Cuộc họp công bố kết quả kinh doanh Quý 3 FY2026 của Rapid7 (RPD): ARR cốt lõi ổn định

Thông tin chính

• Rapid7 đã kết thúc quý tài chính thứ 3 năm 2026 với 820 triệu USD ARR, cao hơn 8 triệu USD so với dự báo hàng quý của công ty. Tổng ARR giảm khoảng 2% so với cùng kỳ năm trước, trong khi ARR cốt lõi đi ngang so với quý trước.
• Doanh thu giảm khoảng 3% so với cùng kỳ năm trước xuống còn 212,4 triệu USD. Thu nhập từ hoạt động phi GAAP đạt 46,2 triệu USD, tương ứng với biên lợi nhuận hoạt động 21,7%.
• Các giải pháp nền tảng cốt lõi chiếm khoảng 85% ARR và tăng trưởng khoảng 1% so với cùng kỳ năm trước. ARR mảng phát hiện và ứng phó tăng khoảng 5%, trong khi ARR mảng quản lý rủi ro phơi nhiễm giảm khoảng 6%.
• Các sản phẩm không cốt lõi chiếm khoảng 15% ARR và giảm khoảng 19% so với cùng kỳ năm trước. Rapid7 đang đánh giá hướng đi dài hạn cho các giải pháp này và đã thông báo ngừng bán một số phiên bản độc lập được lựa chọn.
• Ban lãnh đạo tái khẳng định dự báo dòng tiền tự do cả năm khoảng 130 triệu USD. Rapid7 dự định dùng tiền mặt hiện có để thanh toán 600 triệu USD trái phiếu chuyển đổi đáo hạn vào tháng 3 năm 2027.
• Công ty đang hướng tới phiên bản phát hành rộng rãi đầu tiên của trung tâm vận hành an ninh tự chủ vào khoảng RSAC 2027, đồng thời nhấn mạnh rằng mức độ chấp nhận của khách hàng và tăng trưởng ARR bền vững vẫn là các mục tiêu trong tương lai.

Dữ liệu tài chính cốt lõi

Hiệu quả kinh doanh và hoạt động

Rapid7 đang tập trung khoản đầu tư tăng trưởng mới vào mảng phát hiện và ứng phó cũng như quản lý rủi ro phơi nhiễm. Ban lãnh đạo cho biết việc nâng cao trọng tâm bán hàng, làm rõ quyền sở hữu và gắn kết chặt chẽ hơn xung quanh chân dung khách hàng lý tưởng của công ty đã góp phần cải thiện năng suất của đại diện bán hàng và thực thi tốt hơn ở cả các hợp đồng đăng ký mới và các hợp đồng gia hạn có nguy cơ mất.

Phát hiện và ứng phó tiếp tục là danh mục cốt lõi mạnh nhất, duy trì mức tăng trưởng ARR khoảng 5% so với cùng kỳ năm trước. Mảng quản lý rủi ro phơi nhiễm tiếp tục thu hẹp, mặc dù ban lãnh đạo báo cáo mức độ chấp nhận Exposure Command vẫn khả quan khi khách hàng chuyển đổi từ các sản phẩm quản lý lỗ hổng bảo mật cũ hơn.

Rapid7 đang giảm sự chú trọng vào các sản phẩm không cốt lõi. Các sản phẩm bảo mật đám mây và ứng dụng độc lập đang chuyển sang trạng thái ngừng bán nhưng vẫn khả dụng thông qua Exposure Command. Bảo vệ rủi ro kỹ thuật số cũng đang chuyển sang trạng thái ngừng bán. Khách hàng hiện tại có thể tiếp tục gia hạn và mở rộng các sản phẩm này.

Hầu hết các khoản đầu tư bổ sung đang được hướng vào mảng sản phẩm và kỹ thuật. Các ưu tiên bao gồm phát triển phần mềm tập trung vào AI, nhân sự lãnh đạo và tài năng kỹ thuật mới, các năng lực do Kenzo hỗ trợ, năng lực tính toán AI và các sản phẩm an ninh mạng thế hệ tiếp theo.

Công ty cũng đang phát triển mô hình dịch vụ ưu tiên AI, kết hợp nền tảng, trí tuệ an ninh mạng, agent và các chuyên gia con người. Mục tiêu của ban lãnh đạo là mang lại các kết quả vận hành an ninh mạng với đòn bẩy hoạt động tương tự như phần mềm. Theo công ty, các năng lực Kenzo ban đầu đang được sử dụng bởi số lượng khách hàng ngày càng tăng.

Dự báo của ban lãnh đạo

Ban lãnh đạo dự kiến tổng ARR kết hợp giữa mảng phát hiện và ứng phó với mảng quản lý rủi ro phơi nhiễm sẽ duy trì ở mức tương đương so với quý trước trong Q4. Mức giảm tiếp tục ở các sản phẩm không cốt lõi dự kiến sẽ làm giảm tổng ARR từ 820 triệu USD xuống còn khoảng 812 triệu USD.

Rapid7 dự kiến sẽ phát sinh tổng chi phí khoảng 11 triệu USD liên quan đến đợt tái cấu trúc đã thông báo vào tháng 8. Các khoản chi phí này sẽ được loại trừ khỏi kết quả phi GAAP. Công ty đã hoãn việc đưa ra dự báo tài chính chi tiết cho năm 2027 sang cuộc gọi báo cáo kết quả kinh doanh tiếp theo.

