What Rapid7 (RPD) Said on Its Q3 Earnings Call

Key Points

• Rapid7 ended Q3 with $820 million in ARR, $8 million above guidance but down about 2% year over year; revenue fell 3% to $212.4 million. Management called flat sequential core ARR an early sign of stability, not a return to growth.
• Core ARR grew about 1% year over year, led by 5% growth in detection and response, while exposure management declined 6% and non-core offerings fell 19%. Rapid7 expects ARR to slip to about $812 million in Q4, primarily because of continued non-core declines.
• The company reaffirmed its full-year free cash flow outlook of approximately $130 million and plans to use cash on hand to retire $600 million of convertible notes due in March 2027. It is also investing in an AI-first service model, with an initial Autonomous SOC release targeted around RSAC 2027.

Rapid7 NASDAQ: RPD reported third-quarter annual recurring revenue above its guidance and reaffirmed its full-year cash flow outlook, but executives cautioned that stability in its core cybersecurity business has not yet translated into sustained growth.

The company ended the quarter with $820 million in annual recurring revenue, or ARR, $8 million above its guidance but down approximately 2% from a year earlier. Revenue fell approximately 3% to $212.4 million.

CEO Wael Mohamed said core ARR was flat from the second quarter, calling it an early sign of stability. “One quarter of execution is not a return to growth,” he said.

Core business stabilizes as non-core offerings decline

Rapid7 is concentrating investment on detection and response and exposure management, which together represented approximately 85% of total ARR at quarter-end. Core ARR grew approximately 1% year over year, Chief Financial Officer Rafe Brown said.

Detection and response, which accounts for more than 55% of total ARR and includes managed detection and response, grew approximately 5% year over year. Exposure management declined approximately 6%, though Brown said customers continued to adopt Exposure Command as they upgraded from older vulnerability management products.

Non-core products, representing approximately 15% of ARR, declined approximately 19% year over year. Rapid7 has reduced its sales emphasis on those offerings and is evaluating their long-term future, including opportunities to move customers to core products.

Brown said third-quarter ARR benefited from better-than-expected new bookings and outcomes at some accounts considered at risk. He said the company has increased engagement with larger customers ahead of their renewals.

Rapid7 forecasts further ARR decline

For the fourth quarter, Rapid7 expects ARR of approximately $812 million, down from $820 million at the end of September. Management expects core ARR to remain approximately flat sequentially, with non-core offerings accounting for the decline.

Brown said the non-core drag is expected to continue in the near future. He declined to provide 2027 guidance, saying the company would address it on its next earnings call.

The company’s outlook includes:

• Fourth-quarter revenue of $208 million to $210 million and full-year revenue of $841 million to $843 million.
• Fourth-quarter non-GAAP operating income of $40 million to $42 million and full-year non-GAAP operating income of $140 million to $142 million.
• Fourth-quarter non-GAAP earnings of $0.53 to $0.55 per diluted share.
• Approximately $130 million in full-year free cash flow, unchanged from its prior outlook.

Rapid7 reported third-quarter non-GAAP operating income of $46.2 million, a margin of 21.7%, and non-GAAP earnings of $0.60 per diluted share. Free cash flow was $26.5 million. Brown said the quarter’s 72.2% non-GAAP gross margin is expected to moderate in the fourth quarter and beyond as AWS and AI-related charges increase.

AI service investment and product changes

Mohamed said Rapid7 is building an AI-first service model that combines software, agents, intelligence and security experts. The company is working toward an initial generally available release of its Autonomous SOC around RSAC 2027, he said, describing it as a first production step rather than a finished product.

A growing number of customers are using early capabilities powered by Kenzo, Mohamed said. Brown said most of the company’s new investment is in product and engineering, including staff, technology and AI computing.

Rapid7 also announced an end of sale for selected standalone products. Brown clarified that this is not an end of life: cloud and application security capabilities remain available within Exposure Command, while existing digital risk protection customers can continue to renew and expand their usage. The end-of-sale changes will take a few months to become official, he said.

Cash and restructuring

Rapid7 ended the quarter with $732 million in cash, equivalents and short-term investments. Mohamed said the company intends to use cash on hand to retire its $600 million convertible notes due in March 2027. Brown also cited a $200 million undrawn credit facility.

The company continues to expect approximately $11 million in charges from the restructuring announced in August. It also continues to evaluate further efficiencies, Brown said.

About Rapid7 (NASDAQ:RPD)

Rapid7, Inc NASDAQ: RPD is a cybersecurity company that provides technology and services to help organizations identify, assess and manage security risk across their IT environments. Its offerings are designed to support security operations, vulnerability management, cloud security, application security and incident response.

The company's product portfolio includes the Insight platform and solutions such as InsightVM for vulnerability risk management, InsightIDR for security detection and response, InsightCloudSec for cloud security and compliance, and InsightAppSec for application security testing.

This instant news alert was generated by narrative science technology and financial data from MarketBeat in order to provide readers with the fastest reporting and unbiased coverage. Please send any questions or comments about this story to contact@marketbeat.com.