管理層發言
Good day, everyone. My name is Kehaylani, and I will be your conference operator today. At this time, I would like to welcome you to the Q2 26 Rapid7 earnings call. All lines have been placed on mute to prevent any background noise. After the speakers' remarks, there will be a question-and-answer session. If you would like to ask a question during this time and if you have joined via the webinar, please use the raise hand icon which can be found at the bottom of your webinar application. At this time, I would like to turn the call over to Matthew Ryan Wells, Vice President of Investor Relations.
Thank you, operator. And good afternoon, everyone. Today, we will be discussing Rapid7's second quarter fiscal 26 financial results. We have distributed our earnings press release over the wire; it can be accessed on our investor relations website. With me on the call are Corey E. Thomas, Executive Chairman; Wael Mohamed, Chief Executive Officer; and Rafeal Edgar Brown, Chief Financial Officer. As a reminder, all participants are in a listen-only mode and a question-and-answer session will follow our opening remarks. Before I hand the call over to Corey, I want to remind everyone that certain statements made during this conference call may be considered forward-looking statements under federal securities laws. These statements are made pursuant to the Safe Harbor provisions of the Private Securities Litigation Reform Act of 2000 and include, among other things, our outlook for the third quarter and full-year 2026, our expectations regarding fiscal periods beyond 2026, our transformation and restructuring initiatives, our strategy, priorities, and capital allocation, anticipated operational improvements, investments in our core platform and AI capabilities, and our expected growth drivers and financial performance. These forward-looking statements are based on our current expectations and information currently available to us. We believe any forward-looking statements we make are reasonable; actual results could differ materially due to a number of risks and uncertainties including those contained in our filings with the SEC. Reported results should not be considered indicative of future performance. We do not undertake and expressly disclaim any obligation to update or alter our forward-looking statements whether as a result of new information, future events or otherwise, except to the extent required by applicable law. Further information on these forward-looking statements and risk factors are included in the filings we make with the SEC including the section titled cautionary language concerning forward-looking statements in our earnings press release. Additionally, over the course of this call, we will reference non-GAAP measures to describe our performance. Please review our earnings press release and filings with the SEC for our rationale behind these non-GAAP measures and for a full reconciliation of these GAAP to non-GAAP metrics. These documents, in addition to a replay of this call, will be available on the Rapid7 Investor Relations website. With that, I would like to turn the call over to Corey.
Welcome to Rapid7's Q2 26 earnings call. I join you today in a new role, but with the same passion and purpose: to ensure that organizations of all sizes can get the best results from their security operations. I have worked with the board and especially with Wael over the last year to revitalize our team, improve our execution, and fully leverage the opportunity that AI is providing. As part of that work, it was clear that we have significant opportunities but only if we tighten our focus on our core offerings, sharpen our alignment and execution around those offerings, and deliver a more efficient model. The board and I recruited Wael, whom I have known and respected for many years, to do exactly that: deliver on Rapid7's full potential in the midst of one of the most exciting moments in technology. In many ways, Wael is accelerating a plan he helped develop. In other areas, he is providing sharper focus in leadership, as you will hear in his upcoming comments. Before I hand it over to Wael, I want to take a moment to acknowledge the incredible work of our colleagues at Rapid7, whose passion and care for our customers and their deep and energetic embrace of innovation continue to inspire me. With that, I turn the call over to Wael.