Rủi ro và các mảng cần theo dõi

• ARR cốt lõi đã ổn định so với quý trước nhưng vẫn chưa trở lại đà tăng trưởng.
• ARR mảng quản lý rủi ro phơi nhiễm đã giảm khoảng 6% so với cùng kỳ năm trước và vẫn thấp hơn mức hiệu quả kỳ vọng của ban lãnh đạo.
• ARR không cốt lõi dự kiến sẽ tiếp tục là yếu tố kìm hãm trong ngắn hạn, với việc ban lãnh đạo chỉ ra rằng đà giảm của mảng này sẽ tiếp diễn trong phạm vi tầm nhìn hiện tại của công ty.
• Biên lợi nhuận gộp dự kiến sẽ hạ nhiệt khi việc sử dụng AWS, chi phí tính toán AI và đầu tư phát triển sản phẩm tăng lên.
• Việc thanh toán trái phiếu chuyển đổi tháng 3 năm 2027 sẽ làm giảm thu nhập lãi liên quan đến số dư tiền mặt của Rapid7.
• Trung tâm vận hành an ninh tự chủ vẫn đang trong quá trình phát triển. Ban lãnh đạo đang nỗ lực hướng tới phiên bản phát hành rộng rãi ban đầu vào khoảng RSAC 2027 và mô tả đây là bước sản xuất đầu tiên chứ chưa phải là một nền tảng hoàn chỉnh.

Tóm tắt phần Hỏi & Đáp với nhà phân tích

Sự ổn định của mảng kinh doanh cốt lõi: Ban lãnh đạo quy sự ổn định đang cải thiện cho bộ máy bán hàng tập trung hơn, các ưu tiên sản phẩm rõ ràng hơn, sự gắn kết với khách hàng mạnh mẽ hơn và việc giám sát chặt chẽ hơn đối với các hợp đồng gia hạn lớn. Họ cho biết hiệu quả hoạt động được hưởng lợi từ cả hoạt động kinh doanh mới tốt hơn dự kiến và kết quả khả quan ở một số tài khoản có nguy cơ mất.

Con đường trở lại đà tăng trưởng: Rapid7 cho biết chiến lược trở lại đà tăng trưởng phụ thuộc vào việc tiếp tục thực thi ở các sản phẩm cốt lõi, tập trung vào những khách hàng mà công ty có vị thế cạnh tranh mạnh mẽ hơn và ra mắt các sản phẩm mới tích hợp AI. Ban lãnh đạo không đưa ra mốc thời gian cụ thể cho tăng trưởng tổng ARR dương.

Danh mục không cốt lõi: Ban lãnh đạo cho biết các sản phẩm không cốt lõi vẫn là những mảng kinh doanh lành mạnh với các khách hàng trung thành, nhưng chúng không phù hợp với những mảng mà Rapid7 tin rằng mình có lợi thế chiến thắng rõ ràng nhất. Công ty dự kiến sẽ cung cấp thông tin rõ ràng hơn về cấu trúc dài hạn của danh mục này sau khi đánh giá thêm.

Đầu tư AI và hiệu quả kinh tế: Hầu hết chi tiêu được đưa vào sản phẩm và kỹ thuật, bao gồm nhân sự, quy trình phát triển hỗ trợ bởi AI và hạ tầng tính toán. Ban lãnh đạo dự kiến kiến trúc dịch vụ mới sẽ bắt đầu mang lại hiệu quả hạ tầng trong suốt năm 2027, trong khi chi phí hỗ trợ khách hàng và phát triển vẫn tiếp tục trong giai đoạn chuyển đổi.

Định giá và cạnh tranh: Ban lãnh đạo cho biết các cuộc thảo luận với khách hàng ngày càng tập trung vào kết quả an ninh mạng, chiến lược AI và các năng lực sản phẩm dài hạn hơn là giá cả. Họ cũng cho biết áp lực cạnh tranh trong mảng quản lý rủi ro phơi nhiễm đã trở nên dễ giải quyết hơn khi khách hàng thấy rõ nơi các sản phẩm của Rapid7 bổ sung cho các nền tảng an ninh mạng lớn hơn.

Toàn văn cuộc gọi báo cáo kết quả kinh doanh

Toàn văn cuộc gọi công bố kết quả kinh doanh

Phần trình bày của ban lãnh đạo

Operator

Good day, everyone. My name is Alice, and I will be your conference operator today. At this time, I would like to welcome you to the Q3 2026 Rapid7 Earnings Call. [Operator Instructions]

At this time, I would like to turn the call over to Ryan Flanagan with ICR. Please go ahead.

Ryan Flanagan

Thank you, operator, and good afternoon, everyone. We appreciate you joining us. Today, we'll be discussing Rapid7's third quarter fiscal 2026 financial results. We've distributed our earnings press release over the wire, and it can be accessed on our Investor Relations website. With me on the call today are Wael Mohamed, CEO; and Rafe Brown, CFO. [Operator Instructions]

Before I hand the call over to Wael, I'd like to remind everyone that certain statements made during this conference call may be considered forward-looking statements under the federal securities laws. These statements are made pursuant to the safe harbor provisions of the Private Securities Litigation Reform Act of 1995 and include, among other things, our outlook for the fourth quarter and full year 2026, our expectations regarding fiscal periods beyond 2026, our transformation and restructuring initiatives and their expected costs and benefits, our strategy, priorities and capital allocation, including our evaluation of noncore offerings and plans to repay our convertible notes due in March 2027 and the anticipated financial effects, anticipated operational improvements, investments in our core platform and AI capabilities, including the development, anticipated launch timing, adoption and expected benefits of new products and AI-first services, including autonomous SOC and our expected growth drivers and financial performance.

These forward-looking statements are based on our current expectations and beliefs and information currently available to us. While we believe any forward-looking statements we make are reasonable, actual results could differ materially due to a number of risks and uncertainties, including those contained in our filings with the SEC. Reported results should not be considered as indicative of future performance. We do not undertake and expressly disclaim any obligation to update or alter our forward-looking statements, whether as a result of new information, future events or otherwise, except to the extent required by applicable law. Further information on these forward-looking statements and risk factors are included in the filings we make with the SEC, including the section titled cautionary language concerning forward-looking statements in our earnings press release. Additionally, over the course of this call, we'll reference non-GAAP measures to describe our performance. Please review our earnings press release and filings with the SEC for a rationale behind the use of non-GAAP measures and for full reconciliation of these GAAP to non-GAAP metrics. These documents, in addition to a replay of this call will be available on the Rapid7 Investor Relations website. Lastly, I'd like to note that Wael's prepared remarks today are being delivered using an AI-generated version of his voice, and he will respond to questions live during Q&A.

