Prospectus Summary
PROSPECTUS SUMMARY This summary highlights information contained elsewhere in this prospectus and does not contain all of the information that you should consider in making your investment decision. Before investing in our common stock, you should carefully read this entire prospectus, including our consolidated financial statements and the related notes and the information set forth under the sections titled “Risk Factors,” “Special Note Regarding Forward-Looking Statements,” and “Management’s Discussion and Analysis of Financial Condition and Results of Operations,” in each case included in this prospectus. Unless the context otherwise requires, we use the terms “Rapid7,” “company,” “our,” “us,” and “we” in this prospectus to refer to Rapid7, Inc. and, where appropriate, our consolidated subsidiaries.RAPID7, INC.
Rapid7 is a leading provider of security data and analytics solutions that enable organizations to implement an active, analytics-driven approach to cyber security. Our security data and analytics platform was purpose built for today’s increasingly complex and chaotic IT environment. We combine our extensive experience in security data and analytics and deep insight into attacker behaviors and techniques to make sense of the wealth of data available to organizations about their IT environments and users. There has been an explosion of increasingly sophisticated cyber attacks as the proliferation of mobile devices, cloud-based applications and solutions relying on user credentials has eliminated the boundaries that previously defined an organization’s network perimeter and expanded the threat surface that organizations must now defend. Our powerful and proprietary analytics enable organizations to contextualize and prioritize the threats facing their physical, virtual and cloud assets, including those posed by the behaviors of their users. Leveraging our security data and analytics platform, our solutions enable organizations to strategically and dynamically manage their cyber security exposure. Our solutions empower organizations to prevent attacks by providing visibility into vulnerabilities and to rapidly detect compromises, respond to breaches and correct the underlying causes of attacks. This balanced and analytics-focused approach ultimately better secures organizations’ environments and reduces the likelihood of, and risks associated with, cyber attacks. We believe our technology and solutions revolutionize the practice of cyber security and are central and critical to implementing a modern security program.
With our security data and analytics platform at our core, we are pioneering active, analytics-driven solutions to cyber security that enable organizations to find and eliminate critical weaknesses and detect attacks in their IT environments. Our threat exposure management offerings include our industry-leading vulnerability management products, which we enhance with deep security analytics capabilities to quickly deliver contextual risk prioritization, critical threat awareness and impactful remediation guidance. Similarly, we added analytics and automation to traditional manual penetration testing to be able to deliver robust ongoing attack simulation solutions that provide organizations with visibility into real-world threats. By providing and combining analytics and actionable insights related to both an organization’s attack surface and the dynamic threat landscape, our security data and analytics platform enables organizations to manage their threat exposure above and beyond traditional vulnerability management products on the market. Further leveraging our technology platform and analytics capabilities, we recently introduced our incident detection product to provide organizations with the ability to rapidly detect and respond to cyber security incidents and breaches. To complement our incident detection product, we also recently introduced our incident response services, which provide our customers with critical access to our security experts and experience, enabling them to accelerate incident response and containment. We also offer security advisory services that help organizations develop a holistic approach to their cyber security programs and advance their cyber security program maturity. All of our products have been designed with an intuitive user interface, focused on ease-of-use and fast time-to-value for our customers.
Cyber security has become a strategic imperative for organizations globally, driven by increased focus by boards of directors and senior management in the wake of numerous recent high profile breaches and data thefts. Organizations are increasingly at risk of being compromised, with the number of reported security incidents within enterprises increasing 48% in 2014 over the prior year, according to a report by PricewaterhouseCoopers LLP. There are three converging macro drivers that are changing the cyber security landscape for organizations and driving the increase in cyber breaches. First, mobile and connected devices, cloud-based applications and more open and interconnected networks have increased IT complexity, expanding the exploitable attack surface across an organization and resulting in more sources of potential vulnerability. Second, there has been a dramatic change in the tools available to cyber attackers. Attackers can now purchase highly effective and easy-to-use software at very low cost that is designed to circumvent traditional prevention-based tools, thereby lowering the bar for nearly anyone to launch advanced cyber attacks. Third, the economic motives for attackers are more compelling, with new, vibrant markets providing attackers an efficient and effective way to monetize stolen customer information and employee data.
The confluence of these factors has rendered the old model of “block and protect” prevention-based cyber security programs ineffective. These traditional “block and protect” approaches to cyber security typically rely disproportionately on network perimeter protection tools such as firewalls and antivirus software to stop attackers. However, as the network perimeter rapidly disappears, the effectiveness of these legacy solutions diminishes greatly. Further, preventative solutions are generally not able to identify or deter attacks that involve stolen or weak credentials, which are used in 76% of cyber attacks according to the 2013 Verizon Data Breach Investigations Report. When an attacker gains access to an organization’s network through compromised credentials or otherwise, the attacker can freely exploit assets within the breached environment until they are detected, which took a median of 205 days in 2014 according to a report by Mandiant. The decreasing effectiveness of a traditional prevention-focused approach to cyber security is causing a significant shift to a new model that uses an active, analytics-driven approach to reduce and manage risks to the organization. This new model disrupts the historical focus on “block and protect” solutions and balances organizations’ investments in prevention, detection and correction to reduce the likelihood of, and risks associated with, cyber attacks. Effective implementation of this new model demands data and analytics to assess the effectiveness of tools and programs, identify attacker behaviors and prioritize and remediate exposures. Rapid7 empowers organizations to better secure their dynamic IT environments by providing the security data and analytics that are at the core of a holistic and active, analytics-driven approach to cyber security.
