Rapid7's Cash-Flow Yield Is Real; the Shrinking ARR Is the Test

Rapid7 is a cybersecurity company that has made itself cheap, then cheaper. The shares hit $10.46 after sliding 22% in the last five trading days, down roughly 31% on the year and half their 52-week high. At that price the whole company, net of debt, sells for about seven times the free cash flow it produced over the last twelve months — a roughly 18% cash yield from a software business that digs currency out of recurring contracts. Its rival Tenable trades at nearly 3.6 times sales; Qualys at 8.4 times; Varonis at 7.6 times. Rapid7 sells for about one times sales.

That is not a normal spread. It is the market pricing in a specific, unglamorous possibility: that Rapid7's number — the annualized recurring revenue that feeds that cash flow — is shrinking and keeps shrinking. New CEO Wael Mohamed, who took the job June 1, spends Tuesday afternoon at the Citi Global TMT Conference explaining why it won't.

The number that started the slide

ARR is the subscription engine for a company like this. Every dollar of it is a contract the customer has signed to keep paying; the whole business model is converting growing ARR into cash. Rapid7's ARR is $824 million, and it is down 2% year over year. Revenue followed, off 1.5% in the second quarter, with the company guiding to a roughly 2% decline for all of 2026.

That single negative sign is what separates Rapid7 from the rest of the security software group and justifies the deepest multiple in the sector. Morgan Stanley said the quiet part out loud in July when it cut the stock to Underweight with a $9 price target, arguing that vulnerability management — Rapid7's traditional core — is a "less defensible" slice of cyber, that AI-native competitors are encroaching, and that Rapid7 fell behind in the pivot to exposure management. The stock dropped 11% the morning that hit. An aggregate of sell-side signals labels RPD a Hold, not a Buy.

The honest way to read this: the cheap multiple is a flag for shrinkage, not a mispricing of hidden growth. This is the trap case, and it is built on actual math.

The composition underneath

But ARR is not one number, and this is where the story gets worth watching. Inside the $824 million are two businesses moving in opposite directions. Detection & Response — network and endpoint security operations, roughly 55% of ARR — grew 5% year over year. The core platform overall grew 1%. The thing dragging the whole figure down is the non-core product line, less than a fifth of ARR, which the company is visibly shedding.

So the decline is not uniform decay. It is a mix problem: an old, smaller line eroding while the larger, faster-growing piece keeps expanding. Management is being pointed about what it is not doing well either; the new CEO said plainly that exposure management "is not yet where it needs to be", the exact area Morgan Stanley said Rapid7 fell behind in. That admission is data. It tells you the bulls and the bears are fighting over the same two questions: can the growing majority outrun the shrinking minority, and can the new hands stabilize ARR before the cash flow erodes too?

The balance sheet buys time

There are reasons to think the cash engine is sturdier than the revenue drip would suggest. Rapid7 guided to roughly $130 million of free cash flow for the full year even after paying for a restructuring that cut 12% of its workforce. That restructuring exists to do exactly what the thesis needs: lift non-GAAP operating margin from the mid-teens to a 20% target by the fourth quarter, converting a leaner cost base into cash while the top line finds its floor.

The balance sheet is the second backstop. The company held about $700 million in cash and government securities at the end of June and said it intends to use that cash to pay off $600 million of convertible notes due in March 2027 — retiring the debt instead of handing out new shares to convertible holders. For a stock already punished by dilution concerns, retiring what is fast approaching maturity is meaningfully de-risking: it protects per-share economics at the exact moment the growth story is unproven.

What Tuesday is for

Put it together and the setup is a classic Stone Fox test: deep value with a genuinely strong cash yield and a real balance sheet, but the "discount" is earned until one number changes direction. Forward math carries this, and right now the forward math — ARR down 2%, revenue down for the year — points the wrong way. That is not an invitation to buy the chart. It is an invitation to demand one specific break condition: core-plus-D&R ARR growth outrunning non-core attrition, which would take total ARR back to flat or positive and make the ~18% cash yield the durable number it currently only appears to be.

Tuesday afternoon's conference presentation matters precisely because it is the new CEO's first big public stage since taking over. Listen not for optimism but for the operating detail: whether he puts numbers behind the D&R growth, what happens to the non-core drag through the second half, and whether the 20% margin target is a one-quarter achievement or the new run rate. If he cannot show the ARR trajectory stabilizing, the market's pessimism was not a panic — it was correct, and the cheap multiple stays cheap for structural reasons. If the mix shift is real and the shrink gets bounded, that ten-times-cash-flow price is a gift only because almost no one believes the thing can grow again. Rapid7's story is one dollar of cash flow, one shrinking contract book, and one CEO who has to prove which one wins.