And with that, I'd like to turn the call over to Wael.

Wael Mohamed

Good afternoon, and thank you all for joining. Last quarter, I said the actions we announced were a focused reset. The actions were not the strategy. They gave us focus and room to execute. I also said this would be a multi-quarter journey. Q3 was another step. My read is simple. We delivered what we said. The company is operating with greater focus and discipline, but one quarter of execution is not a return to growth. That work remains ahead. We met our Q3 ARR guidance and core ARR was flat from Q2. That is an early sign of greater stability. It is not yet growth. We also continue to expect to exit 2026 at approximately 20% non-GAAP operating margin. Rafe will take you through the quarter, the year-end outlook and our balance sheet plan.

Last quarter, I asked you to measure us in three ways. First, cash generation. Our cash outlook for the year remains on track, and we are reaffirming our guidance for approximately $130 million of free cash flow. Cash is not the finish line. Durable growth is, but cash tells you whether the operating model is becoming healthier and whether we have the capacity to keep investing. We intend to use cash on hand to retire our convertible notes due in March 2027. After that, the interest income tied to that cash will fall away. Our job is to replace it with more cash generated by the business and carry the discipline behind our year-end margin into 2027. I will leave the detailed 2027 framework to Rafe and our normal guidance process.

Second, execution in the core, especially exposure management. The major investment choices are made. We continue to support customers across our products while placing new growth investment behind detection and response and exposure management. The core is becoming more stable. The operating model is leaner. Ownership is clearer. In exposure management, the work is underway, but it is still not where it needs to be. We will let the evidence speak before we call it progress. We will stay focused on the heart of the enterprise market, customers that need enterprise-grade security, but also need fewer tools, less complexity and faster outcomes. Our strength in the mid-market is proof of what we can do. It is not a limit on where we can win. As I said last quarter, we are changing the path of the company toward durable growth, not managing for one quarter. We also need to be clear about the noncore portfolio. Our noncore businesses have strong technology, loyal customers and efficient operations. The issue is not quality. It is strategic fit. They are good businesses, but they are not the races where Rapid7 has the clearest right to win or where we will place the next dollar of growth investment. We are reviewing the best long-term path for each business under our new strategy. In Q3, we took the first step by announcing the end of sale for selected stand-alone versions. We will continue to support existing customers responsibly and give them clear paths forward.

Third, how we reinvest. As we enter 2027, we will keep shaping the business around the core. The quarters will not all look the same. We will continue to invest behind growth, but the discipline should remain. Discipline creates capacity. Strategy decides where it goes.

One place we are investing is the service layer. Growth starts with winning in our core. The service layer lets us extend that position and deliver the outcome, not only the product. Cybersecurity cannot stop at software that generates more alerts. Customers want continuous monitoring, investigation, validation, response and resolution. This is not a traditional people-heavy service business, and it is not a choice between product and service. Product builds the capability, intelligence informs it. Service delivers the outcome. Agents provide scale. People remain accountable. We are building an AI-first service model where software, agents, intelligence and experienced security experts come together as one system. People decide, agents do. Automation helps us move faster today. Agents let us do more across more data, more steps and at much greater scale. Our ambition is to deliver security operations center outcomes as a service with software-like leverage.

Customers consume the outcome, while automation and agents help our experts serve more customers and complete more work without cost rising one-for-one with demand. That creates a path to stronger service economics over time. That is why Mel Stone's role matters. As Chief Global Services Officer, she brings our global security operations center, MDR, service delivery and intelligence under one leader. Our product and technology team builds the platform and agent foundation. Mel's organization turns that capability into a repeatable service outcome. Under Mel, threat intelligence, vulnerability research, attacker research and labs come together as Rapid7 Intelligence. It closes the loop, turning what we learn into better detections, better service and better protection.

Rapid7 Intelligence is not a stand-alone product. It is the intelligence engine for the Command Platform, our service layer and our autonomous security operations center. Research should not end when it is published. It should end when protection changes.

Last quarter, I said AI needs a foundation, not another feature. Today, I want to introduce the next R in Rapid7, reasoning. The outcome must be resolution. Detection without reasoning creates volume. response without context creates motion, resolution creates value. More and more, the next cyber fight will be machine against machine. Defense must move at machine speed, but inside clear human boundaries. At our Boston Customer Summit, we walked customers through the model we are building, three colors, mission. Red agents probe like an attacker. Blue agents investigate and respond like a defender. Orange agents reason across both and help guide the safest path to resolution. People set the mission, policy and limits. People remain accountable. Kenzo is moving from acquisition to adoption. A growing number of customers across our base are now using early Kenzo-powered capabilities, giving us real-world feedback as we build toward our autonomous security operations center.

As we design and build it, the Autonomous Security Operations Center is a governed system where people, intelligence and red, blue and orange agents work together. The service model is designed for different ways to consume it, run by Rapid7, operated with the customer or added as an assurance layer above the customer's own security operations center. One service mission, different ways to consume it, AI first, vendor-neutral and sovereignty aware.

The summit was an important checkpoint. We showed what is operating today, what is in proof and what remains ahead. We tested where agents should act, where people must remain involved and what evidence is required to trust the outcome. That work is shaping the capability, the guardrails and the service model. Based on our current progress, we are working toward our first generally available release around RSAC 2027. We view that as version 1.0, not the finish line, but the first production step in a long and exciting journey toward increasingly autonomous security operations.

We are also working with leading partners across cloud architecture, advanced models and accelerated computing. Together, we are testing how the system performs before customers depend on it. Measure us across quarters by our cash generation, by execution in the core, including clear progress in exposure management, by how we reinvest and by whether that work becomes customer adoption, ARR growth and stronger long-term value. We are not declaring victory. We are building proof. We delivered what we said. Now we must turn that work into durable growth. My commitment remains the same, clear words, fast action, long-term thinking, and we own the result.

