N-Able Inc
NYSE:NABL
Earnings Call Analysis
Q3-2023 Analysis
N-Able Inc
N-able is reinforcing its position as a leading provider of security solutions, backed by strategic partnerships and a focus on enhancing customer experience. Through an improved integration framework, functionality across security offerings has been enhanced and ecosystem breadth is expanding. Customer engagement with their multi-tenanted, cloud-native modern architecture has met high expectations since commercialization. Security, including Managed Detection and Response (MDR) and mail protection, remains a critical focus area.
The company's business model capitalizes on its relationship with approximately 25,000 Managed Service Providers (MSPs) to reach over 500,000 small- and medium-sized businesses, offering a multi-layered growth strategy. Growth is driven through MSP retention, New Customer Acquisition (NCA), MSP device growth, and cross-selling new services to existing MSPs. Despite a challenging macro environment, 2023 marked the best year yet for customer cohort dollars. N-able's educational and marketing efforts are proving fruitful, with a significant presence at industry events, roadshows, and Head Nerd Boot Camps driving expansion.
Tightening IT budgets and slower device growth are impacting the MSP and small- and medium-sized business sectors due to the uncertain macroeconomic landscape. Nevertheless, N-able's focus on customer-retention efforts led to a record-high technical support customer satisfaction score, and the launch of the N-ableMe partner success center has engaged with nearly 13,000 partners. N-able asserts that its commitment to customers and overall strategy are yielding efficient access to SME IT spend, leading to the highest ever third-quarter adjusted EBITDA margin in its public company history.
For the third quarter, N-able posted revenues of $107.6 million, a 15% growth from the previous year, with 13% growth on a constant currency basis. Subscription revenues stand at $105.2 million, and partners contributing $50,000 or more of Annual Recurring Revenue (ARR) grew by 19%. Gross margins are stable at 84.6%, adjusted EBITDA is up by 27% to $36.6 million. Looking ahead, Q4 revenue expectations are set between $106.5 million to $107 million, with a projected 33% adjusted EBITDA margin. Full-year revenue guidance maintains at $420 million to $420.5 million, reflecting a constant year-over-year growth, and adjusted EBITDA guidance has been raised to $139.2 million to $139.7 million. This outlook accounts for foreign exchange headwinds, showcasing a strong operational foundation.
You don't have any saved screeners yet
Hello, and welcome to the N-able Third Quarter 2023 Earnings Call. My name is Alex, and I'll be coordinating the call today. [Operator Instructions] I'll now hand over to your host, Griffin Gyr, Investor Relations Manager. Please go ahead.
Thanks, operator, and welcome, everyone, to N-able's Third Quarter 2023 Earnings Call. With me today are John Pagliuca, N-able's President and CEO; and Tim O’Brien, EVP and CFO. Following our prepared remarks, we will open the line for a question-and-answer session. This call is being simultaneously webcast on our Investor Relations website at investors.enable.com. There, you can also find our earnings press release, which is intended to supplement our prepared remarks during today's call.
Certain statements made during this call are forward-looking statements, including those concerning our financial outlook, our market opportunities and the impact of the global economic environment on our business. These statements are based on currently available information and assumptions, and we undertake no duty to update this information except as required by law. These statements are also subject to a number of risks and uncertainties, including those highlighted in today's earnings release and our filings with the SEC. Additional information concerning these statements and the risks and uncertainties associated with them is highlighted in today's earnings release and in our filings with the SEC. Copies are available from the SEC or on our Investor Relations website. Furthermore, we will discuss various non-GAAP financial measures on today's call. Unless otherwise specified, when we refer to financial measures, we will be referring to non-GAAP financial measures. A reconciliation of certain GAAP to non-GAAP financial measures discussed on today's call is available in our earnings press release on our Investor Relations website.
And now I will turn the call over to John.
Thank you, Griffin. Welcome, everyone, and thank you for joining us today. As the age of the managed service provider advances, the IT outsourcing market remains strong. There are a few key factors for this. IT is getting more complex and expensive as organizations look to realize the benefit of digital operations, modernize their legacy systems and meet growing regulatory requirements. This trifecta of challenges distracts organizations from their core operations and can push them to outsource and augment their IT needs to MSPs.
N-able was formed with this in mind. Our unwavering mission to empower MSPs with purpose-built technology, positions us favorably with the expanding small and medium enterprise IT ecosystem by helping partners meet these challenges head on. We believe our third quarter results highlight the strength of our market and cement our standing as a leading software provider to MSPs. Despite an uncertain macro environment, we exceeded top and bottom line guidance with revenue of $107.6 million, growing 15% year-over-year or 13% on a constant currency basis; and adjusted EBITDA of $36.6 million, representing an adjusted EBITDA margin of 34%, our highest margin ever as a stand-alone public company.
