Rapid7, Inc. 10-K

Item 9A. Controls and Procedures. Evaluation of Disclosure Controls and Procedures Our management, with the participation of our chief executive officer and chief financial officer, evaluated the effectiveness of our disclosure controls and procedures as of December 31, 2023. The term “disclosure controls and procedures,” as defined in Rules 13a-15(e) and 15d-15(e) under the Exchange Act of 1934, as amended, means controls and other procedures of a company that are designed to ensure that information required to be disclosed by a company in the reports that it files or submits under the Exchange Act is recorded, processed, summarized and reported, within the time periods specified in the SEC’s rules and forms. Disclosure controls and procedures include, without limitation, controls and procedures designed to ensure that information required to be disclosed by a company in the reports that it files or submits under the Exchange Act is accumulated and communicated to the company’s management, including its principal executive and principal financial officers, as appropriate to allow timely decisions regarding required disclosure. Management recognizes that any controls and procedures, no matter how well designed and operated, can provide only reasonable assurance of achieving their objectives and management necessarily applies its judgment in evaluating the cost-benefit relationship of possible controls and procedures. Based on the evaluation of our disclosure controls and procedures as of December 31, 2023, our chief executive officer and chief financial officer concluded that, as of such date, our disclosure controls and procedures were effective at the reasonable assurance level. Management’s Report on Internal Control Over Financial Reporting Our management is responsible for establishing and maintaining adequate internal control over financial reporting, as such term is defined in Rules 13a-15(f) and 15d-15(f) of the Exchange Act. Our management assessed the effectiveness of our internal control over financial reporting as of December 31, 2023 based on the criteria set forth by the Committee of Sponsoring Organizations of the Treadway Commission (“COSO”) in Internal Control – Integrated Framework (2013). Based on this assessment, management concluded that as of December 31, 2023, our internal control over financial reporting was effective. This Annual Report on Form 10-K includes an attestation report of our independent registered public accounting firm regarding internal control over financial reporting, which appears in Part II, Item 8 of this Annual Report on Form 10-K. Inherent Limitations of Internal Controls Our management, including our chief executive officer and chief financial officer, does not expect that our disclosure controls and procedures or our internal controls will prevent all errors and all fraud. A control system, no matter how well conceived and operated, can provide only reasonable, not absolute, assurance that the objectives of the control system are met. Because of the inherent limitations in all control systems, no evaluation of controls can provide absolute assurance that all control issues and instances of fraud, if any, within the company have been detected. These inherent limitations include the realities that judgments in decision-making can be faulty, and that breakdowns can occur because of a simple error or mistake. Additionally, controls can be circumvented by the individual acts of some persons, by collusion of two or more people, or by management override of the control. The design of any system of controls also is based in part upon certain assumptions about the likelihood of future events, and there can be no assurance that any design will succeed in achieving its stated goals under all potential future conditions. Over time, controls may become inadequate because of changes in conditions, or the degree of compliance with the policies or procedures may deteriorate. Because of the inherent limitations in a cost-effective control system, misstatements due to error or fraud may occur and not be detected. Changes in Internal Control over Financial Reporting There were no