Rafe, over to you.

Rafeal Brown

Thank you, Wael, and good afternoon, everyone. As a quick reminder, unless otherwise noted, all numbers, except revenue and balance sheet items mentioned during my remarks today are non-GAAP. Please refer to our earnings release and SEC filings for additional details regarding the presentation of our results and guidance metrics.

In the third quarter of 2026, I'm pleased to report that we exceeded expectations across all guided metrics. We ended the third quarter with total ARR of $820 million, $8 million above our guidance for the quarter. We reported non-GAAP operating income of $46.2 million. Free cash flow came in at $26.5 million. As of the end of the quarter, we had total cash, cash equivalents and short-term investments of $732 million. We are particularly pleased with these results as the team remained incredibly focused on our customers and executing against our plan even as the company undertook a significant restructuring in the quarter.

I want to begin by taking a closer look at ARR as of the end of the quarter. As a quick reminder, our long-term strategy is focused on our core platform solutions comprised of our detection and response business, which includes our managed detection response offering and our exposure management business. Our core platform solutions now represent approximately 85% of overall ARR, reflecting the gradual mix shift of our business towards our core products, which on a year-over-year basis, grew approximately 1%, led by our detection response business, which at over 55% of total ARR maintained its growth rate at approximately 5% on a year-over-year basis. Our exposure management business declined approximately 6% year-over-year, offsetting some of the growth of our D&R business. Within the Exposure Management segment, we continue to see healthy adoption of our Exposure Command solution as customers upgrade from older vulnerability management solutions. In contrast to the growth of our core solutions, our noncore products, which, as a reminder, approximately 15% of total ARR declined approximately 19% year-over-year, driving the approximately 2% year-over-year decline we saw in total ARR. This drop in noncore ARR was in line with our expectations as we have deemphasized the sales of many of these noncore solutions.

As we plan for the remainder of 2026 and beyond, each of the noncore solutions are being carefully evaluated, ensuring we optimize margins as well as seeking opportunities to migrate customers to core platform offerings where possible.

Our favorable ARR performance in the third quarter reflects our strategic focus on building and selling our core solutions and focusing our go-to-market efforts on customers within our ICP. This effort led by our Chief Commercial Officer, Allan Peters, is demonstrating tangible results as we saw productivity per rep show notable improvement over the prior year. Beyond the numbers, we saw demonstrations of this strategy paying off in key wins during the quarter such as a new logo win from a global facilities management and property support services company who turned Rapid7 for both MDR and Exposure Command out of frustration with their incumbent provider for a lack of innovation and limited AI strategy.

In Europe, a large religious organization recognized the benefits of consolidating their cyber needs across a single platform and purchased MDR, Exposure Command and our cybersecurity compliance solution. In a third example, a national U.S. manufacturer came to Rapid7 looking for a provider that could understand its business and security environment and restore confidence in running a managed SOC after a failed prior implementation with a competitor. We positioned our MDR, Exposure Command and Vector Command solutions for a comprehensive end-to-end solution. These wins and more like them demonstrate our product and go-to-market team's focus on selling our core solutions into our target market.

Within the product organization, our new Chief Product and Technology Officer, Dan Deklich, now five months into his role, is making sweeping changes and has started making investments across the product and engineering organization. He has accelerated his investments into our products by rebuilding his leadership team with experienced product and AI leaders, deploying and training the team on a modern AI-focused SDLC and launching the development of our next-generation solutions. These efforts are core to the anticipated 2027 launch of the AI-enabled solutions needed to address the dramatically more dangerous cyber environment our customers are facing.

Returning now to our financial statements. Total revenue of $212.4 million declined approximately 3% year-over-year, reflecting the declines in noncore product ARR we saw earlier this year. We finished the quarter with approximately 11,800 customers and an average ARR per customer of approximately $69,000.

Turning to third quarter profitability. We delivered total non-GAAP gross margins of 72.2%, which we expect to moderate in Q4 and beyond as AWS and AI charges ramp. We reported non-GAAP operating income of $46.2 million or a margin of 21.7%, favorable to our guidance. This upside to profitability drove non-GAAP earnings of $0.60 per diluted share. Free cash flow totaled $26.5 million in the third quarter. Our GAAP financial statements also include a $5.5 million noncash charge for the full write-down of a minority investment made in the prior year. The charge appears in our GAAP income statements under other income and expense. From a balance sheet perspective, we ended the third quarter with $732 million in cash, cash equivalents and short-term investments. Combined with our continued free cash flow generation and a $200 million undrawn credit facility, we are well positioned to repay our $600 million convertible notes due in March of 2027.

Turning to the restructuring announced last quarter. This restructuring marked a strategic shift in our business operations to drive efficiency and focus across the organization, aligning resources and investments to our core platform solutions. We also created capacity to increase our investments in cutting-edge AI-driven solutions that will improve customer experience and increase competitiveness in the marketplace. As noted above, this investment is underway, but it will continue into 2027 as we build out our leadership and team within the product and engineering organization as well as ramp AI-related compute costs. We continue to expect to incur total charges related to the restructuring announced in August of approximately $11 million. In addition, the company continues to evaluate opportunities for further efficiency. These restructuring charges will be excluded from our non-GAAP P&L results.