And as Tim will elaborate, we are maintaining our full year 2023 constant currency revenue guide of 13% and raising the midpoint of our full year 2023 adjusted EBITDA guide from $136.3 million to $139.5 million. We accomplished all of this while laying the groundwork for future success. Our teams advanced important strategic initiatives and we are particularly excited to announce that we are entering into a new product category, bringing N-able managed detection and response to market this month.
Our relentless determination to bring value to the MSP community requires adapting to fast-changing technology needs through focused product innovation. With our approximately 25,000 MSPs ranging in size from sole proprietors to global publicly-traded technology service providers, we believe we have a unique line of sight into the dynamic market landscape. And I want to discuss 3 prominent trends influencing our product development, focus and strategy. First, consolidation and modernization; second, the movement up market; and third, increasing security standards. First, we see technology consolidation and modernization driving customer behavior. In an uncertain economic environment, MSPs have an eye on operational efficiency and solutions with proven ROI. Our integrated platform and leading technology solutions aligned with MSP needs, helping to reduce [tool straw] and unlock their growth.
We believe our tech suite of top-tier RMM, data protection and security solutions, coupled with our multi-tenanted platform and external integrations, strongly positions us to satisfy MSPs desires to consolidate and modernize their tech stack.
A second trend is MSPs going up market. Large enterprises face many of the same IT challenges as SMBs and are increasingly turning to MSPs to augment or run their IT or security operations. We believe this means a larger addressable market for both MSPs and N-able. And our product and go-to-market investments aim to enable MSPs to realize this opportunity. The scalability, automation and efficiency of our solutions appeal to upmarket-focused MSPs, and we continue to raise the bar to position N-able as a leader in this evolving market segment.
A great byproduct of the MSP upmarket trend is the capabilities we developed to help win MSPs win upmarket, also better position our teams to land midsize and large IT departments directly. While our core focus is our MSP partners, we continue to pursue direct IT sales opportunistically and are seeing positive momentum in this part of our business.
Now turning to our third trend, increasing security standards. The significant business impact of a successful cyber attack has long placed security as a top IT priority. In addition to MSPs buying security solutions to protect from bad actors, they also face growing global compliance requirements that serve as a tailwind to security demand. Here, the message is clear. Security is shifting from an option to a requirement. With our robust and recently expanded suite of security options spanning endpoint protection, mail protection, content filtering and more, we provide a layered security approach that is built to fulfill regulatory requirements and safeguard the modern digital enterprise.
We made exciting progress in the last quarter to advance our product suite to capitalize on these trends, and I want to share these updates and the encouraging market feedback we received. Starting with Cove, we have invested considerably in developing our technology to further Cove's ability to scale into larger domains and help MSPs move upmarket. A third quarter deal involving the displacement of a known upmarket competitor and representing our largest initial Cove land ever at over $500,000 of ARR at scale speaks to our success here.
Another excellent example of Cove's market traction comes from a recent MSP customer with 11 legacy data protection solutions. Understanding the risks and headaches of a multi-vendor approach, they decided to consolidate on Cove. The MSP thoroughly evaluated each product and specifically commented on Cove's strong technical performance, intuitive technician-friendly interface and ability to meet data sovereignty requirements with Cove data centers located worldwide. With sophisticated attacks often going beyond in organization's core network and now targeting data storage copies, the distinction between data protection and security is increasingly blurry. Modern data protection solutions can't just restore data, they must keep data safe. And Cove was built with this in mind. Because of our cloud-first approach, customers' data copies are not exposed to local network, which reduces the attack surface and gives our customers peace of mind. The market is responding to Cove's innovation. Our 2023 new customer cohort is the best ever, and our Cove Microsoft 365 backup solution is now protecting over 1.8 million users, growing at approximately 48% year-over-year.
Cove is also receiving industry recognition, and we are delighted to share that [ Canalys ], a global technology research firm, recently named Cove a champion in their managed backup and recovery leadership matrix.
On the RMM front, we remain laser-focused on meeting MSPs where its messiest. We simplify the complexity of hybrid environments, users and devices, going beyond the confines of traditional RMM. This means delivering a modern, end-to-end unified IT management platform. We made significant progress on this vision in the third quarter. We released a refreshed user interface, unveiling a new asset inventory view which comes on the heels of the analytics feature and enhanced Apple management capabilities we released earlier this year. These advancements give technicians deeper insight into their IT environment and enable them to manage their IT stacks better.
