Rapid7’s core business model is now firmly based on a unified platform approach, with recurring revenue and managed services at its heart. While the core platform is gaining share of ARR, overall company growth is muted due to rapid non-core churn. Differentiation is real but not unassailable: plat…
Rapid7 (RPD) Q1 2026: Core Platform Hits 80% of ARR as Non-Core Churn Accelerates
Rapid7’s core platform now drives over 80% of recurring revenue, marking a decisive pivot away from legacy standalone products. The company’s strategic focus on AI-enabled security operations and exposure management aligns with customer urgency, but non-core churn is accelerating, weighing on overall ARR and revenue outlook. Management’s commitment to margin expansion and operational discipline is clear, yet the pace of core growth and upgrade adoption will determine share gains in a rapidly evolving threat landscape.
Summary
- Core Platform Dominance: Detection and response plus exposure management now comprise the vast majority of ARR.
- Non-Core Decline Accelerates: Standalone legacy products are declining faster, driving overall ARR contraction.
- AI and Automation Bet: Investment in AI SOC and agentic automation is central to Rapid7’s long-term margin and growth thesis.
Business Overview
Rapid7 is a cybersecurity solutions provider focused on detection and response (DNR, managed threat detection and response services) and exposure management (VM, vulnerability management and exposure command). The company generates revenue primarily through recurring software subscriptions and managed security services. Its business is now split between core platform offerings—detection response and exposure management, accounting for over 80% of ARR—and a shrinking portfolio of standalone, non-platform products.
Performance Analysis
Q1 2026 results highlight a business in strategic transition, with core platform ARR growing modestly while non-core churn intensifies. Core platform solutions, now representing more than 80% of total ARR, grew 2% year-over-year, led by a 7% increase in the detection and response business, which itself accounts for 55% of total ARR. However, total revenue declined slightly year-over-year, reflecting the drag from non-core standalone offerings.
Profitability outperformed guidance as operating discipline and improved collections drove strong free cash flow. Gross margins, while healthy, dipped due to increased staffing in global SOCs (Security Operations Centers), a necessary investment to maintain service quality amid rising cyber risk. The company ended the quarter with robust liquidity, positioning it to address upcoming debt maturities and ongoing investments in platform innovation.
- Core Platform Share Rises: Over 80% of ARR now comes from detection response and exposure management, up from prior periods.
- Detection & Response Outpaces: This segment’s 7% ARR growth outstrips exposure management and provides the main growth engine.
- Non-Core Churn Deepens: Accelerating declines in standalone products drove sequential ARR contraction and will continue to weigh on reported results.
Net new customer wins in Fortune 500 verticals and high-value deal cycles validate the core platform’s relevance, but overall top-line pressure persists until non-core declines stabilize or core growth reaccelerates materially.
Executive Commentary
"The premium is no longer on detecting threats faster after they emerge. It shifts to preemptive exposure management, autonomous detection, and remediation at scale, closing the windows attackers exploit before they can be exploited at all. This is precisely the environment that plays to our strengths... The opportunity in front of us has never been clearer, and our conviction in this strategy has never been higher."
Corey Thomas, Chief Executive Officer
"Our core platform solutions, which now total over 80% of our overall ARR, grew approximately 2% on a year-over-year basis. Led by our strongest offer in the group, our detection response business, which had approximately 55% of total ARR, grew approximately 7%... Re-accelerating the growth of these core platform solutions is the focus of our strategy and where we are placing our bets."
Rafe Brown, Chief Financial Officer
Strategic Positioning
1. Core Platform Focus and Segmentation
Rapid7 is sharply delineating its business into core platform solutions and legacy standalone offerings. The core—detection and response and exposure management—receives all major product and go-to-market investment. This focus is intended to drive sustainable growth, while non-core products are allowed to decline, with limited incremental investment.
2. AI-Driven Security Operations
Investment in AI-enabled SOC (Security Operations Center) and the acquisition of Kenzo Security, an agentic automation platform, underpin the company’s move toward autonomous detection and remediation. Management believes that only machine-scale response can address the accelerating threat landscape, and Kenzo’s integration is expected to improve both customer outcomes and operating margins over time.
