What changed in this filing

/stocks — the workspaceLOADING

Item 1. Business

2023-02-24 compared with 2022-02-24 · 84 added, 84 removed, 284 unchanged (37% of the section changed)

Rapid7 is advancing security with visibility, analytics, and automation delivered through our Insight Platform.

Our solutions simplify the complex, allowing security teams to work more effectively with IT and development to reduce vulnerabilities, monitor for misconfigurations and malicious behavior, investigate and shut down attacks, and automate routine tasks.

Rapid7 is on a mission to create a safer digital world by making cybersecurity simpler and more accessible.

We empower security professionals to manage a modern attack surface through our best-in-class technology, leading-edge research, and broad, strategic expertise.

Our comprehensive security solutions help our customers unite cloud risk management and threat detection to reduce attack surfaces and eliminate threats with speed and precision.

In the over 20 years that Rapid7 has been in business, security companies and trends have come and gone, while broader technology innovation continues to advance rapidly.

26 unchanged sentences

• Vulnerability Risk Management:

Our industry-leading Vulnerability Risk Management (VRM) solutions provide clarity into risk across traditional and modern IT environments, and the capabilities and data to influence remediation teams and track progress.

With built-in risk prioritization, IT-integrated remediation projects, tracking of goals and

service level agreements, and pre-built automation workflows, our solutions are designed to not just enumerate risk, but also accelerate risk mitigation.

Our industry-leading Vulnerability Risk Management (“VRM”) solutions provide clarity into risk across traditional and modern IT environments, and the capabilities and data to influence remediation

teams and track progress.

With built-in risk prioritization, IT-integrated remediation projects, tracking of goals and service level agreements, and pre-built automation workflows, our solutions are designed to not just enumerate risk, but also accelerate risk mitigation.

• Application Security:

26 unchanged sentences

Network flow data illuminates environments and helps accelerate investigations.

Our lightweight Network Sensor passively analyzes raw traffic to increase visibility into user activity, pinpoint real threats, and accelerate investigation with granular detail of attacker movement.

Our lightweight Network Sensor passively analyzes raw traffic to increase visibility into user activity, pinpoint real threats, and accelerate investigations with granular detail of attacker movement.

• Cloud and Virtual Infrastructure Assessment:

34 unchanged sentences

We offer the following cloud products across the main pillars of Security Operations (“SecOps”):

InsightIDR, our Incident Detection and Response (IDR) solution, is designed to enable organizations to rapidly detect and respond to cybersecurity incidents and breaches across physical, virtual and cloud assets.

InsightIDR unifies SIEM, UBA, and endpoint detection to detect stealthy attacks across today’s complex networks.

InsightIDR, our unified extended detection and response (“XDR”) and next-gen security information and event management (“SIEM”) solution, is designed to enable organizations to rapidly detect and respond to cybersecurity incidents and breaches across the entirety of their modern environment.

InsightIDR unifies SIEM, UEBA, EDR, NTA, and cloud detection to detect stealthy attacks across today’s complex networks.

It analyzes the billions of events that occur daily in organizations to reduce them to the important behaviors and deliver high-fidelity and prioritized alerts.

In addition to identifying stealthy attacks often missed by other solutions, InsightIDR focuses the security team on issues that warrant investigation and reduces the time to investigate with its user correlation, powerful search and endpoint interrogation capabilities.

In addition to identifying stealthy attacks, InsightIDR reduces the signal-to-noise ratio to deliver reliable, high-context alerts and reduce the time to investigate with its correlation engine, powerful search and forensic capabilities.

InsightIDR is designed to provide a cost-effective response to the need for a modern SIEM or XDR solution.

With our Metasploit community, research and incident response services, we are continually studying and identifying the latest attacker methods.

We have found ways to increase accuracy, speed processes, and achieve greater confidence, even as attacker methods change.

These include built-in deception capabilities such as honeypots and automated threat intelligence feeds that quickly alert our customers to new attacker behaviors seen in the wild by our own threat hunters.

Unlike most SIEMs, InsightIDR also provides the capability to seamlessly act on many threats automatically, thus further reducing the time from detection to response.

InsightIDR includes out-of-the-box automation workflows to improve analyst productivity such as automated containment to mitigate an attack.

