Rapid7 Announces Third Quarter 2026 Financial Results

• Annualized recurring revenue (“ARR”) of $820 million
• Total revenue of $212 million; Product subscriptions revenue of $206 million
• GAAP income from operations of $9.0 million; Non-GAAP income from operations of $46.2 million
• Net cash provided by operating activities of $30.1 million; Free cash flow of $26.5 million

BOSTON, Nov. 04, 2026 (GLOBE NEWSWIRE) -- Rapid7, Inc. (Nasdaq: RPD), a global leader in AI-powered managed cybersecurity operations, today announced its financial results for the third quarter 2026.

“Last quarter, we took decisive action to focus resources and energy on our core business. This quarter, we delivered on some of our early goals in this multi-quarter journey,” said Wael Mohamed, CEO of Rapid7. “The company is operating with greater discipline, our core business is becoming more stable, and our cash generation outlook for the year remains on track. That is real progress, but one quarter of stability is just a start. Turning this execution into durable growth is the work ahead of us.”

“Discipline creates capacity, and strategy decides where it goes. We are putting that capacity behind our core and an AI-first service model where our platform, Rapid7 Intelligence, AI agents, and experienced security experts work as one system, taking customers beyond detection and response to resolution. In Exposure Management, that same intelligence helps customers focus on the exposures attackers can actually exploit and fix them before they become incidents. Hundreds of customers are already using Kenzo-powered capabilities as we build toward Autonomous SOC. We are not declaring victory. We are building proof, and we intend to earn confidence across quarters.”

Third Quarter 2026 Financial Highlights

• Revenue: Total revenue of $212.4 million, a decrease of 2.5% year-over-year. Product revenue of $206.1 million, a decrease of 1.9% year-over-year.
• ARR: Annualized recurring revenue of $819.7 million, a decrease of 2.2% year-over-year.
• Operating Income: GAAP income from operations of $9.0 million; Non-GAAP income from operations of $46.2 million.
• Net Income: GAAP net income of $3.5 million or $0.05 per diluted share and non-GAAP net income of $47.4 million or $0.60 per diluted share.
• Cash Flow: Net cash provided by operating activities of $30.1 million and free cash flow of $26.5 million.
• Total cash, cash equivalents, and government securities of $731.6 million as of September 30, 2026.

Recent Business Highlights

• In October, Rapid7 launched Rapid7 Intelligence, a unified engine that combines threat intelligence, vulnerability research, and Rapid7 Labs to turn insight on attacker behavior into AI-powered action that helps organizations anticipate and disrupt attacks. Rapid7 Intelligence is led by Mel Stone, Chief Global Services Officer, and its frontline intelligence flows directly into Rapid7 products, MDR, and Exposure Management.
• In October, Rapid7 hosted its customer summit in Boston and previewed its Autonomous SOC, a governed system in which security experts, threat intelligence, and Red, Blue, and Orange AI agents work together to take customers from detection to resolution.
• In August, Rapid7 released its Q2 Threat Landscape Report. The report found that 62% of newly exploited vulnerabilities could be exploited over a network without authentication or user interaction, and that high and critical disclosures doubled year over year to 8,539.
• In August, Rapid7 released research conducted by Omdia, which found that 97% of security professionals report AI is having a positive impact on security operations, 92% agree human oversight remains essential, and 86% believe MDR providers that integrate AI hold an advantage over traditional MDR services.
• In August, at Black Hat USA 2026, Rapid7 showcased three platform innovations: (1) the newly generally available Rapid7 AI-Accelerated Exposure Discovery & Visibility, (2) Preemptive MDR Alerts, and (3) Agentic SOC, which applies AI agents to accelerate investigations and guide response while preserving analyst control over high-impact decisions.

Fourth Quarter and Full Year 2026 Guidance

Non-GAAP guidance excludes estimates for stock-based compensation expense, amortization of acquired intangible assets, amortization of debt issuance costs, and certain other items such as acquisition-related expenses, impairment of long-lived assets, impairment of strategic equity investment, restructuring expense, induced conversion expense, change in the fair value of derivative assets, non-ordinary course litigation-related expenses and discrete tax items. A reconciliation of non-GAAP guidance measures to the most comparable GAAP measures is not available on a forward-looking basis without unreasonable efforts due to the high variability, complexity and low visibility with respect to the charges excluded from these non-GAAP measures.

