Rapid7 (RPD) 8-K Entry into a Material Definitive Agreement

Exhibit 99.2

Rapid7 Announces Intent to Acquire DivvyCloud and Provides Preliminary First Quarter 2020 Financial Results

Acquisition will strengthen the company’s ability to offer its customers comprehensive cloud security posture management

Boston, MA — April 28, 2020Rapid7, Inc. (NASDAQ: RPD), a leading provider of security analytics and automation, today announced that it has entered into a definitive agreement to acquire Divvy Cloud Corporation, a leader in Cloud Security Posture Management (CSPM). Under the terms of agreement, Rapid7 will acquire DivvyCloud for a total purchase price of approximately $145 million, subject to adjustments, to be paid in cash and stock. The acquisition is expected to close during the second quarter of 2020, subject to the satisfaction of customary closing conditions.

As organizations accelerate their migration and adoption of cloud services, they need help bringing Security and DevOps teams together to understand and effectively manage the governance, risk and security of their cloud and container environments. Through DivvyCloud’s platform, Rapid7 customers will have the ability to innovate more securely, move out of data centers and into the cloud, and make infrastructure accessible and manageable.

DivvyCloud enables deep visibility, combined with automated prevention and real-time remediation of risk to deliver continuous security and compliance for cloud environments, including support for Amazon Web Services, Microsoft Azure, Google Cloud Platform, Alibaba Cloud and Kubernetes. Using DivvyCloud, customers can protect cloud and container environments from misconfiguration, policy violations, external and internal threats, and identity and access management challenges.

Quotes

• “We are thrilled to welcome DivvyCloud, its customers, and the entire DivvyCloud team to the Rapid7 family,” said Corey Thomas, chairman and CEO, Rapid7. “With the acceleration of cloud adoption introducing new enterprise risk areas, we’re excited to bring Security and DevOps teams together with DivvyCloud’sbest-of-breed compliance, risk management and governance for multi-cloud and container environments, while also integrating it with our Insight Cloud platform to create enduring customer value.”

• “Joining forces with Rapid7 is a natural next step,” said Brian Johnson, CEO andco-founder, DivvyCloud. “Their commitment to customers, employees, and company culture is well-aligned with the values that have made DivvyCloud so successful. With the combined expertise of both Rapid7 and DivvyCloud, we are even better positioned to help enterprises accelerate innovation using cloud and containers without the loss of control.”

• “Security teams are constantly challenged with understanding and effectively managing the risk and security for cloud environments at DevOps speeds,” said Lee Weiner, chief innovation officer, Rapid7. “DivvyCloud’s technology, team, and market leadership in the cloud security space will enable Rapid7 to better serve its customers’ needs by helping them innovate more securely, and provide a robust set of compliance and remediation paths for those with modern cloud infrastructure.”

Rapid7 provides one of the most comprehensivesecurity operations platforms in the market today, with a broad set ofbest-of-breed capabilities across SIEM-based incident detection and response, vulnerability management, application security and security automation and orchestration. Through this acquisition, Rapid7 will address the growing need for organizations to secure multi-cloud environments by extending the cloud security capabilities of its Insight platform.

RTP Ventures, MissionOG, and Providence Strategic Growth, an affiliate of Providence Equity Partners, were the lead investors in DivvyCloud. DC Advisory served as DivvyCloud’s financial advisor and Miles & Stockbridge served as legal advisor.

Preliminary First Quarter Financial Results

Rapid7 also provided preliminary estimated financial results for the first quarter ended March 31, 2020. Preliminary estimates of revenue andnon-GAAP loss from operations for the first quarter 2020 exceeded Rapid7’s previous guidance provided on February 10, 2020. Rapid7 anticipates revenue for the first quarter 2020 to be in the range of $93.8 million to $94.0 million. For the first quarter 2020, the Company anticipates GAAP loss from operations to be in the range of $(20.3) to $(20.1) million, andnon-GAAP loss from operations to be in the range of $(4.4) to $(4.2) million.

Preliminary First Quarter 2020 Key Metrics

	As of March 31,
	2020			2019			% Change
Annualized recurring revenue (in millions)	$	350.6 to $ 350.8		$	268.2			31	%
Number of customers		9,024			7,934			14	%
ARR per customer (in thousands)	$	38.9		$	33.8			15	%
Renewal rate*		106	%		117	%

* Rapid7’s renewal rate as of March 31, 2019 was adjusted from 120%, as previously disclosed, to 117% based on a reclassification of certain upsells and cross-sells.

