Rapid7, Inc. (RPD) Earnings Call Transcript & Summary

Good day, everyone. My name is Kahalmani, and I'll be your conference operator today. At this time, I would like to welcome you to the Q2 2026 Rapid7 Earnings Call. [Operator Instructions] At this time, I would like to turn the call over to Matt Wells, Vice President of Investor Relations.

Thank you, operator, and good afternoon, everyone. Today, we will be discussing Rapid7's second quarter fiscal 2026 financial results. We've distributed our earnings press release over the wire, and it can be accessed on our Investor Relations website. With me on the call are Corey Thomas, Executive Chairman; Wael Mohamed, CEO; and Rafe Brown, CFO. As a reminder, all participants are in listen-only mode and a question-and-answer session will follow our opening remarks. Before I hand the call over to Corey, I want to remind everyone that certain statements made during this conference call may be considered forward-looking statements under federal securities laws. These statements are made pursuant to the safe harbor provisions of the Private Securities Litigation Reform Act of 1995 and include, among other things, our outlook for the third quarter and full year 2026, our expectations regarding fiscal periods beyond 2026, our transformation and restructuring initiatives, our strategy, priorities and capital allocation, anticipated operational improvements, investments in our core platform and AI capabilities and our expected growth drivers and financial performance. These forward-looking statements are based on our current expectations and beliefs and information currently available to us. While we believe any forward-looking statements we make are reasonable, actual results could differ materially due to a number of risks and uncertainties, including those contained in our filings with the SEC. Reported results should not be considered indicative of future performance. We do not undertake and expressly disclaim any obligation to update or alter our forward-looking statements, whether as a result of new information, future events or otherwise, except to the extent required by applicable law. Further information on these forward-looking statements and risk factors are included in the filings we make with the SEC, including the section titled Cautionary Language Concerning Forward-Looking Statements in our earnings press release. Additionally, over the course of this call, we'll reference non-GAAP measures to describe our performance. Please review our earnings press release and filings with the SEC for our rationale behind the use of non-GAAP measures and for a full reconciliation of these GAAP to non-GAAP metrics. These documents, in addition to a replay of this call will be available on the Rapid7 Investor Relations website. And with that, I'd like to turn the call over to Corey.

Welcome to Rapid7's Q2 2026 Earnings Call. I join you today in a new role, but with the same passion and purpose to ensure that organizations of all sizes can get the best results from their security operations. I have worked with the Board and especially with Wael over the last year to revitalize our team, improve our execution and fully leverage the opportunity that AI is providing. As part of that work, it was clear that we have significant opportunities, but only if we tighten our focus on our core offerings, sharpen our alignment and execution around those offerings and deliver a more efficient model. The Board and I recruited Wael, whom I have known and respected for many years to do exactly that, deliver on Rapid7's full potential in the midst of one of the most exciting moments in technology. In many ways, Wael is accelerating a plan he helped developed. In other areas, he's providing sharper focus and leadership as you will hear in his upcoming comments. Before I hand it over to Wael, I want to take a moment to acknowledge the incredible work of our colleagues at Rapid7, whose passion and care for our customers and their deep and energetic embrace of innovation continue to inspire me. With that, I turn the call over to Wael. Wael?

