Business Overview and History
Rapid7, Inc. (NASDAQ:RPD) is a Boston-based cybersecurity software company that has established itself as a leading provider of integrated security solutions. With a focus on detection, response, and exposure management, Rapid7 has evolved to meet the growing demands of organizations navigating an increasingly complex threat landscape.
Rapid7 was founded in 2000 with the mission of empowering security teams to more effectively protect their organizations. The company initially gained recognition for its vulnerability management solutions, including the popular Nexpose and Metasploit products. Over the years, Rapid7 has strategically expanded its offerings, leveraging its deep security expertise to develop a comprehensive security operations platform.
In its early years, Rapid7 focused on developing vulnerability management and penetration testing solutions to help organizations identify and remediate security vulnerabilities. As the threat landscape grew more complex, the company expanded beyond vulnerability management into areas like security information and event management (SIEM), incident detection and response, and cloud security. Key acquisitions, such as the purchases of Logentries in 2015 and IntSights in 2021, helped Rapid7 build out its security analytics and threat intelligence capabilities.
Throughout its history, Rapid7 has faced challenges, particularly in recent years as it navigated the transition from traditional on-premises software to cloud-based subscription models. The company had to manage declines in its legacy vulnerability management business while investing in new cloud security and managed services offerings. This shift required Rapid7 to reevaluate its go-to-market strategies and optimize its cost structure to align with the changing industry dynamics.
Despite these headwinds, Rapid7 has remained a leading provider of security operations solutions. The company now has over 11,700 customers in 146 countries, including 45 of the Fortune 100. Rapid7's solutions are used by organizations of all sizes across a wide range of industries to improve their security posture and better manage cyber risks.
In 2024, Rapid7 reported annual revenue of $844 million, representing a 9% year-over-year increase. The company's annualized recurring revenue (ARR) reached $840 million, growing 4% compared to the prior year. Rapid7's success has been driven by the strong performance of its detection and response (D&R) business, which now accounts for over $400 million in ARR and is growing at a mid-teens rate.
Rapid7's strategy has centered on transitioning from a vulnerability management-focused provider to a leader in integrated security operations. This shift has involved significant investments in the company's managed detection and response (MDR) capabilities, as well as the development of its Exposure Command solution, which delivers comprehensive attack surface visibility and risk management.
Financials and Key Metrics
Rapid7's financial performance in 2024 reflects its evolving business model. The company's product subscriptions revenue, which includes cloud-based subscriptions, managed services, and software licenses, grew 9% year-over-year to $809 million. However, the company's professional services revenue declined 6% to $35 million, as it has actively deemphasized certain lower-value services.
The company's gross margin remained relatively stable, with product subscriptions gross margin at 75% and total gross margin at 73% in the fourth quarter of 2024. Rapid7's focus on operational efficiency is evident in its non-GAAP operating income, which reached $164 million, or 19% of revenue, for the full year.
For the three months ended September 30, 2024, product subscription revenue was $205.59 million, representing 95.8% of total revenue. On a year-over-year basis, product subscription revenue grew 8.3%. This growth was driven by both new customer acquisitions, contributing $2.4 million, as well as expansion within Rapid7's existing customer base, adding $13.4 million. The company's focus on delivering cloud-based and managed security solutions has been a key driver of the product subscription revenue expansion.
Professional services revenue for the same period was $9.06 million, representing 4.2% of total revenue. Compared to the same period in 2023, professional services revenue increased 1.0%, as Rapid7 continued to support customers in implementing and optimizing its security platform.
Overall, Rapid7's total revenue for the three months ended September 30, 2024 was $214.65 million, representing an 8.0% year-over-year increase. The company's focus on cloud-based and managed security offerings has driven strong growth in its higher-margin product subscription business, which now accounts for 96.0% of total revenue on a year-to-date basis.
