Rapid7 (RPD) 2026 財年第三季法說會：核心 ARR 回穩

重點摘要

• Rapid7 2026 財年第三季結束時的年經常性收入 (ARR) 為 8.2 億美元，比其單季指引高出 800 萬美元。總 ARR 年減約 2%，而核心 ARR 則與上季持平。
• 營收年減約 3% 至 2.124 億美元。Non-GAAP 營業利潤達到 4,620 萬美元，相當於 21.7% 的營業利潤率。
• 核心平台解決方案約占 ARR 的 85%，年增約 1%。偵測與回應 (Detection and response) ARR 年增約 5%，而曝險管理 (exposure management) ARR 則年減約 6%。
• 非核心產品約占 ARR 的 15%，年減約 19%。Rapid7 正評估這些產品的長期發展路線，並已宣布停售部分獨立版本。
• 管理層重申全年自由現金流指引為約 1.3 億美元。Rapid7 計劃使用手頭現金償還將於 2027 年 3 月到期的 6 億美元可轉換公司債。
• 該公司的目標是在 RSAC 2027 前後推出其自主資安營運中心 (autonomous security operations center) 的首個正式版本 (GA)，同時強調客戶採用與持續的 ARR 成長仍是未來目標。

核心財務數據

業務與營運表現

Rapid7 正將新的成長投資集中在偵測與回應以及曝險管理上。管理層表示，銷售重點的改善、更清晰的責任劃分以及圍繞公司理想客戶畫像的更緊密協調，有助於提高銷售人員的生產力，並在新增訂單與面臨流失風險的續約執行上取得更強勁的表現。

偵測與回應仍是最強勁的核心類別，維持約 5% 的 ARR 年成長率。儘管管理層報告隨著客戶從較舊的漏洞管理產品遷移，Exposure Command 的採用情況良好，但曝險管理業務仍持續收縮。

Rapid7 正在減少對非核心產品的重視。獨立的雲端與應用程式安全產品正轉為停售狀態，但仍可透過 Exposure Command 取得。數位風險保護 (Digital risk protection) 也正轉為停售。現有客戶可以繼續續約並擴充這些產品。

大部分新增投資正投向產品與工程領域。優先事項包括聚焦 AI 的軟體開發、引進新領導團隊與技術人才、Kenzo 驅動的功能、AI 算力以及下一代資安產品。

該公司還在開發以 AI 為優先的服務模式，結合其平台、資安威脅情報、代理 (agents) 和專家人力。管理層的目標是透過類似軟體的營運槓桿來提供資安營運成果。據公司表示，越來越多客戶正在使用早期 Kenzo 功能。

管理層財務指引

管理層預計第四季偵測與回應及曝險管理的合計 ARR 將與上季持平。非核心產品的持續下滑預計將使總 ARR 從 8.2 億美元降至約 8.12 億美元。

Rapid7 預計將產生約 1,100 萬美元與 8 月宣布的重組相關的總費用。這些費用將不納入 Non-GAAP 結果。該公司將詳細的 2027 財年財務指引延至下次法說會發布。

風險與關注領域

• 核心 ARR 季變動已趨於穩定，但尚未恢復成長。
• 曝險管理 ARR 年減約 6%，仍低於管理層預期的表現水準。
• 短期內非核心 ARR 預計將繼續成為拖累因素，管理層指出，在公司目前的能見度內，其下滑趨勢仍將持續。
• 隨著 AWS 使用量、AI 算力成本和產品開發投資增加，毛利率預計將有所趨緩。
• 償還 2027 年 3 月到期的可轉換公司債將減少與 Rapid7 現金餘額相關的利息收入。
• 自主資安營運中心仍處於開發階段。管理層正努力在 RSAC 2027 前後進行初始正式發布，並將其描述為邁向正式運作的第一步，而非一個完全建置完成的平台。

分析師問答集錦

核心業務穩定性：管理層將穩定性的改善歸因於更聚焦的銷售組織、更明確的產品優先順序、更強的客戶互動以及對大型續約案更緊密的監控。管理層表示，營運表現受益於高於預期的新業務，以及部分面臨流失風險帳戶的正面結果。

重返成長之路：Rapid7 表示，其重返成長的策略取決於核心產品的持續執行、專注於具備較強競爭優勢的客戶，以及推出新的 AI 應用產品。管理層未提供總 ARR 恢復正成長的具體時間表。

非核心產品組合：管理層表示，非核心產品仍屬於擁有忠誠客戶的健康業務，但不符合 Rapid7 認為自身擁有最明確勝算優勢的領域。公司預計在進一步評估後，對該產品組合的長期結構提供更明確的說明。

AI 投資與效益：大部分支出投入於產品與工程領域，包括人員、AI 輔助開發流程和算力基礎設施。管理層預計新服務架構將在 2027 年期間開始產生基礎設施效益，而客戶支援與開發成本在轉型期內仍將持續。

定價與競爭：管理層表示，客戶討論越來越集中於資安成果、AI 策略及長期產品功能，而非價格。管理層還表示，隨著客戶越來越清楚了解 Rapid7 的產品如何補充大型資安平台，曝險管理領域的競爭壓力已變得更容易應對。

完整電話會議逐字稿

---

完整財報電話會議逐字稿

管理層陳述

Operator

Good day, everyone. My name is Alice, and I will be your conference operator today. At this time, I would like to welcome you to the Q3 2026 Rapid7 Earnings Call. [Operator Instructions]

At this time, I would like to turn the call over to Ryan Flanagan with ICR. Please go ahead.