Rapid7 anticipates ARR, revenue, non-GAAP income from operations, non-GAAP net income per share and free cash flow to be in the following ranges:

The guidance provided above is forward-looking in nature. Actual results may differ materially. See the cautionary note regarding “Forward-Looking Statements” below. Guidance for the fourth quarter 2026 and full-year 2026 does not include any potential impact of foreign exchange gains or losses.

Conference Call and Webcast Information

Rapid7 will host a conference call today, November 4, 2026, to discuss its results at 4:30 p.m. Eastern Time. The call will be available live via webcast on Rapid7's website at https://investors.rapid7.com. A webcast replay of the conference call will be available at https://investors.rapid7.com.

About Rapid7

Rapid7, Inc. (NASDAQ: RPD) is a global leader in AI-powered managed cybersecurity operations, trusted to advance organizations’ cyber resilience. Open and extensible, the Rapid7 Command Platform integrates security data, enriching it with AI, threat intelligence, and 25 years of expertise and innovation to reduce risk and disrupt attackers. As a recognized leader in preemptive managed detection and response (MDR), Rapid7 unifies exposure and detection to transform the cybersecurity operations of approximately 11,800 customers worldwide. For more information, visit our website, check out our blog, or follow us on LinkedIn or X.

Non-GAAP Financial Measures and Other Metrics

To supplement our consolidated financial statements, which are prepared and presented in accordance with generally accepted accounting principles in the United States (“GAAP”), we provide investors with certain non-GAAP financial measures and other metrics, which we believe are helpful to our investors. We use these non-GAAP financial measures and other metrics for financial and operational decision-making purposes and as a means to evaluate period-to-period comparisons. We also use certain non-GAAP financial measures as performance measures under our executive bonus plan. We believe that these non-GAAP financial measures and other metrics provide useful information about our operating results, enhance the overall understanding of past financial performance and future prospects and allow for greater transparency with respect to metrics used by our management in its financial and operational decision-making.

While our non-GAAP financial measures are an important tool for financial and operational decision-making and for evaluating our own operating results over different periods of time, you should review the reconciliation of our non-GAAP financial measures to the comparable GAAP financial measures included below, and not rely on any single financial measure to evaluate our business.

Non-GAAP Financial Measures

We disclose the following non-GAAP financial measures: non-GAAP gross profit, non-GAAP income from operations, non-GAAP net income, non-GAAP net income per share, adjusted EBITDA, free cash flow and unlevered free cash flow. We also disclose non-GAAP gross margin and non-GAAP operating margin derived from these financial measures.

We define non-GAAP gross profit, non-GAAP income from operations, non-GAAP net income and non-GAAP net income per share as the respective GAAP balances excluding the effect of stock-based compensation expense, amortization of acquired intangible assets, amortization of debt issuance costs and certain other items such as acquisition-related expenses, litigation-related expenses, impairment of long-lived assets, change in the fair value of derivative assets, impairment of strategic equity investment, restructuring expense, induced conversion expense and discrete tax items. Non-GAAP net income per basic and diluted share is calculated as non-GAAP net income divided by the weighted average shares used to compute net income per share, with the number of weighted average shares decreased, when applicable, to reflect the anti-dilutive impact of the capped call transactions entered into in connection with our convertible senior notes.

We believe these non-GAAP financial measures are useful to investors in assessing our operating performance due to the following factors:

Stock-based compensation expense. We exclude stock-based compensation expense because of varying available valuation methodologies, subjective assumptions and the variety of equity instruments that can impact our expense. We believe that providing non-GAAP financial measures that exclude stock-based compensation expense allows for more meaningful comparisons between our operating results from period to period.