In the most recent quarter (Q4 2024), Rapid7 reported revenue of $216.26 million, up 5.4% year-over-year. Net income for the quarter was $2.2 million. The revenue growth was driven primarily by a 6% increase in product subscriptions revenue, while professional services revenue declined 5%. The company saw strength in its detection and response business, which now has over $400 million in ARR and is growing in the mid-teens. However, the company continues to face headwinds in its traditional vulnerability management business, which has seen deceleration and increased churn.
Geographically, Rapid7 noted that international revenue grew 14% year-over-year in Q4 2024 and now represents 25% of total revenue, while North America grew 3% and accounts for 75% of the mix.
Liquidity
Rapid7's balance sheet remains strong, with $559 million in cash, cash equivalents, and investments as of the end of 2024. The company generated $154 million in free cash flow during the year, representing a free cash flow margin of 18%. Operating cash flow for 2024 was $172 million.
The company's debt-to-equity ratio stands at 57.49, with a current ratio and quick ratio both at 1.25. Rapid7 has a $100 million revolving credit facility, with a letter of credit sublimit of $15 million and an accordion feature to increase the facility to $150 million.
Competitive Landscape and Risks
The cybersecurity industry in which Rapid7 operates is highly competitive, with players ranging from established industry giants to nimble startups. Rapid7 faces competition from both traditional vulnerability management providers, as well as emerging cloud security and exposure management vendors.
One of the key risks facing Rapid7 is the potential for increased churn and growth deceleration in its legacy vulnerability management business, as the market shifts towards more integrated security solutions. The company has attempted to mitigate this risk by investing heavily in its Exposure Command platform and expanding its MDR offerings.
Additionally, Rapid7 operates in a rapidly evolving threat landscape, where cybercriminals continuously develop new and sophisticated attack methods. The company's ability to keep pace with these threats and provide effective security solutions is critical to its long-term success.
The cybersecurity industry is experiencing rapid growth, driven by increasing cyber threats, cloud migration, and AI adoption. According to Cybersecurity Ventures, global cybercrime damages are projected to reach $10.5 trillion annually by 2025, up from $3 trillion in 2015.
Outlook and Strategic Initiatives
For the full year 2025, Rapid7 expects to generate ARR in the range of $870 million to $890 million, representing growth of 4% to 6%. The company's revenue guidance for 2025 is $860 million to $870 million, reflecting a slower growth rate of 2% to 3% compared to the previous year. Rapid7 also expects non-GAAP operating income of $125 million to $135 million, free cash flow of approximately $135 million, and net income per share of $1.72 to $1.85.
For Q1 2025, Rapid7 expects total revenue of $207 million to $209 million, representing growth of 1% to 2%, non-GAAP operating income of $23 million to $25 million, and non-GAAP net income per share of $0.33 to $0.36.
To drive this growth, Rapid7 is making targeted investments in several key areas:
- Expanding its MDR capabilities and offerings to reach a broader set of customers and accelerate enterprise adoption.
- Accelerating the development of its Exposure Command platform to capitalize on the growing demand for integrated risk and exposure management.
- Establishing a new innovation center in India to support future product enhancements and improve operational leverage.
These strategic initiatives are expected to position Rapid7 for accelerated growth in 2026 and beyond, as the company strengthens its competitive positioning and enhances its cost structure. The company noted that they are making $30 million in incremental investments in 2025 to accelerate growth in their Managed Detection and Response (MDR) offerings and their Exposure Command platform, with the goal of driving improved profitability and growth in 2026 and beyond.
Conclusion
Rapid7's transformation from a vulnerability management specialist to a leader in integrated security operations has been a strategic priority for the company. While the transition has presented some challenges, the company's sustained investments in its detection and response capabilities, as well as its emerging Exposure Command platform, position it for long-term success.
As Rapid7 navigates the competitive cybersecurity landscape, its focus on delivering comprehensive security solutions, expanding its partner ecosystem, and improving operational efficiency will be critical to driving sustainable growth and shareholder value. The company's strong financial performance, growing customer base, and strategic investments in key growth areas demonstrate its commitment to maintaining its position as a leading provider of integrated security solutions in an increasingly complex threat landscape.