Understand any stock in simple English
Enter a ticker to learn what the company does and how it makes money.
Rapid7 sells software that helps companies find weaknesses in their computer systems and spot attacks while they are happening.
Rapid7 is a cybersecurity company. It sells tools that let a company's security team see what computers, servers, and cloud accounts they own, find the holes an attacker could crawl through, and watch for break-ins in real time. Its two big product families are vulnerability management — scanning systems for weak spots and telling the team what to patch first — and detection and response, which watches network traffic and logs for signs of an actual attack.
The customers are mostly businesses and government agencies with IT departments big enough to care about this stuff, from mid-sized firms to large enterprises. They pay Rapid7 a subscription, usually yearly, for the software and the cloud service behind it. The pitch is consolidation: instead of buying one tool to scan for weaknesses, another to watch the network, and a third to manage employee laptops, a customer can buy one platform from one vendor and see everything in one place. Competitors include much larger players like Palo Alto Networks, CrowdStrike, and Microsoft, and Rapid7's pitch is that it is simpler and often cheaper to run than stitching those pieces together. The business runs on recurring subscription revenue, which is the good kind — predictable, and it stacks up as customers renew and add more. Rapid7 has grown steadily but not explosively, and it has often spent more than it earned while chasing growth, which is why profitability has been a running argument among investors. Its managed detection and response service, where Rapid7's own analysts watch a customer's network for them, has been a growing piece because smaller security teams would rather rent the expertise than hire it.
Rapid7 was founded in 2000 and went public in 2015. It is based in Boston, a well-known cybersecurity hub. The company also owns the Metasploit project, a famous tool that security researchers use to test whether a vulnerability can actually be exploited — a bit like a locksmith's pick set that Rapid7 gives to the good guys. The awkward truth about this business is that demand is reliable, since attacks never stop, but competition is brutal and the big platform vendors keep bundling more for less.
Saved answer · last researched 26 Oct 2026