Rapid7 (RPD) Q1 2026 earnings review
Top-Line Contraction Accelerates Despite Earnings Beat
Rapid7 delivered a classic 'beat and raise' against a severely lowered bar, but the core business is reversing into contraction. Q1 revenue of $210M dipped 0.3% YoY, while Annualized Recurring Revenue (ARR) shrank 0.6% to $832M. While management highlighted strong Non-GAAP Operating Income of $24.4M and Free Cash Flow of $33.4M, the forward outlook is bleak. Q2 guidance projects a further decline in ARR to ~$820M (-2% YoY). The company's strategic pivot to AI-powered Managed Detection and Response (MDR) is currently unable to plug the holes left by rapid churn in the legacy Vulnerability Management segment.
🐂 Bull Case
Free Cash Flow remains robust at $33.4M in Q1, with FY26 guidance of $125-$135M. This cash generation supports the balance sheet and provides an operational floor while managing the convertible debt obligations.
The acquisition of Kenzo Security and the rollout of Exposure Command positions the company favorably for future vendor consolidation deals, provided GTM execution stabilizes.
🐻 Bear Case
ARR dropped $8M sequentially and is guided to drop another $12M in Q2. The core business is bleeding faster than the new strategic segments can grow.
A major sales overhaul and previous decisions to pull full-year ARR guidance signal profound near-term visibility issues and persistent execution risk.
⚖️ Verdict: 🔴
Bearish. While profitability and cash flow provide a floor, a SaaS company exhibiting sequentially shrinking ARR and negative YoY revenue growth is a broken growth story until the transition normalizes.
Key Themes
ARR Reverses into Contraction
Management's claim that Rapid7 'exceeded guidance expectations across all metrics' masks a deteriorating reality: the core business is shrinking. ARR dropped $8M sequentially to $832M, turning negative YoY (-0.6%) for the first time. The Q2 guidance of ~$820M implies an accelerating -2% YoY decline. This explicitly contradicts the positive narrative, revealing that rapid churn in the legacy Vulnerability Management segment is overwhelmingly outpacing growth in Detection and Response.
Kenzo Security Acquisition Adds Agentic AI
Rapid7 acquired Kenzo Security in March to integrate agentic AI into its Command Platform. This specific technology scales security investigations autonomously, shifting the SOC from reactive alert management to preemptive automation. This product enhancement is critical for Rapid7's strategy to win platform consolidation deals and justify higher price points against legacy competitors.
GTM Disruption and Visibility Loss
The company is undergoing a painful go-to-market overhaul under new commercial leadership. The disruption from re-aligning the sales force to push the Exposure Command platform is lengthening deal cycles and suppressing pipeline conversion. Having pulled full-year ARR guidance entirely in the previous quarter due to 'low visibility', the ongoing contraction indicates that management has not yet stabilized the sales motion.
Macroeconomic Scrutiny Lengthening Deal Cycles
Macroeconomic uncertainty remains a heavy anchor on the business. Management faces intense budget scrutiny, particularly within the North American mid-market segment. Because upgrading to the Exposure Command platform requires incremental budget, cash-strapped customers are increasingly treating the upgrade as a discretionary purchase, prolonging sales cycles and increasing the risk of slipped deals.
MDR Partner Expansion
To bypass direct sales bottlenecks, the company revamped its PACT Partner Program in March, adding a Platinum tier and streamlined deal motions. By incentivizing the channel to lead Managed Detection and Response (MDR) sales, Rapid7 is utilizing its partner ecosystem as a primary operational lever to restore pipeline volume and mitigate direct sales friction.
Other KPIs
Decelerating. Dropped significantly compared to the $32.4M generated a year ago (25Q1). Margin compressed to 11.6% from 15.4% YoY. This reflects a higher expense base from previous investments and seasonal costs, though it beat the heavily sandbagged $19-21M guidance. Management expects margins to recover toward the mid-teens later in the year.
Stable. Up from $24.7M in 25Q1, driven by $39.8M in operating cash flow. This solid cash generation allows the company to comfortably manage its convertible debt load and fund internal investments. Total cash and short-term investments stand at a robust $670M, providing a vital liquidity cushion while the company attempts its GTM turnaround.
Guidance
Reversing. This guidance points to a -2% YoY decline and a sequential destruction of $12M in ARR from Q1. This is a severe deterioration from the +3% YoY growth seen in 25Q2, underscoring that legacy churn continues to heavily outweigh new bookings in the Detection and Response portfolio.
Reversing. Implies a -2% to -3% YoY contraction compared to FY25's $860M. The lack of full-year ARR guidance combined with negative revenue growth expectations reflects profound uncertainty in the sales pipeline and the ongoing pain of the platform transition.
Decelerating. Down significantly from the $135.7M achieved in FY25. The implied FY26 margin of ~13.7% at the midpoint shows that negative operating leverage is taking hold as the top line shrinks, despite management's focus on operational discipline.
Key Questions
Legacy Churn Bottom
Given the $12M sequential drop implied in the Q2 ARR guidance, what is the specific retention rate of the legacy Vulnerability Management base, and when is the mathematical bottom expected?
Kenzo Integration Timing
How will the Kenzo Security acquisition technically accelerate the migration of customers to the Exposure Command platform, and when will that yield measurable ARR?
Cash Flow Sensitivity
You pulled full-year ARR guidance due to low visibility, yet maintained full-year FCF guidance. How sensitive is the FCF outlook to further deterioration in bookings?
Channel Effectiveness
With the PACT Partner Program updates, what percentage of net new ARR is expected to be partner-sourced by the end of the year to offset direct sales friction?