Rapid7 (RPD) Q3 2026 Earnings Call Transcript

Rapid7 reported Q3 revenue of $212.4 million, down 2.5% year over year, and ARR of $820 million, down 2.2%; both declines reflected weakness in noncore products. Core platform ARR grew 1%, led by detection and response growth of about 5%, while exposure management fell about 6%; management said core ARR was flat sequentially and reaffirmed approximately $130 million in full-year free cash flow. Q4 revenue guidance is $208 million–$210 million, down 3%–4% year over year, and full-year revenue guidance is $841 million–$843 million; Rapid7 plans to use cash on hand to repay $600 million of convertible notes due in March 2027. Management is investing in AI-driven products and services, with an Autonomous SOC release targeted around RSA Conference 2027, while cautioning that durable growth remains ahead and noncore ARR declines are expected to continue in the near term.

Analysis

The key distinction is between a deliberate runoff and a genuine recovery: non-core sales exits explain much of the headline drag, but the core is only roughly flat sequentially, so the business has not yet demonstrated that customer losses and new bookings have turned. End-of-sale can improve sales focus and bundle economics, but it also risks converting customers who need standalone products into churn rather than core-platform upgrades. Track core ARR and renewal outcomes—not the improving mix share—as the cleanest evidence of progress.

The AI-first service strategy has asymmetric near-term economics: compute and product investment arrive before proof that agents let security teams serve more customers without comparable labor growth. If that leverage materializes, it could strengthen differentiation against larger security platforms and specialist exposure-management vendors; if not, higher cloud costs pressure margins while the product roadmap remains a promise. The planned 2027 launch is therefore a proof point, not a near-term growth catalyst.

Liquidity appears adequate for the stated note repayment, but using cash for it removes associated interest income; operating cash generation must increasingly carry investment and balance-sheet needs. Near term, watch Q4 core sequential ARR, gross-margin progression, and renewal behavior. Over 6–18 months, exposure-management stabilization and evidence of AI-service adoption matter more than launch timing. The thesis weakens if core ARR turns positive sequentially and sustains it; it worsens if core declines or margin erosion exceeds revenue improvement. Valuation and current price are not provided, so avoid asserting a target or treating the earnings beat as mispriced.

Key Decisions for Investors

• Keep RPD underweight / avoid chasing an earnings-driven rally until core ARR shows sequential growth. Reassess after Q4 results using core ARR, renewal trends, and gross margin; a further core decline or accelerating margin pressure strengthens the cautious view.
• Treat exposure management as the pivotal operating alert: verify whether adoption of bundled Exposure Command converts legacy customers into durable core ARR rather than merely shifting product mix. A renewed decline in this segment would undermine the stabilization thesis.
• Do not underwrite the Autonomous SOC as current earnings upside. Monitor customer adoption, compute-cost growth, and service-delivery productivity into 2027; evidence of more customers served per unit of labor without sustained gross-margin deterioration would support a more constructive view.
• Monitor cash and note repayment execution alongside free cash flow. The stated cash plan reduces refinancing uncertainty, but the post-repayment loss of interest income makes operating cash generation and 2027 investment discipline important verification points.