Additionally, with the Insight Agent, users can kill malicious processes or quarantine infected endpoints from the network.

They can also use InsightIDR to take containment actions across Active Directory, Access Management, EDR, and firewall tools.

InsightIDR also offers modules for Enhanced Network Traffic Analysis and Enhanced Endpoint Telemetry.

Enhanced Network Traffic Analysis continuously monitors network traffic at any location or site across your network.

This data increases visibility across the attack surface and detects intrusions (or other potential security events) on the network.

Enhanced Endpoint Telemetry is the collection of detailed activity logs that are sent to InsightIDR each time a process starts on a monitored endpoint.

In short, these logs give visibility into all endpoint activity—whether events occurred before, during, or after a detection.

With our Metasploit and open source community, research and incident response services, we are continually studying and identifying the latest attacker methods.

We have increased accuracy, speed processes, and achieve greater confidence, even as attacker methods change.

With diverse detection capabilities across known and unknown threats, unique intelligence, and constant curation, InsightIDR customers benefit from an always up-to-date library of detections and coverage against the most evasive and emergent threats.

Unlike most SIEMs, InsightIDR also provides expertly vetted recommendations with every alert and a number of prebuilt workflows and automation capabilities - giving customers the ability to respond quickly and confidently, reducing mean time to respond (“MTTR”).

Prebuilt workflows span a number of use cases - including productivity and ticketing workflows, user and asset containment, threat enrichment and more - helping SecOps teams realize greater efficiency and gain time back.

While InsightIDR is optimized to drive ultimate efficiency for resource constrained teams, customers with greater security maturity can also have access to a number of advanced modules to unlock expanded use cases.

Enhanced Network Traffic Analysis continuously monitors network traffic at any location or site across your network - east / west and north / south.

This data not only increases visibility across the attack surface and detects intrusions or other potential security events, it also is incredibly difficult for attackers to tamper with - making it an excellent source of forensic evidence and information.

With Enhanced Endpoint Telemetry, InsightIDR collects detailed process activity logs off every endpoint, providing visibility into all endpoint activity whether events occurred before, during, or after a detection.

With this holistic view into endpoint activity, customers can unlock custom use cases and enrich investigations in InsightIDR.

InsightIDR is offered through a cloud-based subscription or as a managed service.

The managed service is known as Managed Detection and Response, a fully outsourced service that combines our team of expert analysts with InsightIDR.

InsightIDR is offered through a cloud-based subscription.

Customers that seek greater support and expertise also have the option of leveraging our Managed Detection and Response (“MDR”) service, an outsourced service that leverages elite security experts to deliver 24 x 7 x 365 monitoring of your environment and a first line of defense and triage against attacks.

When attacks are found, customers are promptly informed of all known details and our team moves to incident response, providing security teams with detailed, easy-to-follow remediation steps tailored to the environment.

This MDR service is powered by InsightIDR - providing a real-time feedback loop and constant vetting of our technology.

This infused expertise means that even software only customers benefit from having the insights, input, and vetting of experts across all of our detections, investigation capabilities, and overall user experience.

InsightCloudSec:

InsightCloudSec, our cloud-native security platform, enables customers to drive digital transformation while continuously identifying and remediating security and compliance issues in their public cloud environments.

InsightCloudSec, our cloud risk and compliance management platform, enables customers to securely accelerate cloud adoption with continuous security and compliance throughout the entire software development lifecycle.

InsightCloudSec is a fully-integrated solution that integrates posture management, workload protection, infrastructure entitlements management, infrastructure-as-code security, and Kubernetes protection.

It helps Security and DevOps teams surface risk in complex multi-cloud and container environments, shift their cloud security program earlier in the development lifecycle, and automate workflows to speed up remediation and implement cost-saving efforts.

It helps Security and DevOps teams surface risk in cloud and container environments, shift their cloud security program earlier in the development lifecycle, and automate workflows to speed up remediation and implement cost-saving efforts.

Integrating best-of-breed technologies, InsightCloudSec provides unified visibility and robust context across multi-cloud environments to analyze, prioritize, and remediate issues as they arise.

