Rapid7 Launches Cyber GRC in General Availability, Becoming the First Major SecOps Platform to Unify Security Operations and Compliance

Rapid7, Inc. (NASDAQ: RPD), a cybersecurity company specializing in AI-driven managed detection, response, and exposure management, announced the general availability of Rapid7 Cyber GRC on July 28, 2026, making it the first major security operations platform to natively unify SecOps and governance, risk, and compliance workflows in a single product. Built on the Rapid7 Command Platform, Cyber GRC connects live security data with compliance controls, audit evidence, and risk reporting, replacing the disconnected, point-in-time compliance processes that most enterprises currently rely on. The launch follows an early access program that opened in May 2026 and received strong uptake from customers across financial services, healthcare, and enterprise technology.

The Problem Cyber GRC Solves Is Structural, Not Just Operational

Most enterprise compliance programs run on a separate track from security operations. Vulnerability data, threat intelligence, and detection workflows live in one set of tools; SOC 2 evidence collection, HITRUST assessments, and audit reporting live in another. The result is compliance teams manually assembling documentation before each assessment, pulling data from systems that were never designed to produce it, and generating reports that reflect a snapshot in time rather than the actual security posture of the organization. Rapid7 Cyber GRC eliminates that separation by using the real-time exposure data and security workflows already flowing through the Command Platform as the operating foundation for compliance. Controls, vulnerability insights, and audit details live together, which means organizations can demonstrate control effectiveness using live operational data rather than manually assembled evidence. The platform covers SOC 2, NIST CSF, ISO 27001, ISO 42001, PCI DSS, FedRAMP, GovRAMP, CMMC, and HITRUST E1, supported by ecosystem partners including Insight Assurance and 360 Advanced.

Cyber GRC Extends the Preemptive Security Strategy Into a New Buying Center

Rapid7 frames Cyber GRC as a natural extension of its Preemptive Security strategy, which aims to shift customers from reactive incident response toward continuous exposure management and risk reduction. The significance of the GRC launch goes beyond product expansion. GRC buyers sit in a different part of the enterprise than SecOps buyers: chief compliance officers, risk committees, and internal audit functions hold separate budgets and procurement authority. By building a product that appeals directly to that buyer while integrating seamlessly with the Command Platform that IT security teams already use, Rapid7 creates a cross-sell and upsell motion that does not depend on winning net-new security operations customers. The March 2026 acquisition of Kenzo Security for $25.5 million, which added AI-powered attack path analysis to the Command Platform, further strengthens the live security context that makes Cyber GRC’s continuous compliance model credible to enterprise buyers.

ARR Stabilization and FCF Growth Frame the Investment Context

Rapid7 reported Q1 2026 ARR of $832 million, revenue of $210 million, and non-GAAP operating income of $24.4 million, beating all guided metrics. Free cash flow of $33.4 million and $670 million in cash and equivalents give the company a solid balance sheet despite ARR declining 0.6% year over year as non-core standalone offerings continue to roll off. Full-year 2026 guidance calls for revenue of $836 to $842 million and free cash flow of $125 to $135 million. The stock fell roughly 9.5% following Q1 results despite the earnings beat, reflecting investor concern about the near-term ARR trajectory. Cyber GRC’s general availability represents the most significant product-led growth catalyst Rapid7 has disclosed since that earnings call, targeting a compliance software market that runs independently of the headwinds affecting its legacy non-core offerings.

Strategic Investment Summary

• General Availability: Rapid7 (NASDAQ: RPD) launched Cyber GRC in general availability on July 28, 2026, becoming the first major security operations platform to natively unify SecOps and GRC workflows within a single product built on live security data.
• Technical Foundation: Cyber GRC uses real-time exposure data already flowing through the Command Platform to power continuous compliance, automated evidence collection, and audit-ready reporting across SOC 2, HITRUST, ISO 27001, PCI DSS, FedRAMP, GovRAMP, CMMC, and other major frameworks.
• New Buying Center: GRC buyers (chief compliance officers, risk committees, internal audit) hold separate budgets from SecOps teams, giving Rapid7 a cross-sell motion that does not depend on winning new security operations customers.
• Kenzo Security Acquisition: The March 2026 acquisition of Kenzo Security for $25.5 million added AI-powered attack path analysis to the Command Platform, strengthening the live security context that underpins Cyber GRC’s continuous compliance model.
• Q1 2026 Financials: Q1 ARR of $832 million, revenue of $210 million, non-GAAP operating income of $24.4 million, and free cash flow of $33.4 million all beat guidance, with full-year revenue guidance of $836 to $842 million and FCF of $125 to $135 million.
• Growth Catalyst: Cyber GRC’s general availability is the most significant product-led growth catalyst Rapid7 has announced since Q1 results, targeting the compliance software market independently of the non-core ARR headwinds weighing on the near-term revenue trajectory.

Find out more about the latest corporate developments and financial reports at the Rapid7 investor portal.