Rapid7 (RPD) Q1 2026 Earnings Call Transcript

Rapid7 reported Q1 ARR of $832 million and revenue of $209.7 million, with core platform ARR up about 2% year over year and detection and response ARR up 7%, but non-core offerings continued to drive sequential ARR declines. The company beat guidance on profitability, posting $24.4 million of non-GAAP operating income, 72% gross margin, and $33.4 million of free cash flow, while raising full-year non-GAAP operating income guidance to $112 million-$118 million and FCF guidance to $125 million-$135 million. Management framed AI-driven security demand as a long-term tailwind and highlighted the Kinzo Security acquisition plus new Exposure Command features, but revenue guidance still implies a mid-single-digit year-over-year decline.

Analysis

The key second-order takeaway is that the business is quietly becoming a “quality at all costs” story, not a growth re-acceleration story. Core platform ARR is still positive, but the mix is increasingly concentrated in MDR, which is both the best growth engine and the business line most exposed to margin debate because of human-in-the-loop delivery. Kinzo is the real strategic lever: if automation reduces analyst load in six to nine months, the market should start pricing a gross margin inflection before top-line acceleration becomes visible.

What investors are likely missing is that the non-core runoff is not just a drag; it is also an architectural clean-up that can improve upgrade economics later. The risk is sequencing: if non-core declines remain faster than core platform expansion for another two quarters, reported revenue will continue to look weak and sentiment will stay anchored on shrinkage, even if underlying product-market fit improves. That creates a window where the stock can de-rate on optics while the operating model is actually improving underneath.

On the competitive side, this is more threatening to mid-tier point solution vendors than to the large platforms. Rapid7 is positioning itself as the “operational layer” between discovery and remediation, which becomes more valuable as AI increases vulnerability noise; that’s a strong wedge against customers overwhelmed by alert volume. The counter-risk is that larger security platforms can bundle similar workflows into broader suites, so Rapid7 needs proof of conversion from exposure management into higher ARR per customer within the next two reporting cycles.

The contrarian setup is that consensus may be over-fixated on revenue contraction and under-appreciating the free-cash-flow durability. With balance sheet liquidity ample and guidance implying mid-teens operating margin, the equity can work even without growth reacceleration if management executes on cost discipline and AI-driven service leverage. The stock likely needs one or two quarters of gross margin stabilization and a clearer core ARR inflection to re-rate meaningfully.

Key Decisions for Investors

• Long RPD common on any post-earnings weakness over the next 1-2 weeks; thesis is that FCF and margin improvement will matter more than near-term revenue shrinkage. Risk/reward is attractive if the market is pricing it as a melting-ice-cube instead of a mix-shift story.
• Pair trade: long RPD / short a basket of smaller cyber point-solution names over 3-6 months. RPD has a cleaner path to operating leverage and platform consolidation, while weaker niche vendors are more exposed to AI-driven feature commoditization.
• Buy RPD Jan-2027 call spreads to express a delayed re-rating tied to Kinzo integration and exposure-management stabilization. Best payoff comes if gross margin expands before revenue turns positive again.
• For more tactical traders, sell downside puts only after confirming the next quarter does not show accelerated core deceleration. The key risk is that non-core churn worsens faster than expected and overwhelms MDR strength for another quarter.