Rapid7, Inc. (RPD) September 16, 2026 Conference Transcript

Well, good morning, everyone. I am Rob Owens. I head up the technology research group at PIPER and cover cybersecurity and infrastructure software. Very pleased to, after all these years, see Rafe again, but to be having a discussion with Rafe Brown, current CFO of Rapid7. Nice to see you. Welcome. Good seeing you, and thank you all. Yeah. So at a high level, a lot of changes at Rapid7 with senior management. So maybe just kind of take us through some of the different logistics, a lot of the changes, and then what coaxed you to come to the company?

Yeah, and so I joined the company in December of last year, so I'm now up over the nine-month hurdle. But, you know, essentially out of the top management layer, there's been almost complete turnover just in the last few months. You know, whether it was Alan Peters joining in October of last year, we had on June 1st, we got a new CEO and a new chief technology and product officer. Right. So, you know, quite literally out of the top five executives on the team, our longest tenured person is right now the head of HR who's been there a year and a half. So, you know, it really speaks to a lot of change. I really believe it speaks to the commitment of the organization to really transform the next leg of the journey. And I think that's a big piece of it. Corey Thomas, who's been the CEO for a number of years, is our executive chairman. So we do have that continuity element, you know, as Corey still is active in the organization and part of it. But, you know, obviously with that many new executives and the path on our way, there's a lot of change going on.

So you're no stranger to the Boston area. You're no stranger to being a public company CFO. What compelled you most to come over?

You know, part of it is really that. It's the, you know, Rapid7, great history, had a very high stock price for a long time. And that was dislocated over the last few years. And so, you know, I looked at it as this opportunity to come into an organization where big change was needed, but an organization that was determined to make the big changes to go on that next leg of the journey. And I think that's what's really exciting for us. There's certainly stages of any kind of redirection like that, but there were some of them that were just glaringly obvious. And I came in for Corey, and Corey hired me, and he laid out a path that was determined to make some of those big changes, whether it was changes we need to do on the product side and the technology side, changes we need to do to the expense structure. and you know and and already he had hired a new leader on the go-to-market side who is you know at the time I was interviewing was just a couple months into this job role but who was already very actively engaged and could lay out a real strong path of how we could sharpen our go-to market while we're still building out some of these other legs of the stool so I just like the fact that the company you know it had its history it has you know over 800 million dollars of ARR It has all those kind of advantages, but yet was, you know, looking very clearly at the challenge ahead and willing to make the tough choices to get that done.

So company at reasonable scale. I mean, we haven't had, ironically, we haven't had that many companies in cyber achieve a billion dollars a year in ARR, number one. But you mentioned big changes, big changes go to market, big changes from a product standpoint. There are a lot of change at a very interesting time in cyber. So let's focus on that change and maybe what was required most, in your opinion.

Yeah, so, you know, and I'm sure we'll get into more of this. If you think about our business, we've really started talking about it with investors as our core business versus some non-core elements of it. So just zeroing in on the core, which is over 80% of our business, our core business consists of our DNR business, detection and response business, and our exposure management business. OK, the changes that are needed fundamentally are, you know, have been making sure we're investing in those solutions and having that focus. And I think that's one of the things we've really worked hard on, making sure we're clear who we want to be as an organization, where those investment dollars are going. And when I say that, I really mean going into the product. You know, we're big believers that technology is going to drive the difference in our outcomes down the road. But what that took was having that discussion that ultimately manifested ourselves just two quarters away of starting to communicate around what core growth, what our core is doing. So there's, you know, there's very big and exciting changes, you know, on into our core products and making sure that we're building world-class products that can really differentiate. What I think has been very exciting is over these, you know, nine months, a lot's happened in the cyber world with the frontier models and their work they're doing. we actually think it's going to be a benefit for our core solutions you know and if you think about it there's you know this is a finance guy describing this so it's probably too simplistically but like the exposure management is dealing with all the exposures in a business finding all the things that need to be upgraded and patched well we all know that the frontier models are now coming in and finding more vulnerabilities in you you know than ever before like that part of the business of people going out and hunting vulnerabilities, you know, of the industry, I mean, that's just on fire, right? Like, I was reading something, Microsoft just came out with a new list of patches, and there was over 900 of them, it's just extraordinary. Well, our customers have to go figure out which of those 900 apply, you know, that's like multitudes more than they've had to deal with, so the exposure management business is on fire, at the same time as the bad actors now have these lists to exploit and the tools and you need the detection response so we're sitting here at the midst of knowing that exposure management and dnr are good businesses by themselves but looking at a world where they become you know that end-to-end coverage the end-to-end ability to help our customers from taking an exposure to dealing with the attacks that time space is disappearing and that needs disappearing which puts us in this great position of being one of the few vendors that has both sides of the formula, needing to make technology advancements on our own. But I think that's a great opportunity. And I think that's what's exciting about what we are, but it's also the work that we need to do to take advantage of that.

