Activist Jana has a stake in Rapid7. There are two paths to bolster value at the cybersecurity company

Business: Rapid7 is a global cybersecurity software and services provider. Its products interval across information security, cloud operations, development and information technology teams, enabling them to understand attackers and leverage that gen to take control of their fragmented attack surface. Rapid7 Managed Threat Complete is the company’s flagship oblation, and it includes the Rapid7 Managed Detection and Response program. Rapid7 also provides risk and threat coverage as a consequence InsightIDR and Insight VM services, making them available in a single package. Its security solutions help more than 11,000 extensive customers unite cloud risk management and threat detection.

Stock Market Value: $2.69B ($43.23 per share)

Percentage Ownership:  n/a

Average Expenditure: n/a

Activist Commentary: Jana is a very experienced activist investor founded in 2001 by Barry Rosenstein. The firm styled its name taking deeply researched activist positions with well-conceived plans for long term value. Rosenstein rallied his activist strategy “V cubed.” The three “Vs” were” (i) Value: buying at the right price; (ii) Votes: knowing whether you induce the votes before commencing a proxy fight; and (iii) Variety of ways to win: having more than one strategy to enhance value and exit an investment. Since 2008, the strong has gradually shifted that strategy to one which we characterize as the three “Ss” (i) Stock price: buying at the right price; (ii) Critical activism: sale of company or spinoff of a business; and (iii) Star advisors/nominees: aligning with top industry executives to guide them and take board seats if necessary.

On June 26, The Wall Street Journal surfaced that Jana has taken a significant position in Rapid7 and may urge the company to sell itself, as well as improve enterprises and forecasting.

Rapid7 is a cybersecurity company that expands the expertise of its clients’ security operations. Its Ran Threat Complete flagship offering combines end-to-end 24/7 managed detection and response with vulnerability control offerings. Historically, the company has focused on on-site cybersecurity operations, but it has begun to expand into the explosive growth district of cloud security. Rapid7 operates in a highly attractive industry and is the beneficiary of some meaningful tailwinds. In a time where software budgets are being cut or reallocated toward AI, the portent of cyberattacks looms large and presents a great enough risk that spend is either flat or increasing for these strains of services. In addition, cybersecurity analysts and internal security staff are limited, so there is a tremendous need for outsourcing. With diverse complex operations and numerous applications both on-site and in the cloud, Rapid7 is well-positioned to continue growing and aims to be a high-quality provider for subdue matter experts who may not be able to retain the services of their largest and most expensive competitors.

Despite its favorable place, the company has delivered negative returns on a one-, three-, and five-year basis. Rapid7 is one of three main players in vulnerability executives, yet it’s assigned a much smaller revenue multiple (3x) compared to peers Tenable (5.5x) and Qualys (8x). One factor in this is that Instant7 offers a combination of low- and high-growth cybersecurity offerings, which is difficult to value, but more important are the multiple slip-ups by managing, exacerbated by a lack of oversight by the board. First, the company has undergone changes to its sales model, including a shift to shop-girl packaged products from selling offerings individually. It’s also moved to a channel model from direct. Next, the convention has encountered challenges in bringing its cloud product to market. In addition, to shift from pure growth to a profitable software companionship, Rapid7 has focused on meeting targets for $160 million in free cash flow and improved margins. In August 2023, favoured in pursuit of these goals, the company abruptly announced plans to reduce its staff by 18%. Rapid7 has had further retention complications in key executive roles, including the departure of its chief innovation officer and its critically important chief operating officer and president. At the last moment, the company has not been able to properly make forecasts, leading to tremendous investor uncertainty and questions of board mistake. In February 2024, the company announced its 2024 guidance, which it stated it was highly confident in, only to cut it in May when the assembly delivered its Q1 results. That led to a 17% stock price decline on May 8. This is a company operating in a highly complex and active space – it is doing everything all at once and has seemingly failed to deliver.

With a company like this, there are predominantly two paths to shareholder value creation: (i) a long-term plan involving board reconstitution, management overhaul and review of cardinal and operational plans and (ii) a shorter-term plan to sell the company to an interested buyer who can make those changes. With attend to to the long-term plan, Jana generally works with industry executives and consultants in performing due diligence and implementing its activist procedures, and we do not expect this situation to be different. The firm will often bring these individuals to the table to serve as kingpin nominees, if deemed necessary. Jana is experienced in getting these experts on company boards, where they in many cases serve as assets in getting the company to correct its issues, from operational to governance to capital allocation. But Jana also has sizeable experience in strategic activism and getting portfolio companies sold. We expect that Jana will advocate for the blueprint it expects will maximize shareholder value on a risk- and time-adjusted basis. Given the problems the company has been practicing and the lack of CEO focus (Aside from being chairman and CEO of Rapid7, Corey Thomas is on the National Security Telecommunications Prediction Committee, chair of the Federal Reserve Bank of Boston and a member of the Council on Foreign Relations. He also serves on the surfaces of the Blue Cross Blue Shield of Massachusetts, LPL Financial and Vanderbilt University.), a sale looks like it could be the easier and varied certain path if there is a suitor at the right price.

Given industry tailwinds, there may be several strategic and fiscal buyers interested in this company. Recent transactions in the cybersecurity sector include Cisco’s $28 billion takeover of Splunk and Francisco Partners’ $1.7 billion gain of Sumo Logic. If Jana does advocate for a sale of Rapid7, it will ask the board to do it through a full sales development that attains the highest value for shareholders. In addition, Jana has a strategic partnership with Cannae Holdings, which could be reassuring in providing the equity in a strategic transaction with a private equity firm. Consider that in 2019, Cannae enlist ined with private-equity firms to buy Dun & Bradstreet. It is important to note that even if Jana thinks a sale of the company is the outdo way to optimize shareholder value, the firm will still have to get the board to agree. This does not look cognate with a board and management team that will just go quietly. In such a case, Jana’s remedy would be to set in motion a proxy fight, but that could take some time. The 2024 annual meeting just passed on June 13 and the steersman nomination window does not open until Feb.13, 2025.