Ryan Flanagan

Thank you, operator, and good afternoon, everyone. We appreciate you joining us. Today, we'll be discussing Rapid7's third quarter fiscal 2026 financial results. We've distributed our earnings press release over the wire, and it can be accessed on our Investor Relations website. With me on the call today are Wael Mohamed, CEO; and Rafe Brown, CFO. [Operator Instructions]

Before I hand the call over to Wael, I'd like to remind everyone that certain statements made during this conference call may be considered forward-looking statements under the federal securities laws. These statements are made pursuant to the safe harbor provisions of the Private Securities Litigation Reform Act of 1995 and include, among other things, our outlook for the fourth quarter and full year 2026, our expectations regarding fiscal periods beyond 2026, our transformation and restructuring initiatives and their expected costs and benefits, our strategy, priorities and capital allocation, including our evaluation of noncore offerings and plans to repay our convertible notes due in March 2027 and the anticipated financial effects, anticipated operational improvements, investments in our core platform and AI capabilities, including the development, anticipated launch timing, adoption and expected benefits of new products and AI-first services, including autonomous SOC and our expected growth drivers and financial performance.

These forward-looking statements are based on our current expectations and beliefs and information currently available to us. While we believe any forward-looking statements we make are reasonable, actual results could differ materially due to a number of risks and uncertainties, including those contained in our filings with the SEC. Reported results should not be considered as indicative of future performance. We do not undertake and expressly disclaim any obligation to update or alter our forward-looking statements, whether as a result of new information, future events or otherwise, except to the extent required by applicable law. Further information on these forward-looking statements and risk factors are included in the filings we make with the SEC, including the section titled cautionary language concerning forward-looking statements in our earnings press release. Additionally, over the course of this call, we'll reference non-GAAP measures to describe our performance. Please review our earnings press release and filings with the SEC for a rationale behind the use of non-GAAP measures and for full reconciliation of these GAAP to non-GAAP metrics. These documents, in addition to a replay of this call will be available on the Rapid7 Investor Relations website. Lastly, I'd like to note that Wael's prepared remarks today are being delivered using an AI-generated version of his voice, and he will respond to questions live during Q&A.

And with that, I'd like to turn the call over to Wael.

Wael Mohamed

Good afternoon, and thank you all for joining. Last quarter, I said the actions we announced were a focused reset. The actions were not the strategy. They gave us focus and room to execute. I also said this would be a multi-quarter journey. Q3 was another step. My read is simple. We delivered what we said. The company is operating with greater focus and discipline, but one quarter of execution is not a return to growth. That work remains ahead. We met our Q3 ARR guidance and core ARR was flat from Q2. That is an early sign of greater stability. It is not yet growth. We also continue to expect to exit 2026 at approximately 20% non-GAAP operating margin. Rafe will take you through the quarter, the year-end outlook and our balance sheet plan.

Last quarter, I asked you to measure us in three ways. First, cash generation. Our cash outlook for the year remains on track, and we are reaffirming our guidance for approximately $130 million of free cash flow. Cash is not the finish line. Durable growth is, but cash tells you whether the operating model is becoming healthier and whether we have the capacity to keep investing. We intend to use cash on hand to retire our convertible notes due in March 2027. After that, the interest income tied to that cash will fall away. Our job is to replace it with more cash generated by the business and carry the discipline behind our year-end margin into 2027. I will leave the detailed 2027 framework to Rafe and our normal guidance process.

Second, execution in the core, especially exposure management. The major investment choices are made. We continue to support customers across our products while placing new growth investment behind detection and response and exposure management. The core is becoming more stable. The operating model is leaner. Ownership is clearer. In exposure management, the work is underway, but it is still not where it needs to be. We will let the evidence speak before we call it progress. We will stay focused on the heart of the enterprise market, customers that need enterprise-grade security, but also need fewer tools, less complexity and faster outcomes. Our strength in the mid-market is proof of what we can do. It is not a limit on where we can win. As I said last quarter, we are changing the path of the company toward durable growth, not managing for one quarter. We also need to be clear about the noncore portfolio. Our noncore businesses have strong technology, loyal customers and efficient operations. The issue is not quality. It is strategic fit. They are good businesses, but they are not the races where Rapid7 has the clearest right to win or where we will place the next dollar of growth investment. We are reviewing the best long-term path for each business under our new strategy. In Q3, we took the first step by announcing the end of sale for selected stand-alone versions. We will continue to support existing customers responsibly and give them clear paths forward.

Third, how we reinvest. As we enter 2027, we will keep shaping the business around the core. The quarters will not all look the same. We will continue to invest behind growth, but the discipline should remain. Discipline creates capacity. Strategy decides where it goes.

One place we are investing is the service layer. Growth starts with winning in our core. The service layer lets us extend that position and deliver the outcome, not only the product. Cybersecurity cannot stop at software that generates more alerts. Customers want continuous monitoring, investigation, validation, response and resolution. This is not a traditional people-heavy service business, and it is not a choice between product and service. Product builds the capability, intelligence informs it. Service delivers the outcome. Agents provide scale. People remain accountable. We are building an AI-first service model where software, agents, intelligence and experienced security experts come together as one system. People decide, agents do. Automation helps us move faster today. Agents let us do more across more data, more steps and at much greater scale. Our ambition is to deliver security operations center outcomes as a service with software-like leverage.