The above preliminary estimated financial data and key metrics as of and for the three months ended March 31, 2020 are based upon Rapid7’s estimates and are subject to completion of the Company’s financial closing procedures. Moreover, these data have been prepared solely on the basis of currently available information by, and are the responsibility of, Rapid7. Rapid7’s independent registered public accounting firm has not audited or reviewed, or expressed an opinion with respect to, these data. This information is not a comprehensive statement of Rapid7’s financial results for this period, and its actual results may differ materially from these estimates due to the completion of its financial closing procedures, final adjustments, completion of the review of the Company’s financial statements and other developments that may arise between now and the time the review of Rapid7’s financial statements is completed. There can be no assurance that these estimates will be realized, and estimates are subject to risks and uncertainties, many of which are not within our control. Complete quarterly results as of and for the three months ended March 31, 2020 are expected to be announced in connection with the Company’s first quarter financial results earnings conference call, to be held on May 7, 2020, and included in the Company’s Quarterly Report on Form10-Q for the three months ended March 31, 2020.

Second Quarter and Full-Year 2020 Guidance

Rapid7 anticipates annualized recurring revenue, revenue, andnon-GAAP income (loss) from operations to be in the following ranges:

	Second Quarter 2020							Full-Year 2020
Annualized recurring revenue (in millions)								$	387.0		to	$	407.0
Year-over-year growth									14	%	to		20	%
Revenue (in millions)	$	94.6		to	$	96.2		$	388.0		to	$	395.0
Year-over-year growth		20	%	to		22	%		19	%	to		21	%
Non-GAAP income (loss) from operations (in millions)	$	1.0		to	$	2.0		$	(3.0	)	to	$	(1.0	)

The guidance provided above is forward-looking in nature. Actual results may differ materially. See the cautionary note regarding “Forward-Looking Statements” below. Guidance for the second quarter and full-year 2020 assumes the anticipated closing of the DivvyCloud acquisition in the second quarter of 2020, which has not yet been consummated, and includes the anticipated contribution from the acquisition of DivvyCloud as of May 1, 2020. Guidance for the second quarter and full-year 2020 does not include any potential impact of foreign exchange gains or losses. In addition, fluctuations in Rapid7’s quarterly operating results may be particularly pronounced in the current economic environment due to the uncertainty caused by, and the unprecedented nature of, the currentCOVID-19 pandemic, whose severity, duration and ultimate impact is difficult to predict at this time. The guidance above also assumes that there are no new or recurrent shocks to the global economy, that the quarter ended June 30, 2020 will

see the highest negative impact to economic growth and that it will be a12-to-24 month economic recovery period. The primary set of drivers of Rapid7’s actual financial performance relative to the ranges provided will be a function of how long the economy remains closed and at what pace it recovers when it reopens. The guidance provided above is based on a number of assumptions, estimates and expectations as of the date of this press release and, while presented with numerical specificity, this guidance is inherently subject to significant business, economic and competitive uncertainties and contingencies, many of which are beyond the Company’s control and are based upon specific assumptions with respect to future business decisions or economic conditions, some of which may change. Rapid7 undertakes no obligation to update guidance after this date.

Non-GAAP guidance excludes estimates for stock-based compensation expense, amortization of acquired intangible assets, acquisition-related expenses and litigation-related expenses. Rapid7 has provided a reconciliation of historicalnon-GAAP financial measures to the most comparable GAAP measures in the financial statement tables included in this press release. A reconciliation ofnon-GAAP guidance measures to the most comparable GAAP measures is not available on a forward-looking basis without unreasonable efforts due to the high variability, complexity and low visibility with respect to the charges excluded from thesenon-GAAP measures.

Acquisition Details

Under the terms of the acquisition agreement, Rapid7 will acquire DivvyCloud for a total purchase price of approximately $145 million, subject to adjustments. The purchase price includes approximately $128.3 million in cash to be paid at closing, $7.4 million of deferred cash payments and $9.3 million in stock. DivvyCloudco-founders Brian Johnson and Chris DeRamus have agreed to join Rapid7.

Revolving Credit Facility

Rapid7 today announced that it has entered into a new three-year revolving credit facility with Keybank National Association that provides borrowing capacity up to $30 million with an accordion feature to expand borrowing capacity up to $70 million. Rapid7 does not intend to immediately draw on this revolving credit facility.