Thank you, Corey, and good afternoon. Since this is my first earnings call as CEO of Rapid7, I want to use my time a little differently. Rafe will take you through the quarter, the actions we announced and our guidance. I want to focus on our strategy, the operating discipline behind it and how I ask you to measure our progress. I have known Rapid7 for years. Long before I joined the Board, I saw this company at its best, moving fast, earning customer trust and winning in the heart of the market. Joining the Board gave me a much closer view of the company, its people and its potential. The closer I got, the more I liked what I found. Rapid7 is a good company ready to be great. It is not broken. It has reached a ceiling. The issue is not our assets. It is how we focus our resources and energy. Breaking through requires clear choices, strong execution and an operating system that can repeat success at scale. That is the work I signed up for. Transformation is not about changing everything. it is about having the discipline to change the few things that matter most and doing so consistently over time. Over the past year, we put the leadership team in place for this next chapter. We added a proven Chief Financial Officer to strengthen operating discipline, a Chief Commercial Officer to help us scale and win with customers and the Chief Product and Technology Officer to build an AI-first platform. We now have our leadership team, operating model and capital allocation aligned behind one direction. Since stepping into this role, I have spent my time listening to customers, our people, partners and many of you. Three things are clear. First, focus matters. We do not need to win everywhere. We need to be exceptional where we can win. Our clearest right to win is in the heart of the enterprise market. Customers that need enterprise-grade security, but also need fewer tools, less complexity and faster outcomes. Our leadership in the mid-market is proof of our strength. It is not a limit on our technology or our market. We will continue to compete for larger enterprises where our platform is the right fit. These customers want fewer, better partners, not more tools. That is where Rapid7 has earned the right to win. Second, outcomes matter more than products. For years, Cybersecurity answered complexity with more complexity, more tools, more alerts, more consoles, more people. Customers do not need another dashboard. They need less risk, less complexity and faster action. Our opportunity is to connect exposure management with detection and response to move from finding problems to resolving them. For many customers, that outcome will be delivered as a service. Skilled security people are hard to find. They need a trusted partner that can bring the platform, the expertise and the work together. Third, the way security work gets done is changing. AI should not become another label. It should change the work. Automation helps us move faster today. Agents let us do more across more data, more and at much greater scale. Attackers are moving at machine speed. Attackers only need to find the scene between an exposure and the fix, an alert and the work needed to investigate it or a decision and an action. Defenders need the same reach and speed with people remaining in control. People decide, agents do. In this model, agents are not just features inside a product. They become part of the service layer, extending the reach of our security experts and helping us deliver outcomes faster and at scale. We acquired Kenzo because AI needs a foundation, not another feature. That foundation connects data, agents and human decisions across the tools customers already use while keeping customers in control of their data. We want AI to fit into our customers' environments, not force them into ours. Building that future requires focus now. The changes we announced affect colleagues who have contributed to Rapid7. I want to thank them for what they have given to this company and to our customers. These actions are a focused reset. We are not shrinking our way to the future. We are reshaping the company so we can invest more behind the parts of the business that will define it. We are simplifying the company, aligning our cost structure with the core and creating room to invest. We are concentrating our growth investment behind detection and response, exposure management and the AI foundation that connects them. We will continue to support customers using our other products. This is not simply a cost action. We will reinvest a meaningful portion of the savings in our core platform, the people building it and the AI foundation behind the next generation of our products. 70 days is not enough to complete a transformation. It is enough to set direction and show how we will operate with speed, clarity and accountability. Operating discipline creates choices. As Rafe will explain, the actions we announced put us on a path to exit the year at approximately 20% non-GAAP operating margin. That is not the destination. It is evidence that we are building a healthier company, one with more capacity to invest, innovate and generate durable returns over time. In the second quarter, we came in slightly above the guidance we provided. Detection and Response continued to perform well. At the same time, total ARR declined. Exposure management is not yet where it needs to be and other parts of the portfolio continued to pressure our results. The current direction of ARR is not good enough. We are acting on it. This is a multi-quarter transformation. We are changing the path of the company toward durable growth, not managing for one quarter. As we sharpen our focus, some parts of the business may face pressure before the benefits become visible. At times, we may need to simplify before we can accelerate. Let me leave you with the framework I ask you to use when measuring Rapid7 over the coming quarters. First, look at the cash generated. Cash is not the finish line. Durable growth is. But cash tells you whether the operating model is becoming healthier and whether we have the capacity to keep investing. Second, measure this transformation over several quarters, not one, look for stronger execution in the core, better outcomes for customers and meaningful improvement in exposure management. Third, watch how we reinvest. We are putting resources behind the platform, the people and the AI foundation required to return Rapid7 to durable growth. We have hard work ahead, but we also have what matters most, strong customer trust, deep security expertise, a clear place to win and a team that cares deeply about our mission. I have believed in Rapid7 for years. The more time I have spent with its people, its customers and its technology, the stronger that belief has become. We know this transformation will take time. We will not ask you to judge us by promises. Judge us by execution. Judge us by whether quarter after quarter, this company becomes more focused, more disciplined and more capable of delivering durable growth. That is how we intend to earn your confidence. Rafe, over to you.