By performing real-time, continuous discovery and analysis of cloud and container resources, we allow customers to identify security risks, threats and policy compliance violations such as data breaches, malicious insiders, account hijacking, insecure interfaces, and weak authentication.

InsightCloudSec then takes automatic action to remediate identified issues based on user-defined and/or automated parameters before they are exploited by a malicious actor.

InsightCloudSec can then take automatic action to remediate identified issues based on user-defined and/or automated parameters before they are exploited by a malicious actor.

InsightCloudSec is offered through a cloud-based subscription.

Utilizing the power of our Insight Platform, InsightVM is designed to provide a fully available, scalable, and efficient way to collect vulnerability data, prioritize risk and automate remediation.

InsightVM is designed to provide prioritized guidance based on customized threat models;

dynamic live dashboards that are easily customizable and queried;

lightweight agents for continuous visibility;

integration with cloud services, virtual infrastructure and container repositories such as dockers;

in-product integration with solutions such as ServiceNow, IBM Bigfix, Microsoft SCCM and Jira ticketing systems;

and remediation workflow for assigning and tracking remediation progress within the product.

Embedded workflows also allow Security and IT teams to automatically deploy compensating controls for vulnerabilities that cannot be patched.

Leveraging the power of our Insight Platform, InsightVM helps organizations to discover and remediate vulnerability risk across their network in a fully available, scalable, and efficient manner.

InsightVM is designed to provide continuous visibility across a company’s IT environment through lightweight agents and prioritize those vulnerabilities using our real risk score with an integrated threat feed - including CVSS scores, malware exposure, exploit exposure and ease of use, and vulnerability age - which provides organizations with the business context of vulnerabilities to focus on what is most important.

Customers can visualize these risk scores through Live Dashboards and our IT-integrated remediation projects help to assign and track remediation duties and provide continuous visibility into how well issues are being fixed.

In-product integrations include ServiceNow, IBM Bigfix, Microsoft SCCM and Jira ticketing systems.

InsightVM is offered through a cloud-based subscription or as a managed service.

1 unchanged sentence

InsightAppSec:

InsightAppSec provides comprehensive dynamic application security testing that continuously analyzes web applications for security vulnerabilities.

The key features include:

a universal translator to enable IT security professionals to analyze complex applications;

customized attack simulation capabilities that allow automatic testing of workflows such as shopping carts;

scanning automation;

attack replay, which allows replay of vulnerabilities in real time in order to verify that vulnerabilities are exploitable and that successful remediation has occurred;

continuous site monitoring, which detects changes in application ecosystems and triggers a re-scan according to configurable settings;

and integration with ticketing systems.

InsightAppSec enables integration with protection technologies to automatically generate web application firewalls (WAFs), which are custom rules that help to protect vulnerable applications while the vulnerabilities are being remediated.

InsightAppSec supports most leading WAFs, including F5, Sourcefire and Imperva.

InsightAppSec is offered on a cloud-based subscription basis or as a managed service.

The managed service is known as Managed Application Security and provides a fully outsourced option for application scanning and security testing.

InsightAppSec provides comprehensive dynamic application security testing (“DAST”) that continuously analyzes web applications for security weaknesses and vulnerabilities.

InsightAppSec assesses web applications with both out of the box and custom attack modules such as scanning for OWASP Top 10 and Out of Band injections.

InsightAppSec also allows security teams to easily partner with key remediators with our Attack Replay functionality and integrations with CI/CD pipeline and key ticketing systems.

InsightAppSec is offered on a cloud-based subscription basis.

For customers that seek greater support and expertise, they can leverage our Managed Application Security (“MAS”) solution which is powered by InsightAppSec and supported by experts.

InsightConnect:

InsightConnect is our SOAR solution that is used by security professionals to connect their many disparate solutions and automate workflows to increase the speed with which they can identify risk and respond to incidents.

With a growing library of over 500 integration plugins and easily customizable pre-built workflows, it allows our customers to automate manual and tedious tasks, while still leveraging their expertise when it is most critical, thereby saving time and improving efficiency.

15 unchanged sentences

Our professional services offerings enhance our ability to serve as a trusted advisor in assisting organizations to think proactively about their security programs and implement strategic, analytics-driven security strategies.

