Krisanapong Detraphiphat | Moment | Getty Images
Company: Rapid7 (RPD)
Business: Rapid7 is a global provider of cybersecurity software and services. Its products span information security, cloud operations, development and IT teams, enabling them to understand attackers and use that intelligence to gain control of their fragmented attack surface. Rapid7 Managed Threat Complete is the company's flagship offering and includes the Rapid7 Managed Detection and Response program. Rapid7 also provides risk and threat protection through the InsightIDR and Insight VM services, delivering them in a single package. Its security solutions help more than 11,000 customers worldwide unify cloud risk management and threat detection.
Market value: $2.69 billion ($43.23 per share)
Stock chart symbolStock chart symbol
Rapid7 in 2024
Activist: Jana Partners
Percentage ownership: n/a
Average costs: n/a
Comment from an activist: Jana is a highly experienced activist investor founded in 2001 by Barry Rosenstein. The firm made its name by taking thoroughly researched activist positions with well-thought-out plans for long-term value. Rosenstein called his activist strategy “V to the power of three.” The three “Vs” were: (i) value: buying at the right price; (ii) votes: knowing if you have the votes before starting a proxy fight; and (iii) multiple ways to win: having more than one strategy to drive value and exit an investment. Since 2008, the firm has gradually transitioned this strategy to what we refer to as the three “Ss”: (i) share price: buying at the right price; (ii) strategic activism: selling the company or spinning off a business; and (iii) star advisors/nominees: working with top industry executives to advise them and take board seats when needed.
What happens
On June 26, the Wall Street Journal reported that Jana had taken a significant position at Rapid7 and may push the company toward a sale and improve its operations and forecasts.
Behind the scenes
Rapid7 is a cybersecurity company that extends the expertise of its clients' security operations. Its flagship offering, Managed Threat Complete, combines 24/7 managed end-to-end detection and response with vulnerability management offerings. In the past, the company has focused on on-premises cybersecurity operations, but has begun to expand into the explosively growing space of cloud security. Rapid7 operates in an extremely attractive industry and benefits from some significant tailwinds. At a time when software budgets are being cut or reallocated in favor of AI, the threat of cyberattacks is large and poses such a large risk that spending on these types of services is either stagnating or increasing. In addition, cybersecurity analysts and in-house security staff are limited, so there is a huge need for outsourcing. With more complex operations and numerous applications both on-premises and in the cloud, Rapid7 is well positioned to continue to grow and aims to be a high-value provider for subject matter experts who may not be able to utilize the services of their largest and most expensive competitors.
Despite its favorable position, the company has delivered negative returns on a one-, three-, and five-year basis. Rapid7 is one of the three major players in the vulnerability management space, but it has a much lower revenue multiple (3x) compared to rivals Tenable (5.5x) and Qualys (8x). One factor here is that Rapid7 offers a combination of low- and high-growth cybersecurity offerings, which is difficult to value. More important, however, are the numerous management slip-ups, which have been exacerbated by a lack of board oversight. First, the company has made changes to its sales model, including a shift from selling individual offerings to selling packaged products. It has also moved from direct sales to a channel sales model. Next, the company has encountered challenges in bringing its cloud product to market. In order to move from pure growth to a profitable software company, Rapid7 has also focused on achieving targets for $160 million in free cash flow and improved margins. In August 2023, likely to meet these goals, the company abruptly announced plans to reduce its workforce by 18%. Rapid7 has had further problems retaining key leadership positions, including the departure of its Chief Innovation Officer and its all-important Chief Operating Officer and President. Finally, the company has been unable to provide adequate forecasting, creating tremendous investor uncertainty and questions of board oversight. In February 2024, the company announced its 2024 guidance, which it said it was very confident about, only to lower it in May when the company reported its first-quarter results. This led to a 17% drop in the stock price on May 8. This is a company operating in a highly complex and dynamic space—it's doing everything at once and has seemingly failed to deliver.
With a company like this, there are generally two paths to shareholder value creation: (i) a long-term plan that includes a board reshuffle, management restructuring, and a review of strategic and operational plans, and (ii) a shorter-term plan to sell the company to an interested buyer who can make those changes. With respect to the long-term plan, Jana generally works with industry executives and advisors to conduct due diligence and execute their activist plans, and we expect this situation will be no different. The company will often bring these individuals to the negotiating table as board candidates when deemed necessary. Jana has experience bringing these experts onto corporate boards, where they often serve as a valuable asset in getting the company to fix its problems, from operations to corporate governance to capital allocation. But Jana also has extensive experience in strategic activism and portfolio company sales. We expect Jana to champion the strategy she believes will maximize shareholder value on a risk- and time-adjusted basis. Given the issues facing the company and the lack of focus from the CEO (Corey Thomas is not only chairman and CEO of Rapid7, but also a member of the National Security Telecommunications Advisory Committee, chairman of the Federal Reserve Bank of Boston, and a member of the Council on Foreign Relations. He also sits on the boards of Blue Cross Blue Shield of Massachusetts, LPL Financial, and Vanderbilt University), a sale seems to be the easier and safer path if an interested buyer can be found for the right price.
Given the industry tailwinds, there could be several strategic and financial buyers interested in this company. Recent deals in the cybersecurity sector include Cisco's acquisition of Splunk for $28 billion and Francisco Partners' acquisition of Sumo Logic for $1.7 billion. If Jana advocates for a sale of Rapid7, she will ask the board to do so as part of a full sale process that generates the highest value for shareholders. Additionally, Jana has a strategic partnership with Cannae Holdings, which could be helpful in providing the equity for a strategic transaction with a private equity firm. Consider that Cannae partnered with private equity firms to buy Dun & Bradstreet in 2019. It's important to note that even if Jana believes a sale of the company is the best way to optimize shareholder value, the company will still need to get board approval. This does not look like a board and management team that will simply go quietly. In such a case, Jana's remedy would be to start a proxy fight, but that could take some time. The 2024 annual meeting just took place on June 13, and the opportunity to nominate new directors will not open until February 13, 2025.
Ken Squire is founder and president of 13D Monitor, an institutional research service on shareholder activism, and founder and portfolio manager of the 13D Activist Fund, a mutual fund that invests in a portfolio of 13D activist investments.