2024-01-11 23:58:36 ET
Summary
- RPD’s revenue has grown impressively well (CAGR +30%). Management has developed a compelling business model, with a broad range of services, underpinned by modern technologies.
- RPD is gaining market share and continues to innovate (supplemented by M&A). ARR exceeds revenue, and Management sees a potential uplift of 8x to ARR per customer over time.
- RPD’s margin development has not been sufficient thus far, but it appears at the precipice of a rapid acceleration as it continues to gain scale.
- The company is trading at a deep discount to its peers despite this potential, implying upside in our view. Even if growth was to slow, value is present.
Investment thesis
Our current investment thesis is:
- RPD appears to be cheap exposure to the cybersecurity industry, which is currently experiencing a long-term tailwind, with mass adoption and significant innovation. RPD appears at the forefront of this, already cloud-capable with a broad integration base, with development in the areas of machine learning and behavioral analysis.
- The company’s financial development has been positive and incredibly consistent despite scale, potentially contributing to margin neglect. We suspect this will be the area of focus, with rapid improvement and a race toward the ability to consistently buy back shares. This will be the key catalyst to generating long-term value for shareholders.
Company description
Rapid7 ( RPD ) is a leading cybersecurity company. Specializing in analytics-driven security solutions, the company aids organizations in managing cybersecurity risks. Rapid7 provides a comprehensive platform for threat detection, incident response, and vulnerability management.
Share price
RPD’s share price performance has been positive, broadly matching the S&P 500. The company has experienced periods of outperformance but has subsequently declined. Investors are attempting to understand the long-term trajectory of the company alongside the wider macroeconomic environment.
Financial analysis
Presented above are RPD's financial results.
Revenue & Commercial Factors
RPD’s revenue growth has been impressive, with a CAGR of +30% into LTM23. Importantly, the company’s trajectory has been consistent, exceeding 20% in every annual period.
Business Model
Services:
RPD is a rapidly growing cybersecurity business, offering a range of services that include:
- Vulnerability Management - RPD specializes in vulnerability management, offering solutions that help organizations identify and prioritize security vulnerabilities in their systems/networks.
- Incident Detection and Response - The company provides tools for the detection and response to security incidents. This includes advanced threat detection, investigation, and response capabilities to identify and mitigate cybersecurity threats in real-time.
- SIEM (”Security Information and Event Management”) - RPD offers SIEM solutions, allowing organizations to aggregate, correlate, and analyze security events from various sources. This helps in identifying patterns, anomalies, and potential security threats.
- Threat Intelligence - The company provides threat intelligence feeds and services, keeping organizations informed about the latest cybersecurity threats.
- Advisory Services - RPD offers advisory services where its experts provide guidance on cybersecurity strategies, risk assessments, and overall security program improvement.
Platform:
A fundamental component of RPD’s services is the integration of automation and data analytics capabilities into its solutions, enabling organizations to automate routine cybersecurity tasks, respond to incidents faster, and improve overall operational efficiency.
For example, UBA (”User Behavior Analytics” ) tools by RPD analyze patterns of user behavior to identify anomalies that might indicate unauthorized access or malicious activities. This proactive approach, which is actively learning and honing its accuracy, adds an extra layer of security.
Further, RPD provides cloud security solutions, aligning with the broader long-term trend of organizations increasingly moving their operations to the cloud. Its development of a strong cloud-based platform insulates RPD against the inevitable transition, while positioning it well to capture market share.
RPD actively engages with the cybersecurity community. It conducts research, shares insights, and contributes to open-source projects. This involvement helps in staying at the forefront of emerging threats and technologies, while marketing its brand.
Financial KPIs:
RPD’s ARR, which is $777m at Q3’23, has grown at a CAGR of +26% since Q3’19 and +14% YoY. Importantly, this remains above revenue, which is a difference from Q3’22, implying an acceleration.
ARR growth has been driven by a combination of new customer wins and ARR by customer, as RPD has seen good success from up/cross-selling customers. Management is actively pursuing a “Land and Expand” approach, with both delivering ~6-7% growth in Q3.
Management estimates the recurring revenue potential for an average-sized customer to be $520k, based on the long-term development of its product offering and cross-selling, a ~8x increase from its existing level.
Competitive Positioning
We consider the following factors to be key competitive advantages:
-
-
Holistic Security Approach - RPD's business model offers a holistic approach to cybersecurity, covering vulnerability management, incident response, and compliance. This comprehensive suite of services appeals to organizations seeking integrated solutions.
-
Strong Threat Intelligence - RPD’s services are recognized for their impressive capabilities and competitive offerings relative to leading market participants.
-
-
Adaptation to Cloud Trends - The company's focus on cloud security reflects the broader industry trend of organizations migrating to cloud-based infrastructures. This future proofs the company and leap-frogs it ahead of many peers.
