What changed in this filing

/stocks — the workspaceLOADING

Item 1. Business

2022-02-24 compared with 2021-02-26 · 114 added, 75 removed, 254 unchanged (43% of the section changed)

1 unchanged sentence

Our solutions simplify the complex, allowing security teams to work more effectively with IT and development to reduce vulnerabilities, monitor for misconfigurations and malicious behavior, investigate and shut down attacks, and automate routine tasks.

In the 20 years that Rapid7 has been in business, security companies and trends have come and gone, while broader technology innovation continues to advance rapidly.

In the over 20 years that Rapid7 has been in business, security companies and trends have come and gone, while broader technology innovation continues to advance rapidly.

Every company is now a technology company, and rampant innovation inevitably creates security risk.

5 unchanged sentences

We call the expanding divide between risk created through innovation and risk effectively managed by security teams the security achievement gap.

We believe Rapid7 is uniquely positioned to improve how customer security challenges are addressed.

All of our solutions and services are built with and supported by the expertise of our dedicated team of security researchers and consultants, who bring knowledge of attacker behavior and emerging vulnerabilities directly to customers.

We believe Rapid7 is uniquely positioned to improve how security challenges are addressed.

Our solutions and services are built with and supported by the expertise of our dedicated team of security researchers, expert SOC analysts and consultants, who bring knowledge of attacker behavior and emerging vulnerabilities directly to customers.

We also continue to invest in further simplifying our technology to improve usability, lowering the barrier for teams and organizations who lack resources to manage their security posture.

9 unchanged sentences

We offer products across multiple pillars on our Insight Platform:

• Vulnerability Risk Management:

Our industry-leading Vulnerability Risk Management (VRM) solutions provide clarity into risk across traditional and modern IT environments, and the capabilities and data to influence remediation teams and track progress.

With built-in risk prioritization, IT-integrated remediation projects, tracking of goals and service level agreements, and pre-built automation workflows, our solutions are designed to not just enumerate risk, but also accelerate risk mitigation.

• Incident Detection and Response:

Our industry-leading Incident Detection and Response (IDR) solutions are designed to enable organizations to rapidly detect and respond to cyber security incidents and breaches across physical, virtual and cloud assets.

Equipped with user behavior analytics (UBA), attacker behavior analytics (ABA), network traffic analysis (NTA), end-point detection and response (EDR) and deception technology, our Security Information and Event Management (SIEM) solution is designed to provide comprehensive network visibility and accelerate threat investigation and response.

• Application Security:

Our Application Security offerings provide dynamic application security testing and run-time application security monitoring and protection solutions that are designed to continuously analyze web applications for security vulnerabilities throughout a customer’s software development life cycle.

Our industry-leading Incident Detection and Response (IDR) solutions are designed to enable organizations to rapidly detect and respond to cybersecurity incidents and breaches across physical, virtual, and cloud assets.

Equipped with user behavior analytics (UBA), attacker behavior analytics (ABA), network traffic analysis (NTA), end-point detection and response (EDR) and deception technology, our Extended Detection and Response (XDR) solution is designed to provide comprehensive network visibility and accelerate threat investigation and response.

• Cloud Security:

1 unchanged sentence

By combining continuous real-time monitoring with automation, our solutions quickly assess an organization's security and compliance posture and automate remediation of misconfigurations and policy violations to help deliver continuous security and compliance across multi-cloud environments.

• Vulnerability Risk Management:

With built-in risk prioritization, IT-integrated remediation projects, tracking of goals and

service level agreements, and pre-built automation workflows, our solutions are designed to not just enumerate risk, but also accelerate risk mitigation.

• Application Security:

• Threat Intelligence:

Our advanced external threat intelligence tool finds and mitigates threats by proactively monitoring thousands of sources across the clear, deep, and dark web.

By providing actionable, real-time information on threats outside their infrastructure coupled with automated remediation capabilities, customers have visibility to tailored threats and can make informed decisions.

