Rapid7, Inc. (RPD)

Item 2. Management’s Discussion and Analysis of Financial Condition and Results of Operations.

The following discussion and analysis of our financial condition and results of operations should be read in conjunction with (1) our unaudited condensed consolidated financial statements and related notes appearing elsewhere in this Quarterly Report on Form 10-Q and (2) the audited consolidated financial statements and the related notes and Management’s Discussion and Analysis of Financial Condition and Results of Operations for the fiscal year ended December 31, 2025 included in our Annual Report on Form 10-K, filed with the SEC on February 19, 2026. Forward-looking statements in this review are qualified by the cautionary statement included under the next sub-heading, “Special Note Regarding Forward-Looking Statements”.

Special Note Regarding Forward-Looking Statements

This Quarterly Report on Form 10-Q, including the sections entitled “Risk Factors,” and “Management’s Discussion and Analysis of Financial Condition and Results of Operations,” contains forward-looking statements that involve risks and uncertainties, as well as assumptions that, if they never materialize or prove incorrect, could cause our results to differ materially from those expressed or implied by such forward-looking statements. Statements that are not purely historical are forward-looking statements within the meaning of Section 27A of the Securities Act of 1933, as amended, and Section 21E of the Securities Exchange Act of 1934, as amended. Forward-looking statements are often identified by the use of words such as, but not limited to, “anticipate,” “believe,” “can,” “continue,” “could,” “estimate,” “expect,” “intend,” “may,” “plan,” “project,” “seek,” “should,” “target,” “will,” “would” and similar expressions or variations intended to identify forward-looking statements. These forward-looking statements include, but are not limited to, statements concerning the following:

• our ability to continue to add new customers, maintain existing customers and sell new products and professional services to new and existing customers;

• uncertain impacts that prolonged economic uncertainty may have on our business, strategy, operating results, financial condition and cash flows, as well as changes in overall level of software spending and volatility in the global economy;

• the effects of increased competition as well as innovations by new and existing competitors in our market;

• our ability to effectively restructure our business in alignment with our strategic priorities;

• our ability to adapt to technological change and effectively enhance, integrate, innovate and scale our solutions and platform capabilities, including our Command Platform;

• our ability to capitalize on customer demand for consolidated security platforms and vendor consolidation trends, including our ability to deliver an integrated, open security operations platform;

• our ability to deliver, scale and operate managed services (including managed detection and response (“MDR”) and related offerings, including with respect to service quality, staffing, operating efficiency, and the integration of technology and expertise;

• our ability to effectively manage or sustain our growth and to sustain profitability;

• our ability to diversify our sources of revenue;

• potential acquisitions and our ability to successfully integrate acquired businesses, technologies and personnel, including the realization of anticipated benefits from such acquisitions;

• our expected use of proceeds from future issuances of equity or convertible debt securities;

• our ability to maintain, or strengthen awareness of, our brand;

• perceived or actual security, integrity, reliability, quality or compatibility problems with our solutions, including problems related to systems, unscheduled downtime, outages or security breaches in our customers;

• statements regarding future revenue, hiring plans, expenses, capital expenditures, capital requirements and stock performance;

• our ability to meet publicly announced guidance or other expectations about our business, key metrics and future operating results;

• our ability to maintain an adequate annualized recurring revenue growth;

• our ability to attract and retain qualified employees and key personnel and further expand our overall headcount;

• our ability to grow, both domestically and internationally;

• our ability to stay abreast of new or modified laws and regulations that currently apply or become applicable to our business both in the United States and internationally;

• our ability to maintain, protect and enhance our intellectual property;

26

• the outcomes of our initiatives that use artificial intelligence (“AI”), including the development, integration and effectiveness of AI-driven and autonomous (“agentic”) security capabilities within our solutions;

• the evolving threat landscape, including the increasing sophistication and frequency of cyberattacks, including those leveraging AI;

• costs associated with defending intellectual property infringement and other claims; and

• the future trading prices of our common stock and the impact of securities analysts’ reports on these prices.

These statements represent the beliefs and assumptions of our management based on information currently available to us. Such forward-looking statements are subject to risks, uncertainties and other important factors that could cause actual results and the timing of certain events to differ materially from future results expressed or implied by such forward-looking statements. Factors that could cause or contribute to such differences include, but are not limited to, those identified above, and those discussed in the section titled “Risk Factors” included under Part II, Item 1A. Furthermore, such forward-looking statements speak only as of the date of this report. Except as required by law, we undertake no obligation to update any forward-looking statements to reflect events or circumstances that occur after the date of this report.