Thank you, Corey, and good afternoon. Since this is my first earnings call as CEO of Rapid7, I want to use my time a little differently. Rafeal will take you through the quarter, the actions we announced, and our guidance. I want to focus on our strategy, the operating discipline behind it, and how I ask you to measure our progress. I have known Rapid7 for years. Long before I joined the board, I saw this company at its best—moving fast, earning customer trust, and winning in the heart of the market. Joining the board gave me a much closer view of the company, its people, and its potential. The closer I got, the more I liked what I found. Rapid7 is a good company ready to be great. It is not broken. It has reached a ceiling. The issue is not our assets. It is how we focus our resources and energy. Breaking through requires clear choices, strong execution, and an operating system that can repeat success at scale. That is the work I signed up for. Transformation is not about changing everything. It is about having the discipline to change the few things that matter most, and doing so consistently over time. Over the past year, we put the leadership team in place for this next chapter. We added a proven Chief Financial Officer to strengthen operating discipline, a Chief Commercial Officer to help us scale and win with customers, and a Chief Product and Technology Officer to build an AI-first platform. We now have our leadership team, operating model, and capital allocation aligned behind one direction. Since stepping into this role, I have spent my time listening to customers, our people, partners, and many of you. Three things are clear. First, focus matters. We do not need to win everywhere. We need to be exceptional where we can win. Our clearest right to win is in the heart of the enterprise market: customers that need enterprise-grade security but also need fewer tools, less complexity, and faster outcomes. Our leadership in the mid market is proof of our strength. It is not a limit on our technology or our market. We will continue to compete for larger enterprises where our platform is the right fit. These customers want fewer, better partners—not more tools. That is where Rapid7 has earned the right to win. Second, outcomes matter more than products. For years, cybersecurity answered complexity with more complexity: more tools, more alerts, more consoles, more people. Customers do not need another dashboard. They need less risk, less complexity, and faster action. Our opportunity is to connect exposure management with detection and response, to move from finding problems to resolving them. For many customers, that outcome will be delivered as a service. Skilled security people are hard to find. Customers need a trusted partner that can bring the platform, the expertise, and the work together. Third, the way security work gets done is changing. AI should not become another label. It should change the work. Automation helps us move faster today. Agents let us do more across more data, more steps, and at much greater scale. Attackers are moving at machine speed. Attackers only need to find the seam between an exposure and the fix, an alert and the work needed to investigate it, or a decision and an action. Defenders need the same reach and speed with people remaining in control. People decide. Agents do. In this model, agents are not just features inside a product; they become part of the service layer, extending the reach of our security experts and helping us deliver outcomes faster and at scale. We acquired Kenzo because AI needs a foundation, not another feature. That foundation connects data, agents, and human decisions, and the tools customers already use, while keeping customers in control of their data. We want AI to fit into our customers' environments, not force them into ours. Building that future requires focus now. The changes we announced affect colleagues who have contributed to Rapid7. I want to thank them for what they have given to this company and to our customers. These actions are a focused reset. We are not shrinking our way to the future. We are reshaping the company so we can invest more behind the parts of the business that will define it. We are simplifying the company, aligning our cost structure with the core, and creating room to invest. We are concentrating our growth investment behind detection and response, exposure management, and the AI foundation that connects them. We will continue to support customers using our other products. This is not simply a cost action. We will reinvest a meaningful portion of the savings in our core platform, the people building it, and the AI foundation behind the next generation of our products. Seventy days is not enough to complete a transformation. It is enough to set direction, and show how we will operate—with speed, clarity, and accountability. Operating discipline creates choices. As Rafeal will explain, the actions we announced put us on a path to exit the year at approximately 20% non-GAAP operating margin. That is not the destination. It is evidence that we are building a healthier company—one with more capacity to invest, innovate, and generate durable returns over time. In the second quarter, we came in slightly above the guidance we provided. Detection and response continued to perform well. At the same time, total ARR declined. Exposure management is not yet where it needs to be, and other parts of the portfolio continued to pressure our results. The current direction of ARR is not good enough. We are acting on it. This is a multi-quarter transformation. We are changing the path of the company toward durable growth, not managing for one quarter. As we sharpen our focus, some parts of the business may face pressure before the benefits become visible. At times, we may need to simplify before we can accelerate. Let me leave you with the framework I ask you to use when measuring Rapid7 over the coming quarters. First, look at the cash generated. Cash is not the finish line. Durable growth is. But cash tells you whether the operating model is becoming healthier and whether we have the capacity to keep investing. Second, measure this transformation over several quarters, not one. Look for stronger execution in the core, better outcomes for customers, and meaningful improvement in exposure management. Third, watch how we reinvest. We are putting resources behind the platform, the people, and the AI foundation required to return Rapid7 to durable growth. We have hard work ahead but we also have what matters most: strong customer trust, deep security expertise, a clear place to win, and a team that cares deeply about our mission. I have believed in Rapid7 for years. The more time I have spent with its people, its customers, and its technology, the stronger that belief has become. We know this transformation will take time. We will not ask you to judge us by promise. Judge us by execution. Judge us by whether quarter after quarter this company becomes more focused, more disciplined, and more capable of delivering durable growth. That is how we intend to earn your confidence. Rafeal, over to you.
