Conference Transcript - RPD 2026-06-02

Jonathan Ho, Analyst — William Blair

Hello, everyone, and thank you for joining us for our Growth Stock Conference and today's session with Rapid7. My name is Jonathan Ho, and I'm the analyst covering Rapid7 for William Blair. Rapid7 has certainly gone through some significant leadership changes in the past 24 hours, so we're pleased to have with us the newly appointed CEO, Yael Mohamed, Executive Chairman Corey Thomas, and CFO Rafe Brown, who will provide an overview presentation for the company, followed by a fireside chat. Before we begin, I'm required to inform you that a complete list of research disclosures or conflicts of interest is available at our website at www.williamblair.com. As a quick reminder, the breakout session will be in the Burnham A. room following the presentation. With that, I'll hand it over to Weill, Corey, and Rafe.

Corey Thomas, Chairman

Thank you. Thank you so much, and thank you, Jonathan, and thank you all for joining us here today. You know, before we got started on the Q&A with both Jonathan and with you all, thought we'd just give you a little bit of overview of the business that we're in how we approach and what we do so we're in the security operations space and security operations it's primary focus of how do you actually make sure the organization does not have unnecessary exposures vulnerabilities and weakness that make them easily susceptible to attackers and if attackers do get in how do you find them shut them down and stop them as quickly as possible. This market has actually undergoing a lot of changes over the last five years and of itself. It used to be a market that was categorized by people using tools and managing, quite frankly, a small part of the environment. As cyber security got more serious, people started really advancing the tools and the technologies they were using, expanding their resources and investment, and frankly as they were trying to tackle the problems they actually started partnering with managed services providers MBR providers to manage their entire swath of their security operations and exposures. Rapid7 was a major player first in the tools market we led the transformation in the MBR shift where people actually partner with us to actively manage their environment and to take some of the risk management operations off their plate but even Even today, by and large, the pace of change is insurmountable. I'm sure we'll talk about AI and a bunch of stuff a little bit later on, but if you look at the biggest factors that has happened is that, one, people are adopting technology at an even faster rate. The rate of vulnerabilities and exposures from AI accelerated exploits and vulnerabilities is increasing at an incredibly fast rate. And the time that attackers are in environments, called the dwell time in the industry, it's just like how fast are people getting in and doing damage. is compressing and so the need to respond faster is a bigger deal than ever before. When you think about what that means for the overall cybersecurity industry, people have to cover more of their environment faster, cheaper, and more effectively. And so what we've actually are moving towards and what we're pioneering is the autonomous stock. And the core idea around the autonomous stock is that you use technology to provide scale and cost efficacy, but it's not just technology it's also the people and the tools that tailor the technology the tools the AI resources to a customer's environment so ensuring it matches their risk profile the skill and maturity of their cyber security operations and is tuned in a way that allows them to respond as quickly as possible this combination of AI technology and the people that tailor it to customers environments will be the model that people use to actually manage and scale their security operations cost effectively over time and we're pioneering that space if you look at the core of our business today our leading segment in our highest growth segment which is we're still unlocking the TAM around that is around the MDR and it's shift to a genetic MDR and the way to think about that is that we're applying a genetic technology so we recently made an acquisition called Kinto that allows us to actually process more data more scale for our customers and then allow them to actually monitor more of their environment scale we're going to do the same thing with risk and exposures we're going to do the same thing with compliance the same thing with third-party risk over time and then there's some interesting areas about how we enable people to respond that will be a long-term endure differentiator but that's

Jonathan Ho, Analyst — William Blair

the opening sort of like view and lens overall excellent excellent thank you for that and i mean i think we definitely have to kind of start with the elephant in the room so thank you for joining us a while and also Corey to come by and sort of give us an overview of what's what's been happening and changes within Rapid7 but maybe first can you help us understand the strategic rationale and the timing to make the change in leadership in Rapid7 right now yeah sure