• Security Orchestration and Automation Response:

Our Security Orchestration and Automation Response (SOAR) solutions allow security teams to connect disparate solutions within their cyber security, IT and development operations and build automated workflows, without requiring code, to eliminate repetitive, manual and labor-intensive tasks, resulting in measurable time and cost savings.

Our Security Orchestration and Automation Response (SOAR) solutions allow security teams to connect disparate solutions within their cybersecurity, IT and development operations and build automated workflows, without requiring code, to eliminate repetitive, manual and labor-intensive tasks, resulting in measurable time and cost savings.

Finally, to complement our products, we offer a range of managed services based on our software solutions and professional services, including penetration testing services, incident response services, security advisory services, and deployment and training.

1 unchanged sentence

Our cloud-native Insight Platform is at the core of our product offerings.

The platform was built using our extensive experience in collecting and analyzing data to enable our customers to create and manage analytics-driven cyber security risk management programs.

The platform was built using our extensive experience in collecting and analyzing data to enable our customers to create and manage analytics-driven cybersecurity risk management programs.

By utilizing our powerful, proprietary analytics to assess and understand the context and relationships around users, IT assets and cyber threats within a customer’s environment, our solutions make it easier for teams to identify and remediate vulnerabilities, monitor for misconfigurations and malicious behavior, investigate and shutdown attacks, and automate operations.

21 unchanged sentences

As organizations grow and infrastructure becomes more complex, maintaining visibility into attack surface becomes more challenging.

Our platform directly integrates with Project

Sonar, a Rapid7 research project that regularly scans the public internet, to gain insights into global exposure to common vulnerabilities.

Our platform directly integrates with Project Sonar, a Rapid7 research project that regularly scans the public internet, to gain insights into global exposure to common vulnerabilities.

This capability also enables security professionals to identify previously unknown, externally facing assets connected to the internet.

Increasing IT environment complexity coupled with a severe lack of cyber security professionals is overwhelming security and IT teams, who are struggling to deal with false positives and maintain adequate levels of cyber security.

Increasing IT environment complexity coupled with a severe lack of cybersecurity professionals is overwhelming security and IT teams, who are struggling to deal with false positives and maintain adequate levels of cybersecurity.

Our Insight Platform addresses these challenges with the following features:

14 unchanged sentences

With a highly specialized team of penetration testing, incident response, threat hunting and security operation center experts, we believe we are uniquely positioned to stay ahead of emerging threats and help detect threats quickly across a customer’s entire IT ecosystem.

Our Insight Platform unites technology stacks and allows security operations teams to connect disparate solutions within their cyber security, IT and development operations.

Our Insight Platform unites technology stacks and allows security operations teams to connect disparate solutions within their cybersecurity, IT and development operations.

• Built-in Workflows:

3 unchanged sentences

• Highly Customizable:

The Insight Platform not only has a wide range of pre-built workflows and integrations, it is also highly extensible.

The Insight Platform not only has a wide range of pre-built workflows and integrations, but it is also highly extensible.

With approximately 500 plugins to connect security tools and easily customizable connect-and-go workflows, the Insight Platform frees up security teams to tackle other challenges, while still leveraging human decision points when it is most critical.

3 unchanged sentences

We offer the following cloud products across the main pillars of Security Operations (SecOps):

Utilizing the power of our Insight Platform, InsightVM is designed to provide a fully available, scalable, and efficient way to collect vulnerability data, prioritize risk and automate remediation.

InsightVM is designed to provide prioritized guidance based on customized threat models;

dynamic live dashboards that are easily customizable and queried;

lightweight agents for continuous visibility;

integration with cloud services, virtual infrastructure and container repositories such as dockers;

in-product integration with solutions such as ServiceNow, IBM Bigfix, Microsoft SCCM and Jira ticketing systems;

and remediation workflow for assigning and tracking remediation progress within the product.

Embedded workflows also allow Security and IT teams to automatically deploy compensating controls for vulnerabilities that cannot be patched.

InsightVM is offered through a cloud-based subscription or as a managed service.

The managed service is known as Managed Vulnerability Risk Management, which provides our resource constrained customers with a fully outsourced option for leveraging our innovation, expertise and technology.