Thank you, Wael. Good afternoon, everyone. As a quick reminder, unless otherwise noted, all numbers except revenue and balance sheet items mentioned during my remarks today are non-GAAP. Please refer to our earnings release and SEC filings for additional details regarding the presentation of our results and guidance metrics. In the second quarter of 26, I am pleased to report that we exceeded expectation across all guided metrics. We ended the second quarter with total ARR of $824 million. We reported non-GAAP operating income of $28.9 million. Free cash flow came in strong at $31.9 million, with collections healthily exceeding our internal expectations. As of the end of the quarter, we had total cash, cash equivalents, and short-term investments of $702.6 million. I want to begin by taking a closer look at our ARR as of the end of the quarter. As a quick reminder, our long-term strategy is focused on our core platform solutions, comprised of our detection and response business, which includes MDR, and our exposure management business. Our core platform solutions represent over 80% of overall ARR and grew approximately 1% year over year, led by our detection and response business which, at approximately 55% of total ARR, grew approximately 5% year over year. Within the exposure management segment of our core offerings, we continue to see healthy adoption of our Exposure Command solution driven by both new customers and customers upgrading from our older vulnerability management solutions. In contrast, our noncore products, as a reminder less than 20% of total ARR, declined in the quarter, driving the sequential decline we saw in total ARR as we focus our resources toward growing our core products. As we plan for the remainder of 2026 and beyond, we see opportunities to optimize margins for these standalone, noncore solutions as well as opportunities to migrate customers to core platform offerings. As Wael mentioned, our organization is undergoing a significant transformation. Our new Chief Product and Technology Officer, Dejan Deklich, just two months into his role, is making changes and investments across the product and engineering organization. We expect these investments to strengthen our core platform solutions, accelerate innovation, and deliver meaningful product capabilities throughout 2027. We expect, however, that these efforts will take time to translate into ARR growth. Returning now to our financial statements, total revenue of $210.9 million declined approximately 1.5% year over year, reflecting the declines in noncore product ARR we saw earlier this year. We finished the quarter with over 11.5 thousand customers and an average ARR per customer of approximately $70 thousand. Turning to second quarter profitability, total non-GAAP gross margins of 71.7% were down approximately 215 basis points year over year, consistent with our expectations and driven by year-over-year increases in staffing of our global security operations centers and increased cloud usage for product improvements. We reported non-GAAP operating income of $28.9 million or a margin of 13.7%, favorable to our guidance. This upside to profitability drove non-GAAP earnings per share of $0.44 per diluted share. Free cash flow totaled $31.9 million in the second quarter, driven by strong collections. From a balance sheet perspective, we ended the second quarter with $703 million in cash, cash equivalents, and short-term investments. Combined with our continued free cash flow generation and a $200 million undrawn credit facility, we are well positioned to repay our $600 million convertible notes due in March 2027. Turning to the restructuring announced earlier today, this restructuring marks a strategic shift in our business operations to drive efficiency and focus across the organization, aligning resources and investments to our core platform solutions. We are also creating capacity to increase our investments in cutting-edge AI-driven solutions that will improve customer experience and increase competitiveness in the marketplace. In terms of approach, we first eliminated non-headcount spend wherever possible. Unfortunately, approximately 12% of our workforce has been notified that their roles are impacted by the restructuring. From a financial perspective, as a