Rapid7 (NASDAQ:RPD) reported second-quarter fiscal 2026 results that exceeded its guided metrics, while outlining a restructuring and strategic reset centered on Detection and Response, Exposure Management and artificial intelligence-driven platform capabilities.
The cybersecurity company ended the quarter with $824 million in annual recurring revenue, non-GAAP operating income of $28.9 million and free cash flow of $31.9 million. Revenue totaled $210.9 million, down about 1.5% from a year earlier, while non-GAAP diluted earnings per share were $0.44.
Core platform growth offsets by non-core declines
Chief Financial Officer Rafe Brown said Rapid7’s core platform solutions, consisting of Detection and Response and Exposure Management, represented more than 80% of total ARR and grew about 1% year over year. Detection and Response, which includes managed detection and response services and represented roughly 55% of ARR, increased approximately 5% from the prior-year period.
However, overall Exposure Management results offset some of the Detection and Response growth, according to Brown. He said the company continued to see adoption of its Exposure Command offering from both new customers and customers upgrading from older vulnerability management products.
Non-core products, which represent less than 20% of ARR, declined during the quarter and drove the sequential decline in total ARR. Brown said the company sees opportunities to improve margins on standalone non-core offerings and migrate customers toward core platform solutions.
Rapid7 finished the quarter with more than 11,500 customers and average ARR per customer of about $70,000. Non-GAAP gross margin was 71.7%, down about 215 basis points year over year, reflecting higher staffing at global security operations centers and increased cloud usage tied to product improvements.
Restructuring targets efficiency and AI investment
The company announced a restructuring that will affect approximately 12% of its workforce. Brown said Rapid7 first sought to eliminate non-headcount spending before making workforce reductions.
The restructuring is intended to align costs and investment with the core platform while creating capacity for additional investment in AI-driven products and product engineering. Rapid7 expects to incur restructuring charges of approximately $10 million to $11 million, with most payments occurring in the third and fourth quarters of 2026.
Mohamed said the company plans to reinvest a meaningful portion of the savings into its core platform, personnel building that platform and an AI foundation designed to connect Exposure Management and Detection and Response. He said the company will continue supporting customers that use other products, but it will de-emphasize categories where it does not intend to compete against specialized providers.
“We are not shrinking our way to the future,” Mohamed said. “We are reshaping the company so we can invest more behind the parts of the business that will define it.”
Rapid7 acquired Kenzo as part of its AI strategy, which Mohamed said is intended to connect data, AI agents and human decision-making across customers’ existing tools. The company aims to use AI and automation to help customers move from identifying security exposures and alerts to addressing and resolving them.
Mohamed said customers are increasingly seeking platforms and service providers that can help identify vulnerabilities, determine whether they are exploitable and assist with remediation. He said pricing was not typically the deciding factor in Detection and Response customer discussions, with customers more focused on service levels, AI capabilities and vendor references.
Margin targets and outlook
Rapid7 expects the restructuring and other efficiency actions to produce a non-GAAP operating margin of about 20% in the fourth quarter of 2026, compared with 13.7% in the second quarter. Brown said the company expects limited restructuring-related savings in the third quarter because the action is occurring during the period, with a more complete benefit expected in the fourth quarter.
Despite severance costs and planned product investments, the company maintained its full-year free cash flow outlook of approximately $130 million. Rapid7 ended the quarter with $702.6 million in cash equivalents and short-term investments, along with an undrawn $200 million credit facility. Brown said those resources and ongoing free cash flow generation position the company to repay its $600 million of convertible notes due in March 2027.
- Third-quarter ARR is expected to be approximately $812 million.
- Third-quarter revenue is projected at $208 million to $210 million.
- Third-quarter non-GAAP operating income is projected at $34 million to $36 million, implying a 16.7% margin at the midpoint.
- Full-year revenue is forecast at $837 million to $841 million, down about 2% year over year at the midpoint.
- Full-year non-GAAP operating income guidance was raised to $129 million to $133 million, or a 15.6% margin at the midpoint.
Mohamed said investors should evaluate the transformation over several quarters, focusing on cash generation, stabilization and improvement in the core business, performance in Exposure Management and how the company reinvests in product, engineering and AI capabilities.
About Rapid7 (NASDAQ:RPD)
Rapid7, Inc is a publicly traded cybersecurity company headquartered in Boston, Massachusetts. Since its founding in 2000, the company has specialized in delivering cloud-based security data and analytics solutions designed to help organizations detect, investigate, and remediate cyber threats. Rapid7 operates under the NASDAQ symbol “RPD” and serves a broad range of industries, including technology, financial services, healthcare, retail, and the public sector.
The core of Rapid7’s offering is its Insight platform, a unified, cloud-native security operations and analytics suite.
