Recurring Revenue Went Backwards
Disclosure: I am an N-able shareholder.
Start with the press release itself, which looked fine. N-able reported revenue of a hundred thirty-eight point two million dollars for the second quarter, up five point nine percent. Adjusted earnings of ten cents a share, exactly what analysts expected. Adjusted profit of thirty-nine point nine million, a twenty-nine percent margin. If you stopped reading there, you would call that an ordinary quarter.
Then look at annual recurring revenue. Five hundred forty-four point five million dollars. Three months earlier it was five hundred forty-eight. The number went down. For a subscription business, that is not a slower quarter — that is more money walking out the door than came in.
Now the part that explains where it went, and it is management’s own breakdown. Security operations, they said, is running ahead of plan. Data protection is growing faster than the company overall. But renewals in two specific lines fell. The chief financial officer put it this way: renewal rates for that cohort moved from the higher eighty percent range earlier in the quarter to the mid eighty percent range as the quarter progressed. The two lines were unified endpoint management, and endpoint detection and response.
Ninety days earlier, on the first-quarter call, the chief executive described the company as delivering a strong quarter driven by improving retention.
So the full-year outlook came down. Revenue guidance from five hundred fifty-four to five hundred fifty-nine million, down to five hundred thirty-nine to five hundred forty-two. Recurring revenue growth guidance cut from eight or nine percent to four or five — about twenty million dollars taken out of the forecast because a renewal rate moved three points. Management added that the new outlook does not assume renewal rates improve for the rest of the year.
The market took the stock down thirty-six percent in a day, from four ninety-nine to three nineteen, within thirty cents of its fifty-two-week low.
Two lines failed and one didn’t — same company, same quarter, same customers. Something separates them, and it isn’t the technology.
They Stopped Saying RMM
The difference between the line that held and the lines that left has nothing to do with what they protect. It has to do with what a customer loses by leaving.
Endpoint detection and response, at N-able, is not N-able’s product. It’s SentinelOne’s, resold. A customer who walks takes the same logo somewhere else and gives up nothing. A license is portable by design.
Now look at what the company bought.
In November of twenty twenty-four, N-able acquired a company called Adlumin for roughly two hundred sixty-six million dollars — a hundred million in cash, a block of stock, and a hundred twenty million in installments it is still paying off. Adlumin does extended detection and response, and managed detection and response. That second one is the important one. Managed detection is people. Analysts in a room, watching one customer’s environment, learning what normal looks like there.
N-able didn’t build that. It couldn’t. You can ship a feature in a release. You cannot ship years of an analyst knowing which alerts at a particular company are always nothing.
And they committed to it. The following June they made Adlumin’s chief marketing officer the CMO of the entire company, and the chief executive said they were shifting — his words — from IT management to becoming the midmarket’s most trusted cyber resiliency partner. By April, at their own conference, executives stopped saying the letters R-M-M on stage and called N-able a global cybersecurity company. The analyst firm Omdia was in the room and wrote it down, along with the number underneath it: the acquired security business was nearly twenty-seven percent of revenue and the fastest-growing thing they had. Without it, Omdia said, the framing would not hold together.
So the piece they bought, the one with people in it, grew. The licenses they resell left.
And the chief financial officer said where they went, in a phrase worth hearing exactly. Customers, he said, are going to get a SentinelOne type of service from a different type of provider.
Not a different vendor. A different type of provider.
N-able’s response was to renegotiate its SentinelOne contract — more SKUs, better pricing protection. A licensing answer to a customer who had just told them, in plain language, that the problem was who was delivering it.
Hold onto that phrase — a different type of provider — because it’s about to stop describing N-able’s customers and start describing yours.
So bring it into your own business.
Start with what is happening to the price of the thing being resold. SonicWall announced this month a single lightweight agent that combines next-generation antivirus with endpoint detection and response — and in the company’s own launch announcement, so weigh it accordingly, it comes two ways. You can buy it as a product. Or you can buy it fully managed, from SonicWall. And read who that managed tier is sold to, because it isn’t the client — it’s you. SonicWall’s pitch is that MSPs shouldn’t have to choose between enterprise-grade protection and margin. Which means the offer on the table is that their analysts do the watching, and you resell it. That is the whole trade: the one part of your stack that wasn’t portable, turned into a SKU that is.
Then the other number, and this one is the whole episode.
N-able carries about a billion dollars of goodwill on its balance sheet — the accounting value of what it has bought, a hundred sixty million of that from Adlumin. After Monday, the entire company is worth roughly six hundred million on the open market. The things they bought are carried on the books for more than the market now thinks the entire company is worth. Underneath sits four hundred million in term debt and about sixty million still owed on the Adlumin purchase itself. And in its own filing back in May, the company wrote the warning: a continued and sustained decline in our stock price could require an interim goodwill impairment analysis. They described the condition in the spring and met it in August.
Sit with what that money was for. Two hundred sixty-six million dollars, a billion in goodwill, and a stock cut by a third in a single day — to acquire a group of people who watch client environments and know what normal looks like there.
You have that. You have had it the entire time. And you have been putting it on the invoice as a line item called endpoint protection, at a markup, sitting in a list next to four other logos.
So here is the choice, and it arrives at your next renewal, not eventually. Re-cut your security lines so every one of them names something a person did and something the client received — the review that happened, the thing that got contained, the report somebody actually read. Or keep handing over a list of logos, and lose them one at a time to whoever quotes those same logos cheaper — which is precisely what just happened to the company that sells you your console.
Which sounds like a positioning exercise right up until you have to write the number down.
Because the moment you separate the license from the work, you have to put a number on the work — and most providers have never priced it, because it has always been buried inside the endpoint fee. Pull one client agreement and try to write the service line as its own figure, with its own basis. If you can’t defend that number without pointing at the license underneath it, you’ve just found the line your competitor underquotes first.
What to Consider
- Find the residual before you name it. Take your total per-endpoint security revenue for one client, subtract what you actually pay for the licenses underneath it, and look at what’s left. That number is your entire security service business, and right now it has no name, no basis, and no line on the invoice — which is why nobody has ever had to defend it.
- Get off the seat as your pricing basis. N-able’s security revenue was indexed to endpoints, which is a product basis, and the moment a manufacturer offers the same endpoint cheaper, seat-indexed revenue has no defense — that’s not a strategy failure, it’s arithmetic. If your detection and response line is quoted per device, you have adopted the losing basis. Price it against what your people commit to instead — coverage hours, response time, environments reviewed — so your number doesn’t move every time a license price does.
- Price the manufacturer’s managed tier before you resell it. SonicWall now sells a fully managed MDR tier out of its own SOC, to MSPs, and it will not be the last. Get that quote and decide deliberately whether you are buying capacity you can’t staff, or quietly outsourcing the only line on your invoice a client can’t get anywhere else. Both can be right — but the second one needs to be a decision, not a default.
If this trend continues: within twelve months the opening question in a competitive security bid stops being “what’s in your stack” and becomes “what does your team do that the manufacturer’s managed tier doesn’t” — and that is a question the provider who kept their own analysts can answer in one sentence, while the one who can only answer with a logo finds themselves bidding against the vendor whose logo it is.