changes in our internal control over financial reporting identified in connection with the evaluation required by Rule 13a-15(d) and 15d-15(d) of the Exchange Act that occurred during the period covered by this Annual Report on Form 10-K that has materially affected, or is reasonably likely to materially affect, our internal control over financial reporting. Item 9B. Other Information. Certain of our executive officers and directors may execute purchases and sales of our securities through Rule 10b5-1 equity trading plans and “non-Rule 10b5-1 equity trading arrangements” (as defined in Item 408(c) of Regulation S-K). During the three months ended December 31, 2023, several of our executive officers, as set forth below, adopted or terminated a contract, instruction or written plan for the purchase or sale of Rapid7 securities that was intended to satisfy the affirmative defense conditions of Rule 10b5-1(c). 93 Ta ble of Contents Name and Position Action Adoption or Transaction Date Type of Trading Arrangement Number of Shares of Common Stock to be Sold Expiration Date Andrew Burton , Chief Operating Officer (1) Adoption December 13, 2023 Rule 10b5-1* 70,675 ** 12/31/2024*** Tim Adams , Chief Financial Officer Adoption November 28, 2023 Rule 10b5-1* 15,000 ** 11/28/2024*** Corey Thomas , Chief Executive Officer (2) Adoption December 13, 2023 Rule 10b5-1* 296,842 ** 12/13/2024*** (1) The selling start date under Mr. Burton's 10b5-1 Plan adopted on December 13, 2023 is contingent on the completion or expiration of his previously adopted plan. (2) Mr. Thomas' plan includes the sale of 30,842 shares that were gifted to the Ancore Foundation, Inc., a charitable foundation of which Mr. Thomas is a director. * Contract, instruction or written plan intended to satisfy the affirmative defense conditions of Rule 10b5-1(c) under the Exchange Act. ** Represents the maximum number of shares that may be sold pursuant to the Rule 10b5-1 trading arrangement in amounts and prices determined in accordance with a formula set forth in the plan. The actual number of shares sold will be dependent on the satisfaction of certain conditions as set forth in the written plan. *** The Rule 10b5-1 trading arrangement will terminate on the earlier of the date all the shares under the plan are sold and the expiration date indicated, subject to early termination for specified events set forth in the plan. During the year ended December 31, 2023, other than noted above, none of our executive officers or directors terminated or modified a 10b5-1 equity trading plan, or adopted , terminated , or modified any “non-Rule 10b5-1 equity trading arrangement”. Item 9C. Disclosure Regarding Foreign Jurisdictions that Prevent Inspections. Not Applicable. 94 Ta ble of Contents PART III Item 10. Directors, Executive Officers and Corporate Governance. The information required by this item is incorporated by reference to our Proxy Statement for our 2024 Annual Meeting of Stockholders to be filed with the SEC within 120 days after the end of the fiscal year ended December 31, 2023. As part of our system of corporate governance, our board of directors has adopted a code of business conduct and ethics. The code applies to all of our employees, officers (including our principal executive officer, principal financial officer, principal accounting officer or controller, or persons performing similar functions), agents and representatives, including our independent directors and consultants, who are not employees of ours, with regard to their Company-related activities. Our code of business conduct and ethics is available on our website at www.rapid7.com. We intend to post on this section of our website any amendment to our code of business conduct and ethics, as well as any waivers of our code of business conduct and ethics, that are required to be disclosed by the rules of the SEC or the Nasdaq Stock Market. Item 11. Executive Compensation. The information required by this item is incorporated by reference to our Proxy Statement for our 2024 Annual Meeting of Stockholders to be filed with the SEC within 120 days after the end of the year ended December 31, 2023. Item 12. Security