brian Essex

Congrats on the better results. It's great to see the stability in the operations. I guess maybe to start, Wael, could you maybe walk us through, I guess, the profile of the sales organization, the changes that you've made there, how it was affected by the restructuring? And do you have the retention there that you need to build the maturity that's required to put yourself in a better position for growth next year?

Wael Mohamed

Thanks, Brian. Great question. As you are aware, as I mentioned last call, I've been in the Board for over a year prior to me taking the CEO job, and I was part of the team that actually did the search and the appointment of Allan Peters, our CCO. So we've actually been working in the background, making sure that we have a sales organization that both stable and it can be able to actually help us through growth. So I feel very good about what we have right now and what Allan has been doing prior to me joining as a CEO and been working very closely in the last few months as we evaluate the resources, what is the best way to utilize them. And most importantly, as Dan basically catch up with all the great work he's doing on his end that we'll be ready with the expertise to be able to take that to market.

We have a big base of customers. That's really our focus right now, making sure that these customers are served, understand exactly where we're heading. We had actually a customer summit in October where we brought in a sample of our customers here in Boston, around 50 customers from all over the world to be able to test our story, our road map, also get some really frank feedback about where we are and where we're heading. We showed them what we have right now, what we're building and our vision, and it was extremely positive. It was not only positive for our customers, but it was very positive to our team. And I feel very good about how the team is actually organized right now.

Brian Essex

Great. Maybe if I could follow up on that, too. Like what -- how does that reflect to what you're seeing in the pipeline? Do you have -- do you have a building pipeline in your core business right now that gives you confidence in growth next year? Or do you feel like maybe it's reliant on the products that you need to deliver like what you're planning for RSAC 2027?

Wael Mohamed

That's a great question. And sometimes the apple-to-apple is something like this is my first year here. Alan has been a little bit over a year. He feels very good about basically building the pipeline. I think we were always going to try to be able to put more investment in the area that we believe we can get more return. But the discipline, the sales process he and his management team have put in place, it gives us really a good feeling and confidence that we have the system we need to be able to basically lean on.

Operator

Your next question comes from Mike Cikos at Needham.

Michael Cikos

And I like the comments as far as the stability that you guys are starting to demonstrate here. Wael, if we could just come back to the prepared remarks, can you just peel back the layers on the services component that you were speaking to as far as what the investments are that are required? How we should be thinking about those initiatives as far as execution and how that's expected to transpire in the model?

Wael Mohamed

Absolutely. One of the great things, as I came to the company, I was telling the team the other day, the more I dig, the more gold I find, and we have an abundance of data. And as you know, we're not only providing our product as a software. We provide a service layer in the form of our SOC, where customers entrust us with all the form of data, so we can be able to help them to find that needle in the haystack. And we've done a very good job servicing plenty of customers that basically we process, I want to say, in the tune of maybe 250,000 alerts a day, over a terabyte of data that we crunch. And we know that as we move to the Agentic layer, this data will be definitely what we need.

But one of the things I needed Mike to do is, as I was sitting with my top team, I'm surrounded with an incredible team, Rafe, my CFO; and Allan, my CCO; Dan, our CPTO and Katie, my Chief People Officer, I knew that I needed to have another senior person that all think about how are we going to deliver this service layer at a software economics. That's extremely important. And I believe that's the future, not only for our company, but actually in our industry.

Cybersecurity wanted to be delivered as a service. There's always a problem how to be able to do that with the right margins. And that's really a major focus to the team. So that's why the addition of Mel, Mel has many years of basically experience in high-scale service delivery in the U.S. military and the command center and bring her to our team and bring that deep expertise and the focus, if you will. So that's basically when you peel the onion, this is the layer that I'm very excited about it, the data fabric and on top of that, the service layer that we can be able to deliver it at a software economics, if you will.

Michael Cikos

Excellent. And for the follow-up for you or for Rafe here, but I know that you were talking about the restructuring and how it's freeing up capacity to make additional investments. Some of those investments obviously already underway. Others expected to begin in calendar '27. Can you help us think a little bit more about where those investments are going to be taking place? Is it more on product and getting product ready in preparation for RSA as an example? Or is it feet on the street and reorienting the go-to-market? Can you just help us think about those AI-driven investments that you guys are alluding to?

Rafeal Brown

Yes. You bet. Thank you. The majority is really within the product and engineering organization. I touched on some of the work Dan is doing, making changes on the leadership level, bringing in new talent to really build this modern AI-enabled SDLC, right? And that's some different players that some different leaders, but it's also putting AI to work for us in a lot of ways. So there's certainly an element of that throughout the R&D organization where there's investment on that side of it.