result of the efficiency gains already underway, as well as the impact of the restructuring announced today, we expect to deliver 20% non-GAAP operating margins in Q4 of 26, compared to 13.7% in the second quarter. Fulfilling our commitment to improve our cost run rate as we exit 2026. We expect to incur restructuring charges of approximately $10 million to $11 million, the majority of which will be paid throughout the third and fourth quarters of 26. These restructuring charges will be excluded from our non-GAAP P&L results. The cash expenditures will, however, be reflected in our operating and free cash flow results. As such, for the remainder of the year, the cash benefit of reduced headcount will largely be offset by the associated severance-related costs as well as targeted reinvestments into our product and engineering organization. Therefore, while weighted toward the fourth quarter, we are maintaining our expectation of approximately $130 million in free cash flow for the full-year 2026. We believe this restructuring will allow us to improve free cash flow in 2027 over our 2026 guide, despite a lower ARR base as we enter 2027, investments we are making to modernize our products and SDLC process, and the reduction of our interest income that will occur once we use our cash to repay our March 2027 convertible bonds. This brings us to third quarter 26 guidance. We expect to end the third quarter with ARR of approximately $812 million. On a sequential basis, we expect ending ARR for our combined core platform solutions of D&R and exposure management will be approximately flat quarter on quarter, with the expected sequential ARR decline coming from our noncore offerings. For the third quarter, we expect total revenue in the range of $208 million to $210 million, down approximately 4% at the midpoint year over year. Non-GAAP operating income is expected to be in the range of $34 million to $36 million, or a margin of 16.7% at the midpoint. Non-GAAP earnings per diluted share are expected to be in the range of $0.44 to $0.47 on approximately 80 million fully diluted shares. Updating our full-year fiscal 26 guidance, we expect total revenue in the range of $837 million to $841 million, a year-over-year decline of approximately 2% at the midpoint. We are raising non-GAAP operating income guidance for 2026 to a range of $129 million to $133 million, or a full-year non-GAAP operating margin of 15.6% at the midpoint. As I mentioned earlier, this implies a 20% non-GAAP operating margin in the fourth quarter. Non-GAAP earnings per share are expected to be in the range of $1.78 to $1.83 per share on approximately 79 million fully diluted shares. We expect free cash flow of approximately $130 million for the full year, in line with prior year performance and a free cash flow margin of approximately 15.5%. In conclusion, our solid execution in the second quarter combined with our focus and prioritization efforts to improve our core product offerings, as well as our commitment to manage costs and expand operating margins, positions Rapid7 well for the transformation ahead. And with that, I would like to turn the call over to the operator for Q&A.
分析師問答
We will now move to our question-and-answer session. If you have joined via the webinar please use the raise hand icon which can be found at the bottom of your webinar application. When you are called on, please unmute your line and ask your question. We kindly ask that you limit yourself to one question and one follow-up. Our first question comes from Rob Owens with Piper Sandler. Please unmute to ask your question.
Good afternoon and thank you for taking my question. As you look across the product set, and in particular your exposure management platform, I know you said things will get better from here and you are looking at adding to the portfolio or adding to capability. When you focus on that, is this a function of coverage or is it lacking functionality that your customers were looking for? I'm trying to understand directionally where you hope to take this technology. I will just ask the follow-up right away: in terms of customers that have not moved to your more comprehensive capability, especially given the threat environment right now, what is your sense as to what customers are doing here? Thanks.