Ownership of Certain Beneficial Owners and Management and Related Stockholder Matters. The information required by this item is incorporated by reference to our Proxy Statement for our 2024 Annual Meeting of Stockholders to be filed with the SEC within 120 days after the end of the year ended December 31, 2023. Item 13. Certain Relationships and Related Transactions, and Director Independence. The information required by this item is incorporated by reference to our Proxy Statement for our 2024 Annual Meeting of Stockholders to be filed with the SEC within 120 days after the end of the year ended December 31, 2023. Item 14. Principal Accounting Fees and Services. The information required by this item is incorporated by reference to our Proxy Statement for our 2024 Annual Meeting of Stockholders to be filed with the SEC within 120 days after the end of the year ended December 31, 2023. 95 Ta ble of Contents PART IV Item 15. Exhibits and Financial Statement Schedules. (a)(1) Financial Statements See Index to Consolidated Financial Statements on page 61 of this Annual Report on Form 10-K, which is incorporated into this item by reference. (a)(2) Financial Statement Schedules All financial statement schedules are omitted because they are not applicable or the required information is shown in the financial statements or notes thereto. (b) Exhibits The following list of exhibits includes exhibits submitted with this Annual Report on Form 10-K as filed with the SEC and others incorporated by reference to other filings. Exhibit Number Description 3.1 Amended and Restated Certificate of Incorporation of Rapid7, Inc., as of June 3, 2020 (incorporated by reference Exhibit 3.1 to the Registrant’s Quarterly Report on Form 10-Q (File No. 001-37496), filed on August 10, 2020). 3.2 Amended and Restated Bylaws of Rapid7, Inc., as of June 3, 2020 (incorporated by reference to Exhibit 3.2 to the Registrant’s Quarterly Report on Form 10-Q (File No. 001-37496), filed with the Securities and Exchange Commission on August 10, 2020). 4.1 Form of common stock certificate of Rapid7, Inc. (incorporated by reference to Exhibit 4.1 to the Registrant’s Registration Statement on Form S-1/A (File No. 333-204874), filed on July 6, 2015). 4.2 Indenture, dated as of August 13, 2018, between Rapid7 Inc. and U.S. Bank National Association, as trustee (incorporated by reference to Exhibit 4.1 to the Registrant's Current Report on Form 8-K (file No. 001-37496), filed on August 13, 2018). 4.3 Form of 1.25% Convertible Senior Notes due 2023 (included in Exhibit 4. 2 ). 4.4 * Description of Securities Registered Pursuant to Section 12 of the Securities Exchange Act of 1934 . 4.5 Indenture, dated as of May 1, 2020, by and between Rapid7, Inc. and U.S. Bank National Association, as Trustee (incorporated by reference to Exhibit 4.1 to the Registrant’s Current Report on Form 8-K (File No. 001-37496), filed on May 4, 2020). 4.6 Form of Global Note, representing Rapid7, Inc.’s 2.25% Convertible Senior Notes due 2025 (included in Exhibit 4. 5 ). 4.7 Indenture, dated as of March 19, 2021, by and between Rapid7, Inc. and U.S. Bank National Association, as Trustee (incorporated by reference to Exhibit 4.1 to the Registrant’s Current Report on Form 8-K (File No. 001-37496), filed on March 19, 2021). 4.8 Form of Global Note, representing Rapid7, Inc.’s 0.25% Convertible Senior Notes due 2027 (included in Exhibit 4. 7 ). 4.9 Indenture, dated as of September 8, 2023, by and between Rapid7, Inc. and U.S. Bank Trust Company. National Association, as Trustee (incorporated by reference to Exhibit 4.1 to the Registrant's Current Report on Form 8-K (File No. 001-37496), filed on September 8, 2023). 4.10 Form of Global Note, representing Rapid7, Inc.’s 1.25% Convertible Senior Notes due 2029 (included in Exhibit 4.9). 10.1 Form of Confirmation for Capped Call Transactions (incorporated by reference to Exhibit 10.1 to the Registrant’s Current Report on Form 8-K (File No. 001-37496), filed on August 13, 2018). 10.2 Purchase Agreement, dated April 28, 2020, by and between Rapid7, Inc. and Barclays Capital Inc. (incorporated by reference to Exhibit 10.2 to the Registrant’s Current Report on Form 8-K (File No. 001-37496), filed on May 4, 2020). 