Thank you, Wael, and good afternoon, everyone. As a quick reminder, unless otherwise noted, all numbers, except revenue and balance sheet items mentioned during my remarks today are non-GAAP. Please refer to our earnings release and SEC filings for additional details regarding the presentation of our results and guidance metrics. In the second quarter of 2026, I'm pleased to report that we exceeded expectations across all guided metrics. We ended the second quarter with total ARR of $824 million. We reported non-GAAP operating income of $28.9 million. Free cash flow came in strong at $31.9 million with collections healthily exceeding our internal expectations. As of the end of the quarter, we had total cash, cash equivalents and short-term investments of $702.6 million. I want to begin by taking a closer look at our ARR as of the end of the quarter. As a quick reminder, our long-term strategy is focused on our core platform solutions comprised of our detection and response business, which includes MDR and our exposure management business. Our core platform solutions represent over 80% of overall ARR and grew approximately 1% on a year-over-year basis, led by our detection and response business, which at approximately 55% of total ARR grew approximately 5% on a year-over-year basis. While our overall exposure management business offset some of the growth of our D&R business within the exposure management segment of our core offerings, we continue to see healthy adoption of our Exposure Command solution driven by both new customers and customers upgrading from our older vulnerability management solutions. In contrast, our noncore products, which, as a reminder, are less than 20% of total ARR declined in the quarter, driving the sequential decline we saw in total ARR as we focus our resources toward growing our core products. As we plan for the remainder of 2026 and beyond, we see opportunities to optimize margins for these stand-alone noncore solutions as well as opportunities to migrate customers to core platform offerings. As Wael mentioned, our organization is undergoing a significant transformation. Our new Chief Product and Technology Officer, Dan Deklich, just two months into his role, is making changes and investments across the product and engineering organization. We expect these investments to strengthen our core platform solutions, accelerate innovation and deliver meaningful product capabilities throughout 2027. We expect, however, that these efforts will take time to translate into ARR growth. Returning now to our financial statements. Total revenue of $210.9 million declined approximately 1.5% year-over-year, reflecting the declines in noncore product ARR we saw earlier this year. We finished the quarter with over 11,500 customers and an average ARR per customer of approximately $70,000. Turning to second quarter profitability. Total non-GAAP gross margins of 71.7% were down approximately 215 basis points year-over-year, consistent with our expectations, driven by year-over-year increases in staffing of our global security operations centers and increased cloud usage for product improvements. We reported non-GAAP operating income of $28.9 million or a margin of 13.7%, favorable to our guidance. This upside to profitability drove non-GAAP earnings per share of $0.44 per diluted share. Free cash flow totaled $31.9 million in the second quarter, driven by strong collections. And from a balance sheet perspective, we ended the second quarter with $702.6 million in cash, cash equivalents and short-term investments. Combined with our continued free cash flow generation and a $200 million undrawn credit facility, we are well positioned to repay our $600 million convertible notes due in March of 2027. Turning to the restructuring announced earlier today. This restructuring marks a strategic shift in our business operations to drive efficiency and focus across the organization, aligning resources and investments to our core platform solutions. We are also creating capacity to increase our investments in cutting-edge AI-driven solutions that will improve customer experience and increase competitiveness in the marketplace. In terms of approach, we first eliminated non-headcount spend wherever possible. Unfortunately, approximately 12% of our workforce has been notified that their roles are impacted by the restructuring. From a financial perspective, as a result of the efficiency gains already underway as well as the impact of the restructuring announced today, we expect to deliver 20% non-GAAP operating margins in Q4 of 2026 compared to 13.7% in the second quarter, fulfilling our commitment to improve our cost run rate as we exit 2026. We expect to incur restructuring charges of approximately $10 million to $11 million, the majority of which will be paid throughout the third and fourth quarters of 2026. These restructuring charges will be excluded from our non-GAAP P&L results. The cash expenditures will, however, be reflected in our operating and free cash flow results. As such, for the remainder of the year, the cash benefit of reduced head count will largely be offset by the associated severance-related costs as well as targeted reinvestments into our product and engineering organization. Therefore, while weighted toward the fourth quarter, we are maintaining our expectation of approximately $130 million in free cash flow for the full year 2026. We believe this restructuring will allow us to improve free cash flow in 2027 over our 2026 guide despite a lower ARR base as we enter 2027, investments we are making to modernize our products and SDLC process and the reduction of our interest income that will occur once we use our invested cash to repay our March 2027 convertible bonds. This brings us to third quarter 2026 guidance. We expect to end the third quarter with ARR of approximately $812 million. And on a sequential basis, we expect ending ARR for our combined core platform solutions of D&R and Exposure Management will be approximately flat quarter-on-quarter with the expected sequential ARR decline coming from our noncore offerings. For the third quarter, we expect total revenue in the range of $208 million to $210 million or down approximately 4% at the midpoint on a year-over-year basis. Non-GAAP operating income is expected to be in the range of $34 million to $36 million or a margin of 16.7% at the midpoint. Non-GAAP earnings per diluted share are expected to be in the range of $0.44 to $0.47 on approximately 80 million fully diluted shares. Updating our full year fiscal 2026 guidance, we expect total revenue in the range of $837 million to $841 million, a year-on-year decline of approximately 2% at the midpoint. We are raising non-GAAP operating income guidance for 2026 to a range of $129 million to $133 million or a full year non-GAAP operating margin of 15.6% at the midpoint. As I mentioned earlier, this implies a 20% non-GAAP operating margin in the fourth quarter. Non-GAAP earnings per share are expected to be in the range of $1.78 to $1.83 per share on approximately 79 million fully diluted shares. We expect free cash flow of approximately $130 million for the full year, in line with prior year performance and a free cash flow margin of approximately 15.5%. In conclusion, our solid execution in the second quarter, combined with our focus and prioritization efforts to improve our core product offerings as well as our commitment to manage costs and expand operating margins positions Rapid7 well for the transformation ahead. And with that, I'd like to turn the call over to the operator for Q&A.