Conference Call and Webcast Information

Rapid7 will host a conference call today, April 28, 2020, to discuss the acquisition at 4:30 p.m. Eastern Time. The call will be accessible by telephone at877-357-4230 (domestic) or629-228-0721 (international). The call will also be available live via webcast on the Company’s website athttps://investors.rapid7.com. A telephone replay of the conference call will be available at855-859-2056 or404-537-3406 (access code 5172645) until May 5, 2020. A webcast replay will be available athttps://investors.rapid7.com.

About Rapid7

Rapid7 (Nasdaq: RPD) is advancing security with visibility, analytics, and automation delivered through our Insight cloud. Our solutions simplify the complex, allowing security teams to work more effectively with IT and development to reduce vulnerabilities, monitor for malicious behavior, investigate and shut down attacks, and automate routine tasks. Over 9,000 customers rely on Rapid7 technology, services, and research to improve security outcomes and securely advance their organizations. For more information, visitour website, check outour blog, or follow us on LinkedIn.

About DivvyCloud

DivvyCloud protects cloud and container environments from misconfigurations, policy violations, threats, and identify and access management challenges. With automated prevention and real-time remediation of risk, DivvyCloud customers achieve continuous security and compliance, and can fully realize the benefits of cloud and container technology. Freedom is good. Chaos is bad. To learn more:www.divvycloud.com.

About KeyCorp

KeyCorp’s roots trace back 190 years to Albany, New York. Headquartered in Cleveland, Ohio, Key is one of the nation’s largest bank-based financial services companies, with assets of approximately $145.0 billion at December 31, 2019. Key provides deposit, lending, cash management, and investment services to individuals and businesses in 15 states under the name KeyBank National Association through a network of approximately 1,100 branches and more than 1,400 ATMs. Key also provides a broad range of sophisticated corporate and investment banking products, such as merger and acquisition advice, public and private debt and equity, syndications and derivatives to middle market companies in selected industries throughout the United States under the KeyBanc Capital Markets trade name. For more information, visithttps://www.key.com/. KeyBank is Member FDIC.

PreliminaryNon-GAAP Financial Measures and Key Metrics

To supplement our preliminary revenue and GAAP loss from operations estimates, which are prepared and presented in accordance with generally accepted accounting principles in the United States (GAAP), but, as noted above, are preliminary estimates based on information available to management as of the date hereof, we have provided investors with certain preliminarynon-GAAP financial measures and key metrics, which we believe are helpful to our investors. We use thesenon-GAAP financial measures and key metrics for financial and operational decision-making purposes and as a means to evaluateperiod-to-period comparisons. We also use certainnon-GAAP financial measures as performance measures under our executive bonus plan. We believe that thesenon-GAAP financial measures and key metrics provide useful information about our operating results, enhance the overall understanding of past financial performance and future prospects and allow for greater transparency with respect to metrics used by our management in its financial and operational decision-making.

While ournon-GAAP financial measures are an important tool for financial and operational decision-making and for evaluating our own operating results over different periods of time, you should review the reconciliation of ournon-GAAP financial measures to the comparable GAAP financial measures included below, and not rely on any single financial measure to evaluate our business.

Non-GAAP Financial Measures

We definenon-GAAP loss from operations as GAAP loss from operations excluding the effect of stock-based compensation expense, amortization of acquired intangible assets, and certain other items such as acquisition-related expenses, and litigation-related expenses.

We believe thesenon-GAAP financial measures are useful to investors in assessing our operating performance due to the following factors:

Stock-based compensation expense. We exclude stock-based compensation expense because of varying available valuation methodologies, subjective assumptions and the variety of equity instruments that can impact ournon-cash expense. We believe that providingnon-GAAP financial measures that exclude stock-based compensation expense allows for more meaningful comparisons between our operating results from period to period.

Amortization of acquired intangible assets.We believe that excluding the impact of amortization of acquired intangible assets allows for more meaningful comparisons between operating results from period to period as the intangible assets are valued at the time of acquisition and are amortized over several years after the acquisition.

Litigation-related expenses.We exclude certain litigation-related expenses consisting of professional fees and related costs incurred by us related to significant litigation outside the ordinary course of business. We believe it is useful to exclude such expenses because we do not consider such amounts to be part of our ongoing operations.

Acquisition-related expenses.We exclude acquisition-related expenses as costs that are unrelated to the current operations and neither are comparable to the prior period nor predictive of future results.