As used in this report, the terms “Rapid7,” the “company,” “we,” “us,” and “our” mean Rapid7, Inc. and its subsidiaries unless the context indicates otherwise.

Overview

Rapid7 is a global leader in AI-powered managed cybersecurity operations, trusted to advance organizations’ cyber resilience. Open and extensible, the Rapid7 Command Platform integrates security data, enriching it with AI, threat intelligence, and 25 years of expertise and innovation to reduce risk and disrupt attackers. As a recognized leader in preemptive managed detection and response (MDR), Rapid7 unifies exposure and detection to transform the cybersecurity operations of customers worldwide. In today's rapidly evolving IT environment, customers are encountering escalating challenges due to the widening spectrum of attackers and techniques, including the proliferation of cyberattacks leveraging AI. We empower security professionals to manage a modern attack surface through our AI-driven technology, research, and broad, strategic expertise. Rapid7’s comprehensive security solutions, including our MDR services, next-gen security information and event management ("SIEM"), and exposure management help our global customers unify exposure management with threat detection and response to prioritize and reduce material risk, and eliminate threats with greater speed, precision, and consistency.

We believe that Rapid7 is poised to expand the capabilities of today's SecOps teams through our integrated, open data security operations platform which is powered by our AI-assisted workflows to AI-driven, machine-speed security operations. Rapid7 enables the Security Operations Center (“SOC”) to understand their fragmented attack surface through an attacker's perspective, thereby allowing them to proactively reduce exposures and better detect and respond to threats. Enriched by years of industry-leading risk research and managed services expertise, our integrated platform replaces reactive security with a preemptive, risk-aware approach that reduces attack surfaces and enables faster, more confident response through contextually rich insights and deep operational visibility.

In recent years, security leaders have increasingly prioritized consolidating fragmented point products into unified security operations platforms to improve visibility, operational efficiency, and risk outcomes. In 2022, Gartner reported that approximately 75% of organizations were pursuing security vendor consolidation as part of their SecOps strategies. This shift reflects mounting challenges associated with managing expanding attack surfaces, disconnected exposure data, escalating alert volume, and the need to continuously prioritize and respond to risk across complex environments. As a result, customers are seeking platforms that unify exposure management with threat detection and response, enabling them to identify where they are most vulnerable, anticipate how attackers may exploit those exposures, and respond with speed and precision. At the same time, customers are increasingly relying on MDR and adjacent managed services to deliver continuous expertise, higher-fidelity detection, and faster response outcomes that extend and augment internal SOC teams. In this context, organizations are prioritizing open, integrated security operations platforms that pair technology with expertise to deliver risk-aware detection and response across on-premise, cloud, identity, and external attack surfaces. We have been an active participant in advancing this shift toward consolidated SecOps by innovating across our open platform architecture, strengthening our exposure management and AI SOC capabilities, and expanding our managed services portfolio. As we continue to execute on our SecOps consolidation strategy, we are advancing innovation across our core platform capabilities and managed services to accelerate customer value and deliver a frictionless, integrated security operations experience.

As the threat landscape continues to grow in complexity, customers are demonstrating demand for integrated expertise to support them in effectively managing their security technologies. The convergence of these key trends – security consolidation, AI SOC capabilities, integrated cloud security, and expertise driven outcomes – forms the foundation of what our customers require for the modern SOC. Our focus is to be the leading provider of integrated, AI-driven security solutions infused with

27

human expertise for the modern SOC by providing risk-aware detection and response that outpaces attackers and strengthens security program maturity.

We market and sell our products and professional services to organizations of all sizes globally, including mid-market businesses, enterprises, non-profits, educational institutions and government agencies. Our customers span a wide variety of industries such as technology, energy, financial services, healthcare and life sciences, manufacturing, media and entertainment, retail, education, real estate, transportation, government and professional services. As of June 30, 2026, we had over 11,500 customers in 149 countries, including 34% of the Fortune 100. Our revenue was not concentrated with any individual customer and no customer represented more than 1% of our revenue for the three and six months ended June 30, 2026 and 2025.

Recent Developments

Restructuring Plan

In June 2026, we executed a limited restructuring activity designed to improve operational efficiencies and better align our workforce with current business needs. The restructuring included a reduction of our workforce primarily within our sales and marketing departments and, to a lesser degree, within our general and administrative business support departments. The restructuring activities are expected to be substantially completed by the end of the third

[Excerpt truncated for page length; source filing is linked above.]