This brings us to guidance. We expect to end the fourth quarter with ARR of approximately $812 million. And on a sequential basis, we expect that ending ARR for our combined core platform solutions of D&R and Exposure Management will be approximately flat quarter-on-quarter with expected continued sequential ARR decline coming from our noncore offerings. For the fourth quarter, we expect total revenue in the range of $208 million to $210 million, a year-on-year decline of approximately 4% at the midpoint. This would bring our full year 2026 revenue to $841 million to $843 million, a decline of approximately 2% at the midpoint and continuing to reflect the decline in ARR we have seen year-to-date. Fourth quarter non-GAAP operating income is expected to be in the range of $40 million to $42 million, even as we have accelerated some product and engineering hires into the quarter. This would bring our full year 2026 non-GAAP operating income to $140 million to $142 million, an increase of approximately 4% at the midpoint or a full year non-GAAP operating margin of 17% at the midpoint. Fourth quarter non-GAAP earnings per share are expected to be in the range of $0.53 to $0.55 per share on approximately 82.1 million fully diluted shares. We continue to expect free cash flow of approximately $130 million for the full year.

To sum up, we executed well in Q3 and are doubling down on our prioritization efforts to invest in and improve our core product offerings, even while we maintain our focus on opportunities for cost management and improved efficiency, all of which gives us confidence in where Rapid7 is headed in its transformation.

And with that, I'd like to turn the call over to the operator for Q&A.

Operator

[Operator Instructions] Your first question comes from Brian Essex with JPMorgan.

Phần hỏi đáp

Brian Essex

Congrats on the better results. It's great to see the stability in the operations. I guess maybe to start, Wael, could you maybe walk us through, I guess, the profile of the sales organization, the changes that you've made there, how it was affected by the restructuring? And do you have the retention there that you need to build the maturity that's required to put yourself in a better position for growth next year?

Wael Mohamed

Thanks, Brian. Great question. As you are aware, as I mentioned last call, I've been in the Board for over a year prior to me taking the CEO job, and I was part of the team that actually did the search and the appointment of Allan Peters, our CCO. So we've actually been working in the background, making sure that we have a sales organization that both stable and it can be able to actually help us through growth. So I feel very good about what we have right now and what Allan has been doing prior to me joining as a CEO and been working very closely in the last few months as we evaluate the resources, what is the best way to utilize them. And most importantly, as Dan basically catch up with all the great work he's doing on his end that we'll be ready with the expertise to be able to take that to market.

We have a big base of customers. That's really our focus right now, making sure that these customers are served, understand exactly where we're heading. We had actually a customer summit in October where we brought in a sample of our customers here in Boston, around 50 customers from all over the world to be able to test our story, our road map, also get some really frank feedback about where we are and where we're heading. We showed them what we have right now, what we're building and our vision, and it was extremely positive. It was not only positive for our customers, but it was very positive to our team. And I feel very good about how the team is actually organized right now.

Brian Essex

Great. Maybe if I could follow up on that, too. Like what -- how does that reflect to what you're seeing in the pipeline? Do you have -- do you have a building pipeline in your core business right now that gives you confidence in growth next year? Or do you feel like maybe it's reliant on the products that you need to deliver like what you're planning for RSAC 2027?

Wael Mohamed

That's a great question. And sometimes the apple-to-apple is something like this is my first year here. Alan has been a little bit over a year. He feels very good about basically building the pipeline. I think we were always going to try to be able to put more investment in the area that we believe we can get more return. But the discipline, the sales process he and his management team have put in place, it gives us really a good feeling and confidence that we have the system we need to be able to basically lean on.

Operator

Your next question comes from Mike Cikos at Needham.

Michael Cikos

And I like the comments as far as the stability that you guys are starting to demonstrate here. Wael, if we could just come back to the prepared remarks, can you just peel back the layers on the services component that you were speaking to as far as what the investments are that are required? How we should be thinking about those initiatives as far as execution and how that's expected to transpire in the model?

Wael Mohamed

Absolutely. One of the great things, as I came to the company, I was telling the team the other day, the more I dig, the more gold I find, and we have an abundance of data. And as you know, we're not only providing our product as a software. We provide a service layer in the form of our SOC, where customers entrust us with all the form of data, so we can be able to help them to find that needle in the haystack. And we've done a very good job servicing plenty of customers that basically we process, I want to say, in the tune of maybe 250,000 alerts a day, over a terabyte of data that we crunch. And we know that as we move to the Agentic layer, this data will be definitely what we need.

But one of the things I needed Mike to do is, as I was sitting with my top team, I'm surrounded with an incredible team, Rafe, my CFO; and Allan, my CCO; Dan, our CPTO and Katie, my Chief People Officer, I knew that I needed to have another senior person that all think about how are we going to deliver this service layer at a software economics. That's extremely important. And I believe that's the future, not only for our company, but actually in our industry.

Cybersecurity wanted to be delivered as a service. There's always a problem how to be able to do that with the right margins. And that's really a major focus to the team. So that's why the addition of Mel, Mel has many years of basically experience in high-scale service delivery in the U.S. military and the command center and bring her to our team and bring that deep expertise and the focus, if you will. So that's basically when you peel the onion, this is the layer that I'm very excited about it, the data fabric and on top of that, the service layer that we can be able to deliver it at a software economics, if you will.

Michael Cikos

Excellent. And for the follow-up for you or for Rafe here, but I know that you were talking about the restructuring and how it's freeing up capacity to make additional investments. Some of those investments obviously already underway. Others expected to begin in calendar '27. Can you help us think a little bit more about where those investments are going to be taking place? Is it more on product and getting product ready in preparation for RSA as an example? Or is it feet on the street and reorienting the go-to-market? Can you just help us think about those AI-driven investments that you guys are alluding to?

Rafeal Brown

Yes. You bet. Thank you. The majority is really within the product and engineering organization. I touched on some of the work Dan is doing, making changes on the leadership level, bringing in new talent to really build this modern AI-enabled SDLC, right? And that's some different players that some different leaders, but it's also putting AI to work for us in a lot of ways. So there's certainly an element of that throughout the R&D organization where there's investment on that side of it.

But then the products we're talking about here, even if it's Kenzo from the acquisition last year as we're getting ready to roll that out, but also the new products that Wael referred to earlier, both of those take investment from the team. It's people working on them, but it's also the technology and the compute, if you will, the AI-driven compute to make them come to life. And so there is investments going on in that area. But the quick summary is really within the product and engineering is where we're seeing the bulk of it.