Customers consume the outcome, while automation and agents help our experts serve more customers and complete more work without cost rising one-for-one with demand. That creates a path to stronger service economics over time. That is why Mel Stone's role matters. As Chief Global Services Officer, she brings our global security operations center, MDR, service delivery and intelligence under one leader. Our product and technology team builds the platform and agent foundation. Mel's organization turns that capability into a repeatable service outcome. Under Mel, threat intelligence, vulnerability research, attacker research and labs come together as Rapid7 Intelligence. It closes the loop, turning what we learn into better detections, better service and better protection.

Rapid7 Intelligence is not a stand-alone product. It is the intelligence engine for the Command Platform, our service layer and our autonomous security operations center. Research should not end when it is published. It should end when protection changes.

Last quarter, I said AI needs a foundation, not another feature. Today, I want to introduce the next R in Rapid7, reasoning. The outcome must be resolution. Detection without reasoning creates volume. response without context creates motion, resolution creates value. More and more, the next cyber fight will be machine against machine. Defense must move at machine speed, but inside clear human boundaries. At our Boston Customer Summit, we walked customers through the model we are building, three colors, mission. Red agents probe like an attacker. Blue agents investigate and respond like a defender. Orange agents reason across both and help guide the safest path to resolution. People set the mission, policy and limits. People remain accountable. Kenzo is moving from acquisition to adoption. A growing number of customers across our base are now using early Kenzo-powered capabilities, giving us real-world feedback as we build toward our autonomous security operations center.

As we design and build it, the Autonomous Security Operations Center is a governed system where people, intelligence and red, blue and orange agents work together. The service model is designed for different ways to consume it, run by Rapid7, operated with the customer or added as an assurance layer above the customer's own security operations center. One service mission, different ways to consume it, AI first, vendor-neutral and sovereignty aware.

The summit was an important checkpoint. We showed what is operating today, what is in proof and what remains ahead. We tested where agents should act, where people must remain involved and what evidence is required to trust the outcome. That work is shaping the capability, the guardrails and the service model. Based on our current progress, we are working toward our first generally available release around RSAC 2027. We view that as version 1.0, not the finish line, but the first production step in a long and exciting journey toward increasingly autonomous security operations.

We are also working with leading partners across cloud architecture, advanced models and accelerated computing. Together, we are testing how the system performs before customers depend on it. Measure us across quarters by our cash generation, by execution in the core, including clear progress in exposure management, by how we reinvest and by whether that work becomes customer adoption, ARR growth and stronger long-term value. We are not declaring victory. We are building proof. We delivered what we said. Now we must turn that work into durable growth. My commitment remains the same, clear words, fast action, long-term thinking, and we own the result.

Rafe, over to you.

Rafeal Brown

Thank you, Wael, and good afternoon, everyone. As a quick reminder, unless otherwise noted, all numbers, except revenue and balance sheet items mentioned during my remarks today are non-GAAP. Please refer to our earnings release and SEC filings for additional details regarding the presentation of our results and guidance metrics.

In the third quarter of 2026, I'm pleased to report that we exceeded expectations across all guided metrics. We ended the third quarter with total ARR of $820 million, $8 million above our guidance for the quarter. We reported non-GAAP operating income of $46.2 million. Free cash flow came in at $26.5 million. As of the end of the quarter, we had total cash, cash equivalents and short-term investments of $732 million. We are particularly pleased with these results as the team remained incredibly focused on our customers and executing against our plan even as the company undertook a significant restructuring in the quarter.

I want to begin by taking a closer look at ARR as of the end of the quarter. As a quick reminder, our long-term strategy is focused on our core platform solutions comprised of our detection and response business, which includes our managed detection response offering and our exposure management business. Our core platform solutions now represent approximately 85% of overall ARR, reflecting the gradual mix shift of our business towards our core products, which on a year-over-year basis, grew approximately 1%, led by our detection response business, which at over 55% of total ARR maintained its growth rate at approximately 5% on a year-over-year basis. Our exposure management business declined approximately 6% year-over-year, offsetting some of the growth of our D&R business. Within the Exposure Management segment, we continue to see healthy adoption of our Exposure Command solution as customers upgrade from older vulnerability management solutions. In contrast to the growth of our core solutions, our noncore products, which, as a reminder, approximately 15% of total ARR declined approximately 19% year-over-year, driving the approximately 2% year-over-year decline we saw in total ARR. This drop in noncore ARR was in line with our expectations as we have deemphasized the sales of many of these noncore solutions.

As we plan for the remainder of 2026 and beyond, each of the noncore solutions are being carefully evaluated, ensuring we optimize margins as well as seeking opportunities to migrate customers to core platform offerings where possible.

Our favorable ARR performance in the third quarter reflects our strategic focus on building and selling our core solutions and focusing our go-to-market efforts on customers within our ICP. This effort led by our Chief Commercial Officer, Allan Peters, is demonstrating tangible results as we saw productivity per rep show notable improvement over the prior year. Beyond the numbers, we saw demonstrations of this strategy paying off in key wins during the quarter such as a new logo win from a global facilities management and property support services company who turned Rapid7 for both MDR and Exposure Command out of frustration with their incumbent provider for a lack of innovation and limited AI strategy.