Amortization of acquired intangible assets. We believe that excluding the impact of amortization of acquired intangible assets allows for more meaningful comparisons between operating results from period to period as the intangible assets are valued at the time of acquisition and are amortized over several years after the acquisition.

Amortization of debt issuance costs. The expense for the amortization of debt issuance costs related to our convertible senior notes and our revolving credit facility is a non-cash item, and we believe the exclusion of this interest expense provides a more useful comparison of our operational performance in different periods.

Acquisition-related expenses. We exclude acquisition-related expenses, including accretion expense associated with contingent consideration, as costs that are unrelated to the current operations and are neither comparable to the prior period nor predictive of future results.

Impairment of strategic equity investment. We exclude impairment of strategic equity investment because we believe the exclusion of the impairment charges provides a more useful comparison of our operational performance in different periods.

Discrete tax items. We exclude certain discrete tax items such as income tax expenses or benefits that are not related to ongoing business operations in the current year and adjustments to uncertain tax position reserves as these charges are not indicative of our ongoing operating results, and they are not considered when we are forecasting our future results.

Restructuring expense. We exclude non-ordinary course restructuring expenses related to the restructuring activities because we do not believe these charges are indicative of our core operating performance and we believe the exclusion of restructuring expense provides a more useful comparison of our performance in different periods.

Adjusted EBITDA. Adjusted EBITDA is a non-GAAP measure that we define as net income (loss) before (1) interest income, (2) interest expense, (3) other (income) expense, net, (4) provision for income taxes, (5) depreciation expense, (6) amortization of intangible assets, (7) stock-based compensation expense, (8) acquisition-related expenses, and (9) restructuring expense. We believe that the use of adjusted EBITDA is useful to investors and other users of our financial statements in evaluating our operating performance because it provides them with an additional tool to compare business performance across companies and across periods.

Free Cash Flow and Unlevered Free Cash Flow. Free cash flow is a non-GAAP measure that we define as cash provided by operating activities less purchases of property and equipment and capitalization of internal-use software costs. We consider free cash flow to be a liquidity measure that provides useful information to management and investors about the amount of cash generated by the business after necessary capital expenditures. We define unlevered free cash flow as free cash flow adjusted for the after-tax cash flow impact of interest income and interest expense. We believe unlevered free cash flow provides investors with useful supplemental information regarding our liquidity because it provides insight into the cash generated by our business before cash interest payments on financing obligations and excluding interest received on cash and investments. Management uses unlevered free cash flow to assess our ability to invest in the business and satisfy future contractual obligations. However, given our debt obligations, non-cancelable commitments and other contractual obligations, unlevered free cash flow does not represent residual cash flow available for discretionary expenses.

We include all non-GAAP financial measures in the current year or any comparative year that will be included in the non-GAAP reconciliation during the current fiscal year annual Form 10-K. As such, not all non-GAAP financial measures listed above may be included in the current reporting period non-GAAP reconciliation in the GAAP to Non-GAAP Reconciliation section below.

Our non-GAAP financial measures may not provide information that is directly comparable to that provided by other companies in our industry, as other companies in our industry may calculate non-GAAP financial results differently, particularly related to non-recurring, unusual items. In addition, there are limitations in using non-GAAP financial measures because the non-GAAP financial measures are not prepared in accordance with GAAP, may be different from non-GAAP financial measures used by other companies and exclude expenses that may have a material impact upon our reported financial results. Further, stock-based compensation expense has been and will continue to be for the foreseeable future a significant recurring expense in our business and an important part of the compensation provided to our employees.

Other Metrics

ARR. Annualized Recurring Revenue and Growth. ARR is defined as the annual value of all recurring revenue related to active contracts as of the last day of the period. ARR is measured at a specific point in time and does not incorporate consideration of any anticipated contract terminations or other prospective events, regardless of whether such events may exert a favorable or adverse influence on the metric. ARR should be viewed independently of revenue and deferred revenue, as ARR is an operating metric and is not intended to be combined with or replace these items. ARR is not a forecast of future revenue, which can be impacted by contract start and end dates and renewal rates and does not include revenue reported as professional services revenue in our consolidated statement of operations. We use ARR and believe it is useful to investors as a measure of the overall success of our business.