Jared, I want to build on something you said relative to end-to-end, because Rapid7 started as a mid-market velocity play inside sales that then Corey built out once he took the helm. And it was always a company that sold into, call it kind of resource-starved types of companies that might have a few IT guys, not huge budgets. And so that concept of managed services always kind of came up and went away and came up and went away. We're now at a point, I think, just from a technology curve standpoint, where that mid-market customer in low-end enterprise, however you want to characterize it, but probably needs more help than ever in terms of time of exposure and understanding to response and actually patching or reconfiguring or however we're thinking about it from the other end. So how much is the managed services proposition really coming into play here? And I always felt like before, Rapid7 didn't embrace it as much as it needed to. And now it feels like given where we're at in this point in history, it needs to be more important than ever.

Yeah, I think that's exactly right. And one of the tensions for a room like this is we know our customers need service, but we need to deliver that with a software-like margin. And that's one of the mantras we have internally always is we have to figure out how to do that. At the end of the day, when an organization is under attack, they need security expertise. And a lot of times that needs to come in the form of a human who's experienced and knows how to manage them through that. What we need to be able to do, though, is also provide that at a good margin, is the finance side of it. But you also think about it as this world has changed, the number of alerts is just skyrocketing. The infrastructure, you know, if you're a commercial company or you're a manufacturing organization that's quite large, which, you know, these are examples of organizations where we do really well from a sales perspective. You have world-class enterprise needs. You can't have your business shut down any more than anybody else, but that's not your expertise. that's where you get with a company like us what we're doing and you know one of the first very visible steps of it is we acquired a company called Kenzo that you know overly simplifying again you know helps gather alerts from a much broader set of equipment and allows you to quickly be able to bring those alerts into your sock but the more alerts you bring in the more alerts you have to monitor humans just can't keep up with that scale so we're building that technology to you know if you will find all the different alerts sort out very quickly which alerts go together one attack can set off alerts all over you need that centralized allocated down and so then you can provide that package to the humans that get involved and ultimately we're building that technology that has this broader data view across the organization and the exposures that will helpfully let the machine revolutionize the hard work it is to make sense out of the noise but yet the humans jump in where it's really needed where somebody's under attack and that's to your point exactly you need that combination you need a service that service has to be empowered by ai and technology but it has to be always set up so that there can be a human that comes in as well so right now in our cost structure and we've talked about this on the call you know we have a large we have large socks that run out there we made an investment of adding people to it over this last year to make sure that we're providing that service but we're very well aware that you can't keep adding people to that problem it's got to be technology with true expertise where would you say you are then on that technology journey to be able to deliver that to end customers and what are they asking for that rapid seven might not have so right now you know we're relatively early stages we did the kinzo acquisition earlier this year. So right now in our product stack, we have the two separate product stacks, if you will, the exposure management and the DNR. The Kinzo solution came in earlier this year. A lot of work's going on there. Dan, who's our new chief technology and product officer, investing heavily, really bringing those platforms together, driving that next generation products that will hopefully start to see some releases over the course of 2027. That'll be exciting. So as we know, software development it's a continuum as you're on the journey we're relatively early in that journey but i think we're making really great strides and we've you know if i looked at our organization in nine months the amount of focus the sharpness whether it's on the product side whether it's on the customer success side it's a lot i mean it's just nine day crispness and that execution which is you know corey's strategy and now yl's strategy our new ceo that's very exciting you You know, the reality is, is all great things take time to come. The bad things seem to show up right away in life. But, you know, we're on that continuum. And I think we're going to start to see, you know, release after release over the next, you know, few quarters. That is going to be quite exciting.

