Rapid7’s third-quarter revenue and recurring revenue both fell year on year, though the company beat its own guidance and says its core business has steadied. The bigger story for customers is the plan behind the numbers: a smaller product focus, a $600m debt repayment and an AI-driven “Autonomous SOC” due around RSAC 2027.
What happened
Rapid7 published its results for the quarter to 30 September 2026 on 4 November. Total revenue came in at $212.4m, down 2.5% year on year, and annualised recurring revenue (ARR) dropped 2.2% to $819.7m, still about $8m above guidance. Non-GAAP operating income reached $46.2m, a 21.7% margin, while GAAP net income was $3.5m.
The outlook stays soft. Rapid7 expects ARR of roughly $812m at the end of the year, a 3% decline, and fourth-quarter revenue of $208m to $210m. Full-year revenue is guided at $841m to $843m, around 2% lower than 2025, with free cash flow of about $130m.
Chief executive Wael Mohamed, leading a reset since an August restructuring, stayed cautious. “We are not declaring victory,” he said in the results statement. On the earnings call he went further, telling analysts that a single solid quarter did not yet amount to growth.
The detail
Rapid7 now splits its business into “core” and “noncore”. Core means detection and response, including its managed detection and response (MDR) service, plus exposure management. Together these make up about 85% of ARR and grew around 1% year on year, and core ARR was flat against the second quarter. Detection and response alone accounts for more than 55% of ARR and grew about 5%, but exposure management shrank by roughly 6%, even as customers move from older vulnerability management tools to its Exposure Command product.
The remaining 15% of ARR, the noncore products, fell by about 19%, a decline the company expected after it stopped pushing them. It is still weighing what to do with that portfolio, which Mohamed called healthy but outside the markets Rapid7 can win.
On the balance sheet, Rapid7 held $732m in cash and short-term investments at quarter end, alongside an undrawn $200m credit facility. It plans to use cash to retire $600m of convertible notes that mature in March 2027. That removes refinancing risk, but the interest income on that cash goes too. Management also expects gross margin, 72.2% this quarter, to ease as AWS and AI compute costs rise. Restructuring charges this quarter were $10m.
In October Rapid7 launched Rapid7 Intelligence, which brings its threat intelligence, vulnerability research and Rapid7 Labs teams together, and previewed an Autonomous SOC at its Boston customer summit. On the call Mohamed described a model where “red” agents probe like attackers, “blue” agents investigate and respond, and “orange” agents reason across both, with people setting the mission and limits. Customers will be able to buy it as a service run by Rapid7, run it jointly with Rapid7, or use it as an assurance layer above their own SOC. Early capabilities from Kenzo Security, which Rapid7 acquired last year, are already in use with some customers. The first generally available release is aimed at around RSAC 2027, which the company itself calls version 1.0.
Why it matters for UK organisations
Rapid7 is a familiar name in UK security teams, particularly for vulnerability management and outsourced detection, so these results matter to buyers deciding whether to renew, expand or move on. The first thing to understand is the split. If your organisation relies on Rapid7 for MDR or Exposure Command, you are in the part of the business where investment is going. If you rely on one of the noncore products, the message is different: the vendor is openly reviewing its options for that portfolio and has ended sales of some stand-alone products in it. That is a signal to check roadmaps and contract terms now, not at renewal.
The second point is the Autonomous SOC. Rapid7 says the service is being designed to be “sovereignty aware”, which will interest UK public sector bodies and regulated firms that care where security telemetry is processed and who can access it. But the general release date is more than a year away.
Rapid7’s own research also shows the pressure defenders face: its second-quarter threat landscape report found that 62% of newly exploited flaws could be exploited over a network without authentication or user interaction.
Expert view
Strip away the investor language and this is a company choosing to be smaller and more focused. In my experience that is often healthy: vendors that cover every category end up with a long tail of products that get less engineering time each year. Clearing the notes from cash is also sensible housekeeping that should reassure buyers worried about vendor stability.
I am more cautious about the Autonomous SOC as a near-term buying factor. The red, blue and orange agent model is an interesting design, and the emphasis on people setting boundaries is the right one. But a version 1.0 targeted around RSAC 2027 is a roadmap item, not a capability you can contract for today. When we test environments with outsourced detection, the gaps usually come from incomplete log sources, unmanaged assets and unclear handovers, not a lack of clever tooling. Agents will not fix those on their own.
Panabee, an analysis site, has linked the margin improvement to a workforce reduction earlier this year that it puts at 12%, a figure the company did not repeat in its results. Existing customers should watch for any change in the quality of service delivery over the next few quarters.
What to do now
- Map your Rapid7 estate. List which products you use and whether each falls into detection and response, exposure management or the noncore group. Ask your account team directly which category applies.
- Check contract terms for noncore products. Look at renewal dates, notice periods, data export rights and what happens if a product is sold or retired. Plan an exit route before you need one.
- Test your MDR service, do not just trust it. Run a purple team exercise or tabletop to confirm detections and escalation work end to end, whichever provider you use.
- Keep the basics strong. With so many exploited flaws reachable without authentication, prioritise Cyber Essentials controls: secure configuration, patch management within 14 days for high and critical issues, and boundary firewalls that keep management interfaces off the internet.
- Set AI rules before you buy. Write down which response actions an AI agent may take without a human, what evidence it must log, and where your data may be processed. Use that list when evaluating any agentic SOC offering.
- Revisit vendor risk. Add financial health and product strategy to third-party reviews of all critical security suppliers.
Bottom line
Rapid7 has steadied rather than recovered. Revenue is still falling, but the core detection and response business is growing, the balance sheet can cover its March 2027 debt, and the company has a clear story about AI-driven operations. For UK customers, the useful takeaway is practical: know which side of the core and noncore line your products sit on, and treat the Autonomous SOC as a promise to evaluate in 2027, not a reason to sign today.