Item 7. Management’s Discussion and Analysis of Financial Condition and Results of Operations.

The following discussion and analysis of our financial condition and results of operations should be read in conjunction with our consolidated financial statements and related notes appearing elsewhere in this Annual Report on Form 10-K. In addition to historical financial information, the following discussion contains forward-looking statements that reflect our plans, estimates and beliefs. Our actual results could differ materially from those contained in or implied by any forward-looking statements. Factors that could cause or contribute to these differences include those under “Risk Factors” included in Part I, Item 1A or in other parts of this Annual Report on Form 10-K.

Overview

Rapid7 is a global cybersecurity software and service provider on a mission to create a safer digital world by making cybersecurity simpler and more accessible. For more than twenty years, Rapid7 has partnered with enterprises across the globe representing a diverse range of industries to improve the efficacy and productivity of their security operations (“SecOps”). In today's rapidly evolving IT environment, customers are encountering escalating challenges due to the widening spectrum of attackers and techniques, including the proliferation of cyberattacks leveraging AI and targeted automation. We empower security professionals to manage a modern attack surface through our trusted AI infused technology, leading-edge research, and broad, strategic expertise. Rapid7’s comprehensive security solutions help our global customers unite exposure management with threat detection and response to reduce attack surfaces and eliminate threats with speed and precision.

Our Command Platform is anchored on our cloud security, security information and event management (“SIEM”), advanced detection and response, and vulnerability management offerings. Rapid7 enables the Security Operations Center (“SOC”) to understand their fragmented attack surface with attacker perspective, allowing them to proactively secure their attack surface and better detect and respond to threats. Enriched by years of managed services expertise, our integrated security operations platform enables SecOps teams to move away from a reactive approach, reduce their attack surface, and enhance response efficiency with a deep contextual understanding of their environment.

In the past few years, we have observed the industry undergoing a customer-driven shift to consolidated security platforms. As part of this transition, customers are moving away from cloud security as a specialized function towards cloud security as an integrated capability for SecOps teams. We view this as a demand driver for integrated SecOps, and believe that we have an opportunity to be a leader in delivering integrated risk and threat management across on-premise, cloud, and external attack surfaces. As we have shifted our strategic focus to SecOps consolidation, we are focused on continuing to drive innovation

38

Table of Contents

across our core products and capabilities to accelerate customer value and provide a frictionless and integrated cloud security experience.

As the threat landscape continues to grow in complexity, customers are demonstrating demand for integrated expertise to support them in effectively managing their security technologies. The convergence of these key trends – security consolidation, integrated cloud security, and expertise driven outcomes – are the foundation of what our customers require for the modern SOC. Our focus is to be the leading provider of integrated security operations solutions by providing exposure and threat management that leverages our ability to give customers command of their attack surface.

We market and sell our products and professional services to organizations of all sizes globally, including mid-market businesses, enterprises, non-profits, educational institutions and government agencies. Our customers span a wide variety of industries such as technology, energy, financial services, healthcare and life sciences, manufacturing, media and entertainment, retail, education, real estate, transportation, government and professional services. As of December 31, 2025, we had over 11,500 customers in 150 countries, including 36% of the Fortune 100. Our revenue was not concentrated with any individual customer and no customer represented more than 1% of our revenue for the years ended December 31, 2025, 2024 or 2023.

Our Business Model

We offer our products through a variety of delivery models to meet the needs of our diverse customer base, including:

•Cloud-based subscriptions, which provide our software capabilities to our customers through cloud access and on a subscription basis. Our Incident Command, Exposure Command, and Threat Command products are offered as cloud-based subscriptions, with an option for a one or multi-year term.

•Managed services, through which we operate our products and provide our capabilities on behalf of our customers. Our Managed Vulnerability Management, Managed Detection and Response, and Managed Application Security products are offered on a managed service basis, pursuant to one or multi-year agreements.

•Licensed on-premise software consists of term licenses. When licensed on-premise software is purchased, maintenance and support and content subscriptions, as applicable, are bundled with the license for the term period. Our Nexpose and Metasploit products are offered through term software licenses with an option for one or multi-year terms. Our maintenance and support provides our customers with telephone and web-based support and ongoing bug fixes and repairs during the term of the maintenance and support agreement, and our customers who purchase our Nexpose and Metasploit products also purchase content subscriptions, which provide them with real-time access to the latest vulnerabilities and exploits.