Yeah, that's great. Okay, so new CFO walking in the door nine months in, third restructuring, I think, in three years. So not only from a disruptive element, but as you came in, what needed to be changed from your perspective? Where was the low-hanging fruit, and how does this position RAPID 7 to grow from here?

So I think one of the first things, the first priorities I had that came up in every interview with everyone across the board is we had to get much more control about our ability to guide publicly, but to guide internally as well, to really double down on how we're laying out our projections and our modeling for the organization. So we took that very seriously, and we continue to. you know and I think we've made good progress there I certainly don't want to jinx myself but you know but again you know that's that readiness of an organization who had frankly had some challenges on that front in the quarters leading up to it you know I had to make sure the organization was ready to deal with you know the analysis the reality the giving good guidance the whole shebang and what that means and so we took that on priority one I think the next version of that is making sure we're able to you know do that deeper level dive you know really zeroing in on how the different products are performing contributions by a product really getting that granular look that is all part of this broader situation as we're going forward of the prioritization to be able to make sure we know how to prioritize on what products on what go-to-market strategies and how to bring that together I think that has been a real tremendous piece And then lastly, and this speaks to, you know, when you go into an organization that's had restructurings in the past and then a lot of those costs came back. There was a restructuring in 23. You know, just look at the financials. All those costs came back. So we have to look at it. Well, why was that? What didn't we do or what should we have done or how do we do it different this time? And I think that's the exercise that we spent a lot of time on of making sure that, yes, we need to do a restructuring. We've got to watch the bottom line. But we also have to fund growth. You know, I often say the rule of 40, simple math, but we all know you get a lot more credit at the top line than the bottom. Well, we have to do both. We have to be a balanced grower, and that's that determination of showing the value on the bottom side while re-accelerating the top. So we've been able to dive in there, have those tough conversations, but also really flex up on, you know, for example, it's not as simple as taking costs out of a SOC. You still have to provide great service to your customers or you're going to get in trouble. So what are we going to do different on the technology side? What are we going to do in our customer success organization to make sure we're maximizing the dollars and ultimately taking great care of our customers regardless of the cost structure? And then take care of your customers and then make sure you're meeting your margin goals.

So you mentioned a couple times the managed service elements, and historically you've had big margin differentials. between a managed service business and a traditional product company. SaaS kind of put us somewhere in the middle, to be honest, from a gross margin perspective. Given we don't really have good examples anymore of companies in the managed service area, how should investors perceive the impact of your model longer term? And where you find efficiencies? You mentioned some of them around the SOC.