[Operator Instructions] Our first question comes from Rob Owens with Piper Sandler.

As you look across the product set and in particular, your exposure management platform, and I know you said that things will get better from here and you're looking at adding to the portfolio or adding to the capability. When you focus on that, is this a function of coverage? Or is it lacking functionality that your customers are looking for? Just trying to understand directionally where you hope to take this technology. And I'll just ask the follow-up right away. In terms of customers that haven't moved to your more comprehensive capability, especially given the threat environment that we're in right now, what is your sense as to what customers are doing here?

Thanks, Rob. Very good question. First of all, it's nice to actually be here, and I look forward to work with all of you. It's been a little bit over two months. When I was on the Board, and as you know, I actually started a year ago -- over a year ago with Corey on the Board, and I looked at the overall business, it was very clear that there was part core and noncore. And as I actually got on the seat, it was very clear to me that most of the decline happened in the noncore. Nonetheless, there's a lot of work we needed to do on the core side. So the restructure that actually Rafe talked about was to shift some of our focus to the core and making sure that we have our weight on it because we have really a good position. We have a lot of customers that use us. We have the right to win. And most importantly, we are invited every single day. I sat on a lot of customer calls in the last two months, and I can see that we're actually in a better position. But to answer your question on the exposure management, there is definitely some work to do on focus. We were spread very thin, try to be able to address all our portfolio. And now we are basically shifting our focus on the core side and making sure that we are actually also making some investments so we can get our fair share in that market. We are invited, which is good. We're shortlisted because we are one of the leaders Nonetheless, we can increase our win rate by having more focus and obviously, having the right investment. And I'm very excited about the addition of Dan since Dan is actually -- is working very hard to making sure that not only new features, but the AI-first methodology is implemented in all our product line. The second question was...

The migration.

What are customers doing in this environment? Yes.

When I talk to customers, they actually -- they talk about how can you not only find things but actually fix it. And I'm very excited that we play in these two subcategories, the exposure management as well as the detection and response. And I do believe the AI first basically structure will allow us to be able to provide that for customers. But customers are actually buying every single day. They are not waiting and wait and see. That's what I thought when I came in. It will be a wait and see. They're waiting for the AI. They're actually -- they just want to make sure that the right vendors are moving in the right direction, and they are looking for solution that not only help them to identify what's going on, but also fix it and take them through that journey.

Your next question comes from the line of Jonathan Ho with William Blair.

Just wanted to understand, first of all, Wael, I really appreciate the detail that you're providing. Can you help us understand the opportunities to reaccelerate growth? Like where do you specifically see sort of these ability to focus paying off? And it's always been challenging to show operating leverage while trying to reaccelerate growth at the same time. Can you help us understand sort of the balance between these two?

Thank you, Jonathan. And it's a very good question, and I always ask myself when I basically -- before I started, the most question I ask myself, are we in a category that it's big enough and is growing fast enough to be able to get us the growth we're looking for. And you cannot buy that. And we are very fortunate that we are in two big categories. And even in the vulnerability management and basically the migration into exposure, it almost like feel like it has a refuel of interest again. So there's two categories that we have very strong position. We are definitely a leader. We have the right to win, and we're invited to participate, and that's itself extremely important. How can we basically find growth? The way I look at it is a sequence. This is not going to be a one quarter turnaround. It's going to be multiple quarters. And the way I think about it, first, the cash generated, it will be able to demonstrate how well and how precise we're running the business. Number two, we need the noncore to clear, and we already basically understand what that is, and we're making all the right structure to allow us to do that. And number three, we need to stabilize the core itself. Within the core, there's a lot of great assets, a good position, but there's some more work we needed to do. And that's why we are refunneling part of the investment and put it behind that. And fourth, we will get back again to growth. So I believe the category we're in will allow us to do so. The work we're doing will allow us to get there faster.

Excellent. And just in terms of the strong margins that you guided to in the fourth quarter, I just want to better understand, I mean, is this a starting point then for 2027? Or can you maybe help shape what the endpoint looks like in terms of what you want to ultimately achieve?