But then the products we're talking about here, even if it's Kenzo from the acquisition last year as we're getting ready to roll that out, but also the new products that Wael referred to earlier, both of those take investment from the team. It's people working on them, but it's also the technology and the compute, if you will, the AI-driven compute to make them come to life. And so there is investments going on in that area. But the quick summary is really within the product and engineering is where we're seeing the bulk of it.

Operator

Your next question comes from the line of Eric Heath at KeyBanc.

Eric Heath

Well, maybe just to ask on the noncore business, if I could. I know you're evaluating some options and thinking about it carefully. But just any further color you can share on how you're thinking about that noncore business, some options and maybe the time line you're thinking of when you'd like to be able to come to a resolution on that. And once we get past kind of that decision or that time line, then we could see kind of the growth start to reaccelerate from there.

Wael Mohamed

Yes. Thanks, Eric. That's a great question. Look, I always tell my team is actually, as we set the strategy, it's what's harder than basically deciding what to do is deciding what not to do. So the first few months, I spent a lot of time with customers, with partners, with my team, talking to basically some advisers to try to figure out what we have and what we need to be able to focus on. And we feel we have a very, very strong understanding of the interconnectivity and all the connected tissues of our platform and our products. So we have a set of what we call noncore. Noncore does not mean they are not important. They are actually healthy business. We have customers that they are loyal, and they are actually produce margins, and we did not take that decision by placing them noncore lightly.

For me, a core is a big part of the business that I'm considered the leader. I have the right to be invited and I have the right to win, and I need to put every single dollar of investment behind that so I can get my fair and in some cases, my unfair share. The noncore, it is basically a set of products that we do not have the right to win those races, not because we do not have a good product, but we don't have the size and the invitation to put us in the top 3 at the selection level. So that's kind of basically the definition.

So that Phase 1 was done. The end of sale announced to the customers. We spend a lot of time to making sure that these customers understand why we did, what we're doing and understand our strategy and why we're the partner for them in the long run. And we're getting a lot of positive feedback about the transparency and the decisiveness in that decision. Number two is we need to figure out what is the best thing we need to do for the shape of the overall business. That's why managing that runoff has to be very carefully assessed. We feel that it will not be symmetric, but we're hoping in a short order, we will basically have a better answer for the best way to manage that noncore.

Eric Heath

That's great. And then quickly, one for Raf3. Sorry if I missed it. But last quarter, I believe we were talking about growth in free cash flow dollars in '27. So I'm just curious if that was still the guardrails that you're thinking about.

Rafeal Brown

Yes. Thank you. We are going to defer all '27 guidance to our next earnings call.

Operator

Your next question comes from the line of Saket Kalia with Barclays.

Saket Kalia

Wael, maybe for you just on the core business. It feels like based on the guide for Q4, it feels like the retention rates there might be starting to stabilize or churn may be improving said a different way. What do you find is working there?

Wael Mohamed

Then focus and the clarity to the team, and you probably saw it from Rafe script where you can see the shape of the business is moving from 80-20 approximately last quarter to an 85-15. So our sales team, our sales organization has basically got their marching orders. It's already been moving in the right direction, all hands on deck. Our precious customers, we are basically providing them with clarity with a road map, where we're going to be in the future and most importantly, how we're making sure that the outcome they're expecting from us is fulfilled and basically get closer. So that focus is really -- is helping, and we feel good about basically our efforts now is moving the needle for sure.

Rafeal Brown

Yes. And the one thing I would add there is that as Wael mentioned, the organization has been extremely focused. That move, we've been calling out the last couple of quarters, more than 80%. I wanted to update people on the current blend. And you also saw the growth rate of our D&R business was the same last quarter to this quarter. So we're feeling like we're pleased with the work the team is doing. That focus is paying off, I think, is really helpful.

Saket Kalia

Yes. No, it makes a lot of sense. Rafe, maybe for my follow-up for you. We mentioned some end-of-life products. I know we're not talking about 2027 again, but just to sort of contextualize when that end of life would start to impact ARR. Could you just remind us what are the products that are going to be end of life? When will they be end of life? And roughly how much in ARR do they contribute currently?

Rafeal Brown

Yes. Thanks, Saket. And just to clarify because it's hotly detailed around here, it's end of sale. So one of the things that we have in our noncore -- noncore is not one thing. It's quite a large range of offerings. But for example, our cloud and our AppSec solutions are end of sale as stand-alone solutions, but they are still available when you buy an exposure command solution where they're part of this overall set. And so that's one of the subtle distinctions here.