This can translate to tangible business impact. Our powerful capabilities bolster MSP's ability to go upmarket and service large organizations with disparate operating systems while realizing the benefit of consolidation. Our approach is resonating with customers, and we are seeing steady demand in this segment.
Turning to security. We continue to advance our security suite and are particularly excited about our entry into managed detection and response. MDR is a unique marriage in the security industry, combining cutting-edge technology with human oversight and expertise to give organizations advanced protection. This combination solves a deep pain point for our customers because threats are increasing, but organizations cannot manage those threats alone. Alert fatigue, staying ahead of the evolving threat environment and staffing challenges mean organizations need help.
In a recent poll we conducted with thousands of our MSPs, they expressed a strong desire for MDR from N-able. Industry research firms also validate the MDR market. With [ Canalys ] recently stating that the cybersecurity services opportunity for partners will be larger than selling cybersecurity technology this year. MDR is much more than managed EDR because MDR goes beyond the endpoint, providing broad security visibility and response across the customer's entire IT ecosystem, including their users, cloud applications and network. This is powerful.
Adding MDR broadens our appeal as a one-stop shop for security solutions and services, and we have the backing of a strategic partner in this space, born from the front lines of national cyber defense with multi-tenanted, cloud-native modern architecture. We believe there's a significant opportunity. And perhaps most telling, since commercializing this technology, customer engagement has met our high expectations. In addition to delivering more solutions, we are focused on superior customer experience. To this end, we recently enhanced our integration framework, improving functionality across our security offerings. This enhanced framework also expands our ecosystem breadth, facilitating faster time to market with vendors that want to expand their go-to-market reach through an enabled partnership. Across the security spectrum, from MDR to mail, security remains mission-critical, and we are committed to helping propel our customer security journey forward.
With these trends powering demand, we are investing and operating for the long term and are focused on delivering great technology that positions N-able to advance the age of the MSP. Our operational efforts and strategic goals are all focused within the framework of our sell-to and sell-through business model. We refer to our MSP customers as partners as we leverage the reach of our approximately 25,000 MSPs to gain access and sell our solutions to over 500,000 small- and medium-sized businesses. This partnership enables a multipronged growth algorithm, which allows us to reach the SME at healthy profit margins.
When we land an MSP, we grow. When an MSP lands a customer, we grow. And when an MSP customer adds an employee, we grow. And when we bring a new service to market, we unlock the potential to grow across that MSP and SME base. These elements of our model are on the building blocks of our growth algorithm, which are: MSP retention; cross-selling of new services to existing MSPs; MSP device growth, and lastly, N-able adding new MSPs. And I want to discuss operational updates in the third quarter regarding each of these components.
Starting with N-able adding new MSPs. Our new customer engine continues to be strong. While we're only 3 quarters through the year, the 2023 customer cohort dollars are the best ever since we became a public company. We are reaching new customers who are choosing to partner with N-able. This success, despite an uncertain macro environment, reflects the strength of our compelling value proposition and is a testament to the efforts of our go-to-market teams.
Education leads to adoption and the N-able Purple was out in force in the market, connecting with customers. In the third quarter alone, we hosted 7 roadshows across North America, sponsored 11 global industry events and hosted over 50 Head Nerd Boot Camps, reaching thousands of partners and prospects. In addition to helping land new MSPs, our efforts to educate our partners on the value of our offerings help drive their expansion, and we saw steady cross-sell in the quarter.
With our solution set spanning RMM, data protection and security, enable MSPs have a low friction path to expansion. Our average revenue per partner is growing as customers buy more of our solution, and there's steady penetration and uptake across our product set. We see a rich opportunity for further penetration with multibillion-dollar cross-sell potential in our existing base.
While cross-sell and NCA are healthy, the uncertain macro environment is weighing on partner device growth and retention. We are seeing tighter IT budgets and slower device growth. We believe tighter budgets have led to rationalization and optimization of existing spend. That said, there are numerous bright spots in our operational effort to retain and expand customers. Our partner success organization scored their highest ever customer satisfaction score on technical support. We see continued demand for our enable Head Nerds, who are partner evangelists and subject matter experts.
And as part of our ongoing mission to constantly improve every aspect of the customer experience, we launched a new partner success center, N-ableMe, and have already engaged with nearly 13,000 partners through the center. We invest in these elements of our business because we grow as our partners grow. With the MSPs acting as an extension of our sales force, we efficiently access SME IT spend, and our third quarter adjusted EBITDA margin was the highest in our public history, which serves as a strong testament to the effectiveness of our strategy.