InsightIDR, our Incident Detection and Response (IDR) solution, is designed to enable organizations to rapidly detect and respond to cyber security incidents and breaches across physical, virtual and cloud assets.

InsightIDR, our Incident Detection and Response (IDR) solution, is designed to enable organizations to rapidly detect and respond to cybersecurity incidents and breaches across physical, virtual and cloud assets.

InsightIDR unifies SIEM, UBA, and endpoint detection to detect stealthy attacks across today’s complex networks.

1 unchanged sentence

In addition to identifying stealthy attacks often missed by other solutions, InsightIDR focuses the security team on issues that warrant investigation and reduces the time to investigate with its user correlation, powerful search and endpoint interrogation capabilities.

InsightIDR is designed to provide a cost-effective response to the need for SIEM.

InsightIDR is designed to provide a cost-effective response to the need for a modern SIEM or XDR solution.

With our Metasploit community, research and incident response services, we are continually studying and identifying the latest attacker methods.

14 unchanged sentences

When attacks are found, customers are promptly informed of all known details and our team moves to incident response, providing security teams with detailed, easy-to-follow remediation steps tailored to the environment.

InsightCloudSec:

InsightCloudSec, our cloud-native security platform, enables customers to drive digital transformation while continuously identifying and remediating security and compliance issues in their public cloud environments.

InsightCloudSec is a fully-integrated solution that integrates posture management, workload protection, infrastructure entitlements management, infrastructure-as-code security, and Kubernetes protection.

It helps Security and DevOps teams surface risk in complex multi-cloud and container environments, shift their cloud security program earlier in the development lifecycle, and automate workflows to speed up remediation and implement cost-saving efforts.

Integrating best-of-breed technologies, InsightCloudSec provides unified visibility and robust context across multi-cloud environments to analyze, prioritize, and remediate issues as they arise.

By performing real-time, continuous discovery and analysis of cloud and container resources, we allow customers to identify security risks, threats and policy compliance violations such as data breaches, malicious insiders, account hijacking, insecure interfaces, and weak authentication.

InsightCloudSec then takes automatic action to remediate identified issues based on user-defined and/or automated parameters before they are exploited by a malicious actor.

InsightCloudSec is offered through a cloud-based subscription.

Utilizing the power of our Insight Platform, InsightVM is designed to provide a fully available, scalable, and efficient way to collect vulnerability data, prioritize risk and automate remediation.

InsightVM is designed to provide prioritized guidance based on customized threat models;

dynamic live dashboards that are easily customizable and queried;

lightweight agents for continuous visibility;

integration with cloud services, virtual infrastructure and container repositories such as dockers;

in-product integration with solutions such as ServiceNow, IBM Bigfix, Microsoft SCCM and Jira ticketing systems;

and remediation workflow for assigning and tracking remediation progress within the product.

Embedded workflows also allow Security and IT teams to automatically deploy compensating controls for vulnerabilities that cannot be patched.

InsightVM is offered through a cloud-based subscription or as a managed service.

InsightAppSec:

13 unchanged sentences

InsightConnect is our SOAR solution that is used by security professionals to connect their many disparate solutions and automate workflows to increase the speed with which they can identify risk and respond to incidents.

With a growing library of approximately 300 plugins to connect tools and easily customizable connect-and-go workflows, it allows our customers to automate manual and tedious tasks, while still leveraging their expertise when it is most critical, thereby saving time and improving efficiency.

With a growing library of over 500 integration plugins and easily customizable pre-built workflows, it allows our customers to automate manual and tedious tasks, while still leveraging their expertise when it is most critical, thereby saving time and improving efficiency.

InsightConnect is offered on a cloud-based subscription basis.

Other Products

DivvyCloud is a Cloud Security Posture Management solution designed to minimize security and compliance risk for an organization’s cloud infrastructure.

DivvyCloud performs real-time, continuous discovery and analysis of cloud and container infrastructure resources allowing customers to identify security risks, threats and policy compliance violations such as

data breaches, malicious insiders, account hijacking, insecure interfaces, and weak authentication.

The product then takes automatic action to remediate identified security and compliance issues based on user-defined and/or automated parameters before they are exploited.

