Rapid7 Puts 80% of $824M ARR Behind Core Platform as CEO Refocuses
Rapid7's new CEO Wael Mohamed used his first earnings call to shift attention to a leaner core: detection and response plus exposure management now make up more than 80% of $824 million ARR. D&R grew roughly 5% while overall ARR kept sliding, but a restructuring aims for a 20% non-GAAP operating margin by Q4.
Beat this week
Last 7 days · Security
Impact 5.4/10, unchanged. Counts are stories in our record, not a market forecast.
Open the change reportCoverage balance Balanced directional read. Positive and negative coverage are within 0 percentage points.
This story sits in Security — the counts compare this beat's last 7 days with the previous 7 in our verified record, not a market forecast.
Figures are computed live from our source-verified story record (as of ) The volume change compares this window with the prior 7 days in the same record. — see our methodology for how impact and sentiment are derived.
Cybersecurity briefing
Key takeaways
- Rapid7's new CEO Wael Mohamed used his first earnings call to shift attention to a leaner core: detection and response plus exposure management now make up more than 80% of $824 million ARR.
- D&R grew roughly 5% while overall ARR kept sliding, but a restructuring aims for a 20% non-GAAP operating margin by Q4.
- insidermonkey.com
- finance.yahoo.com
In this briefing
Mentioned
Key Intelligence
Key Facts
- 1Rapid7 reported total annual recurring revenue of $824 million in Q2 2026, with its core platform of detection and response plus exposure management making up more than 80% of total ARR and growing about 1% year over year.
- 2Detection and response, including managed detection and response, expanded roughly 5% year over year and accounted for about 55% of total ARR.
- 3Non-GAAP operating income reached $28.9 million, a 13.7% non-GAAP operating margin that beat company guidance, while free cash flow was $31.9 million.
- 4Rapid7 raised full-year non-GAAP operating income guidance to a range of $129 million to $133 million and is targeting a roughly 20% non-GAAP operating margin by Q4 2026, up from 13.7% in Q2.
- 5A restructuring cut about 12% of the workforce, with savings to be reinvested in the core platform and the AI foundation built around the Kenzo acquisition.
- 6The company ended Q2 2026 with $702.6 million in cash, cash equivalents, and short-term investments, plus an undrawn $200 million credit facility, ahead of $600 million in convertible notes due March 2027.
Beat guidance; management targets 20% non-GAAP margin by Q4 2026
Analysis
For CISOs and security operations teams sizing up Rapid7 as a strategic partner, the vendor's Q2 2026 earnings reveal a company narrowing its identity to detection and response plus exposure management, which now generate more than 80% of $824 million in annual recurring revenue. That core grew only about 1% year over year while D&R alone expanded roughly 5%, a divergence that will shape product roadmaps and renewal conversations.
Rapid7's first earnings call under new CEO Wael Mohamed on August 10, 2026, delivered a message about focus rather than a detailed operational walkthrough from the new chief executive. Executive Chairman Corey E. Thomas, who recently stepped out of the CEO role, presented the financials and framed the leadership transition as an acceleration of a plan that was already being sharpened. The quarter itself was split: profitability beat the company's own guidance while total annual recurring revenue continued to slide. That tension between better margins and sluggish growth is the core issue for investors and customers trying to assess whether Rapid7 is stabilizing or simply shrinking more efficiently.
Non-GAAP operating income reached $28.9 million, a 13.7% non-GAAP operating margin that beat guidance, and free cash flow came in at $31.9 million on stronger collections.
At the center of the strategy is what Rapid7 calls its core platform, which combines its detection and response business with exposure management. That unit now accounts for more than 80% of the company's $824 million in total annual recurring revenue and grew about 1% year over year. Detection and response, including managed detection and response, was the stronger engine, expanding roughly 5% year over year and representing about 55% of total ARR. Exposure management remained part of the core but did not show the same momentum, and the rest of the business outside the core platform is shrinking on several measures. This is a deliberate narrowing: instead of defending a broad portfolio, Rapid7 is concentrating spending, product development, and go-to-market energy on the areas where it believes it can win.