When I was at the Board, I was actually part of the work on Kenzo. And I was very, very excited because it can be able to allow us to do two things. Not only we can be able to provide services at scale with a software-like margins, but it will allow us to connect our solutions together with a common data structure. So I believe that basically the AI-first work that Dan is doing, it will allow us to not only maintain the margins that we're providing today, but actually sustain it even better. And I will pass it to Rafe. He can share with you how we're thinking about it. We want to run a business that's profitable, high margin and at scale. And the only way we can be able to do that in the category we are in is to be able to make sure that our gross margin is best-in-class.

Yes. Jonathan, I would add -- just to add to that, one of the things that I think we're pleased to be able to talk about today is we talked about improving margins as we went through 2026. We're delivering on that. And I think that was an important goal for us. That balanced growth that Wael is talking about is how we really look out across the next few years, frankly, about how we're focusing. We want to invest in the products so we can drive growth. That is incredibly important, and we think that will be a big driver of valuation over the longer term. But we also realize that the margins on the bottom line incredibly important. So we've taken a big step today. We're obviously not giving 2027 guidance yet, but it speaks to our commitment and our focus, and I think we'll continue to maintain that focus on being very smart about how we invest and also keeping an eye constantly on the bottom line.

Our next question comes from the line of Fatima Boolani with Citi.

Wael, you counted a number of ways in which you're setting the foundation for running a more streamlined business and a streamlined execution. But specifically, I wanted to ask you on the noncore product portfolio. Is the eventual conclusion or end game there to deprecate most of that portfolio on a stand-alone basis? I think you earlier did talk about transitioning some customers out of the noncore and providing them a bridge into the core. I was wondering if you could help us a little bit around is the entire noncore portfolio eligible to move into the core or perhaps there is an opportunity to deprecate and/or rationalize some of what's in that portfolio under the auspices of just becoming more efficient as an organization. And then I have a follow-up as well, please.

Sounds good. Thank you, Fatima. And those are very good questions. The way I look at it at the noncore, certain categories that require different type of investment if you're going to be competing with the pure players. And those races are not the one that we're actually going after. We're focusing all our energy and our investment behind the ones that we're already a leader and we can participate and basically grow with those categories. Nonetheless, we have an incredible amount of technologies and our customer base is intertwined. So some of those technologies will basically be served -- servicing our customers from the vignettes of our platform. So we are basically looking at every opportunity to make sure that we can provide outcomes to our customers, but also not to chase certain races that the market already decided and the pure-play game is not going to be ours to win. There is enough for us to win. There is a big market that is pulling us, and we need to put the appropriate investments so we can make sure that we can have our lion's share of those subcategories as well. As a matter of fact, I believe there is a category envy, like the neighboring industry players, they are already coming from EDR and we see there's a lot of action in MDR. So we'll see some competition coming sideways. They don't have the right to win because they are not vendor neutral like we are. They don't really have the strength and the depth that we have. We have thousands of customers relying on us every single day. So we really need to focus to make sure we defend our turf that we have earned and that may make us actually deemphasize in some subcategories that we will not be able to actually chase. We have to make some choices.

Understood. Very clear. And then you mentioned earlier that the core of the portfolio is around finding things, but then being able to also fix them, right? So this whole patch management and remediation window that has effectively vanished against the innovation that we've seen out of the large language model providers. So I'm curious just from an asset management, patch management perspective, what intellectual property you have there? And why do you feel that a detection and response angle to solving that approach is the right way versus a traditional asset management or patch management intellectual property?

Thank you. We are in a very fortunate position. Over the years, we have assembled some deep technology, deep expertise, and we understand our customer environment extremely well. Sometimes we see the alerts before they even enter. And sometimes we are actually integrated within the customer where we can actually work with them to be able to tackle some attacks and making sure that we respond swiftly. But what we saw in order for us to do this the way the market is going, we needed to have a common data backbone. -- that when we have a common data backbone that it allow us to leverage customers' assets instead of asking them to replace it. So from an architecture perspective, we basically had to focus on that. That's also going to be the basis for the agentic work that we're actually working towards. And with that, we can be able to do way more than what we're doing today. It's the combination between our expertise and our people and the future agents, we should be able to actually close those gaps. And there's going to be many gaps actually in the future more than today. And customers are asking us, how can you be able to help us at scale. And that's really the work that we're doing right now in the platform. And we see that customers will be coming to us asking not only to find the vulnerabilities, not only to make sure that it's exploitable, but help them to close all the gaps, all the scams and help them to fix -- the ultimate answer is patching, but there is a lot of things you can be able to do if you cannot patch on time.