DivvyCloud is offered on a term license subscription basis.

Threat Intelligence:

Threat Intelligence finds and mitigates threats by proactively monitoring thousands of sources across the clear, deep, and dark web.

Threat Intelligence is offered on a cloud-based subscription basis.

Nexpose is an on-premise version of our Vulnerability Risk Management solution, that enables customers to assess and remediate their overall exposure to cyber risk across their increasingly complex IT environments.

6 unchanged sentences

We also offer Metasploit Pro, the commercial penetration testing software based on the Metasploit framework, through term-based software licenses.

InsightOps simplifies IT infrastructure monitoring and troubleshooting by centralizing data from across a customer’s network into one secure location.

With scalable and cost-effective architecture and the ability to bring together asset visibility and log management, InsightOps enables organizations to store and search structured, semi-structured and unstructured data in real time, enabling DevOps and IT professionals to centralize, search and monitor their log data in order to investigate anomalies, troubleshoot issues and conduct root cause analysis.

InsightOps is offered on a cloud-based subscription basis.

Professional Services

1 unchanged sentence

We believe that our role as trusted advisor helps drive better security outcomes for our customers, as well as loyalty and further usage of our products.

Our professional services offerings include, but are not limited to, Penetration Testing, Cyber Security Maturity Assessments, Security & Incident Response Program Development Services, IoT & Internet Embedded Device testing as well as Threat Modeling, TableTop Exercises and Incident Response services.

Our professional services offerings include, but are not limited to, Penetration Testing, Cybersecurity Maturity Assessments, Security & Incident Response Program Development Services, IoT & Internet Embedded Device testing as well as Threat Modeling, TableTop Exercises and Incident Response services.

In addition, we offer deployment and training services related to our platform, to further help customers operationalize and customize their platform experience.

For example, our Cyber Security Maturity Assessments provide our customers with a view of their current security posture, an objective review of their existing plans, and a guide to their strategic planning.

For example, our Cybersecurity Maturity Assessments provide our customers with a view of their current security posture, an objective review of their existing plans, and a guide to their strategic planning.

By accessing our security talent, we help organizations develop an approach and road map to further mature and strengthen their program efforts - often simplifying the otherwise complex.

9 unchanged sentences

We see significant opportunity to deepen our relationship with our existing customers.

With a strong focus on customer experience, satisfaction, and the value proposition of our Insight Platform, we intend to expand customers' usage of products they own (upsell) and help them adopt additional products (cross-sell).

With a strong focus on customer experience, satisfaction, and the value proposition of our

Insight Platform, we intend to expand customers' usage of products they own (upsell) and help them adopt additional products (cross-sell).

• Further strengthen our customer renewal rate:

10 unchanged sentences

Sales, Customer Support, and Marketing

We sell our solutions through direct inside and field sales team and indirect channel partner relationships.

Our sales teams focus on both new customer acquisition as well as up-selling and cross-selling additional offerings to our existing customers.

We sell our solutions through direct inside and field sales teams and indirect channel partner relationships.

Our sales teams focus on both new customer acquisition as well as upselling and cross-selling additional offerings to our existing customers.

Our sales teams are organized by geography, consisting of the Americas;

1 unchanged sentence

and Asia Pacific (APAC), as well as by target organization size.

Our sales team consists of a mix of inside sales and field sales professionals, that sell to small, medium and large enterprise customers.

Our sales team consists of a mix of inside sales and field sales professionals, that sell to small, medium and large customers.

Our highly technical sales engineers help define customer use cases, manage solution evaluations and train channel partners.

3 unchanged sentences

We generated 52%, 47%, and 43% of sales from channel partners, in 2021, 2020, and 2019, respectively.

Our revenue is not concentrated with any individual channel partner.

No channel partner represented more than 10% of our revenue in 2020, 2019 or 2018.

Our revenue is not concentrated with any individual channel partner as no channel partner represented more than 10% of our revenue in 2021, 2020 or 2019.

