Rapid7 (RPD) Q4 2024: Detection & Response Surges to $400M ARR, Anchoring Platform Shift
Rapid7’s managed detection and response business eclipsed $400 million ARR, now over half of total ARR, cementing its strategic pivot away from legacy vulnerability management. Platform deal sizes and contract durations are rising, but longer cycles and secular VM headwinds keep overall growth muted. With new investment in AI-driven MDR and exposure management, Rapid7 is betting on integrated security operations to reaccelerate growth and margin leverage into 2026.
Summary
- Detection & Response Dominance: MDR now anchors ARR, driving the company’s growth focus.
- Platform Consolidation Gains: Larger, longer deals reflect customer shift to integrated security operations.
- 2025 Reacceleration Bet: Targeted investments set up for margin and ARR expansion into 2026.
Business Overview
Rapid7 is a cybersecurity software and services provider focused on security operations. It generates revenue through a mix of recurring product subscriptions—primarily managed detection and response (MDR, outsourced threat monitoring and response), risk and exposure management (integrated vulnerability and cloud security), and a shrinking professional services segment. The business is now weighted toward MDR and platform-based security, with legacy vulnerability management (VM, scanning and risk assessment) in secular decline.
Performance Analysis
Rapid7 closed 2024 with $840 million in annual recurring revenue (ARR), up 4% year-over-year, as detection and response (DNR) surpassed $400 million in ARR and posted mid-teens growth. This segment now constitutes more than half of total ARR, reflecting a decisive business model shift. The risk and exposure management business, including Exposure Command, saw over 20% YoY pipeline growth in Q4 but remains a smaller, emerging contributor with modest direct impact on 2024 results.
Revenue outperformed guidance as recurring product sales grew 9% for the year, offset by a managed contraction in professional services. Operating income and free cash flow both expanded sharply, with full-year operating margin reaching 19% and free cash flow margin at 18%, driven by expense discipline and mix shift toward higher-value platform deals. International markets contributed 25% of revenue, growing 14% YoY, while North America lagged at 3% growth, reflecting sectoral and customer-specific headwinds.
- Detection & Response Momentum: DNR, especially managed MDR, is now the primary revenue engine, with ARR per DNR customer at $100,000.
- Legacy VM Drag: Traditional vulnerability management remains flat to declining, pressuring net new ARR and expansion.
- Deal Cycle Extension: Platform-led deals are larger and longer, supporting future expansion but stretching near-term sales cycles.
The company’s customer base grew 2% to 11,700+, with only 15% adopting consolidated platform offerings, highlighting significant runway for cross-sell and upsell. ARR per customer also ticked up, reflecting increased platform penetration.
Executive Commentary
"Our detection response business remained a key pillar of strength, delivering double-digit growth in 2024 and in the year at over $400 million in ARR. The strategic value of our security operations platform is reflected in the average ARR per DNR customer, which is now approximately $100,000."
Corey Thomas, Chief Executive Officer
"Full-year revenue of $844 million grew 9% over the prior year and exceeded the high end of our guidance range. Operating income of $164 million was above our guided range for the year as well. This represents 19% full-year operating margin and expansion of over 600 basis points from the prior year, demonstrating our ability to drive operational efficiency alongside our 2024 investments in innovation and growth."
Tim Adams, Chief Financial Officer
Strategic Positioning
1. MDR-Led Platform Transformation
Rapid7 has pivoted its business model to anchor on managed detection and response (MDR), which now represents the majority of ARR and is growing in the mid-teens. This shift addresses customer demand for integrated, outsourced threat monitoring and leverages AI to drive cost and detection efficiency.
2. Exposure Management as Growth Adjacent
Exposure Command, Rapid7’s integrated risk and exposure management solution, is positioned as the next growth pillar. While still early, Q4 pipeline grew over 20% YoY and initial conversion rates are ahead of plan, validating customer appetite for consolidated attack surface visibility across cloud, endpoint, and SaaS environments.
3. Partner Ecosystem and Channel Leverage
80-90% of new ARR is now booked through channel partners, signaling an operational pivot to partner-led growth. This deepens pipeline generation and enables more efficient go-to-market execution, especially for complex platform deals and international expansion.