What we want the team to be doing is selling this -- the bundled solutions, if you will, or the combined solutions because that's where the customer gets much more value, and that's where we differentiate and really stand out. So cloud and AppSec are two pieces in there. Within the threat intelligence area, our digital risk protection, we're into sailing on that one. We still have a good deal of customers that will continue to use it. You can still renew, you can still buy more if you're already a customer. But we want that sales focus on selling our core solutions. And so we've announced that. It will take a few months before it becomes official. But even this year, when we look into it, the comp plan was already favoring our core solutions.

The comp plan, of course, set back in January. We'll continue that push, right? We can move a lot of it. So it's a relatively small number of new sales that were going to these products this past year. We're just going to be real crisp and clear with everybody about our go-to-market efforts, how we focus on that core product solutions.

Saket Kalia

Makes a ton of sense. It really just simplifies the price list is how I read it. And thanks for clarifying that it's an end of sale and not an end of life.

Operator

Your next question comes from the line of Josh Tilton at Wolfe Research LLC.

Joshua Tilton

Maybe just two quick ones for me. Rafe, I preface the next -- my first question with, I really appreciate all the disclosure and the color that you give us into the moving pieces behind ARR. But if you kind of take away the segments, the categories, what they're called and we simplify it down here, are you outperforming ARR more than you did last quarter because things that are good are getting better? Or are you outperforming ARR more this quarter than last quarter because things that have been a drag have been less of a drag?

Rafeal Brown

Yes, that's a great question. I think especially if you look relative to our guide, like as I called out in the prepared remarks, we went into the quarter knowing we're doing this restructuring and knowing that can be -- that is a tremendous distraction to the team, yet we saw the team execute well. We saw -- and it was split, frankly, between the new booking side of the house. It's still not the answer we want a few quarters from now, but we did better than we thought we would on new. We also had some notable good news on some of the accounts that were at risk in the quarter.

So I don't want to overstate this. It's subtle elements, but I felt like within some of the core solutions, we saw the team really rallying and hustle in and working well with our customers where we were able to achieve a better result than we had anticipated when we gave our guidance.

Joshua Tilton

Okay. And then maybe just my follow-up. I couldn't help but notice the guidance for Q4 ARR is kind of in line with how you guided this quarter. Like maybe signaling aside and all that, like what gives you the confidence to guide in a way that kind of makes us feel like we could see the end of ARR declining on a sequential basis?

Rafeal Brown

It wasn't centered around that. I will just tell you straight away. We are calling out that we will see a decline from the $820 million that we finished at down to the $812 million that we guided to. That said, like it's more just the way the math worked out that it happened to be the same number in all fairness. We go through like really exhaustive efforts with the team, with the RevOps team, with the sales leaders to make sure we have just as much visibility as we can about how bookings are going to come in, how renewals are going to come in to really do our best to form our guidance. And that's the hard work that goes into this to try to do our best and provide insight wherever we can.

I did call out in the script that we expect that core will be approximately flat sequentially and noncore will be what pulls the ARR down as we go forward. And frankly, we do expect that pattern is going to continue into the near future that we have visibility to. That's a key element of where the business is just as we really focus everybody on core and get these new products out and hope to build growth there. But that noncore drag is going to continue for a little bit.

Operator

Your next question comes from the line of Shrenik Kothari at Baird.

Shrenik Kothari

So, Wael, you had previously highlighted this particularly attractive customer segment of $100,000-plus opportunity. And today, you and Rafe pointed to improving productivity and also focusing on this ideal customer profile is beginning to produce these results. So just wanted to unpack like how is that opportunity developing in practice? Are you seeing these sort of average deal sizes in that range holding up as you become more selective? And also are you seeing a larger proportion of the new logos coming from these customers or not? Then I have a follow up.

Wael Mohamed

Yes. As I mentioned, when we basically start focusing on the core, we also wanted to tune our ICP and the area that is very natural to us, and we have a very, very positive basically customer pull. So as we are aligning this, we're feeling good about basically the shape of the business. We're very natural in what I call it the heart of the enterprise. The companies that basically want to rely on us to take complex basic security jobs and simplify, provide them with a 724 around the world basically solution that they can be able to digest and ensure that they are basically more secure with us. We see that all the time. We see it even when we go and get into a side-by-side with one of our competition, how it's very natural when we are in our ICP that the deal can happen faster and quicker and our value proposition is more clear. So as the team is seeing that, I think our shifting is becoming easier and give us the confidence to actually put the wood behind there, if you will.