Key Metrics

Annualized Recurring Revenue (ARR).ARR is defined as the annual value of all recurring revenue related contracts in place at the end of the period. ARR does not have a standardized definition and is therefore unlikely to be comparable to similarly titled measures presented by other companies. ARR should be viewed independently of revenue and deferred revenue as ARR is an operating metric and is not intended to be combined with or replace these items. ARR is not a forecast of future revenue and can be impacted by contract start and end dates and renewal rates, and does not include revenue reported as perpetual license or professional services revenue in our consolidated statement of operations.

Number of Customers.We define a customer as any entity that has (1) an active Rapid7 contract or a contract that expired within 90 days or less of the applicable measurement date; and for Logentries products, those customers with a contract value equal to or greater than $2,400 per year, or (2) purchased Rapid7 professional services within the 12 months preceding the applicable measurement date.

ARR per Customer.We define ARR per customer as ARR divided by the number of customers at the end of the period.

Renewal Rate. We calculate our renewal rate by dividing the dollar value of renewed customer agreements, including upsells and cross-sells of additional products, but excluding professional services, in a trailing12-month period by the dollar value of the corresponding customer agreements.

GAAP toNon-GAAP Reconciliation (in millions)

	Three Months Ended March 31, 2020
GAAP loss from operations	$	(20.3) - $ (20.1)
Add: Stock-based compensation expense		13.3
Add: Amortization of acquired intangible assets		1.7
Add: Acquisition-related expenses		0.3
Add: Litigation-related expenses		0.6
Non-GAAP (loss) income from operations	$	(4.4) - $ (4.2)

Cautionary Language Concerning Forward-Looking Statements

This press release includes forward-looking statements. All statements contained in this press release other than statements of historical facts, including, without limitation, statements regarding our preliminary results for the first quarter of 2020, our financial guidance for the second quarter and full year 2020, the assumptions underlying such guidance and the timing of global economic recovery, the anticipated closing of the DivvyCloud acquisition, the impact of the DivvyCloud acquisition on our products, strategy and future results of operations, and the anticipated impact ofCOVID-19 on our guidance, business, financial condition and results of operations are forward-looking statements. Our use of the words “anticipate,” “believe,” “continue,” “estimate,” “expect,” “intend,” “may,” “will” and similar expressions are intended to identify forward-looking statements.

The events described in our forward-looking statements are subject to a number of risks and uncertainties, assumptions and other factors that could cause actual results and the timing of certain events to differ materially from future results expressed or implied by the forward-looking statements. Risks that could cause or contribute to such differences include, but are not limited to, risks arising from the ongoingCOVID-19 pandemic, fluctuations in our quarterly results, failure to meet our publicly announced guidance or other expectations about our business, our rapid growth and ability to sustain our revenue growth rate, the ability of our products and professional services to correctly detect vulnerabilities, our customers renewal of their subscriptions with us, competition in the markets in which we operate, market growth, our ability to innovate and manage our growth, our sales cycles, our ability to complete the acquisition of DivvyCloud, our ability to integrate acquired companies, including DivvyCloud, our ability to operate in compliance with applicable laws as well as other risks and uncertainties set forth in the “Risk Factors” section of our most recent Annual Report on Form10-K filed with the Securities and Exchange Commission on February 28, 2020, in the Current Report on Form8-K filed with the Securities and Exchange Commission on the date of this press release and in the subsequent reports that we file with the Securities and Exchange Commission. Moreover, we operate in a very competitive and rapidly changing environment. New risks emerge from time to time. It is not possible for our management to predict all risks, nor can we assess the impact of all factors on our business or the extent to which any factor, or combination of factors, may cause actual results to differ materially from those expressed in any forward-looking statements we may make. Except as required by law, we undertake no obligation to update any forward-looking statements to reflect events or circumstances after the date of such statements. You should, therefore, not rely on these forward-looking statements as representing our views as of any date subsequent to the date of this press release.

Rapid7 Investor Relations

Sunil Shah

Vice President, Investor Relations

+1-857-990-4074

investors@rapid7.com

Rapid7 Media Relations

Caitlin Doherty

Public Relations Manager

+1-857-990-4240

press@rapid7.com

DivvyCloud Media Relations

Jackie Fekeci

Senior Marketing Communications Manager

+1-571-483-8792

jackie.fekeci@divvycloud.com