We believe that our role as trusted advisor helps drive better security outcomes for our customers, as well as loyalty and further usage of our products.

We believe that our role as a trusted advisor helps drive better security outcomes for our customers, as well as loyalty and further usage of our products.

Our professional services offerings include, but are not limited to, Penetration Testing, Cybersecurity Maturity Assessments, Security & Incident Response Program Development Services, IoT & Internet Embedded Device testing as well as Threat Modeling, TableTop Exercises and Incident Response services.

12 unchanged sentences

We see significant opportunity to deepen our relationship with our existing customers.

With a strong focus on customer experience, satisfaction, and the value proposition of our

Insight Platform, we intend to expand customers' usage of products they own (upsell) and help them adopt additional products (cross-sell).

With a strong focus on customer experience, satisfaction, and the value proposition of our Insight Platform, we intend to expand customers' usage of products they own (upsell) and help them adopt additional products (cross-sell).

• Further strengthen our customer renewal rate:

30 unchanged sentences

In addition, we host regional and national events to engage both customers and prospects, deliver product training and foster community collaboration.

Consolidation Offerings:

In addition to offering compelling platform technology, our consolidation offerings are refining how our salesforce goes to market.

For example, our Threat Complete and Cloud Risk Complete consolidation offerings lean into vendor consolidation as well as the prioritization of security budgets around critical spending areas that include Detection & Response and Cloud Security.

Threat Complete enables customers to consolidate our expert-driven threat detection and response solution along with unlimited VM coverage together in one platform subscription.

Cloud Risk Complete is our cloud-centered risk visibility offering, which consolidates visibility across customers’ on-prem, cloud, and external environments, at various stages of transition to the cloud.

It enables use of Cloud and Application Security with unlimited VM

coverage together in one platform subscription.

These consolidation offerings are part of the realignment of our sales strategy, and an important step in advancing our platform selling motion.

Research and Development Efforts

13 unchanged sentences

This online security community provides us with a robust and growing network of active users and influencers who promote the usage of our software.

Security researchers contribute modules to the Metasploit Framework that serve as a resource about real-world

attacker techniques.

Security researchers contribute modules to the Metasploit Framework that serve as a resource about real-world attacker techniques.

The community also provides us with near real-time visibility into new cyber attacks as they occur and a deep understanding of attacker behaviors.

25 unchanged sentences

Velociraptor’s power and flexibility comes from the Velociraptor Query Language (“VQL”).

VQL is a framework for creating highly customized artifacts, which allow you to collect, query, and monitor almost any aspect of an endpoint, groups of endpoints, or an entire network.

VQL is a framework for creating highly customized artifacts, which allow you to collect, query, and monitor almost any aspect of an endpoint, groups of

endpoints, or an entire network.

It can also be used to create continuous monitoring rules on the endpoint, as well as automate tasks on the server.

7 unchanged sentences

The markets we operate in are highly competitive, fragmented, and subject to technology change and innovation.

Our primary competitors in Vulnerability Risk Management include Qualys and Tenable;

in Incident Detection and Response include Splunk, Micro Focus, LogRhythm and Microsoft (Sentinel);

in Application Security include Micro Focus and IBM;

in Security Orchestration and Automation Response include Splunk and Palo Alto Networks;

in Cloud Security include Palo Alto Networks and Check Point Software Technologies;

in Threat Intelligence include Recorded Future and Digital Shadows and finally, while the competition in our professional services business is diverse, our competitors include Mandiant, SecureWorks and NCC Group.

Our primary competitors in XDR and SIEM include CrowdStrike, Exabeam, LogRhythm, Microsoft, and Splunk;

in Cloud Security include Orca Security, Palo Alto Networks, and Wiz;

in Vulnerability Risk Management include Qualys and Tenable;

in Application Security include IBM and Micro Focus;

in Threat Intelligence include Digital Shadows and Recorded Future and finally, while the competition in our professional services business is diverse, our competitors include Crowdstrike, Mandiant (Google), and SecureWorks.

We compete on the basis of a number of factors, including:

1 unchanged sentence

• breadth of offerings;

• depth and expertise of our security service providers;

• performance;

22 unchanged sentences

In order to continue to innovate, compete and succeed in our highly competitive and rapidly evolving market, it is crucial that we continue to attract and retain experienced employees.