In Europe, a large religious organization recognized the benefits of consolidating their cyber needs across a single platform and purchased MDR, Exposure Command and our cybersecurity compliance solution. In a third example, a national U.S. manufacturer came to Rapid7 looking for a provider that could understand its business and security environment and restore confidence in running a managed SOC after a failed prior implementation with a competitor. We positioned our MDR, Exposure Command and Vector Command solutions for a comprehensive end-to-end solution. These wins and more like them demonstrate our product and go-to-market team's focus on selling our core solutions into our target market.

Within the product organization, our new Chief Product and Technology Officer, Dan Deklich, now five months into his role, is making sweeping changes and has started making investments across the product and engineering organization. He has accelerated his investments into our products by rebuilding his leadership team with experienced product and AI leaders, deploying and training the team on a modern AI-focused SDLC and launching the development of our next-generation solutions. These efforts are core to the anticipated 2027 launch of the AI-enabled solutions needed to address the dramatically more dangerous cyber environment our customers are facing.

Returning now to our financial statements. Total revenue of $212.4 million declined approximately 3% year-over-year, reflecting the declines in noncore product ARR we saw earlier this year. We finished the quarter with approximately 11,800 customers and an average ARR per customer of approximately $69,000.

Turning to third quarter profitability. We delivered total non-GAAP gross margins of 72.2%, which we expect to moderate in Q4 and beyond as AWS and AI charges ramp. We reported non-GAAP operating income of $46.2 million or a margin of 21.7%, favorable to our guidance. This upside to profitability drove non-GAAP earnings of $0.60 per diluted share. Free cash flow totaled $26.5 million in the third quarter. Our GAAP financial statements also include a $5.5 million noncash charge for the full write-down of a minority investment made in the prior year. The charge appears in our GAAP income statements under other income and expense. From a balance sheet perspective, we ended the third quarter with $732 million in cash, cash equivalents and short-term investments. Combined with our continued free cash flow generation and a $200 million undrawn credit facility, we are well positioned to repay our $600 million convertible notes due in March of 2027.

Turning to the restructuring announced last quarter. This restructuring marked a strategic shift in our business operations to drive efficiency and focus across the organization, aligning resources and investments to our core platform solutions. We also created capacity to increase our investments in cutting-edge AI-driven solutions that will improve customer experience and increase competitiveness in the marketplace. As noted above, this investment is underway, but it will continue into 2027 as we build out our leadership and team within the product and engineering organization as well as ramp AI-related compute costs. We continue to expect to incur total charges related to the restructuring announced in August of approximately $11 million. In addition, the company continues to evaluate opportunities for further efficiency. These restructuring charges will be excluded from our non-GAAP P&L results.

This brings us to guidance. We expect to end the fourth quarter with ARR of approximately $812 million. And on a sequential basis, we expect that ending ARR for our combined core platform solutions of D&R and Exposure Management will be approximately flat quarter-on-quarter with expected continued sequential ARR decline coming from our noncore offerings. For the fourth quarter, we expect total revenue in the range of $208 million to $210 million, a year-on-year decline of approximately 4% at the midpoint. This would bring our full year 2026 revenue to $841 million to $843 million, a decline of approximately 2% at the midpoint and continuing to reflect the decline in ARR we have seen year-to-date. Fourth quarter non-GAAP operating income is expected to be in the range of $40 million to $42 million, even as we have accelerated some product and engineering hires into the quarter. This would bring our full year 2026 non-GAAP operating income to $140 million to $142 million, an increase of approximately 4% at the midpoint or a full year non-GAAP operating margin of 17% at the midpoint. Fourth quarter non-GAAP earnings per share are expected to be in the range of $0.53 to $0.55 per share on approximately 82.1 million fully diluted shares. We continue to expect free cash flow of approximately $130 million for the full year.

To sum up, we executed well in Q3 and are doubling down on our prioritization efforts to invest in and improve our core product offerings, even while we maintain our focus on opportunities for cost management and improved efficiency, all of which gives us confidence in where Rapid7 is headed in its transformation.

And with that, I'd like to turn the call over to the operator for Q&A.

Operator

[Operator Instructions] Your first question comes from Brian Essex with JPMorgan.

分析師問答

Brian Essex

Congrats on the better results. It's great to see the stability in the operations. I guess maybe to start, Wael, could you maybe walk us through, I guess, the profile of the sales organization, the changes that you've made there, how it was affected by the restructuring? And do you have the retention there that you need to build the maturity that's required to put yourself in a better position for growth next year?

Wael Mohamed

Thanks, Brian. Great question. As you are aware, as I mentioned last call, I've been in the Board for over a year prior to me taking the CEO job, and I was part of the team that actually did the search and the appointment of Allan Peters, our CCO. So we've actually been working in the background, making sure that we have a sales organization that both stable and it can be able to actually help us through growth. So I feel very good about what we have right now and what Allan has been doing prior to me joining as a CEO and been working very closely in the last few months as we evaluate the resources, what is the best way to utilize them. And most importantly, as Dan basically catch up with all the great work he's doing on his end that we'll be ready with the expertise to be able to take that to market.

We have a big base of customers. That's really our focus right now, making sure that these customers are served, understand exactly where we're heading. We had actually a customer summit in October where we brought in a sample of our customers here in Boston, around 50 customers from all over the world to be able to test our story, our road map, also get some really frank feedback about where we are and where we're heading. We showed them what we have right now, what we're building and our vision, and it was extremely positive. It was not only positive for our customers, but it was very positive to our team. And I feel very good about how the team is actually organized right now.