10.3 Form of Capped Call Transactions (incorporated by reference to Exhibit 10.2 to the Registrant's Current Report on Form 8-K (File No. 001-37496), filed on May 4, 2020). 96 Ta ble of Contents 10.4 Purchase Agreement, dated March 16, 2021, by and between Rapid7, Inc., Goldman Sachs & Co. LLC and Barclays Capital Inc. (incorporated by reference to Exhibit 10.1 to the Registrant’s Current Report on Form 8-K (File No. 001-37496), filed on March 19, 2021). 10.5 Form of Confirmation for Capped Call Transactions. (incorporated by reference to Exhibit 10.2 to the Registrant’s Current Report on Form 8-K (File No. 001-37496), filed on March 19, 2021). 10.6 Purchase Agreement, dated September 5, 2023, by and between Rapid7, Inc., Goldman Sachs & Co. LLC and J.P. Morgan Securities LLC. (incorporated by reference to Exhibit 10.1 to the Registrant’s Current Report on Form 8-K (File No. 001-37496), filed on September 5, 2023). 10.7 Form of Confirmation for Capped Call Transactions. (incorporated by reference to Exhibit 10.2 to the Registrant’s Current Report on Form 8-K (File No. 001-37496), filed on September 5, 2023). 10.8 Credit and Security Agreement, dated as of April 23, 2020, by and among Rapid7, Inc., Rapid7 LLC, KeyBank National Association, and the lenders party thereto (incorporated by reference to Exhibit 10.1 to the Registrant’s Current Report on Form 8-K (File No. 001-37496), filed on April 28, 2020, and incorporated herein by reference). 10.9 Merger Agreement, dated as of April 24, 2020, by and between Rapid7, Inc., Rapid7 LLC, Stratus Acquisition, Inc., Divvy Cloud Corporation and Fortis Advisors LLC. (incorporated by reference to Exhibit 10.2 to the Registrant’s Current Report on Form 8-K (File No. 001-37496), filed on April 28, 2020). 10.10 First Amendment Agreement, dated as of May 29, 2020, by and among Rapid7, Inc., Rapid7 LLC, KeyBank National Association, and the lenders party thereto (incorporated by reference to Exhibit 10.4 to the Registrant’s Quarterly Report on Form 10-Q (File No. 001-37496), filed on August 10, 2020). 10.11 Second Amendment Agreement, dated as of December 22, 2021, by and among Rapid7, Inc., Rapid7 LLC, KeyBank National Association, and the lenders party thereto (incorporated by reference to Exhibit 10.9 to the Registrant’s Annual Report on Form 10-K (File No. 001-37496), filed on February 24, 2022). 10.12+ 2011 Stock Option and Grant Plan and Forms of Stock Option Agreement, Stock Option Exercise Notice and Restricted Stock Agreement thereunder (incorporated by reference to Exhibit 10.2 to the Registrant’s Registration Statement on Form S-1 (File No. 333-204874), filed on June 11, 2015). 10.13+ Rapid7, Inc. 2015 Equity Incentive Plan, as amended (incorporated by reference to Exhibit 10.1 to the Registrant's Current Report on Form 8-K (file No. 001-37496), filed on July 19, 2021) 10.14+ Forms of Stock Option Agreement, Notice of Exercise, Stock Option Grant Notice and Restricted Stock Unit Agreement under the Rapid7, Inc. 2015 Equity Incentive Plan, as amended (incorporated by reference to Exhibit 10.3 to the Registrant’s Registration Statement on Form S-1/A (File No. 333-204874), filed on July 6, 2015). 10.15+ Rapid7, Inc. 2015 Employee Stock Purchase Plan (incorporated by reference to Exhibit 10.1 to the Registrant’s Current Report on Form 8-K (File No. 001-37496), filed on October 13, 2015). 10.16+ Form of Indemnification Agreement by and between Rapid7, Inc. and each of its directors and executive officers (incorporated by reference to Exhibit 10.5 to the Registrant’s Annual Report on Form 10-K (File No. 001-37496), filed on March 10, 2016). 10.17 Stock Purchase Agreement, dated July 16, 2021, by and between Rapid7, Inc., Rapid7 International Holdings Limited, IntSights Cyber Intelligence Ltd., the Sellers and Shareholder Representative Services LLC (incorporated by reference to Exhibit 10.1 to the Registrant's Current Report on Form 8-K (File No. 001-37496), filed on July 19, 2021). 10.18 Lease dated November 16, 2017 between Podium Developer LLC and Rapid7, Inc (incorporated by reference to Exhibit 10.1 to the Registrant’s Current Report on Form 8-K (File No. 001-37496), filed on November 16, 2017). 