Thanks, Rob. Very good question. First of all, it's nice to actually be here and I look forward to working with all of you. It's been a little bit over two months since I started as CEO. When I was on the board, and as you know, I actually started over a year ago when Corey was on the board. Looking at the overall business, it was very clear that there were core and noncore parts. As I got into the role it was clear to me that most of the decline happened in the noncore. Nonetheless, there is a lot of work we needed to do on the core side. So the restructure that we have talked about was to shift some of our focus to the core and make sure we have our weight on it because we have a really good position. We have a lot of customers that rely on us. We have the right to win. Most importantly, customers invite us every single day. I set a lot of customer calls in the last two months and I can see that we are in a strong position. To answer your question on exposure management, there is definitely some work to do on focus. We were spread very thin trying to address the whole portfolio. Now we are shifting our focus to the core and making sure we are investing so we can get our fair share in that market. We are invited and shortlisted because we are one of the leaders. We can increase our win rate by having more focus and the right investment. I'm very excited about the addition of Dejan because he is working hard to ensure not only new features but AI-first methodologies are implemented across our product line. On the migration path—what are customers doing in this environment? When I talk to customers, they tell me they want not only to find things but actually to fix them. I'm excited that we play in these two subcategories: exposure management and detection and response. I believe an AI-first structure will allow us to provide that for customers. Customers are buying every day; they are not waiting. They want to make sure the right vendors are moving in the right direction and they look for solutions that help identify issues and also fix them and guide them through the journey. Thanks, Rob.
Thank you. Your next question comes from the line of Jonathan Ho with William Blair. Please unmute to ask your question.
Hi. I really appreciate the detail you are providing. Can you help us appreciate where you specifically see the opportunities to reaccelerate growth—where the ability to focus is paying off? It is always challenging to show operating leverage while trying to reaccelerate growth at the same time. Can you help us understand the balance between these two?
Thank you, Jonathan. That's a very good question. Before I started, I asked myself whether we are in categories that are big enough and growing fast enough to deliver the growth we want. You cannot buy that, and we are fortunate to be in two big categories. Vulnerability management has a renewed interest, and detection and response remains important. There are two categories where we have a strong position and the right to win; we are invited to participate. How do we find growth? I view this as a sequence over multiple quarters, not a one-quarter turnaround. First, cash generation will demonstrate how well we are running the business. Second, we need the noncore to clear, and we understand what that means. Third, we need to stabilize the core itself. There is great technology and position in the core but more work is needed, which is why we're redirecting investment there. Fourth, we will return to growth. I believe the categories we are in will allow us to do so, and the work we are doing will help us get there faster. On the strong margins guided for Q4, when I was on the board I was part of the Kenzo work and I was excited because it allows two things: provide services at scale with software-like margins, and connect solutions with a common data structure. I believe the AI-first work Dejan is doing will allow us to sustain and even improve margins. I'll pass to Rafeal to share how we are thinking about it. We want to run a business that is profitable, high margin, and at scale, and the only way to do that is to make sure our gross margin is best in class.
Jonathan, I would add that one of the things we are pleased to talk about today is margins as we go through 2026. We are delivering on that and that was an important goal. The balanced growth Wael described is how we look across the next few years. We want to invest in products so we can drive growth—that will be a big driver of long-term valuation. At the same time, margins on the bottom line are incredibly important. We have taken a big step today. We're not giving 2027 guidance yet, but this speaks to our commitment and focus. We will continue to be smart about how we invest while keeping an eye on the bottom line.
Thank you. Our next question comes from the line of Fatima Boolani with Citi. Please unmute to ask your question.
Good afternoon. Thank you for taking my questions. Specifically on the noncore product portfolio: is the eventual conclusion to deprecate most of that portfolio on a standalone basis? You mentioned transitioning some customers from noncore into the core and providing a bridge. Is the entire noncore portfolio eligible to move into the core or is there an opportunity to deprecate and rationalize parts of that portfolio to become more efficient?
Thank you, Fatima. Those are very good questions. At a high level, noncore contains categories that require different types of investment to compete with pure players. Those races are not where we intend to compete. We are focusing our energy and investment behind categories where we are a leader and can participate and grow. That said, we have substantial technology and a customer base that is intertwined, so some noncore technologies will be used to service our customers through our platform. We are looking at every opportunity to provide outcomes to customers without chasing races the market has already decided. The pure-play game is not ours to win; there is enough in our addressable market for us to win. We must focus and allocate appropriately to take a lion's share of the subcategories where we have advantage. You will see deemphasis in some subcategories that we cannot chase and choices we must make.