Brian Essex

Great. Maybe if I could follow up on that, too. Like what -- how does that reflect to what you're seeing in the pipeline? Do you have -- do you have a building pipeline in your core business right now that gives you confidence in growth next year? Or do you feel like maybe it's reliant on the products that you need to deliver like what you're planning for RSAC 2027?

Wael Mohamed

That's a great question. And sometimes the apple-to-apple is something like this is my first year here. Alan has been a little bit over a year. He feels very good about basically building the pipeline. I think we were always going to try to be able to put more investment in the area that we believe we can get more return. But the discipline, the sales process he and his management team have put in place, it gives us really a good feeling and confidence that we have the system we need to be able to basically lean on.

Operator

Your next question comes from Mike Cikos at Needham.

Michael Cikos

And I like the comments as far as the stability that you guys are starting to demonstrate here. Wael, if we could just come back to the prepared remarks, can you just peel back the layers on the services component that you were speaking to as far as what the investments are that are required? How we should be thinking about those initiatives as far as execution and how that's expected to transpire in the model?

Wael Mohamed

Absolutely. One of the great things, as I came to the company, I was telling the team the other day, the more I dig, the more gold I find, and we have an abundance of data. And as you know, we're not only providing our product as a software. We provide a service layer in the form of our SOC, where customers entrust us with all the form of data, so we can be able to help them to find that needle in the haystack. And we've done a very good job servicing plenty of customers that basically we process, I want to say, in the tune of maybe 250,000 alerts a day, over a terabyte of data that we crunch. And we know that as we move to the Agentic layer, this data will be definitely what we need.

But one of the things I needed Mike to do is, as I was sitting with my top team, I'm surrounded with an incredible team, Rafe, my CFO; and Allan, my CCO; Dan, our CPTO and Katie, my Chief People Officer, I knew that I needed to have another senior person that all think about how are we going to deliver this service layer at a software economics. That's extremely important. And I believe that's the future, not only for our company, but actually in our industry.

Cybersecurity wanted to be delivered as a service. There's always a problem how to be able to do that with the right margins. And that's really a major focus to the team. So that's why the addition of Mel, Mel has many years of basically experience in high-scale service delivery in the U.S. military and the command center and bring her to our team and bring that deep expertise and the focus, if you will. So that's basically when you peel the onion, this is the layer that I'm very excited about it, the data fabric and on top of that, the service layer that we can be able to deliver it at a software economics, if you will.

Michael Cikos

Excellent. And for the follow-up for you or for Rafe here, but I know that you were talking about the restructuring and how it's freeing up capacity to make additional investments. Some of those investments obviously already underway. Others expected to begin in calendar '27. Can you help us think a little bit more about where those investments are going to be taking place? Is it more on product and getting product ready in preparation for RSA as an example? Or is it feet on the street and reorienting the go-to-market? Can you just help us think about those AI-driven investments that you guys are alluding to?

Rafeal Brown

Yes. You bet. Thank you. The majority is really within the product and engineering organization. I touched on some of the work Dan is doing, making changes on the leadership level, bringing in new talent to really build this modern AI-enabled SDLC, right? And that's some different players that some different leaders, but it's also putting AI to work for us in a lot of ways. So there's certainly an element of that throughout the R&D organization where there's investment on that side of it.

But then the products we're talking about here, even if it's Kenzo from the acquisition last year as we're getting ready to roll that out, but also the new products that Wael referred to earlier, both of those take investment from the team. It's people working on them, but it's also the technology and the compute, if you will, the AI-driven compute to make them come to life. And so there is investments going on in that area. But the quick summary is really within the product and engineering is where we're seeing the bulk of it.

Operator

Your next question comes from the line of Eric Heath at KeyBanc.

Eric Heath

Well, maybe just to ask on the noncore business, if I could. I know you're evaluating some options and thinking about it carefully. But just any further color you can share on how you're thinking about that noncore business, some options and maybe the time line you're thinking of when you'd like to be able to come to a resolution on that. And once we get past kind of that decision or that time line, then we could see kind of the growth start to reaccelerate from there.

Wael Mohamed

Yes. Thanks, Eric. That's a great question. Look, I always tell my team is actually, as we set the strategy, it's what's harder than basically deciding what to do is deciding what not to do. So the first few months, I spent a lot of time with customers, with partners, with my team, talking to basically some advisers to try to figure out what we have and what we need to be able to focus on. And we feel we have a very, very strong understanding of the interconnectivity and all the connected tissues of our platform and our products. So we have a set of what we call noncore. Noncore does not mean they are not important. They are actually healthy business. We have customers that they are loyal, and they are actually produce margins, and we did not take that decision by placing them noncore lightly.

For me, a core is a big part of the business that I'm considered the leader. I have the right to be invited and I have the right to win, and I need to put every single dollar of investment behind that so I can get my fair and in some cases, my unfair share. The noncore, it is basically a set of products that we do not have the right to win those races, not because we do not have a good product, but we don't have the size and the invitation to put us in the top 3 at the selection level. So that's kind of basically the definition.

