Rapid7 (NASDAQ: RPD) reported second-quarter fiscal 2026 revenue of $210.9 million, down approximately 1.5% year over year. The cybersecurity firm generated $28.9 million in non-GAAP operating income, exceeding internal guidance despite a decline in total Annual Recurring Revenue (ARR).

Financial Performance

The company’s total ARR stood at $824 million at the end of the quarter. While the core platform solutions—comprising detection and response and exposure management—represented over 80% of overall ARR and grew approximately 1% year over year, non-core products declined. This drag from non-core offerings drove the sequential decline in total ARR.

Non-GAAP gross margins contracted by approximately 215 basis points year over year to 71.7%. Management attributed this compression to increased staffing costs for Global Security Operations Centers and higher cloud usage for product improvements. Despite the gross margin pressure, the company achieved a non-GAAP operating margin of 13.7%.

Strategic Restructuring

Rapid7 announced a restructuring plan impacting approximately 12% of its workforce. The company expects to incur restructuring charges of $10 million to $11 million, primarily paid throughout the third and fourth quarters of 2026. These charges will be excluded from non-GAAP profit and loss results but will impact free cash flow.

CEO Wael Mohamed emphasized that the transformation focuses on de-emphasizing non-core products to reinvest in AI-driven solutions and core platform enhancements. The goal is to exit 2026 with a 20% non-GAAP operating margin.

Guidance and Balance Sheet

For the third quarter of 2026, Rapid7 expects total revenue between $208 million and $210 million, representing a year-over-year decline of approximately 4% at the midpoint. Non-GAAP operating income is projected at $34 million to $36 million.

Full-year fiscal 2026 guidance was updated to expect total revenue of $837 million to $841 million and non-GAAP operating income of $129 million to $133 million. Free cash flow is expected to remain approximately $130 million for the full year.

As of the end of the second quarter, Rapid7 held $702.6 million in cash, cash equivalents, and short-term investments. Combined with an undrawn credit facility of $200 million, the company stated it is positioned to repay its $600 million convertible notes due in March 2027.

What the Numbers Show

The divergence between core and non-core performance highlights the strategic pivot. Core platform solutions, which constitute over 80% of ARR, grew 1% year over year, led by the detection and response business growing approximately 5%. In contrast, non-core products, making up less than 20% of ARR, declined and drove the sequential drop in total ARR. This concentration suggests that future growth metrics will be heavily dependent on the execution of the core platform strategy and the successful migration of customers away from legacy non-core solutions.

Rapid7, Inc. (NASDAQ: RPD) will participate in three upcoming investor conferences in September 2026. The cybersecurity company scheduled presentations at the Citi Global TMT Conference and the Piper Sandler Growth Frontiers Conference, alongside one-on-one meetings at the Wolfe Research TMT Conference.

Conference Schedule

The company outlined its engagement timeline across New York, San Francisco, and Nashville. All presentations will be webcast live, with replays available for a limited time on the company’s investor relations website.

About Rapid7

Rapid7 describes itself as a global leader in AI-powered managed cybersecurity operations. The Rapid7 Command Platform integrates security data with AI and threat intelligence to serve more than 11,500 customers worldwide. The company focuses on preemptive managed detection and response (MDR) to advance cyber resilience.