Yeah, 100%. The good news is part of our business is just pure software, so software like margins is really easy when you're selling software, and that's a lot of fun. You know, the work we must do is make sure we're taking care of our customers and we're building the technology in to be able to maximize our cost differences, right? So that work of having a layer in our own socks that helps deal with an explosion of alerts coming in, but you'll be able to rationalize those down, making sure they can be taken care of, you know eventually end to end by ai for the the lower risk ones you know think of that as and and this is path this is not where we are but think about it is you know the technology should be able to find an attack they decide that a particular server or particular server port or in the fire or a port on the firewall needs to be shut down it could shut that down while remediation takes place right that's that kind of stuff right now that's humans doing all of that So that's just one example, but there has to be an incredible technology layer that sets up the humans to focus on where only humans can play. If you don't do that, you do have this problem of you've just thrown a bunch of humans at it and there's just no other way to get there. That is going to break a lot of traditional outsourced SOC players. There's just no way to provide the protection our customers need and deserve in a world with the threats, you know, landscape changing so much unless you have that great technology layer. So that's, I think, ultimately, for us and companies like us that have the resources to invest in it, that's going to be an opportunity to consolidate what's, you know, you get past the big players in MD&R very quickly and you get into this long list. I think that's going to be a real challenge for some companies, but where we're well positioned to differentiate.

And you touched earlier on core versus non-core. Maybe you can drill down into the two, what's happening with the non-core component. Because if we look at your ARR, it's flat to down at this point. So obviously, we've got some mixed stuff happening in there.

Yeah, that's exactly right. So again, core, over 80% of our business, and then we have non-core. Now, to be 100% clear, non-core is not just one thing. There's a number of different product solutions in there. The number one question we get in one-on-ones is, well, why don't you get rid of it really quickly? Like, as a finance guy, you're thinking, great idea. We all get to that. Never listen to the finance guys. Yeah, well, the whole company knows that at our organization. But the reality is, now that we've gotten this crisp focus on what we are going to be in the future on our core solutions, now we can look at our non-core. And what we're having to do is go product by product and look at, first of all, the reality of a lot of our customers have a core solution and maybe have a non-core standalone solution. You have to deal with that, right? It takes time to make sure you're going to give your customers the experience they deserve. We're having to go product by product and lay out our strategy. And is it, do we quit, you know, do we deprioritize selling it? Do you end-of-life a product, do you sell the product, or do you realize that what you really need is to take that functionality, build it into the next generation of core, and create an upgrade path? So it is more complicated than one. It's complicated enough, this problem's not gonna go away in the next 90 days by any stretch of the imagination. It means we have to lay this out, we have to communicate clearly to investors, watch core and see how core develops over the next few quarters, and likewise make sure we're drilling in and you know once something's in non-core we owe an affirmative answer to ourselves and to the rest of our investors about what we're doing there and and i think you know one of the things is is core is growing and non-core shrinking so that's going to naturally help the overall financials but we're going to have to make some tough decisions and tough investments on how we bring some of those customers over into the into core applications There is a good opportunity for that, but it's not an easy opportunity, or else they would have already upgraded, right? But there are many cases where there's functionality that augments our experience on the core side that is in some of these standalone solutions. So there is an opportunity to hopefully upgrade some of those customers and do things like that, but it is going to take us several quarters to work our way through and be able to really be crisp on exactly what to expect on the non-core side.

So to that end, it's probably a 27 event where we start to get a little bit more. I think we'll have more visibility over the course of 27. Definitely more visibility over the course of 27. You can give investors maybe a little bit better guidebook relative to how those things are transpiring.

Yeah, that's exactly right. And I think, again, one of my jobs is to, while you're going through, frankly, a rebuild in many ways of a lot of the ways we've been communicating and talking to the street, We have to be very clear to take people on the journey with us. And we're trying our best to do that with our core non-core designation and adding that color each quarter.

You mentioned potential catalysts coming from the Frontier Labs just in terms of vulnerability discovery. Yet at the same time, you see Defense Factory and other things that a former cybersecurity analyst from years ago, who's now the CFO of one of those companies, is talking about this autonomous remediation cycle. How do you think about competition moving forward and where should investors kind of hang their hat on the defensibility of a rapid seven story longer term?