Great technology and superior operational execution are the lifeblood of our business. But our people and culture are the oxygen. One key focus area is our continued diversity, equality and belonging journey. As one recent example, we hosted a global cross-functional women leadership summit to help drive cultural transformation and execution excellence and further develop our women leaders. We were also honored to be recognized by Comparably, a leading workplace culture and corporate brand reputation platform with 3 awards in the quarter.
With that, I would like to turn the call over to Tim to discuss our financial results and outlook, then I will circle back for some closing remarks. Tim?
Thank you, John. And thank you all for joining us today. Our third quarter results were strong, exceeding guidance on both the top and bottom lines. Steady demand for our platform solutions and strong cost management highlighted by our highest ever adjusted EBITDA margin as a public company helped drive our outperformance. Looking ahead, we believe our market remains durable, and while we are mindful of the macro environment, our business model with multiple growth vectors and a clear strategic focus remains well positioned to capitalize on the growing demand for MSPs.
For our third quarter results, total revenue was $107.6 million, representing approximately 15% year-over-year growth or approximately 13% on a constant currency basis. Subscription revenue was $105.2 million, representing approximately 15% year-over-year growth or approximately 13% on a constant currency basis. Other revenue, which consists primarily of revenue from the sale of maintenance services associated with the historical sales of perpetual licenses and revenue from professional services was $2.4 million, up approximately 2% year-over-year.
We ended the quarter with 2,134 partners that contribute $50,000 or more of ARR, which is up approximately 19% year-over-year. Partners with over $50,000 of ARR now represent approximately 55% of our total ARR, up from approximately 50% a year ago. Looking at net retention for the third quarter, dollar-based net revenue retention, which is calculated on a trailing 12-month basis, was approximately 108% or 110% on a constant currency basis.
Turning to profit and margins, note that unless otherwise stated, all references to profit measures and expenses are calculated on a non-GAAP basis and exclude the items outlined in the GAAP to non-GAAP reconciliations provided in today's press release. Third quarter gross margin was 84.6% compared to 84.8% in the same period in 2022. Third quarter adjusted EBITDA was $36.6 million, up approximately 27% year-over-year, representing approximately 34% adjusted EBITDA margin.
Unleveraged free cash flow was $30.2 million in the third quarter and CapEx, inclusive of $2 million of capitalized software development costs, was $5.5 million or 5.1% of revenue. Non-GAAP earnings per share was $0.09 in the quarter based on 186 million weighted average diluted shares. We ended the quarter with approximately $127 million of cash and an outstanding loan principal balance of approximately $343 million, representing net leverage of approximately 1.6x. Approximately 46% of our revenue was outside of North America in the quarter.
Turning to our financial outlook. As John discussed, we see tailwinds in our market and believe in the long-term opportunity for N-able. As we look to the near term, we see macro uncertainty creating caution in SME IT budgets with organizations seeking to optimize spend in a tighter budgetary environment, which we have reflected in our guidance. And while our R&D engine continues to bring critical robust solutions to MSPs, our growth expectations are reflective of the time to market for these new products, which we continue to work to accelerate.
With that in mind, for the fourth quarter of 2023, we expect total revenue in the range of $106.5 million to $107 million, representing approximately 11% to 12% year-over-year growth or approximately 10% to 11% on a constant currency basis. We expect fourth quarter adjusted EBITDA in the range of $35 million to $35.5 million, representing an adjusted EBITDA margin of approximately 33%. For the full year 2023, we now expect total revenue of $420 million to $420.5 million, maintaining the midpoint of our prior full year guidance, representing approximately 13% year-over-year growth on both a reported and constant currency basis. We are raising our adjusted EBITDA outlook and now expect full year adjusted EBITDA of $139.2 million to $139.7 million, up approximately 22% year-over-year at the midpoint and representing an approximately 33% adjusted EBITDA margin.
There have been changes to the foreign exchange environment since our last outlook, and I want to take a moment to reconcile the impact of these changes on our guidance. In our previous call, we assumed FX rates for the euro and pound of 1.07 and 1.25, respectively. Using updated FX rates for the remainder of the year of 1.05 for the euro and 1.22 for the pound and updating other currencies to reflect the current rate environment translates to a negative impact on revenue of approximately $1.1 million for the fourth quarter. We believe our ability to maintain the midpoint of our full year 2023 revenue guidance and raised full year 2023 adjusted EBITDA guidance despite these FX headwinds speaks to our operational strength. We reiterate that we expect CapEx, which includes capitalized software development costs of approximately $8.5 million, will be approximately 6% of total revenue for 2023. We also expect adjusted EBITDA conversion to unleveraged free cash flow to be approximately 65% for the full year. We expect total weighted average diluted shares outstanding of approximately 187 million for the fourth quarter and 186 million for the full year. Finally, we expect our non-GAAP tax rate to be approximately 23% in the fourth quarter and 25% for the full year.