Number of Customers. We define a customer as any entity that has an active Rapid7 recurring revenue contract as of the specified measurement date, excluding only InsightOps and Logentries customers with a contract value less than $2,400 per year.

ARR per Customer. We define ARR per customer as ARR divided by the number of customers at the end of the period.

Cautionary Language Concerning Forward-Looking Statements

This press release includes forward-looking statements within the meaning of the Private Securities Litigation Reform Act of 1995. These forward-looking statements include, but are not limited to, statements regarding our financial guidance for the fourth quarter and full-year 2026, and the assumptions underlying such guidance, and statements regarding our restructuring plan, including the expected timing of its completion, the amount and timing of expected charges, the expected benefits of the restructuring plan, and our strategy, business plans and focus, including our efforts to stabilize our core business, achieve durable growth and generate cash, and our development of an AI-first service model and Autonomous SOC. Our use of the words “anticipate,” “believe,” “estimate,” “expect,” “intend,” “may,” “will” and similar expressions are intended to identify forward-looking statements. The events described in our forward-looking statements are subject to a number of risks and uncertainties, assumptions and other factors that could cause actual results and the timing of certain events to differ materially from future results expressed or implied by the forward-looking statements. Such forward-looking statements are based on our current assumptions, expectations and estimates and involve a number of judgments and risks, many of which are outside of our control. Risks that could cause or contribute to such differences include, but are not limited to, macroeconomic uncertainty, unstable market and economic conditions, fluctuations in our quarterly results, our ability to successfully execute our strategy, stabilize our core business and achieve durable growth, the possibility that our restructuring plan may not achieve its intended benefits or may take longer than anticipated to complete or result in charges greater than currently estimated, our ability to successfully grow our sales of our cloud-based solutions, including through the shift to a consolidated platform sales approach, failure to meet our publicly announced guidance or other expectations about our business, our ability to grow our revenue, the ability of our products and professional services to correctly detect vulnerabilities, renewal of our customers' subscriptions, competition in the markets in which we operate, market growth, our ability to innovate, our sales cycles, our ability to successfully develop, deploy and realize the expected benefits of our artificial intelligence and automation capabilities, including risks related to performance, reliability, security and customer adoption of such technologies, our ability to successfully integrate acquired companies, including Kenzo Security, and achieve the expected synergies and benefits of such acquisitions in a timely manner or at all, exposure to greater than anticipated tax liabilities, our ability to operate in compliance with applicable laws, fluctuations in foreign currency exchange rates and their impact on our results, risks related to the accuracy, efficacy and perceived reliability of our threat intelligence, detection and response capabilities, including the potential for undetected vulnerabilities, false positives or failures in our systems, as well as other risks and uncertainties that could affect our business and results described in our filings with the Securities and Exchange Commission (the “SEC”), including our most recent Quarterly Report on Form 10-Q filed with the SEC on August 10, 2026, particularly in the section entitled "Item 1A Risk Factors," and in the subsequent reports that we file with the SEC. Moreover, we operate in a very competitive and rapidly changing environment. New risks and uncertainties emerge from time to time. It is not possible for our management to predict all risks, nor can we assess the impact of all factors on our business or the extent to which any factor, or combination of factors, may cause actual results to differ materially from those expressed in any forward-looking statements we may make. Except as required by law, we undertake no obligation to update any forward-looking statements to reflect events or circumstances after the date of such statements. You should, therefore, not rely on these forward-looking statements as representing our views as of any date subsequent to the date of this press release.

⁽¹⁾ We use the if-converted method to compute diluted earnings per share with respect to our convertible senior notes. There was no add-back of interest expense or additional dilutive shares related to the convertible senior notes where the effect was anti-dilutive. On an if-converted basis, for the three and nine months ended September 30, 2026 and the three months ended September 30, 2025, the 2027 and 2029 Notes were anti-dilutive; for the nine months ended September 30, 2025, the 2029 Notes, 2027 Notes and 2025 Notes were anti-dilutive.