Shrenik Kothari

Got it. Very helpful. And a follow-up for -- you had previously acknowledged some near-term cloud cost pressure associated with Kenzo development testing. And today, you did mention the SOC efficiency still largely ahead and while also expanded on the AI-first service model to allow agents to support more customers without rising costs. So just -- I know you plan to provide more formal guidance in the coming quarter around that transition. But just how should we think about the magnitude and the timing of the transition? If you can just highlight like the progress there?

Rafeal Brown

Yes. So I think the best way to think about the investments that are going on there, they're going to -- we're in kind of early stages, and we're in a little bit of, frankly, a time where we're developing that next generation or developing those products and solutions, but we still have to provide good support of our customers as we go through this, right? So we're building efficiencies in, and we'll start to see the fruits of that. We'd like to think over the course of 2027.

Wael mentioned in his prepared remarks, some of the Kenzo infrastructure, we're starting to move customers over that in their earliest stages and getting that up and running. So we're making very nice tangible progress. But that -- those offerings do a couple of things. They provide better service to the customer, and then they're going to also help us build greater efficiencies into our infrastructure.

Operator

Your next question comes from the line of Matt Hedberg at RBC.

Matthew Hedberg

Just one for me. There was -- obviously, we all saw the PHP vulnerability a couple of weeks ago. I'm just sort of curious, I don't think you mentioned in the prepared remarks, but any sort of comment on how something like that or other AI-based vulnerabilities might become a bit more of a tailwind for your business?

Wael Mohamed

Sure. Absolutely. You know what? When I talk to customers every single day, I find myself have to answer those questions. And they really appreciate the efforts and the work we're doing to make sure that we're ahead, the amount of information we provide them, the partnership that we're doing right now with the frontier labs and making sure we're in the front end and working with them so we can basically be prepared.

So we're having those conversations all the time, and it's top of mind. And I'm very excited that some customers actually seek us and ask us what we think and we basically have a very constructive conversations about how we assist them. In this incident, we were prepared. We had the advisory, we had the information.

Our team was in front of it. We informed our customers. We've taken some of the calls and we assist them, sometimes assist them in their internal communication as we're finding that more of the executive and even the Board is asking about the status. And we're adjusting to making sure that our information is not only technical, but can also address the business needs.

Operator

Your next question comes from the line of Adam Borg at Stifel.

Adam Borg

Maybe while on the changes that we've been making here, how do we think about the progress that you're seeing both in North America and international? Obviously, international is on a much smaller base, but seeing continued growth there with some lower pressure in North America. I assume that has to do with some of the mix. But any color on kind of the drivers of the two and then the opportunities that you see?

Wael Mohamed

Yes. For me, I can't wait to basically see international do what I'm used to and what I love. we're making huge progress in the U.S., and I still think there's a lot of room as we focus in our -- basically our ICP and our core area. So the team is definitely ultra focused to making sure we have the right investment in the right area, and we have the right upside.

We have a decent international business, but there is a lot of upside. And we are starting to basically plan for next year, what is the appropriate investment and what areas where we can basically get some low-hanging fruit, and there is a lot of great conversations happening on that front.

Operator

Your next question comes from the line of Gregg Moskowitz at Mizuho.

Gregg Moskowitz

Great. Rafe, you mentioned earlier that there was some good news with respect to some accounts that were perceived to be at risk this quarter. Anything that you can share anecdotally in terms of what it was that resulted in these accounts deciding to remain in the fold with Rapid7 as opposed to perhaps going elsewhere?

Rafeal Brown

Yes. I think what I would point to is like the team is incredibly focused on making sure we're providing good services to our customers. We have regular calls with the team where we go through all the accounts. And on those calls, you've got Adam and his -- we got Dan and his leaders on the call as well as Alan and his leaders on the call. And we're looking at that several quarters ahead. Like we're just really trying to focus. And that tends to be on the more senior level accounts or the bigger accounts, but that focus of engagement and getting out in front of those accounts if somebody is having some struggles two, three quarters before the renewals up gives us the flexibility to get in and make a difference. And so some of that effort is stuff we started much earlier in the year, but we're still meeting as a team on a regular basis where we're all there to rally around.

And I just think that kind of discipline, but also just that focus on customer first makes a difference. And you don't get them all, but you make a difference to some of those accounts and you're able to satisfy the customer and they appreciate the focus and you can get your renewal.

Operator

Your next question comes from the line of Gray Powell at BTIG.

