What does it do?
Rapid7 is a maturing business that earns money by selling cloud-based subscriptions to its Command Platform, which helps companies identify and block cyber attacks. Organizations pay an annual fee to use tools like InsightIDR for incident detection and InsightCloudSec for cloud security, often bundled into a managed detection and response service where Rapid7 experts monitor the customer's network. The core mechanism is a recurring subscription model where customers pay per asset or user, creating a steady stream of predictable income that now accounts for 97% of total revenue. Customers keep paying because replacing a core security operations platform involves high technical friction and requires retraining an entire security team.
Where does revenue come from?
Product subscriptions generate the vast majority of income, making up $205.1 million of the $210.9 million earned in the most recent quarter. These subscriptions cover the core analytics platform and managed services, while professional services provide a small remainder through consulting and technical implementation. Nearly 80% of the recurring revenue now comes from core platform solutions, while the rest is tied to legacy standalone products that are being phased out.
Revenue Breakdown
Revenue by Geography
Who are its customers?
Rapid7 serves more than 11,500 customers globally, ranging from large enterprise organizations to smaller regional government entities. These customers are primarily IT and security departments that need automated help managing thousands of daily security alerts across cloud and on-premise environments. The company recently reported $824 million in annualized recurring revenue, which averages out to more than $71,000 in spend per customer. Growth is currently focused on the government sector, where the company recently achieved GovRAMP authorization to provide AI-powered security services to state and local organizations.
What gives it staying power?
Staying power comes from the high switching costs of its Managed Detection and Response services, which are deeply embedded in a customer's daily security workflow. Once a company trust Rapid7 to monitor its entire digital infrastructure, removing the software creates a dangerous "blind spot" that few IT teams are willing to risk.
Where is it headed?
The company is making a major strategic bet on the "Agentic SOC," a model that uses autonomous AI agents to automate the manual work of security analysts. Management is restructuring the workforce to move resources away from legacy tools and toward this AI-first platform. If it works, this will significantly reduce the cost of delivering security services while making the platform faster than human competitors.
Rapid7 is currently seeing a revenue contraction as it intentionally sheds non-core legacy products to focus on its higher-margin core platform. Total revenue fell 1.5% to $210.9 million in the most recent quarter, but the core detection and response business grew 5%, signaling that the underlying platform remains healthy even as the total numbers look weak.
Free cash flow is the most reliable signal of financial health here, as it consistently tracks above GAAP net income and is projected to reach $130 million for the full year. This cash generation is critical because it allows the company to fund its restructuring costs and debt obligations without needing to raise new capital in a difficult market.
The balance sheet is positioned to handle upcoming debt maturities, supported by a significant $702.6 million cash reserve and a $200 million undrawn credit facility. While the company carries roughly $900 million in convertible notes, management has stated they are well-positioned to repay the $600 million portion due in March 2027 using their existing cash balance.
Rapid7 is a business in a strategic transition that is prioritizing durable cash flow and debt repayment over the aggressive top-line growth seen in previous years.
Rapid7 does not pay a dividend and instead uses its cash to fund operations and manage its debt load. The company has never paid a dividend in its history as it remains focused on reinvesting into its AI-first platform pivot. While it has not been active in buying back shares to return cash, it has used $23.3 million for acquisitions recently. The share count has risen by approximately 4% over the last year, largely due to stock-based compensation handed to employees, which slightly shrinks the slice of the company owned by existing shareholders.
The core Detection and Response business continues to grow at 5% year-over-year, now representing more than half of the company's total recurring revenue. This growth proves that the central part of the platform remains competitive even as management cuts costs and shuts down older, non-core products.
The decline in legacy non-core products is currently faster than the growth in the core platform, causing total recurring revenue to shrink. If the core business does not accelerate, the company will struggle to grow its total earnings even after the current restructuring is finished.
The cybersecurity software market is currently worth over $200 billion and is growing at more than 12% annually as businesses move their operations to the cloud. This is a rational industry where customers are willing to pay a premium for reliability, but it is increasingly shaped by "platformization," where large vendors like Palo Alto Networks bundle multiple tools together to win accounts. Rapid7 stands as a specialized leader in managed security operations, though it faces constant pressure from giant software firms that offer security as a free add-on to existing contracts.
The competitive dynamic in security operations is becoming a battle of consolidation, where customers want fewer vendors that can do more. This makes the market brutally competitive for standalone tools and places a high premium on those who can offer a unified "command" platform.
Microsoft is the most dangerous threat because it can bundle security into the Office and Azure contracts that businesses already pay for. CrowdStrike is also a major risk as it uses its dominance in laptop and server security to expand into Rapid7's core territory of incident response.
Rapid7 is currently under pressure as legacy product attrition offsets its core growth, requiring a pivot to AI to maintain its position.
Rapid7's primary protection comes from its proprietary threat intelligence and the high switching costs of its Managed Detection and Response services. When a company relies on Rapid7 to monitor its network 24/7, the technical complexity and risk of switching to a new provider act as a significant barrier.