Understood. Thank you. As a follow-up, you mentioned that the core of the portfolio is about finding things and also fixing them. Given the changes in patch management and the advances in large language models, from an asset management and patch management perspective, what intellectual property do you have and why is a detection and response angle the right way to solve that versus a traditional asset management or patch management approach?
We are in a fortunate position: over the years we've assembled deep technology and expertise and we know customer environments well. Sometimes we detect issues before they surface, and sometimes we are integrated within the customer to help respond rapidly. To deliver at scale, we needed a common data backbone. With that backbone we can leverage customers' assets instead of asking them to replace them. Architecturally, that backbone is the basis for the agentic work we are pursuing. With it, we can do far more than today. It's the combination of our expertise, our people, and future agents that will allow us to close the gaps. There will be many gaps going forward, and customers are asking how we can help them at scale. The work we're doing now in the platform addresses that. Customers will ask us not only to find vulnerabilities and whether they are exploitable but to help them close seams and fix issues. The ultimate answer is patching, but there are many interim measures if you cannot patch immediately. Thank you.
Your next question comes from the line of Brian Essex with JPMorgan. Please unmute to ask your question.
Thank you for taking the question and good afternoon. Rafeal, thank you for another detailed quarter. I'd love to understand what you are seeing in the pipeline. It seems we are in an unprecedented time for some of the business your core segments are exposed to. Are you seeing acceleration in the pipeline? Your assumptions around the core business seem conservative; could you contextualize your outlook for that business, how conversion and win rates are transpiring, and what your expectations might be for upside or downside given the customer environment? Also, I have a follow-up for Corey.
Thanks, Brian. I just talked with team members returning from Black Hat and the excitement around our solutions was notable. Customers are exploring and trying to determine which vendors they will put bets behind. They ask many questions about exposure management and detection and response: what investments are required, what integrations, what is our vision and philosophy around agents, and what they need to prepare for. We had a difficult week as a company with the restructuring, but I am very positive about our positioning. I've been on many customer calls in the last few months, and customers are asking for answers. We have over 10 thousand customers who rely on us; that level of confidence is there. There is work to sharpen the story and better connect our products, and that's my job in the coming months.
Brian, to add some points: we're pleased with how the year has developed. The sales leadership was fairly new at the start of the year and we've seen productivity per rep go up as the team focused on pipeline generation and selling our core platform solutions. There's evidence of those elements in Q2. Alan and the team have done a great job. It is part of a longer journey that must be paired with product releases, but we believe the combination of better sales execution and product momentum will be a positive over time. It may take a few quarters to become clearly evident, but we are encouraged by the progress.
Got it. I appreciate the color. Quick follow-up for Corey: you are here and we've gone through several changes over the years including the 2023 reorganization. Can you provide context around how the changes now are different than before and what the environment is for attracting and retaining talent? Wael, feel free to interject.
Absolutely. Context is important. The biggest change now versus previous restructurings is that we have much more clarity. We enter this with a completely revised leadership team that has operated at this scale and completed turnarounds. We have clarity about where to focus and where to de-emphasize. We're doing this work with purpose and a clear direction for what we want to become. We're investing in something that leverages our existing technology and the great work we've done, and we have a team with experience to execute. This time we are doing it from a place of clarity and focus.
From day one of my partnership with Corey on the board and now as CEO, we've focused on understanding the company's culture and making sure everyone understands why we're doing this and the options available. In the last couple of months we've been communicating findings, structure, and the rationale to the team. To my surprise, the leadership and multiple levels embraced the change. That conviction comes from the belief that we can serve customers in a better way, and that drives the changes.
Your next question comes from Joseph Gallo with Jefferies. Please unmute to ask your question.