10.19 Lease dated July 19, 2019 between Office Tower Developer LLC and Rapid7, Inc (incorporated by reference to Exhibit 10.1 to the Registrant's Current Report on Form 8-K (File no. 001-37496), filed with the Securities and Exchange Commission on July 25, 2019). 10.20 First Amendment to Lease, dated as of September 9, 2020 by and between Office Tower Developer LLC and Rapid7, Inc. (incorporated by reference to Exhibit 10.1 to the Registrant’s Quarterly Report on Form 10-Q (File No. 001-37496), filed on November 5, 2020). 10.21 Second Amendment to Lease, dated as of November 9, 2020 by and between Office Tower Developer LLC and Rapid7, Inc. (incorporated by reference to Exhibit 10.15 to the Registrant's Annual Report on Form 10-K (File no. 001-37496), filed on February 26, 2021). 10.22 Third Amendment to Lease, dated as of February 5, 2021 by and between Office Tower Developer LLC and Rapid7, Inc. (incorporated by reference to Exhibit 10.16 to the Registrant's Annual Report on Form 10-K (File no. 001-37496), filed on February 26, 2021). 10.23+ Rapid7, Inc. Executive Incentive Bonus Plan (incorporated by reference to Exhibit 10.1 to the Registrant’s Current Report on Form 8-K (File No. 001-37496), filed on February 2, 2017). 97 Ta ble of Contents 10.24+ Employment Agreement, dated as of January 3, 2013, by and between Rapid7, Inc. and Corey Thomas (incorporated by reference to Exhibit 10.9 to the Registrant’s Registration Statement on Form S-1 (File No. 333-204874), filed on June 11, 2015). 10.25+ Amendment to Employment Agreement, dated as of April 4, 2016, by and between Rapid7, Inc. and Corey Thomas (incorporated by reference to Exhibit 10.1 to the Registrant’s Current Report on Form 8-K (File No. 001-37496), filed with the Securities and Exchange Commission on April 5, 2016). 10.26+ Second Amendment to Employment Agreement, dated as of March 24, 2017, by and between Rapid7, Inc. and Corey Thomas (incorporated by reference to Exhibit 10.2 to the Registrant’s Quarterly Report on Form 10-Q (File No. 001-37496), filed on May 10, 2017). 10.27+ Third Amendment to Employment Agreement, dated as of August 7, 2023, by and between Rapid7, Inc. and Corey Thomas (incorporated by reference to Exhibit 10.1 to the Registrant's Quarterly Report on Form 10-Q (File No. 001-37496), filed on November 6, 2023). 10.28+ Offer Letter Agreement, dated as of October 3, 2016, by and between Rapid7, Inc. and Andrew Burton (incorporated by reference to Exhibit 10.1 to the Registrant’s Current Report on Form 8-K (File No. 001-37496), filed on October 4, 2016). 10.29+ Offer Letter, dated as of November 23, 2021, by and between Rapid7, Inc. and Tim Adams (incorporated by reference to Exhibit 10.1 to the Registrant’s Current Report on Form 8-K (File No. 001-37496), filed on November 29, 2021). 10.30+ Severance and Equity Award Vesting Acceleration Letter, dated as of March 28, 2017, by and between Rapid7, Inc. and Andrew Burton (incorporated by reference to Exhibit 10.3 to the Registrant’s Quarterly Report on Form 10-Q (File No. 001-37496), filed on May 10, 2017). 10.31+ Severance and Equity Award Vesting Acceleration Agreement, dated as of August 8, 2023, by and between Rapid7, Inc. and Andrew Burton (incorporated by reference to Exhibit 10.2 on Form 10-Q (File No. 001-37496), filed on November 6, 2023). 10.32+ Severance and Equity Award Vesting Acceleration Agreement, dated as of August 30, 2023, by and between Rapid7, Inc. and Tim Adams (incorporated by reference to Exhibit 10.3 on Form 10-Q (File No. 001-37496), filed on November 6, 2023). 10.33+ Severance and Equity Award Vesting Acceleration Agreement, dated as of August 8, 2023, by and between Rapid7, Inc. and Christina Luconi (incorporated by reference to Exhibit 10.4 on Form 10-Q (File No. 001-37496), filed on November 6, 2023). 10.34+* Form of Performance Stock Unit Agreement under the Rapid7 2015 Equity Incentive Plan. Exhibit Number Description 21.1* List of subsidiaries of Rapid7, Inc. 23.1* Consent of KPMG, LLP. 24.1 Power of Attorney (incorporated by reference to the signature pages of this Annual Report on Form 10-K). 