In closing, we are pleased with our strong third quarter. Looking forward, while we are mindful of the macro uncertainty, we believe we are uniquely positioned to benefit from the robust long-term addressable market opportunity. We have a proven track record of execution. Our customer base is diversified by region and industry. And the IT management, security and data protection solutions we provide are high IT priorities. The addition of our new MDR offering adds another gear to the business model. With our strong adjusted EBITDA margins, free cash flow and balance sheet, we have considerable capital allocation flexibility to invest strategically to meet the needs of our market.
Now I will turn it over to John for closing remarks.
Thanks, Tim. We scaled our business to new heights in the third quarter and made progress on critical strategic initiatives. As we march forward on our quest to advance the age of the MSP, our vision is clear and we believe the opportunity is vast. The SME IT ecosystem we serve is large and growing.
And our differentiated model, which efficiently cracks the code to the $1 trillion-plus SME IT market by providing enterprise-grade technology to MSPs, delivers both growth and profit with our clear strategy and appealing market opportunity providing direction and energy to over 1,500-plus N-ablites, our sharp focus is on driving operational excellence and continuing to deliver great technology to MSPs.
And with that, we will open up the line for questions. Operator?
[Operator Instructions] Our first question for today comes from Mike Cikos of Needham.
Great to see the revenue beat here and the maintenance of that revenue guide as well as the EBITDA, the beat and raise for the full year that we're seeing here despite some of those FX headwinds, and I know that Tim had addressed earlier. I think there's probably 2 different angles, but both of these questions are kind of getting at the new customer engine that we're talking to. And John, I appreciate the comments as well for that growth algorithm.
The first question is really tied to the macro. I know that you guys are saying, hey, the calendar '23 customer cohort is the strongest cohort from a dollar perspective when thinking about those new customers for the company is a publicly traded company since the spin. I guess in the context of macro, can you help us think about -- I know you guys are saying that it's potentially a more cautionary environment. Is that cautionary comment demonstrating even on a quarter-to-quarter basis that things might be more difficult versus where we were 90 days ago? That's the first question. I do have a follow-up beyond the macro.
Sure. Thanks, Mike, and I appreciate you following the stock. I'm looking forward to talking to you and your team a little bit more tomorrow. So on the quarter-on-quarter comment, look, we purposely wanted to spell out the growth algorithm just to remind folks that we have this multifaceted approach. As you mentioned, the NCA part of the algorithm is quite strong. It was quite strong in Q3 even compared to Q2. There's really no major difference in the macro environment that we're necessarily seeing from a Q2 to Q3, like quarter-over-quarter performance.
I would say, it's more, Mike, of a little bit of a continuation of the same, where we're seeing MSPs looking to hit their targets, both their top line and their bottom line targets. And the way that they're achieving that is more through cross-sell of additional services rather than adding SMEs. And so that's where we're seeing a little bit of that moderated device adds coming up. And so I'd say it's a continuation of really the moderated device adds and a little bit more of a focus on where they're spending their money as it relates to licenses, licensing costs across their broader portfolio.
Got it. And then the second question, this one comes back to the new customers but almost of competition here. And so I just wanted to see, is there any change on the competitive front? Obviously, with some quarters removed from the Datto acquisition, is there any benefit coming to enable through that?
And then the secondary piece is, obviously, you guys are talking about the MDR offering and what that does for N-able. But I have to imagine in some sense that, that elevates you guys at a competitive level. So any feedback that you guys are receiving since the MDR. I know you had some bullish comments in the prepared remarks, but just wanted to see if I could get any incremental color on those 2 pieces?
Yes. On the NCA, I'd say, we continue to see a strong uptick in our Cove Data Protect offering. So when we spun the business out a couple of years back, we looked at Cove and data protection as a category, as a tremendous opportunity, one, from the category and what we're seeing as the demand from the MSP base; but two, we have a differentiated offering from a technology and from a TCO, total cost of ownership.