As part of these efforts, we strive to offer a competitive

compensation and benefits program, foster a community where everyone feels included and empowered to do their best work, and give employees the opportunity to give back to their communities and make a social impact.

As part of these efforts, we strive to offer a competitive compensation and benefits program, foster a community where everyone feels included and empowered to do their best work, and give employees the opportunity to give back to their communities and make a social impact.

As of December 31, 2022, we had 2,623 full-time employees, including 497 in product and service delivery and support, 1,031 in sales and marketing, 780 in research and development and 315 in general and administrative.

10 unchanged sentences

We also provide emotional well-being services through our Employee Assistance Program.

In response to the COVID-19 pandemic, we implemented significant changes that we determined were in the best interest of our employees as well as the communities in which we operate.

Initially, this included having the vast majority of our employees work from home while implementing additional safety measures, including regular testing for employees continuing critical on-site work.

In 2021, we began to selectively reopen certain offices in a phased approach and to hold in-person or hybrid meetings, on a voluntary basis, taking into consideration government restrictions and employee safety.

Moving forward we intend to continue with a hybrid work model through which we balance our view that the office remains a critical environment for mentorship, career development and the kinds of lasting bonds that create a great work culture, with flexibility and trust in our employees to work with their teams to find the right model that allows for us to deliver for our customers.

As an initial response to the COVID-19 pandemic, we implemented significant changes, including having the vast majority of our employees work from home and providing regular testing for employees continuing critical on-site work.

Over the course of 2022, we evolved to a hybrid-first model, in which employees who are assigned to an office can divide their work between the office and home.

We are actively iterating our approach to support new ways of working and evolving the employee experience.

Moving forward we intend to continue with a hybrid-first work model through which we balance our view that the office remains a critical environment for mentorship, career development and the kinds of lasting bonds that create a great work culture, with flexibility and trust in our employees to work with their teams to find the right model that allows us to deliver for our customers.

Talent Development

We believe in investing in the growth and development of all of our employees so they may build the career experience of their lifetime.

“Never Done” is one of our core values, and our employees take advantage of a myriad of opportunities for continuous learning, both through internal training and development programs, on-demand learning modules, and access to content-specific curriculum based on need and interest.

“Never Done” is one of our core values, and our employees take advantage of a myriad of opportunities for continuous learning, both through internal training and development experiences, on-demand learning modules, and access to content-specific curriculum based on need and interest.

We have designed and implemented learning experiences for our employees at every stage of their careers.

This includes our tailored leadership development programs for both non-technical and technical leaders.

Both programs align to our core values and promote the leadership skills and behaviors we believe are critical to the success of our mission, customers, and development of our people.

As a supporter of a promote-from-within culture, we actively mentor and invest in the pipeline of our future leaders by providing pathways for growth, development, and promotion on an ongoing basis through our early leader programs.

including personalized leadership development experiences that build capabilities for both non-technical and technical leaders at each stage of the leadership journey.

These experiences align to our core values and promote the leadership skills and behaviors we believe are critical to the success of our mission, customers, and development of our people.

As a supporter of internal career growth, we actively mentor and invest in the pipeline of our future leaders.

Additionally, new employees engage in our 90-day onboarding experience, Making the Band , which is intended to support the embodiment of our core values, and shorten their time to create impact.

To supplement our internal programs, as well as provide opportunities for independent study, employees have access to online education tools to build the necessary skills related to one’s role and a digital library curated for our employees.

To further invest in the future of cybersecurity and to deliver on our company mission, we are continuing to strengthen our programming for emerging talent and early career individuals.

Building this programming will support individuals in our various programs that offer early career opportunities.

To supplement our internal learning experiences, as well as provide opportunities for independent study, employees have access to online education tools, including a digital library, to build the necessary skills to pursue additional certifications related to

To further invest in the future of cybersecurity and to deliver on our company mission, we created a platform that includes the most recent product training materials, as well as makes certification exams available at zero cost.

Electronic certificates can be published to an employee’s LinkedIn professional profile, and the CPEs associated with the exam and learning materials help cybersecurity professionals maintain their minimum “continuing development” points for their professional certifications such as Certified Information Systems Security Professional, Global Information Assurance Certification and Certified Professional Hacker.

