Rapid7 Q3 ARR Reaches $820 Million; Year-End Outlook at $812 Million

Rapid7 (NASDAQ: RPD) reported annualized recurring revenue of $820 million for the third quarter of 2026 and said it expects ARR to end the year at approximately $812 million, representing a 3% year-over-year decline. The cybersecurity software company also forecast lower fourth-quarter and full-year revenue while targeting about $130 million in free cash flow for 2026.

Rapid7 generated $46 million in non-GAAP operating income in the third quarter. The company served approximately 11,800 customers globally, with ARR per customer of about $69,000.

The presentation showed that ARR grew at a compound annual rate of 5% from the third quarter of 2022 through the third quarter of 2026. ARR per customer increased at a 2% compound annual rate over the same period.

Rapid7 defines ARR as the annual value of recurring revenue tied to active contracts at the end of the reporting period. The metric excludes professional-services revenue and does not account for anticipated contract terminations or other future events, meaning it should not be treated as a forecast of revenue.

Fourth-Quarter and Full-Year Outlook

For the fourth quarter, Rapid7 expects revenue of $208 million to $210 million, a year-over-year decline of between 4% and 3%. Non-GAAP operating income is projected at $40 million to $42 million, while non-GAAP diluted net income per share is expected to range from $0.53 to $0.55, based on approximately 82.1 million diluted weighted-average shares.

For full-year 2026, management forecasts revenue of $841 million to $843 million, down 2% year over year. Non-GAAP operating income is expected to be $140 million to $142 million, with non-GAAP diluted net income per share of $1.94 to $1.96. The full-year per-share forecast assumes approximately 79.6 million diluted weighted-average shares.

Rapid7 expects full-year free cash flow of approximately $130 million. The company defines free cash flow as operating cash flow less purchases of property and equipment and capitalized internal-use software costs.

The guidance excludes any potential impact from foreign-exchange gains or losses. Rapid7 also excludes stock-based compensation, amortization of acquired intangible assets, amortization of debt issuance costs and certain other items from its non-GAAP outlook. The company said it could not provide a forward-looking reconciliation to comparable GAAP measures without unreasonable effort because of the variability and limited visibility of those excluded charges.

Risks and Operating Priorities

Rapid7 identified stabilizing its core business and achieving durable growth as key execution priorities. Other uncertainties include demand for its products and services, subscription renewals, competition, sales cycles and its transition toward a consolidated platform sales approach.

The company also cited risks related to restructuring, cloud-solution sales, product accuracy, foreign-exchange movements and the integration of acquired businesses, including Kenzo Security. Its plans to develop and deploy artificial intelligence and automation capabilities remain subject to performance, reliability, security and customer-adoption risks, the presentation said.