So we decided a couple of years back to invest in the new brand, bring back up to the front as we call it internally and really started pushing the Cove initiative and suite as more of an NCA, a new customer offering as opposed to just a cross-sell offering. And really, we're starting to see the fruit of all that hard work from our go-to-market teams and the brand and our product leadership continuing to differentiate that offering. So overall, across the geos, I would say, we're pretty consistent. But if I had to point to one headline, our bright spot, it's really that Cove Data Protection offering having success in new customers.
On the MDR front, yes, we are bullish. This is an offering that we've been studying and the market, that we've been studying for quite some time. We wanted to make sure that we found an offering that could by itself differentiate N-able compared to all the competitive landscape. And we think this will help, Mike, both on our cross-sell. As you know, we have a large security offering. And so MSPs look to N-able and they trust N-able with the security offerings. So we expect them to continue to trust N-able with the MDR offering, but also, this will help us with NPA and new customer acquisition. And even some of our early conversations with some of the MSPs in the market, if they're not in the market for a data protection offering or an RMM offering, we're having now a conversation with them on MDR. And so we're quite excited as to what this offering brings both in terms of cross-sell but also new customer acquisitions. So look for further updates as we get into 2024 there.
Our next question comes from Jason Ader of William Blair.
I just wanted to ask about the RMM business, drill down on that a little bit. And just for modeling purposes, can you just remind us what you've said publicly about how big RMM is as a percentage of your revenue?
Jason, this is Tim. Thanks for the question. Drilling down on the RMM business, in terms of what we said historically in terms of size of the business, we don't disclose the size of the underlying kind of product lines within the business. But we have given color on just kind of stack ranking them and just how to think about the components of the overall business. So RMM is #1, data protection is #2 and security is #3. And the combination of data protection and security is bigger than RMM. So they're all sizable product lines within the business.
Got you. Okay. And then on the RMM side, it sounds like it's sort of a continuation of some of the pressure on device growth. We've heard sort of in the market that there's also been a fair amount of pressure on pricing, sort of per device pricing. And I'm wondering just what -- how have those dynamics shifted over time? I don't know if it's a competitive situation where some people in the market are kind of bombing the price.
But what -- I guess, what is the strategy to grow RMM in a weaker macro environment? Let's just assume that we're going to be in the sort of same tighter environment through 2024. How do you guys counteract maybe some of that pressure either it's on device growth or on pricing? And I don't want to put words in your mouth, but if you could comment on the pricing environment there and then also just what the strategy would be to grow RMM in a weaker macro environment, putting aside the strength that you're seeing in DP and security?
Thanks, Jason. And this is John P. So when we -- one of the reasons, by the way, that we don't really disclose revenue by type is we look at the broader opportunity from the LTV of the MSP. And so if you think about the opportunity on the MSP, and I know you're familiar with our investor relations deck, we typically say, hey, per device, that's around a mid-$20 per device type of opportunity. By the way, now with MDR, that opportunity is down in the low 30s, right? So that's why we're so excited about MDR. But when you think about the stack, RMM, depending on what offering they have, that could be $1 to $3 of that $30. Backup and data protection is a material piece. Security is, from an opportunity stack point of view, probably the largest one. And so what we try to do is focus on the word adoption as opposed to just revenue by RMM.
And so for us, and this is not too dissimilar to some of our competitors where we're looking to land and get the trust of the MSP. Historically, the front door coming into N-able for MSPs has been RMM. And so that's when they would come in and then we would go and add and cross-sell from there. But now with data protection, we're finding a different rhythm and a different pattern. We're actually landing with Cove and now we're cross-selling into RMM. We hope and expect to do that with MDR as well. So that will give at least 3, potentially 4 different lanes or avenues into N-able from the cross-sell motion. And then we could begin building that trust and that value with the MSPs to get that stack up to about that $30 per device, $30 per user per month type of opportunity.
So for us, the focus really is not necessarily on the RMM revenue. It's on the RMM adoption. But more so, it's on the N-able MSP partner relationship, so we can unlock that $30. If you take that $30 and you smash it times the roughly 8 million devices that we have and multiply that by 12, you get that $2 billion to $3 billion opportunity. And that's where the real -- the game is going to be won. For us, it's all about landing the customer regardless of what path. And then through trust and showing the value of the platform and how we can help them with their TCO, their total cost of ownership and help with their efficiency play, add more and more services to the MSP. So that's really the strategy.
And the slight, I'd say, evolution there, 3 or 4 years ago, it was, hey, come into N-able through RMM, 1 of our 2 RMMs. Today, it's come in through 1 of those 2 leading RMMs or through data protection. And then tomorrow, it will be through MDR and other type of security offerings. So that's why we're excited in how we think about the overall $2.8 billion, $3 billion opportunity that's just within our customer base today.