Customer Support:

9 unchanged sentences

Our technical and engineering team monitors and tests our products on a regular basis, and we maintain a regular release process to refine, update, and enhance our existing products.

We also have a team of experienced security researchers who work to keep us abreast of the latest developments in the cyber security landscape.

We also have a team of experienced security researchers who work to keep us abreast of the latest developments in the cybersecurity landscape.

Our research and development teams are located in our offices in Boston, Massachusetts;

5 unchanged sentences

Belfast, Northern Ireland;

and Stockholm, Sweden, providing us with a broad, worldwide reach to engineering talent.

Tel Aviv, Israel and Stockholm, Sweden, providing us with a broad, worldwide reach to engineering talent.

Metasploit Community:

1 unchanged sentence

This online security community provides us with a robust and growing network of active users and influencers who promote the usage of our software.

Security researchers contribute modules to the Metasploit Framework that serve as a resource about real-world attacker techniques.

Security researchers contribute modules to the Metasploit Framework that serve as a resource about real-world

attacker techniques.

The community also provides us with near real-time visibility into new cyber attacks as they occur and a deep understanding of attacker behaviors.

2 unchanged sentences

This data is used for security research, product development, and across our services to help protect and inform our customers, partners and community.

We share this data with validated educational

and private security researchers, research partners, vetted threat sharing communities, and organizational security teams through our Open Data portal to foster collaboration and encourage discovery of new insights.

We collect data for research purposes through two key areas:

We share this data with validated educational and private security researchers, research partners, vetted threat sharing communities, and organizational security teams through our Open Data portal to foster collaboration and encourage discovery of new insights.

We collect data for research purposes through a few key areas:

Attacker Intelligence:

8 unchanged sentences

The Under the Hoodie report sheds light on the art of penetration testing by revealing not just the process, techniques and tools that go into it, but also revealing the real-world experience of our engineers and investigators, gathered over thousands of penetration tests.

Velociraptor Open Source DFIR:

Velociraptor is a unique, advanced open-source endpoint monitoring, digital forensic and cyber response platform.

It was developed by Digital Forensic and Incident Response (DFIR) professionals who needed a powerful and efficient way to hunt for specific artifacts and monitor activities across fleets of endpoints.

Velociraptor provides you with the ability to more effectively respond to a wide range of digital forensic and cyber incident response investigations and data breaches such as:

• Reconstruct attacker activities through digital forensic analysis

• Hunt for evidence of sophisticated adversaries

• Investigate malware outbreaks and other suspicious network activities

• Monitor continuously for suspicious user activities, such as files copied to USB devices

• Discover whether disclosure of confidential information occurred outside the network

• Gather endpoint data over time for use in threat hunting and future investigations

Velociraptor’s power and flexibility comes from the Velociraptor Query Language (VQL).

VQL is a framework for creating highly customized artifacts, which allow you to collect, query, and monitor almost any aspect of an endpoint, groups of endpoints, or an entire network.

It can also be used to create continuous monitoring rules on the endpoint, as well as automate tasks on the server.

Our Customers

Our customer base has grown from approximately 8,000 customers at the end of 2019 to more than 10,000 customers as of December 31, 2021, in 142 countries, including 44% of the organizations in the Fortune 100.

We define a customer as any entity that has (1) an active Rapid7 contract or a contract that expired within 90 days or less of the applicable measurement date;

and for Logentries products, those customers with a contract value equal to or greater than $2,400 per year, or (2) purchased Rapid7 professional services within the 12 months preceding the applicable measurement date.

We define a customer as any entity that has an active Rapid7 recurring revenue contract as of the specified measurement date, excluding InsightOps and Logentries only customers with a contract value less than $2,400 per year.

Our customers span a wide variety of industries including technology, energy, financial services, healthcare and life sciences, manufacturing, media and entertainment, retail, education, real estate, transportation, government and professional services, with customers in the services industry representing our largest industry in 2021 at 17% of our revenue.