We believe our investment in these resources, along with flexible working environments, will support our employees in their pursuit of lifelong learning.

We believe we will positively impact the experience of our customers by focusing on the development and engagement of our employees.

Diversity, Equity and Inclusion

3 unchanged sentences

Specifically, we sought to increase the number of under-represented groups (in particular women and people of color) to 50% of the employee base in the U.S.

Having achieved those goals, we have since adapted our focus and progress to increase our global population of women from 29% as of December 31, 2020 to 35% by December 31, 2022.

Additionally, we are investing in our recruiting and retaining of employees who identify as Black, Latinx or multi-racial, with the goal of increasing our U.S.

population of this demographic from 13% as of December 31, 2020 to 18% by December 31, 2022.

We undertook to promote transparency by publishing our workforce demographic data and increasing thoughtful discussions across the Company, including unconscious

bias training for our employees.

In addition, we expanded our efforts to recruit under-represented groups through referrals and beyond the traditional networks from which we previously recruited.

Having achieved those goals in 2021, we focused on increasing our global population of women to 35% and investing in our recruiting and retaining of employees who identify as Black, Latinx or multi-racial, with the goal of increasing our U.S.

population of this demographic to 18%.

While we had originally expected to achieve these goals by the end of 2022, over the course of the year we adjusted the pace of hiring to better align with our operational performance and profitability goals amidst an evolving economic environment.

Despite these pressures, we still made strides towards our goals.

At the end of 2022, we increased our representation of under-represented communities, including Black, Latinx, and those who identify as multi-racial to 14% of U.S.

Additionally, 33% of our U.S.

employees identify as women, and in our international offices, employees identifying as women make up 30% of our staff.

We aim to promote transparency by publishing our workforce demographic data and encouraging thoughtful discussions across the Company, including through unconscious bias training and a mandatory Global Diversity, Equity and Inclusion e-learning titled “Laying the foundation - Diversity, Equity and Inclusion” which was implemented at the end of 2022.

In addition, we continued our efforts to recruit under-represented groups through referrals and beyond the traditional networks from which we previously recruited.

We are also focused on identifying and promoting diverse leaders through the organization at all levels and signed the Corporate Parity Pledge, which includes, among other things, a commitment to interview at least one woman and one person of color for every open role at the vice president level and above.

4 unchanged sentences

Beyond contributions of cash, we encourage employee volunteerism at all our locations.

In 2021, working with the Tides Foundation, we paid out nearly $0.3 million to organizations, principally those engaged in helping create a more diverse and inclusive technology workforce, through the Rapid7 for Good Fund.

In 2021, we also formed the Rapid7 Cybersecurity Foundation .

The Foundation’s mission, which aligns closely to that of Rapid7, is to help close the cybersecurity achievement gap by promoting a more diverse and inclusive cyber workforce;

supporting free and open cybersecurity solutions;

and advocating for those that often lack a voice in advancing security.

We seeded the Foundation with $1.0 million.

In 2021, we formed the Rapid7 Cybersecurity Foundation (the “Foundation”).

The Foundation’s mission, which aligns closely to that of Rapid7, is to help close the cybersecurity achievement gap by promoting a more diverse and inclusive cyber workforce and advancing security by supporting cybersecurity programs and solutions that are free and open.

These include, among others, Hack.Diversity, the Cyber Peace Institute and its program Cyber Peace Builders and Cyversity.

After seeding the Foundation with an initial contribution of $1.0 million in 2021, Rapid7 continued its support of the Foundation with an additional investment of $0.5 million in 2022.

In February 2023, Rapid7 and its Foundation announced a multi-year partnership and a $1.5 million dollar commitment to create the Rapid7 Cyber Threat Intelligence Lab at the University of South Florida (“USF”).

The goal of the interdisciplinary lab at USF is to catalyze new collaborative research efforts in cyber threat detection, track malicious threat actors through an extensive sensor network, support an inclusive approach to diverse talent development in cybersecurity, and serve as a hub for thought leadership and community-engaged programming both locally and within the global cybersecurity industry.

Corporate Information

10 unchanged sentences

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1. Business