As of March 31, 2015, we had more than 3,900 customers, including over 30% of the organizations in the Fortune 1000. We have experienced strong revenue growth with revenue increasing from $31.0 million in 2011 to $76.9 million in 2014, representing a 35% compound annual growth rate. We have strong visibility to our revenue as 53% of the revenue recognized in 2014 was recorded on our balance sheet as deferred revenue as of December 31, 2013 and 85% of the revenue recognized in the first quarter of 2015 was recorded on our balance sheet as deferred revenue as of December 31, 2014. We incurred a net loss of $32.6 million in 2014 as we continued to invest for growth given our large market opportunity.
Industry Background
Increasing Cyber Security Breaches Driven by a Rapidly Evolving and Dynamic Threat Landscape
IT professionals face a rapidly evolving and dynamic threat landscape and an increasingly fragmented mosaic of security technology vendors offering point solutions to prevent specific threats and protect against specific attack vectors. Forced to make choices and allocate budgets with limited information, IT professionals are often left feeling overwhelmed. At the same time, threats continue to escalate due to three converging macro drivers:
Increasingly Complex IT Environment is Expanding Organizations’ Attack Surfaces. IT departments are required to deliver more applications faster, often in the cloud, in order to meet growing user demands for innovation and productivity tools. As a result, it has become increasingly difficult for IT departments to secure the increasing number of systems against the growing number of known security vulnerabilities. Increasing user empowerment has also led to an increase in the number of applications and devices that individual users can access with their credentials, which further expands the attack surface of an organization exposed to potential cyber criminals. Firewalls and other traditional prevention-based techniques are less capable of protecting this complex and expanded attack surface, leaving IT professionals overwhelmed by new threats and looking for new technologies and ways to respond.
Weaponized Malware Evades Traditional Prevention-Based Tools and Expands the Cyber Attacker Universe. There are sophisticated software toolkits and malware that can be used to launch a cyber attack, which are readily available online for free or at a low cost. These toolkits are specifically designed to circumvent the preventative security measures typically put in place by organizations, allowing cyber criminals with rudimentary IT knowledge to launch sophisticated attacks on enterprise users and networks. With this weaponized software, cyber attacks are no longer just the domain of advanced attackers, and the number of security breaches is rapidly increasing.
A Vibrant Cyber-Crime Economy Further Incents Cyber Attackers. Economic incentives for attackers continue to become more compelling, as new and vibrant black markets for stolen data, including credit card information, email account information and healthcare information, enable attackers to efficiently and effectively monetize stolen information. This more recent dynamic has led to a proliferation of data from successful attacks being offered for sale by cyber criminals, and the formation of a lucrative and growing underground economy.
Enterprise Security Shifting from Passive “Block and Protect” to Actively-Managed Security Programs
Organizations have traditionally taken a passive approach to cyber security, relying on deploying “block and protect” security tools aimed at thwarting attackers at the perimeter of the network. However, sophisticated software-enabled technologies and techniques are increasingly used by attackers to evade prevention-based security solutions. Additionally, the explosion of cloud-based applications and mobile devices accessing enterprise data are blurring the previously rigid lines that once defined enterprise network boundaries. Without these boundaries, prevention-based tools are easily circumvented by cyber criminals. Equally problematic for today’s organizations, traditional “block and protect” solutions are ineffective against cyber attacks using compromised user credentials. Many users have administrator-level credentials on their devices to maximize their productivity, but these credentials are relatively easily stolen and can be exploited by attackers in order to gain access to an organization’s network, assets and information. Use of stolen credentials in cyber attacks is becoming a significant issue, and once an attacker has gained access to an IT system with valid credentials, most prevention-based technologies cannot identify the threat. Without knowledge of a breach, IT professionals cannot react to limit the damage and attackers may have months to explore an organization’s network and steal critical data before being detected.
In light of high profile and costly security breaches, IT professionals are increasingly focused on developing comprehensive security programs to better protect their organizations against attacks. An actively-managed approach to an organization’s cyber security program improves the program’s overall effectiveness by focusing on analytics and an understanding of risks and threats in context. This approach further assists IT professionals in allocating security budgets to the specific tools that enable organizations to process and analyze significant amounts of data in real time to quickly identify, understand and react to attacks and breaches as they occur. Through security data and analytics, organizations can recognize behavior patterns associated with breaches, even if the attack vector is completely novel. The organization can then develop and improve its cyber security programs in order to reduce its exposures and better detect and respond to compromises using a holistic approach that balances investments in prevention, detection and correction. Analytics provides the critical context and prioritization to underlying security data to facilitate effective, informed and proactive decisions that allow for the systemic and dynamic management of security programs across each of these areas. An active, analytics-driven security program can prevent attacks through increased visibility into vulnerabilities, rapidly detecting and responding to compromises and correcting the underlying causes of attacks.