So that Phase 1 was done. The end of sale announced to the customers. We spend a lot of time to making sure that these customers understand why we did, what we're doing and understand our strategy and why we're the partner for them in the long run. And we're getting a lot of positive feedback about the transparency and the decisiveness in that decision. Number two is we need to figure out what is the best thing we need to do for the shape of the overall business. That's why managing that runoff has to be very carefully assessed. We feel that it will not be symmetric, but we're hoping in a short order, we will basically have a better answer for the best way to manage that noncore.

Eric Heath

That's great. And then quickly, one for Raf3. Sorry if I missed it. But last quarter, I believe we were talking about growth in free cash flow dollars in '27. So I'm just curious if that was still the guardrails that you're thinking about.

Rafeal Brown

Yes. Thank you. We are going to defer all '27 guidance to our next earnings call.

Operator

Your next question comes from the line of Saket Kalia with Barclays.

Saket Kalia

Wael, maybe for you just on the core business. It feels like based on the guide for Q4, it feels like the retention rates there might be starting to stabilize or churn may be improving said a different way. What do you find is working there?

Wael Mohamed

Then focus and the clarity to the team, and you probably saw it from Rafe script where you can see the shape of the business is moving from 80-20 approximately last quarter to an 85-15. So our sales team, our sales organization has basically got their marching orders. It's already been moving in the right direction, all hands on deck. Our precious customers, we are basically providing them with clarity with a road map, where we're going to be in the future and most importantly, how we're making sure that the outcome they're expecting from us is fulfilled and basically get closer. So that focus is really -- is helping, and we feel good about basically our efforts now is moving the needle for sure.

Rafeal Brown

Yes. And the one thing I would add there is that as Wael mentioned, the organization has been extremely focused. That move, we've been calling out the last couple of quarters, more than 80%. I wanted to update people on the current blend. And you also saw the growth rate of our D&R business was the same last quarter to this quarter. So we're feeling like we're pleased with the work the team is doing. That focus is paying off, I think, is really helpful.

Saket Kalia

Yes. No, it makes a lot of sense. Rafe, maybe for my follow-up for you. We mentioned some end-of-life products. I know we're not talking about 2027 again, but just to sort of contextualize when that end of life would start to impact ARR. Could you just remind us what are the products that are going to be end of life? When will they be end of life? And roughly how much in ARR do they contribute currently?

Rafeal Brown

Yes. Thanks, Saket. And just to clarify because it's hotly detailed around here, it's end of sale. So one of the things that we have in our noncore -- noncore is not one thing. It's quite a large range of offerings. But for example, our cloud and our AppSec solutions are end of sale as stand-alone solutions, but they are still available when you buy an exposure command solution where they're part of this overall set. And so that's one of the subtle distinctions here.

What we want the team to be doing is selling this -- the bundled solutions, if you will, or the combined solutions because that's where the customer gets much more value, and that's where we differentiate and really stand out. So cloud and AppSec are two pieces in there. Within the threat intelligence area, our digital risk protection, we're into sailing on that one. We still have a good deal of customers that will continue to use it. You can still renew, you can still buy more if you're already a customer. But we want that sales focus on selling our core solutions. And so we've announced that. It will take a few months before it becomes official. But even this year, when we look into it, the comp plan was already favoring our core solutions.

The comp plan, of course, set back in January. We'll continue that push, right? We can move a lot of it. So it's a relatively small number of new sales that were going to these products this past year. We're just going to be real crisp and clear with everybody about our go-to-market efforts, how we focus on that core product solutions.

Saket Kalia

Makes a ton of sense. It really just simplifies the price list is how I read it. And thanks for clarifying that it's an end of sale and not an end of life.

Operator

Your next question comes from the line of Josh Tilton at Wolfe Research LLC.

Joshua Tilton

Maybe just two quick ones for me. Rafe, I preface the next -- my first question with, I really appreciate all the disclosure and the color that you give us into the moving pieces behind ARR. But if you kind of take away the segments, the categories, what they're called and we simplify it down here, are you outperforming ARR more than you did last quarter because things that are good are getting better? Or are you outperforming ARR more this quarter than last quarter because things that have been a drag have been less of a drag?

Rafeal Brown

Yes, that's a great question. I think especially if you look relative to our guide, like as I called out in the prepared remarks, we went into the quarter knowing we're doing this restructuring and knowing that can be -- that is a tremendous distraction to the team, yet we saw the team execute well. We saw -- and it was split, frankly, between the new booking side of the house. It's still not the answer we want a few quarters from now, but we did better than we thought we would on new. We also had some notable good news on some of the accounts that were at risk in the quarter.

So I don't want to overstate this. It's subtle elements, but I felt like within some of the core solutions, we saw the team really rallying and hustle in and working well with our customers where we were able to achieve a better result than we had anticipated when we gave our guidance.

Joshua Tilton

Okay. And then maybe just my follow-up. I couldn't help but notice the guidance for Q4 ARR is kind of in line with how you guided this quarter. Like maybe signaling aside and all that, like what gives you the confidence to guide in a way that kind of makes us feel like we could see the end of ARR declining on a sequential basis?

Rafeal Brown

It wasn't centered around that. I will just tell you straight away. We are calling out that we will see a decline from the $820 million that we finished at down to the $812 million that we guided to. That said, like it's more just the way the math worked out that it happened to be the same number in all fairness. We go through like really exhaustive efforts with the team, with the RevOps team, with the sales leaders to make sure we have just as much visibility as we can about how bookings are going to come in, how renewals are going to come in to really do our best to form our guidance. And that's the hard work that goes into this to try to do our best and provide insight wherever we can.