Yael Mohamed, CEO

absolutely so I think no problem I did start yesterday but but actually the journey started a long time ago I joined the board a year ago where where Corey and I sat down and tried to to talk about how can we reimagine our company in this new era of AI. Our industry has been using machine learning and machines for many, many years. And we actually have done a very, very good job across many functions. But we're in a place where we're gonna have to reimagine how machines and humans are gonna be working together in a space where we were designed to protect against bad people. Now we need to be able to figure out bad people, bad states as well as bad machines at a scale that we have never experienced before so in in in this journey where when when korea and i sat down and we tried to basically say okay what do we need to do what core competency we need to be able to bring to the company and what type of skill set we need to be able to bring in and what gonna break like i believe the number one thing in our industry some of the definitions will actually be broken and it will be redefined We came in a world known and unknown, zero day. Like, how can you actually say zero day when we know that it's probably six months in the known world that has not really surfaced yet? Maybe the bad guys already know about it. And how you deal with a world where now you got the speed, the accuracy, the scale, not only on your offensive side, but actually on the defensive side. And how can you simulate that? taking all the tools that Corey's talking about it and know that now the bad guys already have the same tools and maybe even at a higher scale, they have access to resources more than you do. I have not met a customer in the last couple of years who did not tell me we wanna use AI very fast. Our problem is what are gonna break in the process and what can you do to making sure that we take a full advantage of it but we do not lose what we have built over the years there is a lot of institutional memory that we have built processes requirements reporting compliance many many intertwined things inside the organization so one of the things that Corey talked about the autonomous sock is designed from the ground up to be the operating layer that sits between both it will allow you to have your cake and eat it to it allow it to be able to use All these new models that we can actually work on a light speed, but without breaking all the processes that we have built over time. And although I started yesterday, I actually started a year ago working with Corey and the team, and we've been doing a lot of stuff in the background, preparing our organization to be ready for what's going to happen tomorrow, which is, I believe, is exciting and a little bit scary because there's a lot of unknown things we're going to have to be prepared for. And I think we're ready.

Corey Thomas, Chairman

Absolutely and you know as far as the timing goes is that you know while had been one of my counselors on the board who was thinking about not just what we wanted to build but how we operationalize it because it's clear that we're in a cusp moment of like we know the technology is possible we have a bunch of key releases they're coming out over the next nine months and so we really shifted the focus to think about like okay how do we make sure that the organization operates efficiently to execute against that and as that got closer and closer I found myself going the wild more and more for advice about like sort of like how to operationally make sure that we were ready to like go at the speed and pace and efficiency that we needed to go at and then it became natural at one time it's like hey you have a clear line of sight and how to think about that how about you come on board and do that full-time yeah as an

Jonathan Ho, Analyst — William Blair

ex-technology guy myself it's it's a lot more fun to be able to play with the product and you know a lot less to deal with Corey. We've known each other since you've started at the company. Exactly. I really enjoyed working with you as well and continue to look forward to those conversations. Yeah likewise. While we're not going to put you on the spot just given you've been here for 24 hours in terms of the strategic vision, we'll give you a few days to figure that out. We'll kind of go on to the bigger picture and hopefully you know we'll be able to to make some great memories as well as Rapid7 evolves in its story. Thank you, Jonathan. One thing I wanted to maybe understand a little bit more about is the other elephant in the room is Mythos. And there's been broad discussion about how this is impacting both your customers as well as Rapid7. Can you talk about what customers are coming to you to solve when it comes to Mythos for Rapid7?

Yael Mohamed, CEO

You can do one too here. I can start. like for me Memphis is a great prototype to show us what's possible and I think they've done a fantastic job but I think it's just scratching the surface I think there is way more we can be able to do all those type of models and that's the of approach I think what really proven to the customer side that there is a lot can be accomplished at an incredible speed and there's some part what they industry used to do is going to become a commodity. It's going to be faster at a scale, at a high level of accuracy. We always suffered in an industry where how we're going to strike the balance between false positive and false negative, and how we're not going to overwhelm our operations, and how we can be able to set the right priorities. And mythos basically showed that, you know what, we already know that in every thousand line of code there is a bug. We knew that, we knew that for 30 years. and we're hopeful that they are not gonna be exposed and when they are actually discovered that it's not exploitable. But Mytho's basically proven that you can accelerate and short circuit that cycle extremely fast. But there's all kind of other things we can be able to add to the table, is the remediation side, or we call it internally the reasoning side. That's where now the expert in the machine can do some really, really cool things. And that's what we're excited about. We're excited that that same technology that's gonna put tremendous pressure in our industry in the short term, it will become an enabler to allow us to do things we could not do in the past.

