Rapid7 (RPD) Q2 2026: Restructuring Drives Path to 20% Operating Margin Amid Core Focus
Rapid7 initiated a significant restructuring to sharpen its core cybersecurity platform focus, aiming for improved profitability and reinvestment in AI-driven capabilities. While ARR declined due to non-core portfolio pressure, core segments showed modest growth. The company’s transformation sets the stage for durable growth and margin expansion into 2027.
Summary
- Focused Platform Strategy: Rapid7 is concentrating resources on detection and response plus exposure management.
- Operational Reset: Workforce reduction and cost realignment target 20% non-GAAP operating margin by Q4.
- AI-Driven Innovation: Investments in AI foundation underpin future product differentiation and customer outcomes.
Business Overview
Rapid7 is a global cybersecurity company specializing in AI-powered managed security operations, offering solutions primarily through its detection and response (DNR) and exposure management platforms. Revenue is predominantly generated from product subscriptions and professional services, with core platform solutions representing over 80% of annual recurring revenue (ARR). The company serves over 11,500 customers worldwide, focusing on enterprise and mid-market segments.
Performance Analysis
In Q2 2026, Rapid7 reported total revenue of $210.9 million, down 1.5% year-over-year, reflecting softness in non-core product subscriptions that comprise less than 20% of total ARR. The company’s ARR stood at $824 million, a 2% decline year-over-year, with core platform solutions growing approximately 1% led by a 5% increase in the detection and response segment, which accounts for about 55% of total ARR. Non-core products continued to decline, driving the overall ARR contraction.
Non-GAAP operating income reached $28.9 million, with a margin of 13.7%, exceeding guidance and highlighting management’s focus on operational efficiency. Gross margins contracted by approximately 215 basis points due to increased staffing in security operations centers and higher cloud usage. Free cash flow of $31.9 million was driven by strong collections, supporting the company’s healthy cash position of $702.6 million in cash and equivalents.
- Core Platform Resilience: Detection and response growth offset declines in legacy and non-core solutions.
- Margin Compression Drivers: Investments in cloud infrastructure and security operations staffing weighed on gross margins.
- Cash Flow Strength: Free cash flow remains robust, supporting debt repayment and reinvestment plans.
Overall, the quarter reflects a company in transition, balancing near-term headwinds from portfolio rationalization with investments to strengthen its core competitive advantages.
Executive Commentary
"Rapid7 is a good company ready to be great, but getting there requires clear choices, strong execution, and the discipline to focus on what matters most... We are simplifying the company, aligning our cost structure with the core, and creating room to invest."
Wael Mohamed, Chief Executive Officer
"We expect to deliver 20% non-GAAP operating margins in Q4 of 2026, compared to 13.7% in the second quarter, fulfilling our commitment to improve our cost run rate as we exit 2026."
Rafe Brown, Chief Financial Officer
Strategic Positioning
1. Concentration on Core Platform Solutions
Rapid7 is prioritizing its detection and response and exposure management businesses, which together constitute over 80% of ARR. This focus aligns with customer demand for integrated solutions that reduce complexity and improve security outcomes. The company is de-emphasizing non-core products, which have shown ARR declines, and is migrating customers towards the core platform offerings.
2. Transformation Through Restructuring
The announced restructuring affects approximately 12% of the workforce and is designed to streamline operations and reduce costs. This realignment supports the goal of achieving 20% non-GAAP operating margins by Q4 2026. While restructuring charges of $10 million to $11 million are expected, these are excluded from non-GAAP results, reflecting a strategic reset rather than a shrinkage.
3. AI-First Product Development
Rapid7 is investing heavily in its AI foundation, integrating agentic capabilities and automation to enhance detection, response, and remediation workflows. The acquisition of Kenzo Security and the appointment of a Chief Product and Technology Officer underscore this commitment. The AI-first approach aims to differentiate Rapid7’s platform by enabling faster, more scalable security operations.