What to Watch
Profitability improved even as top-line ARR slipped. Non-GAAP operating income reached $28.9 million, a 13.7% non-GAAP operating margin that beat guidance, and free cash flow came in at $31.9 million on stronger collections. Management raised full-year non-GAAP operating income guidance to a range of $129 million to $133 million. The improved margin is not just organic; a restructuring eliminated about 12% of the workforce, and the company is targeting a non-GAAP operating margin of roughly 20% by the fourth quarter, up from 13.7% in the second quarter. Rapid7 says a meaningful share of the savings will be reinvested into the core platform and into an AI foundation built around its acquisition of Kenzo. That reinvestment is essential, because a security vendor cannot cut its way to durable relevance, especially in detection and response where data scale, analyst quality, and product velocity define competitive advantage.
On the balance sheet, Rapid7 ended the quarter with $702.6 million in cash, cash equivalents, and short-term investments, plus an undrawn $200 million credit facility. Management said those resources leave the company well positioned to repay $600 million in convertible notes due in March 2027. This is a meaningful backstop for the recovery story, but it also means the company must generate enough cash flow and preserve enough liquidity over the next two quarters to meet that obligation without choking reinvestment. For cybersecurity buyers, the strategic message is clear: Rapid7 intends to be more concentrated around managed detection and response and exposure management, with more AI-driven capability from Kenzo layered into the platform. The question is whether sharper focus can restore growth fast enough to turn the business from a margin-improving but shrinking ARR story into a sustainable challenger in the consolidating security operations market. The fourth-quarter margin target and any acceleration in core ARR will be the clearest tests.
Timeline
Timeline
Rapid7 Q2 2026 earnings call under new CEO Wael Mohamed
First earnings call under Wael Mohamed; company reported $824 million total ARR, $28.9 million non-GAAP operating income, and raised full-year operating income guidance.
Rapid7's $600 million convertible notes mature
Rapid7 has $702.6 million in cash and short-term investments plus a $200 million undrawn credit facility to address the upcoming maturity.
Source cluster
Primary reporting
- insidermonkey.comRapid7 ( RPD ) Bets On A Sharper Focus To Reverse Its Slide
- finance.yahoo.comRapid7 ( RPD ) Bets On A Sharper Focus To Reverse Its Slide
Cite This Page
"Rapid7 Puts 80% of $824M ARR Behind Core Platform as CEO Refocuses." Cyber Intelligence Brief, August 21, 2026. https://getcyberbrief.com/story/rapid7-core-platform-824m-arr-new-ceo-cyber
How we covered this story
Every story in our cybersecurity coverage is assembled from multiple primary sources, cross-referenced for factual consistency, and scored along three independent dimensions: sentiment, operational impact, and source-cluster confidence. Single-source rumors and unverifiable claims do not pass our editorial gate. When a story shows "Verified by N sources" with N≥2, the development is independently corroborated; when N=1, we mark it explicitly so readers can weigh the signal accordingly.
Impact scoring uses a 1-10 scale weighted toward regulatory, financial, and operational consequence rather than coverage volume. A topic that runs in every outlet but moves no real decisions ranks lower than a niche regulatory filing that reshapes how operators in the cybersecurity space have to behave. Read our full methodology for the scoring rubric, our glossary for term definitions, and our trends index for the longitudinal view across the beat.
Sources are only linked to a story once they clear our classification pipeline at a minimum 35 percent relevance threshold. According to that methodology, reviewed July 2026, this follows multi-source corroboration standards recommended by journalism research bodies such as the Reuters Institute for the Study of Journalism.
See something wrong in this story — a wrong fact, a broken source link, a misattributed entity? Report a data issue.
| Signal on this page | What it tells you |
|---|---|
| Verified by N sources | Independent corroboration count. N≥2 is our confidence floor; N=1 is marked explicitly. |
| Impact score (1-10) | Regulatory + financial + operational weight. 8+ signals an experienced-operator action item. |
| Sentiment | Five-tier classification trained on labeled cybersecurity-specific corpora. |
| Timeline | Where applicable, the related-events sequence that contextualizes today's development. |