Corey Thomas, Chairman

Yeah, and the thing I would add to that is that one, it has reinvigorated customers' interest in understanding how to manage their exposure in the environment. So that's very clear. And so as part of that, one, they wanna know what it is. And for reference, I think Anthropoc has expanded their coverage. We have access to it, both that, the OpenAI. But they want to understand it first. The second thing is that for those that understand it, they have a couple takeaways. One, they're finding a significant higher level of vulnerabilities in the environment. And so it's how do you actually help me deal and manage this increased risk exposure surface. And luckily our big focus on exposure management on one, understanding and exploitability to orchestrating for remediation has been warmly received. So we view this as a net positive for our exposure management business, which needs to re-accelerate. The last thing is, while I hit it, is that people know that the operational window to respond is shrinking. And so they're looking for a partner to actually help them navigate that, and that's something that we're heavily invested in.

Jonathan Ho, Analyst — William Blair

That makes a ton of sense, and I think there's a lot of consternation out there from customers as these model gains and capabilities start to materialize. I mean, one thing I wanted to understand is how quickly can those conversations maybe turn into revenue opportunities, and has it changed the narrative around prioritization of some of the traditional exposure management out there?

Corey Thomas, Chairman

It has changed the, so one, it went from a back burner conversation to a conversation where every CISO is actively engaged in it, and so, and frankly, boards are reinvigorated. It was dwindling in focus, to be clear, where you had AI security. The core agentic stock has always been on the list. It is now back on the agenda. The question is, how fast does that turn to ARR and purchases? Look, we're a couple months in, and so it's too early to actually comment on that. But if you look at the customer interest in starting to plan for, organize, and look at how they're going to and actually manage this larger backlog and volume of issues. Right now, my expectation is that that will translate into real market opportunity. The timing and whether these are like shorter sales like the other thing else, it's just too early to actually call the ball on that.

Jonathan Ho, Analyst — William Blair

Makes sense, makes sense. I mean, it takes a while for these budgets to formulate for people to understand what the actions they wanna take, but it's certainly, we're seeing that pressure start to build as mythos shortens the timeframe for people to have to react. I think-

Corey Thomas, Chairman

just very few people have access to it today too. So think about how, so it'll be interesting because right now, again, it's been tightly distributed. And so, and by the way, it's not the only one, like we're talking about mid-days, but like it's actually, I think you're at three or four now that are approaching the capabilities, may not be at the same capabilities, but they're approaching it.

Jonathan Ho, Analyst — William Blair

Yeah, with MOE, they all sort of converge. With the Blackwell-trained models. And we have Vera Rubin following that. So we're not done here. And it will be a brave new world once those models become available to the threat actors. You've talked about some declines in the business stabilizing, and one thing I wanted you to understand a little bit better is maybe what gives you the confidence, Rafe, in terms of seeing that stabilize, and maybe that the worst is over now.

Rafe Brown, CFO

Sure, and one of the things we did this last quarter is provide a little bit more clarity into the business. And for what we really tried to take everyone through is to help people see how you know the performance of our core our platform offerings versus some non-core which are non-platform novice standalone offerings that are you know because there's very different stories and frankly what you're hearing from YL and Corey is all about how where we're investing and that's in our core offerings our core offerings our DNR solution our exposure management solutions and that constitutes over 80 percent of our business you know DNR we've seen it continue to grow if we called out on the last quarter was growing at seven percent overall the exposure management business is offsetting some of that growth so when you netted them down we were at about two percent growth but we've seen you know rather steady performance there and then you hear for what we're doing up here we've got you know between increased customer interest a lot of investment going on the product side and driving that business really helps people see you know where we want to take the business where we want to focus that business and it also reflects our focus internally you know when people come and ask for funds or dollars or what have you if it's on core we have a conversation right and just really helps drive that and i think it's that clarity that has helped us share with the broader investment community about how to think about our business um and then also it helps you know we reiterated our guidance yesterday as well right so you know we're just demonstrating we are really digging in to make sure we have the clarity, the run rate, if you will, to make sure we can see where we are in the quarter, where we are in the year, and be able to share that with people. And so I think that's really what stands behind it. And if anything, with the changes that are going on at the CEO level, we're looking at how we accelerate ourselves on this journey. And that's the big focus here. The one other thing I would add is, I just had my six month anniversary with the company, which means between the three of us, I'm the longest one in position.