Thanks for taking the question. Wael, there are a lot of changes and you talked about product a lot. Can you talk more about go-to-market refinement? Will there be more changes there? With roughly 12% of jobs impacted, does that include the go-to-market organization? And Rafeal, how did you embed the uncertainty and job impact into guidance—are you being more prudent with this guide or should we expect ARR decline to worsen versus the past two quarters?
When we examined the company prior to my taking the role, we had always been thinking about how to reshape for future growth. The additions of Rafeal for precision, Alan as Chief Commercial Officer for scale, and Dejan for AI-first product work were planned from day one. On go-to-market, I partnered with Alan while on the board and continue to do so now as CEO to ensure any restructuring would not impair our ability to scale. We were very careful in several areas. First, anything to do with the customer journey—pre- or post-sale—retains the necessary resources so we can protect our customer base and show up when customers invite us. We need to defend our turf and maintain our win rate. Alan is laser-focused on this and has augmented the go-to-market team with experienced members. I believe the combination will allow us to navigate the transformation.
On the guidance side: the reorganization involved every group to an extent. We focused heavily on individuals who touch customers on the front lines, both customer success and new sales. We tried to be very prudent in where savings had to be taken. That consideration is part of our guidance formation.
Your next question comes from Mina Marshall with Morgan Stanley. Please unmute to ask your question.
Thanks. You noted Dejan has been doing significant work for a couple months, and I know there's been work over the last year to add features into the MDR product. How should we think about judging milestones for product progress in exposure management and MDR—when will they be closer to where you want them to be? Second, any pricing commentary on MDR and what you're seeing in the market would be helpful. Thanks.
We have been doing a lot of product work over the past year and continue to do so. The win rates and deals we are participating in show progress, and we will continue to invest appropriately. For D&R, I have sat with customers and seen the competition. Often price is not the differentiator; customers look for a partner who can help them and provide references—of which we have many. In conversations, price sensitivity has not been the main issue. Customers prioritize service level, the ability to evolve into an agentic and AI world, and our road map. For exposure management, the main requirement is focus. We must emphasize exposure management as a core priority because it completes the customer journey—finding issues and helping to fix them. Dan (Dejan) is managing those priorities and has made progress in recent months. I expect the next quarters will show that manifest as improved win rates and customer acceptance in RFPs and requests.
The next question comes from Adam Tindle with Raymond James. Please unmute to ask your question.
Thanks. Wael, you mentioned asking investors to judge you on cash generated over time and how you reinvest. Given you've been on the board and seen periods of accelerating hiring and now restructuring, what will be different about the period where you start reinvesting? What have you learned that will change how you invest once you get to that phase?
When I was on the board it was clear there was core and noncore in our book. As CEO I was surprised that most of the decline happened in the noncore. The other thing that surprised me was the appetite from customers to work with us and ask for more. Endpoint players are moving into MDR because they see budget and momentum, but they often don't have the right-to-win we have. We are invited to participate. That made me accelerate the restructure and redirect energy to the two important subcategories. These categories are growing and we need to be ready. There is a lot of work to be done to capture our fair share of upcoming growth.
A quick follow-up for Rafeal: can you provide more quantification around the restructuring—what hits in Q3 versus incremental in Q4 given the ramp in EBIT margin? Also, what is the cash cost of the restructuring and how was that considered in the $130 million free cash flow guide?
Thanks, Adam. On the split of the benefit, you can see it in the operating income guidance between Q3 and the full year. Q3 contains part of the restructuring, as the actions occurred partway into the quarter and, as you know, local laws require ongoing processes. So Q3 will not show the full benefit; Q4 will be a much cleaner representation of the restructuring's impact. On the cash side, most of the severance costs will fall in Q3 and Q4, which offsets a lot of the savings from the restructuring. We are guiding to $130 million of free cash flow for the year and are staying with that number. The timing makes it back-end loaded due to the timing of collections and severance costs.
At this time, we have reached the end of our question-and-answer session. We thank you all for your questions, and you can now disconnect your lines.