Additionally, we offer our products through our consolidation offerings, which unify our products and services to our customers in a single package. Our Threat Complete and Cloud Risk Complete packages are offered as cloud based subscriptions, with an option for a one or multi-year term. Our Managed Threat Complete Offering is offered on a managed service basis, generally pursuant to one or multi-year agreements.

For the years ended December 31, 2025, 2024 and 2023, recurring revenue, defined as revenue from term software licenses, content subscriptions, managed services, cloud-based subscriptions and maintenance and support, was 96%, 96%, and 95% respectively, of total revenue.

Immaterial Correction of an Error

During the fourth quarter of 2024, we identified an immaterial error related to stock-based compensation expense associated with certain restricted stock units (“RSUs”) and performance stock units (“PSUs”) granted during fiscal years 2023 and 2024 attributable to an improper valuation of the underlying awards, resulting in an understatement of stock-based compensation expense in 2023 and 2024. In accordance with Staff Accounting Bulletin (“SAB”) No. 99, Materiality, and SAB No. 108, Considering the Effects of Prior Year Misstatements when Quantifying Misstatements in Current Year Financial Statements, we evaluated the errors and determined the related impacts were not material to our consolidated financial statements for the prior periods when they occurred, but that correcting the cumulative errors in the period detected would have been material to our results of operations for that period. Accordingly, we revised previously reported comparative financial information presented herein for such immaterial errors. Refer to Note 19, Immaterial Correction of an Error, in the notes to our consolidated financial statements for further information.

39

Table of Contents

Components of Results of Operations

Revenue

We generate revenue primarily from selling products and professional services through a variety of delivery models to meet the needs of our diverse customer base.

Product Subscriptions

We generate product subscriptions revenue from the sale of (1) cloud-based subscriptions, (2) managed services offerings, which utilize our products and (3) software licenses with related maintenance and support and content subscription, as applicable. Software license revenue consists of revenues from term licenses. When software licenses are purchased, maintenance and support and content subscription, as applicable, are bundled with the license for the term period.

Professional Services

We generate professional service revenue from the sale of deployment and training services related to our products, incident response services and security advisory services.

Cost of Revenue

Our total cost of revenue consists of the costs of product subscriptions and professional services, as noted below. In addition, cost of revenue includes overhead costs for depreciation, facilities, IT, information security, and recruiting. Our IT overhead costs include IT personnel compensation costs and costs associated with our IT infrastructure. All overhead costs are allocated based on relative headcount.

Cost of Product Subscriptions

Cost of product subscriptions consists of personnel and related costs for our content, support, managed service and cloud operations teams, including salaries and other payroll related costs, bonuses, stock-based compensation and allocated overhead costs. Also included in cost of product subscriptions are software license fees, cloud computing costs and internet connectivity expenses directly related to delivering our products, amortization of contract fulfillment costs, as well as amortization of certain intangible assets including internally developed software.

Cost of Professional Services

Cost of professional services consists of personnel and related costs for our professional services team, including salaries and other payroll related costs, bonuses, stock-based compensation, costs of contracted third-party vendors, travel and entertainment expenses and allocated overhead costs.

We expect our cost of revenue to increase on an absolute dollar basis as we continue to grow our revenue over time.

Gross Margin

Gross margin, or gross profit as a percentage of revenue, has been and will continue to be affected by a variety of factors, including the average sales price of our products and services, transaction volume growth, the mix of revenue between software licenses, cloud-based subscriptions, managed services and professional services and changes in cloud computing costs.

We expect our gross margins to fluctuate over time depending on the factors described above.

Operating Expenses

Operating expenses consist of research and development, sales and marketing, general and administrative expenses, impairment of long-lived assets, and restructuring costs. Operating expenses include overhead costs for depreciation, facilities, IT, information security and recruiting. Our IT overhead costs include IT personnel compensation costs and costs associated with our IT infrastructure. All overhead costs are allocated based on relative headcount. In the near term, we expect our operating expenses to increase as a percentage of revenue as we prioritize investments to drive growth.

Research and Development Expense

Research and development expense consists of personnel costs for our research and development team, including salaries and other payroll related costs, bonuses and stock-based compensation. Additional expenses include third-party infrastructure costs,

40

Table of Contents

travel and entertainment, consulting and professional fees for third-party development resources as well as allocated overhead costs.

Sales and Marketing Expense

Sales and marketing expense consists of personnel costs for our sales and marketing team, including salaries and other payroll re

[Excerpt truncated for page length; the complete text is on the linked full-MD&A page.]