Jonathan Ho, Analyst — William Blair

Wow, that's a great, that's a great point. And there's been other changes within the C-level positions as well. Yes, absolutely. So I think Rapid7 is definitely entering sort of the new era in terms of that opportunity set and certainly something to get excited about. I mean, one thing that, just maybe continuing on this theme of reacceleration is that we've been observing that with this heightened concern one of the traditional narratives around vulnerability management is that you can use substitute products. Like you can use things from the hyperscalers or you can use things as part of a platform. Do you see kind of a switch back to tier one scanning or switch back to vendors that have remained focused on exposure and risk management as opposed to those that maybe are just bolting it onto their platforms?

Yael Mohamed, CEO

Sure, you know what, in our industry as you know, We always move from best of breed to sweet and basically back and forth. It depends on the priorities, how the industries basically look at the market need, the customer demand, and so forth. And one of the major transformations that we're going through, we were basically built to be a platform company that we provided multiple products in a way that it was very scalable and and it basically custom catered to our customer sites and we've done an incredible job you know i mean we were we're above 800 million dollars a year doing that incredible stuff but a couple of years ago it was very clear that the market is shifting and now there is a real need for best of breed again and every few years if you've been in the industry as long as i have been we've been every five years we've flipped flow based on on the demand and the new threats and some of the new changes and we are entering an era where customers now going to be very demanding for certain solutions that has to be able to do certain things at the best possible way and an ai is actually stressing that and as i said uh it's allowing everybody to reimagine it so one of the things we're doing internally we're moving from a basically a sweet solution that we did a lot of things good to do a couple of things great and the best possible way and making sure that the two things that we're gonna be doing exactly what the market need and where we can actually become a category leaders in them and that's really the changes that we've been doing not in the last 24 hours we've been doing the last two years and as you can imagine there is a lot of things underneath in the processes the thinking the DNA of the company needed to change to allow that to happen we also believe that was was all the the new models will accelerate that the before all customers at the board level knew there was there was an issue and for them they got to the point it was about risk mitigation okay so okay now how can I deal with every single day I wake up and I know gonna be a bad news right now the asking actually their security team to say how many vulnerabilities do we have where it's almost there is a license where we before the basic is a CIS who comes in to say why they are secure now is he coming back and saying can you tell me how big is a problem right because you can hear in the news ten thousand vulnerability X number of this and so forth and that's almost a license to be able to say okay since we know now what are we doing about it and and I believe there is huge room for best of breed that can be able to partner with with some of the customers on some of those jobs and we believe we're an incredible position to actually provide those

Jonathan Ho, Analyst — William Blair

jobs very very very well excellent excellent so maybe speaking of some of the areas where you can create this differentiated solution i think corey in the summer you referenced your mdr solutions you know it seems like this is an exciting space particularly with agentic sock becoming more and more of a discussion point. Help us understand, how is Rapid7 well positioned for this? What is sort of the role of AI versus the role of Rapid7 within the agentic SOC?

Corey Thomas, Chairman

Yeah, so if you look at, so if you just break down what the agentic SOC is and the evolution of it, it's the idea that technology can actually process most of customers' security-related data and alerts to figure out where bad things are happening. It's at the most basic, simple level overall. and so on one hand you can actually think about that okay like that's an AI winner it could be commoditized anyone can actually do that but then you have to zoom into actually what's happening in a customer's environment for that to be true and there's a couple different things is one you actually have to not just process the alerts you have to understand the context that the data is actually happening most of these things are just geared towards and most competitors are just geared towards processing alerts one of these that we recognized early is that environmental context matters and so you have to understand what's the technology about. Every single customer has a bunch of new and advanced technology and a bunch of old and legacy technology and a bunch of stuff somewhere in between. Some of it's very well maintained, some of it's very poorly maintained. If you don't understand the state of the environment, you actually cannot really process and understand threats, risk, and understand what behavior is bad and good. And so one of the biggest investments we've made over the last two years is collecting deep data about our customers' technology environment that we can then use to actually process and understand two things now part of understand people like why do you have to understand the environment to actually make the decision well the environment matters overall like you know think about if you're trying to price insurance um how do you want to price hurricanes if you're in florida versus california same with earthquakes responses if you don't know the environment that you're actually in you cannot make the right decisions so we've been invested in understanding the environment or our customers that are in overall, that provides two advantages. One, the efficacy of our ability, now that we've acquired one of these models to do it, is we have much richer context. So their team's already looking at, they were a standalone, market-leading AI stock company with great core technology, leveraging AI models to actually do detection. And what they found is leveraging our full contextual data is that their accuracy and efficacy rates have skyrocketed. And so context matters as a differentiator. But the most important thing is the entire industry was built on a premise that it's all about detection. In the AI world, where you have attacks happen fast, it's all about the speed and accuracy of the response. In order to understand response, again, you have to understand what is available in the environment to respond. And so we understand both the environment, the controls that are available. And so our whole goal is how do we actually enable people to actually have a 15-minute time to adoption, time to response, time to containment. We're not there yet. but we have the data and the context to enable that. Those two things are massive differentiated, both the context and the ability to respond with that context are different than most of the standards in the market today. Wow, you look at this stuff all the time.