Operator

Your next question comes from the line of Eric Heath at KeyBanc.

Eric Heath

Well, maybe just to ask on the noncore business, if I could. I know you're evaluating some options and thinking about it carefully. But just any further color you can share on how you're thinking about that noncore business, some options and maybe the time line you're thinking of when you'd like to be able to come to a resolution on that. And once we get past kind of that decision or that time line, then we could see kind of the growth start to reaccelerate from there.

Wael Mohamed

Yes. Thanks, Eric. That's a great question. Look, I always tell my team is actually, as we set the strategy, it's what's harder than basically deciding what to do is deciding what not to do. So the first few months, I spent a lot of time with customers, with partners, with my team, talking to basically some advisers to try to figure out what we have and what we need to be able to focus on. And we feel we have a very, very strong understanding of the interconnectivity and all the connected tissues of our platform and our products. So we have a set of what we call noncore. Noncore does not mean they are not important. They are actually healthy business. We have customers that they are loyal, and they are actually produce margins, and we did not take that decision by placing them noncore lightly.

For me, a core is a big part of the business that I'm considered the leader. I have the right to be invited and I have the right to win, and I need to put every single dollar of investment behind that so I can get my fair and in some cases, my unfair share. The noncore, it is basically a set of products that we do not have the right to win those races, not because we do not have a good product, but we don't have the size and the invitation to put us in the top 3 at the selection level. So that's kind of basically the definition.

So that Phase 1 was done. The end of sale announced to the customers. We spend a lot of time to making sure that these customers understand why we did, what we're doing and understand our strategy and why we're the partner for them in the long run. And we're getting a lot of positive feedback about the transparency and the decisiveness in that decision. Number two is we need to figure out what is the best thing we need to do for the shape of the overall business. That's why managing that runoff has to be very carefully assessed. We feel that it will not be symmetric, but we're hoping in a short order, we will basically have a better answer for the best way to manage that noncore.

Eric Heath

That's great. And then quickly, one for Raf3. Sorry if I missed it. But last quarter, I believe we were talking about growth in free cash flow dollars in '27. So I'm just curious if that was still the guardrails that you're thinking about.

Rafeal Brown

Yes. Thank you. We are going to defer all '27 guidance to our next earnings call.

Operator

Your next question comes from the line of Saket Kalia with Barclays.

Saket Kalia

Wael, maybe for you just on the core business. It feels like based on the guide for Q4, it feels like the retention rates there might be starting to stabilize or churn may be improving said a different way. What do you find is working there?

Wael Mohamed

Then focus and the clarity to the team, and you probably saw it from Rafe script where you can see the shape of the business is moving from 80-20 approximately last quarter to an 85-15. So our sales team, our sales organization has basically got their marching orders. It's already been moving in the right direction, all hands on deck. Our precious customers, we are basically providing them with clarity with a road map, where we're going to be in the future and most importantly, how we're making sure that the outcome they're expecting from us is fulfilled and basically get closer. So that focus is really -- is helping, and we feel good about basically our efforts now is moving the needle for sure.

Rafeal Brown

Yes. And the one thing I would add there is that as Wael mentioned, the organization has been extremely focused. That move, we've been calling out the last couple of quarters, more than 80%. I wanted to update people on the current blend. And you also saw the growth rate of our D&R business was the same last quarter to this quarter. So we're feeling like we're pleased with the work the team is doing. That focus is paying off, I think, is really helpful.

Saket Kalia

Yes. No, it makes a lot of sense. Rafe, maybe for my follow-up for you. We mentioned some end-of-life products. I know we're not talking about 2027 again, but just to sort of contextualize when that end of life would start to impact ARR. Could you just remind us what are the products that are going to be end of life? When will they be end of life? And roughly how much in ARR do they contribute currently?

Rafeal Brown

Yes. Thanks, Saket. And just to clarify because it's hotly detailed around here, it's end of sale. So one of the things that we have in our noncore -- noncore is not one thing. It's quite a large range of offerings. But for example, our cloud and our AppSec solutions are end of sale as stand-alone solutions, but they are still available when you buy an exposure command solution where they're part of this overall set. And so that's one of the subtle distinctions here.

What we want the team to be doing is selling this -- the bundled solutions, if you will, or the combined solutions because that's where the customer gets much more value, and that's where we differentiate and really stand out. So cloud and AppSec are two pieces in there. Within the threat intelligence area, our digital risk protection, we're into sailing on that one. We still have a good deal of customers that will continue to use it. You can still renew, you can still buy more if you're already a customer. But we want that sales focus on selling our core solutions. And so we've announced that. It will take a few months before it becomes official. But even this year, when we look into it, the comp plan was already favoring our core solutions.

The comp plan, of course, set back in January. We'll continue that push, right? We can move a lot of it. So it's a relatively small number of new sales that were going to these products this past year. We're just going to be real crisp and clear with everybody about our go-to-market efforts, how we focus on that core product solutions.

Saket Kalia

Makes a ton of sense. It really just simplifies the price list is how I read it. And thanks for clarifying that it's an end of sale and not an end of life.

Operator

Your next question comes from the line of Josh Tilton at Wolfe Research LLC.

Joshua Tilton

Maybe just two quick ones for me. Rafe, I preface the next -- my first question with, I really appreciate all the disclosure and the color that you give us into the moving pieces behind ARR. But if you kind of take away the segments, the categories, what they're called and we simplify it down here, are you outperforming ARR more than you did last quarter because things that are good are getting better? Or are you outperforming ARR more this quarter than last quarter because things that have been a drag have been less of a drag?

Rafeal Brown

Yes, that's a great question. I think especially if you look relative to our guide, like as I called out in the prepared remarks, we went into the quarter knowing we're doing this restructuring and knowing that can be -- that is a tremendous distraction to the team, yet we saw the team execute well. We saw -- and it was split, frankly, between the new booking side of the house. It's still not the answer we want a few quarters from now, but we did better than we thought we would on new. We also had some notable good news on some of the accounts that were at risk in the quarter.