4. Cost Structure and Innovation Investment
A $30 million reinvestment in 2025—split between MDR expansion, exposure management R&D, and a new India innovation center—aims to accelerate growth and improve long-term margin structure. AI-driven automation is expected to offset lower MDR gross margins, with the India center providing cost leverage and innovation velocity.
5. Product Integration and Upsell Engine
Cross-sell and upsell into the existing install base is now a core strategy, as only 15% of customers have adopted consolidated offerings. New platform modules (like Surface Command and Threat Complete) expand the attach opportunity and drive higher net retention potential.
Key Considerations
Rapid7’s 2024 results reflect a company in mid-transition: legacy VM is flat-to-declining, but MDR and platform security are scaling, with operational and margin discipline providing a bridge to future growth. Management is investing ahead of visible ARR expansion, betting that integrated security operations will unlock cross-sell and market share gains as customers consolidate vendors.
Key Considerations:
- Secular Decline in Standalone VM: Traditional vulnerability management offers little growth, requiring strategic focus on integrated, cloud-enabled risk management.
- Deal Cycle Elongation: Larger, multi-year platform deals extend sales cycles, impacting near-term ARR but building future expansion opportunity.
- Margin Expansion vs. Growth Trade-Off: 2024 saw strong margin gains, but 2025 will see reinvestment, temporarily capping margin upside to fund future scale.
- Channel-Driven Go-to-Market: Heavy partner reliance brings efficiency but may limit direct customer intimacy and control over pipeline quality.
- Greenfield and Upsell Leverage: Only a minority of customers use the full platform, creating a large embedded growth lever if execution improves.
Risks
Secular headwinds in vulnerability management, including cloud migration and competitive pricing, continue to pressure legacy ARR and churn. Deal cycles are lengthening as customers consolidate spend, delaying ARR realization. Execution risk remains elevated, given the company’s recent history of under-delivering on ARR guidance and the ongoing need to upgrade and cross-sell the install base. Macro and sector-specific factors (notably in healthcare and public sector) add further uncertainty to near-term pipeline conversion.
Forward Outlook
For Q1 2025, Rapid7 guided to:
- Total revenue of $207 to $209 million (up 1% to 2% YoY)
- Non-GAAP operating income of $23 to $25 million
- Non-GAAP net income per share of $0.33 to $0.36
For full-year 2025, management maintained guidance:
- ARR of $870 to $890 million (4% to 6% growth)
- Revenue of $860 to $870 million (2% to 3% growth)
- Operating income of $125 to $135 million
- Free cash flow of ~$135 million
Leadership flagged:
- Most ARR growth will come from MDR, with exposure management as upside if pipeline converts.
- Seasonality will be pronounced, with net new ARR skewed to the second half due to longer deal cycles.
Takeaways
- MDR Now Core Growth Engine: Rapid7’s strategic pivot to managed detection and response has achieved scale, but legacy VM drag will persist until cross-sell and platform adoption inflect.
- Margin Discipline Offsets Growth Plateau: Operating and free cash flow margins expanded sharply in 2024, giving management room to reinvest in innovation and go-to-market for 2025.
- Watch for Platform Conversion and Pipeline Realization: The success of Exposure Command and install base upgrades will determine whether ARR growth reaccelerates as planned into 2026.
Conclusion
Rapid7’s Q4 results confirm a business in transition, with MDR-led platform security now the growth focus and legacy VM in managed decline. Margin expansion and targeted investment provide a credible bridge to potential ARR reacceleration, but execution on cross-sell and pipeline conversion will be decisive for investor confidence in 2025 and beyond.
Industry Read-Through
Rapid7’s experience highlights a broader cybersecurity industry trend: pure-play vulnerability management is losing relevance as customers demand integrated, platform-based security operations that span cloud, endpoint, and compliance. The migration toward MDR and consolidated risk management mirrors moves by peers (e.g., Tenable’s exposure management acquisition), signaling that platform consolidation and AI-driven detection are now table stakes. Channel reliance and longer deal cycles are becoming the norm, as buyers seek fewer, more strategic security partners. Vendors unable to evolve beyond single-point solutions will face secular headwinds, while those that can drive cross-sell and platform adoption stand to capture share as security budgets consolidate.