The numbers show a 69.3% gross margin and an average spend per customer of over $71,000, which are consistent with a business that provides high-value services. Rapid7 lacks a Strong moat because its core products face intense pricing pressure from giants like Microsoft who can offer similar security tools at a lower marginal cost.
The moat is stable as the company successfully transitions its customers toward its core Command Platform. While legacy products are declining, the core platform now represents 80% of total recurring revenue, proving that the central part of the business remains defensible.
Total recurring revenue fell 2% year-over-year while the core platform grew only 1%.
Maintaining $702.6M cash to repay $600M in debt due in 2027.
Heavy stock-based compensation ($40M in six months) despite stagnant revenue growth.
Capital Allocation Track Record
Wael Mohamed is taking decisive action to fix a bloated cost structure, but his team has yet to prove they can return the business to growth. The 12% workforce cut and the shift toward an "Agentic SOC" model are necessary strategic pivots, yet the mixed execution on revenue growth suggests the team is still in the "repair" stage of their leadership. Strategic judgment appears sound regarding the focus on core platforms, but investors are still waiting for these bets to show up in the financial results.
The leadership is highly dependent on a newly assembled executive team, and the thesis relies on their ability to execute a difficult turnaround. With a new CFO, CCO, and CPTO all joining within the last year, there is significant execution risk as they attempt to integrate a new AI-first culture. While the board is independent, the high level of stock-based compensation relative to the company's current performance remains a point of governance concern for shareholders.
We expect revenue to grow from $0.8B in FY2026 to $0.9B in FY2031 (~3% CAGR), with EPS growing from $1.80 to $1.93 (~1% CAGR). Revenue growth is slow because the company is struggling to take share from larger competitors in the maturing vulnerability management market. Margins expand significantly as the company reduces its heavy spending on sales and marketing to focus on profitability over rapid expansion. EPS grows slower than revenue because the high rate of new share issuance for employee pay dilutes the total profit per share. Operating margin expected to reach ~23% by FY2031.
AI automation reduces service delivery costs and boosts margins. If the Agentic SOC model works, Rapid7 can handle more customers with fewer analysts, significantly expanding its profit per user.
GovRAMP authorization opens new public sector revenue streams. Gaining federal and state certification allows Rapid7 to compete for large government contracts that were previously off-limits.
Core platform growth accelerates as non-core drag disappears. Once legacy products finish their decline, the 5% growth in the core business will finally show up in the total revenue line.
Legacy product churn accelerates faster than core growth. If older products decline more quickly than expected, total revenue will continue to shrink regardless of core platform performance.
Microsoft and Palo Alto compress pricing with bundled deals. Intense competition from giants could force Rapid7 to lower its prices to keep customers, eroding the benefits of its restructuring.
AI-first pivot fails to gain customer traction or trust. If the "Agentic SOC" is perceived as less reliable than human analysts, customers may move to more established competitors.
Below is our estimate of current and future fair value, with detailed reasoning and assumptions. Fair value is a judgment, not a fact, and other analysts will likely land on different numbers. Use it as one data point in your research, and apply your own discretion in any investing decision.
We value Rapid7 based on what it will earn once its big shift to AI and platform security is complete. The company is currently in a messy transition, cutting staff and letting old products fade away, so its current earnings do not yet reflect the final business. Valuing the company on its eventual steady state gives a clearer picture of its long-term worth.
We took the projected 2031 profit of $1.93 per share and applied a 10x multiple, then adjusted that future value back to what it is worth today. This final multiple of 10x is conservative compared to rivals like Palo Alto Networks at 32x or Fortinet at 30x, reflecting Rapid7's slower growth and narrower competitive position. We added the value of the cash the business produces over the next six years and used a 10% discount rate to land on a fair value of $18.
Priced on next year's earnings instead, at a 10x multiple, we get $18.30 — which is within 2% of our main valuation. We applied that same 10x multiple to the expected 2027 earnings of $1.83 per share. Other specialized security vendors like Tenable trade at 14x and Qualys at 16x, so our 10x target assumes the market stays cautious about Rapid7's turnaround. Since both methods land on nearly the same number, it gives us more confidence in the $18 target.
The biggest risk is that legacy product declines accelerate faster than new AI-driven products can grow. This would drain the annual subscription base and force the terminal multiple down from 10x to 5x, knocking roughly $9 off the per-share fair value. Watch for any drop in total recurring revenue below $205 million in the next quarterly report.
Bear case ($8): Core platform recurring revenue growth drops below 1% for two consecutive quarters; or Restructuring costs exceed $35 million without a matching improvement in profit margins.
Bull case ($31): New Agentic SOC platform wins more than 500 customers in its first year of launch; or Non-core legacy product attrition slows to less than 5% while core products accelerate.
Clearthesis wrote this report from 47 sources, including SEC filings, analyst estimates, industry research, and recent news.
How did you like this thesis?
Your feedback helps us make reports better for you
© 2026 Clearthesis.ai · Report generated on October 11, 2026
This is an AI-generated analysis for informational purposes only and does not constitute financial advice. Data and analysis may not reflect recent developments if viewed significantly after the generation date. Always conduct your own due diligence before making any investment decisions.