4. Strengthening Go-to-Market Execution
With new commercial leadership, the company is sharpening sales focus on core offerings and improving pipeline generation. Customer feedback indicates that service quality and AI integration are more critical than price, supporting the company’s premium positioning. The go-to-market team is also focused on protecting and expanding the existing customer base during the transition.
5. Financial Discipline and Capital Allocation
Rapid7 maintains a strong balance sheet with over $700 million in cash and equivalents and an undrawn $200 million credit facility. The company plans to repay $600 million in convertible notes due in March 2027. Free cash flow generation is prioritized to support both debt reduction and reinvestment in product innovation.
Key Considerations
Rapid7’s Q2 results and strategic moves reflect a company in active transformation, balancing immediate profitability goals with longer-term growth ambitions.
- Core vs. Non-Core Dynamics: The shift away from non-core products is necessary but creates near-term ARR headwinds.
- AI as a Differentiator: The platform’s AI-first strategy is critical to maintaining competitive advantage in a crowded cybersecurity market.
- Customer Retention and Migration: Successfully migrating customers from legacy to core solutions will be key to stabilizing and growing ARR.
- Cost Structure Reset: Restructuring charges and severance costs will offset savings in the short term but improve margins longer term.
- Market Positioning: Rapid7’s vendor-neutral stance and integrated platform position it well against endpoint-focused competitors entering the MDR space.
Risks
The transformation carries execution risk, particularly in successfully migrating customers and accelerating core ARR growth amid competitive pressures. The restructuring may temporarily disrupt operations or morale. Macroeconomic uncertainty and evolving cybersecurity threats could impact customer spending patterns. Additionally, the repayment of significant convertible debt in 2027 adds financial pressure.
Forward Outlook
For Q3 2026, Rapid7 expects ARR of approximately $812 million, reflecting a 3% year-over-year decline, with core platform ARR expected to be flat sequentially. Revenue guidance ranges from $208 million to $210 million, down about 4% year-over-year. Non-GAAP operating income is projected between $34 million and $36 million, with margins improving to roughly 16.7%. Non-GAAP diluted earnings per share are forecasted at $0.44 to $0.47.
For full-year 2026, management maintains revenue guidance of $837 million to $841 million, a 2% decline at midpoint, while raising non-GAAP operating income guidance to $129 million to $133 million, implying a 15.6% operating margin. Free cash flow is expected to be approximately $130 million, consistent with 2025 levels.
- Management emphasizes ongoing investments in AI and core product innovation despite near-term ARR pressure.
- Cost savings from restructuring are expected to materialize mostly in Q4, supporting margin expansion.
Takeaways
Rapid7’s Q2 2026 results reveal a company actively reshaping its portfolio and cost structure to sharpen its competitive position in cybersecurity’s fastest-growing segments.
- Operational Reset Enables Margin Improvement: The restructuring and cost realignment provide a credible path to 20% non-GAAP operating margins by year-end, signaling disciplined financial management.
- Core Platform Growth Offsets Legacy Pressure: Modest growth in detection and response ARR offsets declines in non-core products, validating the strategic focus.
- AI Foundation Poised to Drive Differentiation: Investments in agentic AI and platform integration are critical to future growth and customer retention in a competitive market.
Conclusion
Rapid7’s second quarter reflects a transitional phase marked by decisive restructuring and a sharpened strategic focus on its core cybersecurity platform. While ARR headwinds persist from non-core declines, the company’s operational discipline, AI investments, and go-to-market enhancements position it for durable growth and margin expansion into 2027.
Industry Read-Through
Rapid7’s focus on integrating exposure management with detection and response under an AI-first platform reflects broader cybersecurity industry trends emphasizing consolidation and automation. The company’s vendor-neutral approach contrasts with endpoint-centric competitors moving into managed detection and response (MDR), highlighting the importance of platform extensibility. The restructuring to improve margins amid ARR pressure underscores the challenge many cybersecurity firms face balancing growth with profitability. Investors should watch how Rapid7’s transformation progresses as a bellwether for similar platform-centric security providers.