3. Exposure Management Upgrade Cycle
The migration of legacy vulnerability management customers to the Exposure Command platform is a strategic priority, but remains a work in progress. While management sees stabilization and improved leading indicators, exposure management is not yet a growth driver. The success of this upgrade initiative will be critical for future ARR acceleration.
4. Operational Discipline and Margin Expansion
Cost control and operational leverage are central to the medium-term outlook. Recent investments in global SOC capacity and the India Global Capability Centre are expected to yield productivity gains and margin improvement in the back half of 2026 and beyond. The company is committed to expanding operating margins even as it invests in growth areas.
5. Customer-Centric Innovation
Rapid7’s product roadmap is tightly aligned with customer needs for preemptive, actionable security outcomes. New capabilities like runtime validation and data security posture management are designed to help customers prioritize and remediate only the exposures that matter, reducing operational noise and increasing value delivered per dollar spent.
Key Considerations
This quarter marks a pivotal inflection point as Rapid7 transitions from a mixed product portfolio to a unified platform-centric model. Investors should weigh the following:
Key Considerations:
- Core Platform Growth Trajectory: Sustained, but modest, core ARR growth must accelerate to offset non-core drag and deliver long-term compounding.
- Non-Core Churn Management: The pace and ultimate floor of non-core declines will set the baseline for consolidated revenue and ARR trends.
- AI Integration Execution: The speed and efficacy of Kenzo Security’s integration into the core platform will determine both customer adoption and margin leverage.
- Upgrade Cycle Adoption: Success migrating legacy VM customers to the Exposure Command platform is crucial for re-energizing exposure management as a growth lever.
- Margin Expansion Discipline: Management’s ability to deliver on mid-teens operating margin guidance amid growth pressure will be a key test of execution.
Risks
Rapid7 faces substantial risks from accelerating churn in its non-core product base, which could continue to mask progress in the core platform. The upgrade cycle in exposure management remains uncertain, and customer budget constraints or AI adoption confusion could delay platform migrations. Margin expansion depends on successful integration of automation and disciplined cost management, while the competitive cybersecurity landscape remains intense and rapidly evolving.
Forward Outlook
For Q2 2026, Rapid7 guided to:
- ARR of approximately $820 million, with core platform ARR expected to be flat sequentially
- Total revenue of $207 million to $209 million, implying a year-over-year decline
- Operating income of $24 million to $26 million (12% margin midpoint)
For full-year 2026, management raised non-GAAP operating income guidance:
- Revenue of $836 million to $842 million
- Operating income of $112 million to $118 million (13.7% margin midpoint)
- Free cash flow of $125 million to $135 million
Management emphasized ongoing focus on margin improvement and core platform execution as non-core declines accelerate, with visibility limited to quarterly guidance intervals.
- Core platform to remain the growth engine
- Non-core ARR declines to persist as a headwind
Takeaways
Rapid7’s results reflect a business in active transformation, with core platform strength offset by legacy product runoff.
- Platform Mix Shift: The transition to an 80%+ core platform ARR base is nearly complete, but headline growth will remain muted until exposure management upgrades accelerate.
- Margin Expansion on Track: Operational discipline and automation investment are expected to drive margins higher, even in a flat-to-down revenue environment.
- AI-Driven Differentiation: The company’s bet on agentic automation and preemptive security operations positions it for long-term relevance, but execution risk remains as customers navigate budget and technology transitions.
Conclusion
Rapid7 is executing a decisive pivot to a unified, AI-driven security platform, with core ARR now dominating the business mix. While non-core churn and exposure management headwinds weigh on near-term growth, operational discipline and automation investments set the stage for improved profitability and long-term share gains—provided the platform upgrade cycle accelerates as planned.
Industry Read-Through
Rapid7’s experience highlights the cybersecurity sector’s shift toward platform consolidation, automation, and AI-driven operations. The accelerating obsolescence of standalone products and the increasing demand for preemptive, machine-scale remediation are themes likely to play out across the industry. Vendors with legacy-heavy portfolios face similar ARR headwinds and must execute on platform migrations to sustain growth. The integration of agentic AI for SOC automation and exposure management is becoming table stakes, and margin expansion will increasingly depend on the pace and quality of automation, not just topline growth. Investors should watch for similar mix shifts, upgrade cycles, and automation-driven efficiency plays across the security software landscape.