I did call out in the script that we expect that core will be approximately flat sequentially and noncore will be what pulls the ARR down as we go forward. And frankly, we do expect that pattern is going to continue into the near future that we have visibility to. That's a key element of where the business is just as we really focus everybody on core and get these new products out and hope to build growth there. But that noncore drag is going to continue for a little bit.

Operator

Your next question comes from the line of Shrenik Kothari at Baird.

Shrenik Kothari

So, Wael, you had previously highlighted this particularly attractive customer segment of $100,000-plus opportunity. And today, you and Rafe pointed to improving productivity and also focusing on this ideal customer profile is beginning to produce these results. So just wanted to unpack like how is that opportunity developing in practice? Are you seeing these sort of average deal sizes in that range holding up as you become more selective? And also are you seeing a larger proportion of the new logos coming from these customers or not? Then I have a follow up.

Wael Mohamed

Yes. As I mentioned, when we basically start focusing on the core, we also wanted to tune our ICP and the area that is very natural to us, and we have a very, very positive basically customer pull. So as we are aligning this, we're feeling good about basically the shape of the business. We're very natural in what I call it the heart of the enterprise. The companies that basically want to rely on us to take complex basic security jobs and simplify, provide them with a 724 around the world basically solution that they can be able to digest and ensure that they are basically more secure with us. We see that all the time. We see it even when we go and get into a side-by-side with one of our competition, how it's very natural when we are in our ICP that the deal can happen faster and quicker and our value proposition is more clear. So as the team is seeing that, I think our shifting is becoming easier and give us the confidence to actually put the wood behind there, if you will.

Shrenik Kothari

Got it. Very helpful. And a follow-up for -- you had previously acknowledged some near-term cloud cost pressure associated with Kenzo development testing. And today, you did mention the SOC efficiency still largely ahead and while also expanded on the AI-first service model to allow agents to support more customers without rising costs. So just -- I know you plan to provide more formal guidance in the coming quarter around that transition. But just how should we think about the magnitude and the timing of the transition? If you can just highlight like the progress there?

Rafeal Brown

Yes. So I think the best way to think about the investments that are going on there, they're going to -- we're in kind of early stages, and we're in a little bit of, frankly, a time where we're developing that next generation or developing those products and solutions, but we still have to provide good support of our customers as we go through this, right? So we're building efficiencies in, and we'll start to see the fruits of that. We'd like to think over the course of 2027.

Wael mentioned in his prepared remarks, some of the Kenzo infrastructure, we're starting to move customers over that in their earliest stages and getting that up and running. So we're making very nice tangible progress. But that -- those offerings do a couple of things. They provide better service to the customer, and then they're going to also help us build greater efficiencies into our infrastructure.

Operator

Your next question comes from the line of Matt Hedberg at RBC.

Matthew Hedberg

Just one for me. There was -- obviously, we all saw the PHP vulnerability a couple of weeks ago. I'm just sort of curious, I don't think you mentioned in the prepared remarks, but any sort of comment on how something like that or other AI-based vulnerabilities might become a bit more of a tailwind for your business?

Wael Mohamed

Sure. Absolutely. You know what? When I talk to customers every single day, I find myself have to answer those questions. And they really appreciate the efforts and the work we're doing to make sure that we're ahead, the amount of information we provide them, the partnership that we're doing right now with the frontier labs and making sure we're in the front end and working with them so we can basically be prepared.

So we're having those conversations all the time, and it's top of mind. And I'm very excited that some customers actually seek us and ask us what we think and we basically have a very constructive conversations about how we assist them. In this incident, we were prepared. We had the advisory, we had the information.

Our team was in front of it. We informed our customers. We've taken some of the calls and we assist them, sometimes assist them in their internal communication as we're finding that more of the executive and even the Board is asking about the status. And we're adjusting to making sure that our information is not only technical, but can also address the business needs.

Operator

Your next question comes from the line of Adam Borg at Stifel.

Adam Borg

Maybe while on the changes that we've been making here, how do we think about the progress that you're seeing both in North America and international? Obviously, international is on a much smaller base, but seeing continued growth there with some lower pressure in North America. I assume that has to do with some of the mix. But any color on kind of the drivers of the two and then the opportunities that you see?

Wael Mohamed

Yes. For me, I can't wait to basically see international do what I'm used to and what I love. we're making huge progress in the U.S., and I still think there's a lot of room as we focus in our -- basically our ICP and our core area. So the team is definitely ultra focused to making sure we have the right investment in the right area, and we have the right upside.

We have a decent international business, but there is a lot of upside. And we are starting to basically plan for next year, what is the appropriate investment and what areas where we can basically get some low-hanging fruit, and there is a lot of great conversations happening on that front.

Operator

Your next question comes from the line of Gregg Moskowitz at Mizuho.

Gregg Moskowitz

Great. Rafe, you mentioned earlier that there was some good news with respect to some accounts that were perceived to be at risk this quarter. Anything that you can share anecdotally in terms of what it was that resulted in these accounts deciding to remain in the fold with Rapid7 as opposed to perhaps going elsewhere?