Got you. Makes sense. And I just want to understand sort of the evolution that you just referred to. Is that evolution partly due to the pricing over the last 5-plus years, that $1 to $3 that, that's actually been coming down. And therefore, you guys have had to sort of broaden? Or is there some -- or is it just more the needs of the market have shifted?
I'd say this, the stack -- the opportunity stack has gotten larger, right? When I think about the market, I often refer to it as the X and Y axes, right? And on the X axis are all the services. And if you're a business or any company, if you have one service that you're going to market with, well then, you're laser-focused on particularly that price point. But as we add services and the TAM increases by the X-axis, well, now you have a little bit more of a strategy as to what you're playing for.
And what we're really playing for are making sure that we're landing the MSP and helping them add more small, medium enterprises. So you're willing to take a different cost mix for the different offerings because you're not just focused on one offering. It's one of the benefits, I'd say, of becoming a bigger, more of a platform story, adding data protection, adding security, we now can focus on the bigger LTV. So I'm not -- I don't think it's necessarily that the need for RMM is diminished. I just believe that, that tech stack has gone up just with us -- by itself. I've been in this business for about 10 years. That tech stack might have started about $15 or so years ago. And now that we're adding things in endpoint security, we're adding things like managed detection and response, we're adding things like Office 365 backup, the value of the tech stack continues to increase which somewhat changes the strategy and the tactics that you want to go and really acquire those customers because they are of more value for you to land them and grow them.
[Operator Instructions] Our next question comes from Matt Hedberg of RBC Capital Markets.
John, in your prepared remarks, I believe you said that having direct IT relationships with certain customers could make sense. I presume these are fairly large customers. Just wondering if you could provide a little more detail on that strategy and sort of where do you draw the line between letting an MSP handle everything and more of a direct relationship?
Matt, yes, thanks. Great question. Yes. And what I was referring to there is that internal IT department, right? And so if you think about our offerings, Matt, whether it's our Cove Data Protection offering or the remote monitoring and management, those use cases are very similar and scratch a similar itch for the internal IT department, especially where there's more of a ROBO framework, right, remote office/branch office, folks are working from home. They're in a hybrid environment, different geos, different offices and the IT professional is under the same type of scrutiny and performance issues as is an MSP. And what's that all about? Efficiency.
And MSP or an internal IT department has that same need where they can leverage our tools, our platform via our automation and do more with less. So the use case and the personas are very similar. And we've been finding that our offerings have had quite -- have had success for quite some time. And we're really just leaning in a little bit more with more of a specialized sales and go-to-market team, Matt, because what we're finding is we were not necessarily marketing or selling to that mid-market enterprise but they were buying from us. And in 2023, we really began a little bit more of a focused effort to talk to that persona, understand what persona's needs and setting up a sales and marketing motion that satisfies their needs. And so it's been a success. Overall, that part of the business has been one of our bright spots for sure.
And as far as your second question on the line, there's not really a line. If an internal IT department is choosing to manage their own digital assets themselves, then N-able will provide them that software. The benefit of our tools, and it's the same thing with our MDR offering, is we allow MSPs to co-manage with these customers. And so if you're a CIO of an internal IT department, you can choose to use our central RMM platform or Cove Data Protection. And then you can bring in an MSP to augment. So both your internal team and your managed service provider, your IT consultant, both can have eyes on glass and see the same environment.
And so what's happening now, Matt, I mentioned with Jason's question, that I always refer to our TAM as the X-axis on the services and the Y-axis is the size of the customers. And because of both our direct motion to internal IT departments, but also as a result of MSPs landing larger and larger customers, our TAM is increasing, that Y-axis and the size of enterprise that N-able is servicing is getting bigger in this concept of a co-managed environment where a CIO was saying, hey, look, I have my own IT staffing issues. Let me pull in an MSP to augment some of these services that I need, and I can do so and actually save some budget as well. And so we're finding that to be a healthy formula.
So the fact that our platform allows both MSPs and internal IT departments to either do it separately or together in a co-managed model just really resonates with these personas that are both trying to solve the same thing, doing more with less, keeping their digital assets protected, productive so that their workforce can do so in a collaborative manner. So the personas are similar and our platforms are perfectly really built and architected for that type of persona.