4 unchanged sentences

Our primary competitors in Vulnerability Risk Management include Qualys and Tenable;

in Incident Detection and Response (SIEM) include Splunk, Micro Focus, LogRhythm and Microsoft (Sentinel);

in Incident Detection and Response include Splunk, Micro Focus, LogRhythm and Microsoft (Sentinel);

in Application Security include Micro Focus and IBM;

in Security Orchestration and Automation Response include Phantom (Splunk) and Demisto (Palo Alto Networks);

in Cloud Security include Prisma (Palo Alto Networks) and CloudGuard (Check Point Software Technologies) and finally, while the competition in our professional services business is diverse, our competitors include FireEye’s Mandiant, SecureWorks and NCC Group.

in Security Orchestration and Automation Response include Splunk and Palo Alto Networks;

in Cloud Security include Palo Alto Networks and Check Point Software Technologies;

in Threat Intelligence include Recorded Future and Digital Shadows and finally, while the competition in our professional services business is diverse, our competitors include Mandiant, SecureWorks and NCC Group.

We compete on the basis of a number of factors, including:

11 unchanged sentences

We are subject to various federal, state and international laws and regulations that affect our business, including those relating to the privacy and security of customer and employee personal information and export or import of our products to certain countries, governments or entities.

Additional laws in all of these areas are likely to be passed in the future, which could result in significant limitations on or changes to the ways in which we can collect, use, host, store or transmit the personal information and data of our customers or employees, communicate with our customers, and deliver products and services, may significantly increase our compliance costs.

Intellectual Property

11 unchanged sentences

In order to continue to innovate, compete and succeed in our highly competitive and rapidly evolving market, it is crucial that we continue to attract and retain experienced employees.

As part of these efforts, we strive to offer a competitive compensation and benefits program, foster a community where everyone feels included and empowered to do their best work, and give employees the opportunity to give back to their communities and make a social impact.

As part of these efforts, we strive to offer a competitive

compensation and benefits program, foster a community where everyone feels included and empowered to do their best work, and give employees the opportunity to give back to their communities and make a social impact.

As of December 31, 2021, we had 2,353 full-time employees, including 432 in product and service delivery and support, 889 in sales and marketing, 736 in research and development and 296 in general and administrative.

As of December 31, 2020, we had 1,316 full-time employees in the United States and 531 full-time employees internationally.

As of December 31, 2021, we had 1,518 full-time employees in the U.S.

and 835 full-time employees internationally.

None of our U.S.

8 unchanged sentences

In response to the COVID-19 pandemic, we implemented significant changes that we determined were in the best interest of our employees as well as the communities in which we operate.

This includes having the vast majority of our employees work from home, while implementing additional safety measures for employees continuing critical on-site work.

Initially, this included having the vast majority of our employees work from home while implementing additional safety measures, including regular testing for employees continuing critical on-site work.

In 2021, we began to selectively reopen certain offices in a phased approach and to hold in-person or hybrid meetings, on a voluntary basis, taking into consideration government restrictions and employee safety.

Moving forward we intend to continue with a hybrid work model through which we balance our view that the office remains a critical environment for mentorship, career development and the kinds of lasting bonds that create a great work culture, with flexibility and trust in our employees to work with their teams to find the right model that allows for us to deliver for our customers.

Talent Development

We believe in investing in the growth and development of all of our employees so they may build the career experience of their lifetime.

“Never Done” is one of our core values, and our employees take advantage of a myriad of opportunities for continuous learning, both through internal training and development programs, on-demand learning modules, and access to content-specific curriculum based on need and interest.

We have designed and implemented learning experiences for our employees at every stage of their careers.

This includes our tailored leadership development programs for both non-technical and technical leaders.

Both programs align to our core values and promote the leadership skills and behaviors we believe are critical to the success of our mission, customers, and development of our people.

As a supporter of a promote-from-within culture, we actively mentor and invest in the pipeline of our future leaders by providing pathways for growth, development, and promotion on an ongoing basis through our early leader programs.

Additionally, new employees engage in our 90-day onboarding experience, Making the Band, which is intended to support the embodiment of our core values, and shorten their time to create impact.

To supplement our internal programs, as well as provide opportunities for independent study, employees have access to online education tools to build the necessary skills related to one’s role and a digital library curated for our employees.