Rafeal Brown

Yes. I think what I would point to is like the team is incredibly focused on making sure we're providing good services to our customers. We have regular calls with the team where we go through all the accounts. And on those calls, you've got Adam and his -- we got Dan and his leaders on the call as well as Alan and his leaders on the call. And we're looking at that several quarters ahead. Like we're just really trying to focus. And that tends to be on the more senior level accounts or the bigger accounts, but that focus of engagement and getting out in front of those accounts if somebody is having some struggles two, three quarters before the renewals up gives us the flexibility to get in and make a difference. And so some of that effort is stuff we started much earlier in the year, but we're still meeting as a team on a regular basis where we're all there to rally around.

And I just think that kind of discipline, but also just that focus on customer first makes a difference. And you don't get them all, but you make a difference to some of those accounts and you're able to satisfy the customer and they appreciate the focus and you can get your renewal.

Operator

Your next question comes from the line of Gray Powell at BTIG.

Gray Powell

Congratulations on the better-than-expected results. So I think you may have hit on this already, but I just was hoping to get a little bit more color. So I mean, it was good to see detection and response ARR stable at 5% in Q3. It was growing mid-teens a year ago. So I guess my question is, do you think you can get back to that historical growth rate? What needs to happen? And is it more on the product side? Is it execution or something else that maybe we're not thinking about?

Wael Mohamed

It's a great question. And I agree that this segment is growing, and we need to do better to actually earn our fair share as we used to do before. I think the main thing we needed to do and we're already doing is focusing on the ICP where we actually have the highest possibility for. As we move some time maybe in the ultra large, we basically had some headwind and that basically consumes some of our energy. Now as we corrected that and going into the sweet spot where we are designed and we have the right to win, we are seeing a lot of positive basically movement in the right direction. So that's the #1 thing.

As we also start talking to the customers more, as we said, we increased our engagement with our current customers basically about the future, the road map, what we're believing the future looks like, some of the work we're doing and the exciting work in agentic world and the investment we're making, I think that, that definitely helped customers to see that not only we can serve them today and we should have our fair share, but we should be the right partner for them tomorrow as well.

Operator

Your next question comes from the line of Joseph Gallo at Jefferies.

Grant Darling

This is Grant Darling on for Joe Gallo. And I'll ask them as a two-parter. Maybe to start, there's been a lot of rhetoric from platforms and new entrants around expanding capabilities and exposure management. Are you seeing any change in customer buying behavior or sales cycles as that competitive landscape evolves? And then just to go ahead and follow that up, are you seeing any pricing pressure from privates, particularly impacting margins in MDR?

Wael Mohamed

Very good questions. So in the first part, yes, that was the case in the beginning of the year. And as reality hit we're finding actually ourselves having more of a cooperative conversations with some of the big platforms and basically as customer realizing that what we do is an adjacent, it's not an overlap. And we're seeing that pressure of that as basically more clarity, more engagement with customers, more explaining where we fit and what our value proposition. We believe we have a pretty strong value proposition. And as we engage with the customer, I think that's getting a lot easier.

What was the second part? My apologies.

Grant Darling

Yes. Just any pricing pressure coming from private? Just kind of when you think about your margins in India, are you seeing anything there or things pretty steady?

Wael Mohamed

As I said, as our sales team now is focused on the core, and they basically have more of a clear ICP where we have a high level of winning. We have an incredible amount of reference customers over -- as you know, over 10,000 customers. We have a big scale. When we get in there, I don't think customers really are as price sensitive as you were before. They're more looking for a partner that can address today and the future. And they are more interested about what is exactly your AI strategy, how are you going to get there and basically how you can be able to cover me. And what are you thinking about now the Agentic world and some of the risks associated with it. So we'll find ourselves in the last mile talking about that more than talking about price.

Operator

Your next question comes from the line of Rudy Kessinger at D.A. Davidson.

Benjamin Smith

This is Ben Smith on for Rudy. I was going to ask on the stand-alone products that you're doing end of sale on, have there been any customers that have expressed interest or purchased packages so they can still use those products? And then I had a follow-up.

Rafeal Brown

Yes. I would first say part of the end of sale thing is they can keep utilizing the products, right? We're not taking anything away from them because we're not end of life now. So customers can renew existing customers, if they need more to expand, that's still a thing. So I think just that subtlety on that end of sale. And keep in mind, a good deal of our customers might have other products with us and also these stand-alone products that we have in the noncore bucket. So that was a long way of saying, yes, customers are still interested in buying us the ones that are on many of these products.

Benjamin Smith

Got it. And then yes, maybe bigger picture, you're not giving 2027 color. But just want to ask, do you feel that core is now stabilized? And what would give you -- what could you point to that's giving you confidence that, that can drive maybe a return to positive ARR growth?

Rafeal Brown

Yes. Look, I think it is nice to see the year-over-year growth rate in the same two years -- or two quarters in a row, if you will, the sign of stabilization. I did call out that we expect it to be roughly flat on a sequential basis. That's clearly not where we want to be, but it's where we are and how we're looking at the numbers. We have confidence though that we can get to return to growth because we're focusing on our core like never before. We've got some really great things in the pipeline for new products that will be in the core new product offerings and expansion. And just the way the product team is digging in to focus on those core offerings.

I think all of that adds up to a time where you feel better about the direction and the strength of the company and its focus, combined with the fact that the world needs our products more than ever because of all the changes in the broader macro. That's what excites us and makes us think that we can -- we're sitting on top of an opportunity that's going to take work and it's going to take time. But we think we can turn that into growth down the road.

Operator

At this time, we have reached the end of our question-and-answer session. We thank you all for your questions, and you can now disconnect your lines.