Summary
Rapid7's fiscal 2021 third quarter paired robust demand with a wider GAAP loss. Revenue reached $139.9 million, up 33.1% from the prior-year quarter. Gross profit was $96.4 million, up 30.2%, though gross margin slipped to 68.9%, down 1.5 percentage points. The operating loss was $34.3 million, and the loss widened 91.5%. Net loss was $37.7 million, a loss that widened 47.6%. Diluted loss per share was -$0.67, and the per-share loss widened 34.0%.
The revenue base is increasingly recurring. Recurring revenue was 92% of total revenue in the quarter, compared with 91% in the prior-year quarter. Annualized recurring revenue ended at $550.0 million, up 38% year over year. Customer count rose 17% to 9,909, and ARR per customer increased 18% to $55.5. The company ended the quarter with more than 9,900 customers in 144 countries, including 39% of the Fortune 100. Deferred revenue, current portion, was $316.0 million, up 36.5% from the prior-year quarter. For the first nine months of fiscal 2021, revenue was $383.8 million, up 28.6% year over year, while net loss was $101.7 million and the loss widened 45.4%.
Cash generation improved. Operating cash flow was $19.4 million for the quarter, up 75.6% from the prior-year quarter, and $49.2 million for the first nine months, up 1,043.5%. Capital expenditures were $2.2 million, down 31.7% from the prior-year quarter. Free cash flow, a non-GAAP measure, was $14.3 million in the quarter and $37.2 million for the first nine months. Non-GAAP income from operations was $5.7 million in the quarter and $13.7 million year to date. Adjusted EBITDA was $9.9 million in the quarter and $25.7 million for the first nine months. Non-GAAP net income was $3.4 million in the quarter and $5.9 million year to date.
The quarter included the July 16, 2021 acquisition of IntSights Cyber Intelligence Ltd. for an aggregate fair value of $322.2 million, consisting of $319.2 million in cash paid at closing, $5.6 million in deferred cash payments, and a $2.6 million receivable for estimated purchase price adjustments. Rapid7 said the deal added contextualized external threat intelligence and proactive threat remediation. Management said early customer reception to the threat intelligence capabilities has been encouraging. In October 2021, the company launched Project Doppler, a free tool for external attack surface insights, and announced plans for a new Tampa, Florida office. Rapid7 also issued a notice of redemption for the remaining $45.4 million in aggregate principal amount of its convertible senior notes due 2023.
Management's guidance addresses the fourth quarter and full fiscal year 2021. For the fourth quarter of 2021, Rapid7 guides annualized recurring revenue to approximately $586 million, non-GAAP loss from operations of $(6.7) million, and non-GAAP net loss per share of $(0.18). For full-year 2021, the company guides non-GAAP income from operations of $7.0 million, non-GAAP net loss per share of $(0.07), and free cash flow of approximately $25.0 million. The guidance excludes any potential impact from foreign exchange gains or losses. Risks include the ongoing COVID-19 pandemic, integration of acquired companies, customer renewal rates, competition, sales cycles, the ability to sustain revenue growth, and the possibility that products and services may not correctly detect vulnerabilities. The company also cites fluctuations in quarterly results, market growth, and the ability to manage growth. The company also notes that its subscription model can delay the full effect of the pandemic on results.
Forecast
Reported figures
GAAP, from SEC filings| Metric | Q3 FY2021 | Q2 FY2021 | QoQ | Q3 FY2020 | YoY |
|---|---|---|---|---|---|
| Revenue | $139.9M | $126.4M | +10.7% | $105.1M | +33.1% |
| Gross profit | $96.4M | $87.1M | +10.7% | $74.0M | +30.2% |
| Gross margin | 68.9% | 68.9% | +0.0 pp | 70.5% | -1.5 pp |
| Research & development | $43.9M | $35.3M | +24.3% | $28.5M | +53.9% |
| Sales & marketing | $63.0M | $56.2M | +12.1% | $48.4M | +30.1% |
| General & administrative | $23.8M | $17.5M | +36.2% | $15.0M | +58.7% |
| Total operating expenses | $130.7M | $109.0M | +19.9% | $92.0M | +42.2% |
| Operating income (loss) | -$34.3M | -$21.9M | -56.5% | -$17.9M | -91.5% |
| Operating margin | -24.5% | -17.3% | -7.2 pp | -17.1% | -7.5 pp |
| Net income (loss) | -$37.7M | -$34.2M | -10.4% | -$25.5M | -47.6% |
| Net margin | -26.9% | -27.0% | +0.1 pp | -24.3% | -2.6 pp |
| Diluted EPS | -$0.67 | -$0.62 | -$0.05 | — | — |
Risks
Rapid7 completed the $322.2 million IntSights acquisition in July 2021 after acquiring Alcide and Velocidex earlier in 2021, and risk factors describe complex, expensive integration that may interrupt product development and sales, complicate retention of key personnel, and create unforeseen liabilities. MD&A also notes acquisition-related expenses and intangible amortization contributed to the widened operating loss for the quarter ended September 30, 2021.
Risk factors highlight significant debt from $600.0 million of 2027 Notes, $230.0 million of 2025 Notes, and a $45.4 million 2023 Notes redemption. The conditional conversion features of the 2023 and 2025 Notes were triggered as of September 30, 2021, and cash settlement of conversions or covenant defaults could reduce liquidity and business flexibility.
The SecOps market is described as highly fragmented and intensely competitive, with named competitors including Qualys, Tenable, Splunk, Microsoft, Palo Alto Networks, and others. Larger competitors can bundle products and cut prices, which may pressure Rapid7's pricing and average sales price.
Greater than half of revenue was attributable to InsightVM, Nexpose and Metasploit in each of the last three fiscal years. Any decline in demand for vulnerability management offerings, or failure to increase sales of newer offerings, could disproportionately harm operating results.
COVID-19 risk factors state the pandemic has caused and may continue to cause delays in the sales cycle, renewals at reduced scope, customer requests for payment term deferrals, and pricing or bundling concessions. MD&A says the full impact remains uncertain and may not be fully reflected in results until future periods.
Risk factors state substantial dependence on sales and research and development personnel, where turnover has historically been high, and on senior management including CEO Corey Thomas. Acquisitions add further integration and retention complexity.
Rapid7 derived approximately 47% of 2020 revenue through channel partners, and those agreements are non-exclusive and do not prevent partners from favoring competitors or their own products. Failure to maintain or recruit channel partners could harm growth, particularly internationally.
For the nine months ended September 30, 2021, operations outside North America generated 18% of revenue, up from 17% in the prior-year period. This exposes Rapid7 to Brexit, foreign exchange, regulatory, and geopolitical risks as it continues international expansion.
Risk factors note that non-VM products including InsightAppSec, InsightConnect and InsightCloudSec are relatively new and may not gain expected market acceptance. Cloud Security offerings must achieve widespread adoption to justify the upfront research, development, marketing, and sales investment.
Gross margin decreased to 68.9% for the quarter ended September 30, 2021 from 70.5% in the prior-year quarter, with MD&A citing higher cloud computing costs and amortization of acquired intangibles. Continued cloud and acquisition-related cost increases could constrain profitability.
SaaS KPIs
All quarters →Free Cash Flow
ARR per Customer
Number of Customers
Annualized Recurring Revenue (ARR)
Non-GAAP Operating Margin
Summary, forecast, risks and KPIs are extracted from Rapid7, Inc.'s SEC filings for Q3 FY2021 (10-Q / 10-K and the 8-K earnings release); GAAP figures in the summary are checked against the reported XBRL data. They can contain errors; the filings are authoritative. Processed Oct 2, 2026.