Yael Mohamed, CEO

No, no, absolutely. And look, when we talk to customers, the old model was not sustainable. I mean, I was talking to some CISOs who were basically saying like every single day is like really, really, they don't know what they're going to be dealing with. Now with all the AGI models that allow you to be able to do things way faster and can be able to know what's going on on the detection side. But as Corey said, now since you manage to save a lot of time and reclaim a lot of these resources on that side, what can you do about it? And basically how you can maximize all the control that you have or all the mechanism. me and that's the area we're focusing on the R side, the reasoning side. And I think that's the exciting part where the real experts and the machines working together to do things we could not do before. Then we can finally feel that we're ahead. And I believe in our industry, we're very lucky that the use case of cybersecurity is very prime to those models and it's proven that we can do the jobs extremely well but I think now we can reclaim some of those resources and that time to be able to actually get ahead in this arm's place because we were not winning although we're doing a lot but we're still not winning because one attack bypass is just one attack enough to completely make a big damage and we were stopping millions but it's not good enough and now we're finally feel we can win this and we're excited about what's

Jonathan Ho, Analyst — William Blair

possible. Excellent it makes a ton of sense that you'll be able to bring AI to your customers and it you know you're using the right tool for the right job ultimately. You know I wanted to maybe understand a little bit better now that we've covered the product and product strategy side like how do you think about the sales execution piece like this has been a little bit of a bumpy we ride over the past few years. It seems like Rapid7's moving in the right direction here. So help us understand what's the opportunity set, what's left to be done, how do you think the sales side is going?

Yael Mohamed, CEO

I can jump in since I'm now responsible for the numbers since yesterday. Corey and I and the board, we've been actually working extremely hard to making sure that we have the right leadership at all the right critical positions for what we need to be able to do ahead. and one of the jobs were the head of go-to-market and we're very lucky that we attracted some really really serious leadership we've been working extremely hard in the last four months or so you know I mean and right now we were fully loaded with was basically what we need to be able to execute forward the coverage the skill set the enablement the training the the internal processes that we had great processes before we just needed to modernize it for the the speed and the scale that we needed to build. And we, I think we're in a position way better than we've ever been. I'm very confident in our leadership, as well as basically the team that Alan have put in place. And I'm excited to work with him and his team in the next period to do great things.

Jonathan Ho, Analyst — William Blair

Excellent, excellent. And just from a financial perspective, how do we think about the margin opportunity longer term? You know, what maybe has to happen and for that operating leverage to show through the model? And is this just the function of seeing more productivity, the funnel that you're seeing convert? And just help us understand how do we get to that leverage?

Rafe Brown, CFO

Yeah, absolutely. And we've touched on a lot of it. Building the AI-driven SOC is gonna be a big part of that story and building automation into what we do every day is very much part of the strategy over time. You know, we've talked about, you know, we're very focused on our core platforms, products growing, But we're also talking routinely about balanced growth, meaning not only are we growing the top line, but we're committed to growing the bottom line. And so throughout the organization, with changes like new leadership coming in and sales, the ultimate measure is productivity. And we called out in Q1 that we're happy to see a nice uptick year over year in productivity per rep. That's just, if you will, a down payment on the promises we have to deliver over time. but you know again it's drive growth and drive productivity throughout the organization you know throughout 2025 we saw a number of areas where we were making investments largely in the product and and the customer experience as we've seen some of that come to bear you know it's it's producing those productivity gains that we have baked into our guidance that you know our guidance implies our margins improve throughout the year and then we're really very focused on is making making sure we're working on the organization this year to drive next year's margins. We're constantly rolling that out to give us room to invest in our products and our customers, but also to make sure we're building margins over time.

Jonathan Ho, Analyst — William Blair

Excellent, excellent. Unfortunately, this brings us to the end of our time, and so please join us with the continuation of the conversation upstairs.

Yael Mohamed, CEO

Thank you.