So I don't want to overstate this. It's subtle elements, but I felt like within some of the core solutions, we saw the team really rallying and hustle in and working well with our customers where we were able to achieve a better result than we had anticipated when we gave our guidance.

Joshua Tilton

Okay. And then maybe just my follow-up. I couldn't help but notice the guidance for Q4 ARR is kind of in line with how you guided this quarter. Like maybe signaling aside and all that, like what gives you the confidence to guide in a way that kind of makes us feel like we could see the end of ARR declining on a sequential basis?

Rafeal Brown

It wasn't centered around that. I will just tell you straight away. We are calling out that we will see a decline from the $820 million that we finished at down to the $812 million that we guided to. That said, like it's more just the way the math worked out that it happened to be the same number in all fairness. We go through like really exhaustive efforts with the team, with the RevOps team, with the sales leaders to make sure we have just as much visibility as we can about how bookings are going to come in, how renewals are going to come in to really do our best to form our guidance. And that's the hard work that goes into this to try to do our best and provide insight wherever we can.

I did call out in the script that we expect that core will be approximately flat sequentially and noncore will be what pulls the ARR down as we go forward. And frankly, we do expect that pattern is going to continue into the near future that we have visibility to. That's a key element of where the business is just as we really focus everybody on core and get these new products out and hope to build growth there. But that noncore drag is going to continue for a little bit.

Operator

Your next question comes from the line of Shrenik Kothari at Baird.

Shrenik Kothari

So, Wael, you had previously highlighted this particularly attractive customer segment of $100,000-plus opportunity. And today, you and Rafe pointed to improving productivity and also focusing on this ideal customer profile is beginning to produce these results. So just wanted to unpack like how is that opportunity developing in practice? Are you seeing these sort of average deal sizes in that range holding up as you become more selective? And also are you seeing a larger proportion of the new logos coming from these customers or not? Then I have a follow up.

Wael Mohamed

Yes. As I mentioned, when we basically start focusing on the core, we also wanted to tune our ICP and the area that is very natural to us, and we have a very, very positive basically customer pull. So as we are aligning this, we're feeling good about basically the shape of the business. We're very natural in what I call it the heart of the enterprise. The companies that basically want to rely on us to take complex basic security jobs and simplify, provide them with a 724 around the world basically solution that they can be able to digest and ensure that they are basically more secure with us. We see that all the time. We see it even when we go and get into a side-by-side with one of our competition, how it's very natural when we are in our ICP that the deal can happen faster and quicker and our value proposition is more clear. So as the team is seeing that, I think our shifting is becoming easier and give us the confidence to actually put the wood behind there, if you will.

Shrenik Kothari

Got it. Very helpful. And a follow-up for -- you had previously acknowledged some near-term cloud cost pressure associated with Kenzo development testing. And today, you did mention the SOC efficiency still largely ahead and while also expanded on the AI-first service model to allow agents to support more customers without rising costs. So just -- I know you plan to provide more formal guidance in the coming quarter around that transition. But just how should we think about the magnitude and the timing of the transition? If you can just highlight like the progress there?

Rafeal Brown

Yes. So I think the best way to think about the investments that are going on there, they're going to -- we're in kind of early stages, and we're in a little bit of, frankly, a time where we're developing that next generation or developing those products and solutions, but we still have to provide good support of our customers as we go through this, right? So we're building efficiencies in, and we'll start to see the fruits of that. We'd like to think over the course of 2027.

Wael mentioned in his prepared remarks, some of the Kenzo infrastructure, we're starting to move customers over that in their earliest stages and getting that up and running. So we're making very nice tangible progress. But that -- those offerings do a couple of things. They provide better service to the customer, and then they're going to also help us build greater efficiencies into our infrastructure.

Operator

Your next question comes from the line of Matt Hedberg at RBC.

Matthew Hedberg

Just one for me. There was -- obviously, we all saw the PHP vulnerability a couple of weeks ago. I'm just sort of curious, I don't think you mentioned in the prepared remarks, but any sort of comment on how something like that or other AI-based vulnerabilities might become a bit more of a tailwind for your business?

Wael Mohamed

Sure. Absolutely. You know what? When I talk to customers every single day, I find myself have to answer those questions. And they really appreciate the efforts and the work we're doing to make sure that we're ahead, the amount of information we provide them, the partnership that we're doing right now with the frontier labs and making sure we're in the front end and working with them so we can basically be prepared.

So we're having those conversations all the time, and it's top of mind. And I'm very excited that some customers actually seek us and ask us what we think and we basically have a very constructive conversations about how we assist them. In this incident, we were prepared. We had the advisory, we had the information.

Our team was in front of it. We informed our customers. We've taken some of the calls and we assist them, sometimes assist them in their internal communication as we're finding that more of the executive and even the Board is asking about the status. And we're adjusting to making sure that our information is not only technical, but can also address the business needs.

Operator

Your next question comes from the line of Adam Borg at Stifel.

Adam Borg

Maybe while on the changes that we've been making here, how do we think about the progress that you're seeing both in North America and international? Obviously, international is on a much smaller base, but seeing continued growth there with some lower pressure in North America. I assume that has to do with some of the mix. But any color on kind of the drivers of the two and then the opportunities that you see?

Wael Mohamed

Yes. For me, I can't wait to basically see international do what I'm used to and what I love. we're making huge progress in the U.S., and I still think there's a lot of room as we focus in our -- basically our ICP and our core area. So the team is definitely ultra focused to making sure we have the right investment in the right area, and we have the right upside.

We have a decent international business, but there is a lot of upside. And we are starting to basically plan for next year, what is the appropriate investment and what areas where we can basically get some low-hanging fruit, and there is a lot of great conversations happening on that front.

Operator

Your next question comes from the line of Gregg Moskowitz at Mizuho.