Gray Powell

Congratulations on the better-than-expected results. So I think you may have hit on this already, but I just was hoping to get a little bit more color. So I mean, it was good to see detection and response ARR stable at 5% in Q3. It was growing mid-teens a year ago. So I guess my question is, do you think you can get back to that historical growth rate? What needs to happen? And is it more on the product side? Is it execution or something else that maybe we're not thinking about?

Wael Mohamed

It's a great question. And I agree that this segment is growing, and we need to do better to actually earn our fair share as we used to do before. I think the main thing we needed to do and we're already doing is focusing on the ICP where we actually have the highest possibility for. As we move some time maybe in the ultra large, we basically had some headwind and that basically consumes some of our energy. Now as we corrected that and going into the sweet spot where we are designed and we have the right to win, we are seeing a lot of positive basically movement in the right direction. So that's the #1 thing.

As we also start talking to the customers more, as we said, we increased our engagement with our current customers basically about the future, the road map, what we're believing the future looks like, some of the work we're doing and the exciting work in agentic world and the investment we're making, I think that, that definitely helped customers to see that not only we can serve them today and we should have our fair share, but we should be the right partner for them tomorrow as well.

Operator

Your next question comes from the line of Joseph Gallo at Jefferies.

Grant Darling

This is Grant Darling on for Joe Gallo. And I'll ask them as a two-parter. Maybe to start, there's been a lot of rhetoric from platforms and new entrants around expanding capabilities and exposure management. Are you seeing any change in customer buying behavior or sales cycles as that competitive landscape evolves? And then just to go ahead and follow that up, are you seeing any pricing pressure from privates, particularly impacting margins in MDR?

Wael Mohamed

Very good questions. So in the first part, yes, that was the case in the beginning of the year. And as reality hit we're finding actually ourselves having more of a cooperative conversations with some of the big platforms and basically as customer realizing that what we do is an adjacent, it's not an overlap. And we're seeing that pressure of that as basically more clarity, more engagement with customers, more explaining where we fit and what our value proposition. We believe we have a pretty strong value proposition. And as we engage with the customer, I think that's getting a lot easier.

What was the second part? My apologies.

Grant Darling

Yes. Just any pricing pressure coming from private? Just kind of when you think about your margins in India, are you seeing anything there or things pretty steady?

Wael Mohamed

As I said, as our sales team now is focused on the core, and they basically have more of a clear ICP where we have a high level of winning. We have an incredible amount of reference customers over -- as you know, over 10,000 customers. We have a big scale. When we get in there, I don't think customers really are as price sensitive as you were before. They're more looking for a partner that can address today and the future. And they are more interested about what is exactly your AI strategy, how are you going to get there and basically how you can be able to cover me. And what are you thinking about now the Agentic world and some of the risks associated with it. So we'll find ourselves in the last mile talking about that more than talking about price.

Operator

Your next question comes from the line of Rudy Kessinger at D.A. Davidson.

Benjamin Smith

This is Ben Smith on for Rudy. I was going to ask on the stand-alone products that you're doing end of sale on, have there been any customers that have expressed interest or purchased packages so they can still use those products? And then I had a follow-up.

Rafeal Brown

Yes. I would first say part of the end of sale thing is they can keep utilizing the products, right? We're not taking anything away from them because we're not end of life now. So customers can renew existing customers, if they need more to expand, that's still a thing. So I think just that subtlety on that end of sale. And keep in mind, a good deal of our customers might have other products with us and also these stand-alone products that we have in the noncore bucket. So that was a long way of saying, yes, customers are still interested in buying us the ones that are on many of these products.

Benjamin Smith

Got it. And then yes, maybe bigger picture, you're not giving 2027 color. But just want to ask, do you feel that core is now stabilized? And what would give you -- what could you point to that's giving you confidence that, that can drive maybe a return to positive ARR growth?

Rafeal Brown

Yes. Look, I think it is nice to see the year-over-year growth rate in the same two years -- or two quarters in a row, if you will, the sign of stabilization. I did call out that we expect it to be roughly flat on a sequential basis. That's clearly not where we want to be, but it's where we are and how we're looking at the numbers. We have confidence though that we can get to return to growth because we're focusing on our core like never before. We've got some really great things in the pipeline for new products that will be in the core new product offerings and expansion. And just the way the product team is digging in to focus on those core offerings.

I think all of that adds up to a time where you feel better about the direction and the strength of the company and its focus, combined with the fact that the world needs our products more than ever because of all the changes in the broader macro. That's what excites us and makes us think that we can -- we're sitting on top of an opportunity that's going to take work and it's going to take time. But we think we can turn that into growth down the road.

Operator

At this time, we have reached the end of our question-and-answer session. We thank you all for your questions, and you can now disconnect your lines.