Our Market Opportunity
According to Gartner, Inc., advanced targeted attacks make prevention-centric strategies obsolete. Securing enterprises in 2020 will require a shift to information- and people-centric security strategies, combined with pervasive internal monitoring and sharing of security intelligence. Accordingly, we believe that our market opportunity is large and growing and will be positively impacted by the ongoing shift in security spending from a traditional passive, “block and protect” approach to an active, analytics-driven approach to cyber security. Gartner, Inc. estimates that by 2020, 60% of enterprise information security budgets will be allocated for rapid detection and response approaches – up from less than 10% in 2014.
Our estimate, based on International Data Corporation data, is that the overall market for security data and analytics is a $12.6 billion opportunity in 2015. Included in our estimates are all or a portion of the markets for Security and Vulnerability Management, Network Intrusion Detection and Prevention, Endpoint Security Suites and Security Services. We believe that our market opportunity will grow as organizations continue to move away from prevention-based solutions and toward analytics-driven security environments.
Benefits of Our Solutions
We are a leading provider of security data and analytics solutions that enable organizations to implement an active, analytics-driven approach to cyber security. Key benefits of our solutions include:
Our Competitive Strengths
We have developed the following key competitive advantages that we believe will allow us to maintain a leadership position in the market for security data and analytics:
cloud activity. The platform collects data through an agentless architecture, which allows our platform to amass data from multiple sources quickly and without significant customer installation expertise.
Our Growth Strategy
Our mission is to deliver security data and analytics that revolutionize the practice of cyber security. Key elements of our growth strategy include:
Selected Risks Affecting Our Business
Our business is subject to numerous risks and uncertainties, including those highlighted in the section titled “Risk Factors” immediately following this prospectus summary. These risks include, among others, the following:
Corporate Information
We were initially incorporated in July 2000 in Delaware. Rapid7 LLC, a limited liability company organized under the laws of the Commonwealth of Massachusetts, was formed in January 2004. In August 2004, pursuant to an exchange agreement among Rapid7 LLC and the stockholders of Rapid7, Inc., the stockholders exchanged their shares in Rapid7, Inc. for equity interests in Rapid7 LLC, after which Rapid7, Inc. was dissolved. In August 2008, Rapid7 LLC was merged with and into Rapid7 LLC, a newly-formed Delaware limited liability company. Rapid7, Inc. was reincorporated in Delaware in October 2011. In a series of transactions in November 2011, equity holders of Rapid7 LLC exchanged their equity interests in Rapid7 LLC for capital stock in Rapid7, Inc. and Rapid7 LLC became a wholly-owned subsidiary of Rapid7, Inc., which is the registrant and issuer of the shares of common stock in this offering.
Following this offering, our directors, executive officers and holders of more than 5% of our common stock, some of whom are represented on our board of directors, together with their affiliates will beneficially own % of the voting power of our outstanding capital stock.
Our principal executive offices are located at 100 Summer Street, Boston, Massachusetts. Our telephone number is (617) 247-1717. Our website address is www.rapid7.com. The information contained on, or that can be accessed through, our website is not incorporated by reference into this prospectus, and you should not consider any information contained on, or that can be accessed through, our website as part of this prospectus or in deciding whether to purchase our common stock.
“Rapid7,” the Rapid7 logo, and other trademarks or service marks of Rapid7, Inc. appearing in this prospectus are the property of Rapid7, Inc. This prospectus contains additional trade names, trademarks and service marks of others, which are the property of their respective owners. Solely for convenience, trademarks and trade names referred to in this prospectus may appear without the ® or TM symbols.
Implications of Being an Emerging Growth Company
We qualify as an “emerging growth company” as defined in the Jumpstart Our Business Startups Act of 2012, or the JOBS Act. An emerging growth company may take advantage of specified reduced reporting and other burdens that are otherwise applicable generally to public companies. These provisions include:
We may take advantage of some or all these provisions until we are no longer an emerging growth company. We will remain an emerging growth company until the earlier to occur of (1) the last day of the fiscal year (a) following the fifth anniversary of the completion of this offering, (b) in which we have total annual gross revenues of at least $1.0 billion or (c) in which we are deemed to be a “large accelerated filer” under the rules of the U.S. Securities and Exchange Commission, which means the market value of our common stock that is held by non-affiliates exceeds $700 million as of the prior June 30th and (2) the date on which we have issued more than $1.0 billion in non-convertible debt during the prior three-year period.
We are choosing to “opt out” of the provision of the JOBS Act that permits emerging growth companies to take advantage of an extended transition period to comply with new or revised accounting standards applicable to public companies and, as a result, we will comply with new or revised accounting standards as required when they are adopted. This decision to opt out of the extended transition period is irrevocable.
We have elected to adopt certain of the reduced disclosure requirements available to emerging growth companies. As a result of these elections, the information that we provide in this prospectus may be different than the information you may receive from other public companies in which you hold equity interests. In addition, it is possible that some investors will find our common stock less attractive as a result of these elections, which may result in a less active trading market for our common stock and higher volatility in our stock price.