Gregg Moskowitz

Great. Rafe, you mentioned earlier that there was some good news with respect to some accounts that were perceived to be at risk this quarter. Anything that you can share anecdotally in terms of what it was that resulted in these accounts deciding to remain in the fold with Rapid7 as opposed to perhaps going elsewhere?

Rafeal Brown

Yes. I think what I would point to is like the team is incredibly focused on making sure we're providing good services to our customers. We have regular calls with the team where we go through all the accounts. And on those calls, you've got Adam and his -- we got Dan and his leaders on the call as well as Alan and his leaders on the call. And we're looking at that several quarters ahead. Like we're just really trying to focus. And that tends to be on the more senior level accounts or the bigger accounts, but that focus of engagement and getting out in front of those accounts if somebody is having some struggles two, three quarters before the renewals up gives us the flexibility to get in and make a difference. And so some of that effort is stuff we started much earlier in the year, but we're still meeting as a team on a regular basis where we're all there to rally around.

And I just think that kind of discipline, but also just that focus on customer first makes a difference. And you don't get them all, but you make a difference to some of those accounts and you're able to satisfy the customer and they appreciate the focus and you can get your renewal.

Operator

Your next question comes from the line of Gray Powell at BTIG.

Gray Powell

Congratulations on the better-than-expected results. So I think you may have hit on this already, but I just was hoping to get a little bit more color. So I mean, it was good to see detection and response ARR stable at 5% in Q3. It was growing mid-teens a year ago. So I guess my question is, do you think you can get back to that historical growth rate? What needs to happen? And is it more on the product side? Is it execution or something else that maybe we're not thinking about?

Wael Mohamed

It's a great question. And I agree that this segment is growing, and we need to do better to actually earn our fair share as we used to do before. I think the main thing we needed to do and we're already doing is focusing on the ICP where we actually have the highest possibility for. As we move some time maybe in the ultra large, we basically had some headwind and that basically consumes some of our energy. Now as we corrected that and going into the sweet spot where we are designed and we have the right to win, we are seeing a lot of positive basically movement in the right direction. So that's the #1 thing.

As we also start talking to the customers more, as we said, we increased our engagement with our current customers basically about the future, the road map, what we're believing the future looks like, some of the work we're doing and the exciting work in agentic world and the investment we're making, I think that, that definitely helped customers to see that not only we can serve them today and we should have our fair share, but we should be the right partner for them tomorrow as well.

Operator

Your next question comes from the line of Joseph Gallo at Jefferies.

Grant Darling

This is Grant Darling on for Joe Gallo. And I'll ask them as a two-parter. Maybe to start, there's been a lot of rhetoric from platforms and new entrants around expanding capabilities and exposure management. Are you seeing any change in customer buying behavior or sales cycles as that competitive landscape evolves? And then just to go ahead and follow that up, are you seeing any pricing pressure from privates, particularly impacting margins in MDR?

Wael Mohamed

Very good questions. So in the first part, yes, that was the case in the beginning of the year. And as reality hit we're finding actually ourselves having more of a cooperative conversations with some of the big platforms and basically as customer realizing that what we do is an adjacent, it's not an overlap. And we're seeing that pressure of that as basically more clarity, more engagement with customers, more explaining where we fit and what our value proposition. We believe we have a pretty strong value proposition. And as we engage with the customer, I think that's getting a lot easier.

What was the second part? My apologies.

Grant Darling

Yes. Just any pricing pressure coming from private? Just kind of when you think about your margins in India, are you seeing anything there or things pretty steady?

Wael Mohamed

As I said, as our sales team now is focused on the core, and they basically have more of a clear ICP where we have a high level of winning. We have an incredible amount of reference customers over -- as you know, over 10,000 customers. We have a big scale. When we get in there, I don't think customers really are as price sensitive as you were before. They're more looking for a partner that can address today and the future. And they are more interested about what is exactly your AI strategy, how are you going to get there and basically how you can be able to cover me. And what are you thinking about now the Agentic world and some of the risks associated with it. So we'll find ourselves in the last mile talking about that more than talking about price.

Operator

Your next question comes from the line of Rudy Kessinger at D.A. Davidson.

Benjamin Smith

This is Ben Smith on for Rudy. I was going to ask on the stand-alone products that you're doing end of sale on, have there been any customers that have expressed interest or purchased packages so they can still use those products? And then I had a follow-up.

Rafeal Brown

Yes. I would first say part of the end of sale thing is they can keep utilizing the products, right? We're not taking anything away from them because we're not end of life now. So customers can renew existing customers, if they need more to expand, that's still a thing. So I think just that subtlety on that end of sale. And keep in mind, a good deal of our customers might have other products with us and also these stand-alone products that we have in the noncore bucket. So that was a long way of saying, yes, customers are still interested in buying us the ones that are on many of these products.

Benjamin Smith

Got it. And then yes, maybe bigger picture, you're not giving 2027 color. But just want to ask, do you feel that core is now stabilized? And what would give you -- what could you point to that's giving you confidence that, that can drive maybe a return to positive ARR growth?

Rafeal Brown

Yes. Look, I think it is nice to see the year-over-year growth rate in the same two years -- or two quarters in a row, if you will, the sign of stabilization. I did call out that we expect it to be roughly flat on a sequential basis. That's clearly not where we want to be, but it's where we are and how we're looking at the numbers. We have confidence though that we can get to return to growth because we're focusing on our core like never before. We've got some really great things in the pipeline for new products that will be in the core new product offerings and expansion. And just the way the product team is digging in to focus on those core offerings.

I think all of that adds up to a time where you feel better about the direction and the strength of the company and its focus, combined with the fact that the world needs our products more than ever because of all the changes in the broader macro. That's what excites us and makes us think that we can -- we're sitting on top of an opportunity that's going to take work and it's going to take time. But we think we can turn that into growth down the road.

Operator

At this time, we have reached the end of our question-and-answer session. We thank you all for your questions, and you can now disconnect your lines.