So, you know, like as noted earlier, first, you know, the frontier models have made certain parts of the cycle much. It's just exploded and it's incredibly quick. The bad actors can leverage that, too. So the timeframes in our business of being able to help our customers have just shrunk incredibly. You know, it used to be exposures might be noted, and they'd be out there sometimes for years before there was a known exploitation. We anticipate that that is disappearing. And, you know, and this is where I always go, our biggest competitor is the bad actor, right? Now, there's financial competitors, and that's why we're here today. So I think it's, first of all, there's going to be very few companies who are going to be able to go on that journey. We're one of them 100%. And I think we can make those investments to compete in that space. And that's going to create some consolidation opportunities. But I think from an investor's perspective, one of the things that's very attractive about Rapid7 is, you know, there's competitors out there that are in exposure management, and we have competitors in DNR, but there's very few that have that end-to-end who own both. And I think that's a unique perspective for us. And we think as we bring these technologies together and bring the data underneath that together, is going to add nuance and detail to our visibility about the attacks, the nature of attacks, the nature of exposures. That's going to add a tremendous amount of color to our ability to deal with all the noise that comes with all of this and help our customers very quickly ascertain when they're under attack, what it is, how to remediate, both short-term remediation, longer-term remediation. That is just incredibly important, all the while having to deal with just this onslaught of on some fundamental basis. If you're a security professional, you have just an avalanche of vulnerabilities you need to continue to deal with in that process. So we're one of the few providers that's going to be able to help you right from that vulnerability all the way to a response to an attack and be able to drive that. So I think that's a unique position for us. We're not alone on that journey, right? The competition is always fierce. But the good news is, you know, that competition between the players is what actually helps our customers or, you know, the users out there of the world defend themselves against the real adversaries, which are the bad actors.

Let's have one or two questions.

Yeah, I just wonder if you can talk a little more about the go-to-market investments you're making. Like, where is the incremental dollar going today and kind of where the metrics may be?

Yeah, so thank you. You know, the biggest thing on the go-to-market that we've been really focused on, and Alan's done a great job on this, is really refining our view of our ICP, our ideal customer profile, and, you know, refine it and focus on it and take our resources and put them all in that area. And I think that's something that's been quite attractive. And we've noted the last couple calls are, you know, the number of reps we actually, you know, are seeing productivity increases on a per rate basis two quarters in a row, right? And Alan doesn't let me forget that, of course. But that's just good execution with the resources we have. So we're not throwing sales dollars at trying to get growth going. We're throwing, you know, trying to throw intelligence and good execution. You know, Alan came in in October. He'd already hired a bunch of his new leaders in before SKL. We got comp plans out there. And we got the comp plans out there before we really broke out the core versus non-core designation. But when you really look at it, we were already leaning in that way, so crispening that up. So I see the, you know, not incremental dollars going into sales and market in total, but that, again, refocusing, get them around those reps, get those reps productive and help drive that. And I think that's a big part of what we're doing.

So 12 months from now, you're back here in Nashville.

We're having this conversation again. what do you and hopefully yl can be with us at that point um what do you hope to have delivered to investors and hopefully pointing them towards for that next goal absolutely look i think the number one thing investors need to watch with us is first and foremost watch our product releases over the next year i think it's going to be quite exciting and and i think that's going to tell a lot of story and if you have good product we know how to sell it we know how to deliver it so that be first and foremost. I very much want investors to watch our core growth rates. And, you know, and we've talked about in, we've talked on the street that it's going to be roughly flat as we're going through this process. But as these new products come out, they're going to be very focused into our core. It's going to be great differentiators. You know, hopefully we can start to talk about some good news on that front, right? So that's really that driver. And then I think once we get done through that exciting stuff, we can also talk about, you know, the resolution of some of the non-core stuff, which is, frankly, more noise than it is the big driver for the organization, but it is a distraction. And, you know, we've got to be clearer on that. And I think the next four quarters, this time next year, we're going to have, you know, we're going to be on that journey a lot further down that journey, in my view. And I think that that will be very exciting for me.

All right. Well, Rafe, thank you very much. My pleasure. Thank you, everybody. Thank you all.