31.1* Certification of Principal Executive Officer Pursuant to Rules 13a-14(a) and 15d-14(a) under the Securities Exchange Act of 1934, as Adopted Pursuant to Section 302 of the Sarbanes-Oxley Act of 2002. 31.2* Certification of Principal Financial Officer Pursuant to Rules 13a-14(a) and 15d-14(a) under the Securities Exchange Act of 1934, as Adopted Pursuant to Section 302 of the Sarbanes-Oxley Act of 2002. 32.1** Certification of Principal Executive Officer Pursuant to 18 U.S.C. Section 1350, as Adopted Pursuant to Section 906 of the Sarbanes-Oxley Act of 2002. 32.2** Certification of Principal Financial Officer Pursuant to 18 U.S.C. Section 1350, as Adopted Pursuant to Section 906 of the Sarbanes-Oxley Act of 2002. 97* Compensation Recoupment Policy, dated as of October 19, 2023. 101.INS Inline XBRL Instance Document - the instance document does not appear in the Interactive Data file because its XBRL tags are embedded within the inline XBRL document. 101.SCH Inline XBRL Taxonomy Extension Schema Document. 101.CAL Inline XBRL Taxonomy Extension Calculation Linkbase Document. 101.DEF Inline XBRL Taxonomy Extension Definition Linkbase Document. 101.LAB Inline XBRL Taxonomy Extension Label Linkbase Document. 101.PRE Inline XBRL Taxonomy Extension Presentation Linkbase Document. 104 Cover Page Interactive Data file (formatted as inline XBRL with applicable taxonomy extension information contained in Exhibits 101) 98 Ta ble of Contents * Filed herewith. ** This certification is deemed not filed for purposes of Section 18 of the Securities Exchange Act of 1934, as amended, or otherwise subject to the liability of that section, nor shall it be deemed incorporated by reference into any filing under the Securities Act of 1933, as amended, or the Securities Exchange Act of 1934, as amended. + Indicates management contract or compensatory plan. Item 16. Form 10-K Summary. Not applicable. 99 Ta ble of Contents SIGNATURES Pursuant to the requirements of Section 13 or 15(d) of the Securities Exchange Act of 1934, as amended, the registrant has duly caused this report to be signed on its behalf by the undersigned, thereunto duly authorized . RAPID7, INC. Date: February 26, 2024 By: /s/ Corey E. Thomas Name: Corey E. Thomas Title: Chief Executive Officer 100 Ta ble of Contents POWER OF ATTORNEY KNOW ALL BY THESE PRESENTS, that each person whose signature appears below constitutes and appoints Corey E. Thomas and Tim Adams, and each of them, as his true and lawful attorneys-in-fact and agents, each with the full power of substitution, for him and in his name, place or stead, in any and all capacities, to sign any and all amendments to this report, with exhibits thereto and other documents in connection therewith, with the Securities and Exchange Commission, granting unto said attorneys-in-fact and agents, and each of them, full power and authority to do and perform each and every act and thing requisite and necessary to be done in and about the premises, as fully to all intents and purposes as he might or could do in person, hereby ratifying and confirming all that said attorneys-in-fact and agents, or their, his substitute or substitutes, may lawfully do or cause to be done by virtue hereof. Pursuant to the requirements of the Securities Exchange Act of 1934, as amended, this report has been signed below by the following persons on behalf of the registrant in the capacities and on the dates indicated. Name Title Date /s/ Corey E. Thomas Chief Executive Officer and Director February 26, 2024 Corey E. Thomas ( Principal Executive Officer ) /s/ Tim Adams Chief Financial Officer February 26, 2024 Tim Adams ( Principal Financial Officer and Principal Accounting Officer ) /s/ Michael Berry Director February 26, 2024 Michael Berry /s/ Marc Brown Director February 26, 2024 Marc Brown /s/ Judy Bruner Director February 26, 2024 Judy Bruner /s/ Benjamin Holzman Director February 26, 2024 Benjamin Holzman /s/ Christina Kosmowski Director February 26, 2024 Christina Kosmowski /s/ J. Benjamin Nye Director February 26, 2024 J. Benjamin Nye /s/ Thomas Schodorf Director February 26, 2024 Thomas Schodorf /s/ Reeny Sondhi Director February 26, 2024 Reeny Sondhi 101