That's super helpful, John. It seems like a nice incremental catalyst as well next year as you kind of continue that motion. And then maybe one for Tim. NRR, I think -- looks like it picked up maybe 100 basis points on a constant currency perspective from Q2. Obviously, this is -- it's a trailing 12-month metric. But with that slight improvement, how do you see that perhaps trending into Q4? I mean, could it move up a little bit if there's a little bit of Q4 budget flush? Because obviously, there's an impact on maybe 2024 as a result of that. But just kind of curious on your thoughts there.
Yes. On the trailing 12-month it was slightly up, I would say. On the quarter, it was pretty consistent Q3 versus Q2. I wouldn't say -- historically, we haven't seen like a budgeted flush end of the year from an MSP perspective to lend to any type of natural acceleration from an NRR perspective. And I would say, as we think about NRR in Q4, I would expect it to be fairly consistent. It's been a pretty steady metric. We did get that slight increase due to the timings of some of the price change in Q2. That will live with us kind of through the second quarter of next year. But we aren't modeling any significant change from an NRR perspective quarter-over-quarter.
Our next question comes from Brian Essex of JPMorgan.
Great to see the incremental operating margin expansion. Maybe on that point, Tim, if you could help us understand some of the levers behind some of the cost controls that you had in the quarter. It looks like operating expenses actually declined sequentially, which essentially looks like it might be seasonal. But then when we dig into some of the, I guess, drivers of that, some of them may be different. Maybe you can help us understand what leverage did you pull in the quarter? How sustainable are they? And how you think about operating leverage as we kind of start to look into 2024?
Yes, absolutely. Looking across the P&L, I think we've touched on this historically, but we see leverage opportunities across kind of all 3 aspects, whether it be G&A, sales and marketing and R&D. If you look at '23, we've made a bigger investment into R&D strategically to drive new -- an accelerated pace of new product being introduced to our partner base in 2023 and beyond. I expect us to be able to get leverage on that incremental investment that we made in '23 on that line. G&A, again, that line has been pretty flat since we spun the business out and continue to expect to get leverage there over the short, medium and long term.
And then the last piece is sales and marketing where, I would say, we're always scrutinizing and making sure we're getting the proper ROI from a sales and marketing perspective, breaking down our spend into deciles and optimizing where we see the ROI is not up to our standards. So that's a continuous process that we've looked at kind of since we've been a public company on the sales and marketing front, and we expect to continue to do that. But stack ranking the opportunity for leverage across the P&L, I would say, one, still sits as G&A; two, would be in sales and marketing and, three, would be in R&D, but opportunity on all 3 nonetheless.
Got it. That's super helpful. And maybe if I could circle back on MDR to follow up. Any sense that you might have in terms of any pent-up demand? And how long you might be -- you may have been, I guess, seeding your installed base for that? And what you anticipate ultimate penetration rate might be?
Sure. It's -- we know from talking to our customers, and we hit this a little bit on the prepared remarks. So we did a pretty sizable customer survey where we asked them what their bigger focus areas were for 2023 and 2024, and cybersecurity services was very much top of mind. And from talking to our customers and even looking at the survey results, we believe that there's a good amount of opportunity. And the good news here, Brian, is that they're for both our small MSPs and our large MSPs.
So on your adoption, I believe that it will cover the broader installed base. And so the double-click into that is what type of uptick will the MSPs have as they roll this out to their small and medium enterprise. And so we believe as there's more of a driver from a compliance point of view, and by the way, if we back up, there's 2 things that are really driving this. One, when companies are looking to get cyber insurance, there's much more focus overall on the stack and being to be able to not just protect but also to detect and respond across the base, and this is helping MSPs. And the second thing is there's a big push from a compliance point of view.
So security, really, before was a decision, how -- what is the level of risk I'm willing to take as a small medium enterprise or as an MSP? And now with compliance, it used to be maybe a sliding scale from a risk aversion or a range of gray is now more black and white and binary. If you want to be compliant, whether you're in the health care industry or fintech, whether you're in a certain geography like in the U.K. with Cyber Essentials, if you want to play in that market as a small, medium enterprise, you need to be compliant. And they're pretty specific as to what that need is what those requirements are.
So that's driving a lot of the need for these cybersecurity services to pop up at the small, medium enterprise. And we're seeing it across the geographies and across the verticals that our MSPs participate in and across the different sizes. So we're quite bullish on the opportunity. It will take some time as the MSPs roll this out and get comfortable with the motion themselves, but we're quite bullish that it will have a broad appeal to our installed base.
Thank you. At this time, we currently have no further questions. So I'll hand back to John Pagliuca for any further remarks.
Thank you all for participating in our quarterly call and for the questions and looking forward to talking to you all at the beginning of 2024. Take care.
Thank you for joining today's call. You may now disconnect your lines.