-
Proactive Threat Detection - RPD's emphasis on proactive threat detection, through tools like UBA and SIEM, addresses the need for early identification of security threats.
-
Automation for Efficiency - The incorporation of automation and orchestration features in RPD’s solutions, particularly with developments in AI and ML ahead, positions its offering perfectly to scale alongside technological development.
-
Investments in Innovation - RPD's commitment to staying at the forefront of cybersecurity is evident through its investments in innovation. In conjunction with this, the company continues to broaden its integration capabilities, which is incredibly important in a digital corporate environment.
Cybersecurity Industry
RPD competes with, and is peers with, the following (alongside many others): Splunk ( SPLK ) ( CSCO ), Qualys ( QLYS ), FireEye, CrowdStrike ( CRWD ), Fortinet ( FTNT ), Palo Alto Networks ( PANW ), SentinelOne ( S ), and Zscaler ( ZS ).
Management estimates its market potential is ~$31-38b, with less than $1b currently captured. We suspect the ~$520k ARR per customer is likely optimistic, although even if half that is achievable, the runway for growth is high.
Competitive dynamics include:
- Technological innovation.
- Range and effectiveness of cybersecurity solutions.
- Pricing structure and scalability.
- Integration and breadth of services.
- Market reputation and client trust.
Margins
RPD’s margins have considerably improved with scale, as the company’s relative customer acquisition and R&D costs have declined. SBC costs are likely close to their peak as a % of revenue, which is depressing margins despite FCF now turning positive.
One of the reasons for the share price “correction” post-22 is due to the limited development following this period (3 FY in a row of ~4% EBITDA-M excl. SBC). Margin development remains uncertain, although we do note better execution in recent quarters.
In RPD’s last four quarters, its adj. EBITDA-M was 13.4%, 9.2%, 10.0%, and 21.6%, which represents an LTM23 margin of 13.7%, an improvement of +10.2ppts compared to LTM22, +9.2ppts against LTM21, and +8.6ppts against LTM20.
The key to RPD’s success, and an improvement in investor sentiment, is predicated on now making meaningful improvements to its margins.
Balance sheet & Cash Flows
Similarly to other growth businesses, RPD has relied on debt to fund its growth. With rates increasing, its interest burden has rapidly expanded to 8% of revenue. In the near-term, we suspect this will be a burden that must be accepted as the company is not in a position to sufficiently deleverage through cash, although we suspect funding requirements will soften (outside of opportunistic M&A) as its cash reaches ~$322m.
Outlook
Presented above is Wall Street's consensus view on the coming years.
Analysts are forecasting growth of +9% into FY25F, alongside a rapid expansion of margins. We broadly concur with these forecasts, although we suspect growth will slightly overperform and margins will land lower.
It is worth highlighting that the company has performed exceptionally well recently and is noticeably outperforming analyst estimates on both a revenue and profitability basis, although more so the latter.
Industry analysis
Presented above is a comparison of RPD's growth and profitability to the average of its industry, as defined by Seeking Alpha (36 companies).
RPD performs well relative to its peers, although is not a clear financial leader yet. The company’s growth across revenue and profitability metrics has exceeded the average, at a time when companies big and small have grown impressively due to tailwinds and M&A.
The company is lacking in margins, partially due to it still requiring scale before it can see an acceleration. This said, its FCF margin is noticeably behind, which is the key factor currently which means we expect RPD to trade at a small discount (offset by growth). We see a clear, executable route to closing this gap but risks remain and must be priced in.
Valuation
RPD is currently trading at 5x LTM Revenue, 26x NTM Adj. EBITDA, and 21x NTM FCF.
We believe RPD is attractively undervalued currently. The stock is at a discount of ~56% to its peers on a NTM FCF basis, ~36% on an LTM Revenue basis, and ~1.8ppts on a FCF yield basis. This is a large delta for what is not a large commercial and financial difference.
Even if growth were to slow, rates should decline (forecast to in 2024) and cash flow will accelerate, compounded by this cash being used to deleverage. RPD will see its valuation increase in attractiveness without considerable execution risk. At this point alone, we see value. Beyond this, if we consider its growth and margin potential, upside accelerates considerably.
Key risks with our thesis
The risks to our current thesis are:
- Failure to keep pace with technological advancements.
- Economic downturn impacting corporate spending.
Final thoughts
RPD is a quality business that has consistently managed to grow well, reflecting a strong market offering that is underpinned by quality technology. We suspect the company can maintain a reasonably good trajectory, continuing to gain market share from existing incumbents. AI represents a large opportunity for the company that is currently difficult to quantify.
In the coming 5 years, we expect RPD to experience an accelerating margin as growth slightly softens, with deleveraging allowing for the initiation of buybacks.
For further details see:
Rapid7: Quality Business Trading Attractively In A Thriving Industry