Is Rapid7, a publicly traded (NASDAQ: RPD) threat detection and response-focused cybersecurity company, closer to a sale?
Rumors started when Reuters reported hiring investment bank Goldman Sachs Group in February to explore its future. Those rumors have reignited in earnest with Rapid7’s announcement in August that it would lay off 18% (or nearly 500) of its employees as part of a corporate restructuring plan.
The restructuring plan savings, estimated at US$24 million to US$32 million, may not be enough to make a difference. Rapid7 has posted a net loss every year since its inception: US$124.7 million (2022), US$146.3 million (2021), and US$98.8 million (2020). As of June 30, 2023, the company had an accumulated deficit of US$953.4 million.
In September, the company announced it would raise US$260 million in a private placement of senior notes. Currently, Rapid7 has two existing convertible debt notes for US$234.2 million and US$520.9 million, due in 2025 and 2027, respectively. Their current placement would put them over US$1 billion in debt.
The company’s stock is trading just below the US$50 share, up from its US$16 IPO price. Its current market cap is slightly below US$3 billion. Its 52-week range has widely fluctuated from US$26.48 to US$59.33 a share, but significantly off its US$140 pandemic share price.
Rapid7’s product portfolio is organized into six areas: incident detection and response, cloud security, vulnerability risk management, application security, threat intelligence, and security orchestration and automation response. All areas face significant competition, especially in its extended detection and response, security information and response, security orchestration and automation response, vulnerability management, and threat intelligence segments.
Competitors such as CrowdStrike, Exabeam, Palo Alto Networks, Qualys, Securonix, Splunk, and Wiz have been nipping at Rapid7 for years. Evidence that competition may be affecting growth is that total revenue increased by US$23.0 million in the three months ended June 30, 2023, compared to the same period in 2022. The US$23.0 million increase in revenue (only) consisted of a US$900,000 increase from new customers.
Rapid7 has to find a way to attract new customers. Rapid7’s over 11,000 customers, US$751 million annual recurring revenue, and brand recognition make it an attractive target for a private equity firm with expertise in turning around non-profitable cybersecurity companies. The obstacles are significant: a legacy of unprofitability, over US$1 billion in debt, and an inability to generate revenue from new customers.
Shareholders, employees, and debt holders may be ready to change ownership to right this once-bellwether cybersecurity company. This analyst believes private equity firms will want to discount the sale price based on the obstacles to turning this company around, causing a vast disagreement in valuation. An auction event is likely the best way forward for the sale of this company.