To further invest in the future of cybersecurity and to deliver on our company mission, we are continuing to strengthen our programming for emerging talent and early career individuals.

Building this programming will support individuals in our various programs that offer early career opportunities.

Diversity, Equity and Inclusion

We believe that a company culture focused on diversity and inclusion is a key driver of creativity and innovation and that diverse and inclusive teams make better business decisions, which ultimately drive better business outcomes.

We are committed

to recruiting, retaining and developing high-performing, innovative and engaged employees with diverse backgrounds and experiences.

In 2018, we launched a diversity initiative to increase the number of under-represented groups (women and people of color) to fifty percent of the employee base in the United States by the end of 2020.

We undertook to promote transparency by publishing our workforce demographic data internally and to increase thoughtful discussions across the Company, including holding unconscious bias training for our employees, further expanding efforts to recruit under-represented groups through referrals and by expanding beyond the traditional networks from which we recruited.

We are committed to recruiting, retaining and developing high-performing, innovative and engaged employees with diverse backgrounds and experiences.

Several years ago, we set out to ensure we were creating a more diverse workforce population, while simultaneously ensuring we are creating the best possible environment for everyone to thrive.

Specifically, we sought to increase the number of under-represented groups (in particular women and people of color) to 50% of the employee base in the U.S.

Having achieved those goals, we have since adapted our focus and progress to increase our global population of women from 29% as of December 31, 2020 to 35% by December 31, 2022.

Additionally, we are investing in our recruiting and retaining of employees who identify as Black, Latinx or multi-racial, with the goal of increasing our U.S.

population of this demographic from 13% as of December 31, 2020 to 18% by December 31, 2022.

We undertook to promote transparency by publishing our workforce demographic data and increasing thoughtful discussions across the Company, including unconscious

bias training for our employees.

In addition, we expanded our efforts to recruit under-represented groups through referrals and beyond the traditional networks from which we previously recruited.

We are also focused on identifying and promoting diverse leaders through the organization at all levels and signed the Corporate Parity Pledge, which includes, among other things, a commitment to interview at least one woman and one person of color for every open role at the vice president level and above.

We have also directed our talent acquisition team to take the further step of interviewing at least one woman and/or person of color for every role we hire for.

These efforts yielded results.

At the end of 2020, we increased the percent of under-represented employees in the U.S.

to over 49%, with over 4% increases in each of the percent of women and the percent of people of color.

Additionally, in 2020, we completed a comprehensive employee pay equity survey for our U.S.

employees, with outside advisors using regression models to determine that women and people of color at Rapid7 were not paid less for the same job, level, and location, controlling for pay differentiators such as performance and tenure/experience.

We intend to conduct an analysis like this every few years.

Community Involvement

We aim to give back to the communities where we live and work, and believe that this commitment helps in our efforts to attract and retain employees.

Community Involvement & The Rapid7 Cybersecurity Foundation

We give back to the communities where we live and work, and believe that this commitment helps in our efforts to attract and retain employees.

We partner with a variety of STEM and inclusion-focused programs to promote technology education for all.

Beyond contributions of cash, we encourage employee volunteerism at all our locations by both designating a global day of service each fall, as well as more concentrated work throughout the year.

In 2020, working with the Tides Foundation, we created and funded the Rapid7 for Good Fund to direct charitable contributions to community organizations that focus on STEM education and diversity, equity and inclusion in technology, and in particular, cybersecurity.

Beyond contributions of cash, we encourage employee volunteerism at all our locations.

In 2021, working with the Tides Foundation, we paid out nearly $0.3 million to organizations, principally those engaged in helping create a more diverse and inclusive technology workforce, through the Rapid7 for Good Fund.

In 2021, we also formed the Rapid7 Cybersecurity Foundation .

The Foundation’s mission, which aligns closely to that of Rapid7, is to help close the cybersecurity achievement gap by promoting a more diverse and inclusive cyber workforce;

supporting free and open cybersecurity solutions;

and advocating for those that often lack a voice in advancing security.

We seeded the Foundation with $1.0 million.

Corporate Information

10 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1. Business