Rapid7, Inc.

Special Note Regarding Forward-Looking Statements

This Annual Report on Form 10-K, including the sections entitled "Business", “Risk Factors,” and “Management’s Discussion and Analysis of Financial Condition and Results of Operations,” contains forward-looking statements that involve risks and uncertainties, as well as assumptions that, if they never materialize or prove incorrect, could cause our results to differ materially from those expressed or implied by such forward-looking statements. Statements that are not purely historical are forward-looking statements within the meaning of Section 27A of the Securities Act of 1933, as amended, and Section 21E of the Securities Exchange Act of 1934, as amended. Forward-looking statements are often identified by the use of words such as, but not limited to, “anticipate,” “believe,” “can,” “continue,” “could,” “estimate,” “expect,” “intend,” “may,” “plan,” “project,” “seek,” “should,” “target,” “will,” “would” and similar expressions or variations intended to identify forward-looking statements. These forward-looking statements include, but are not limited to, statements concerning the following:

• our ability to continue to add new customers, maintain existing customers and sell new products and professional services to new and existing customers;

• uncertain impacts that prolonged economic uncertainty may have on our business, strategy, operating results, financial condition and cash flows, as well as changes in overall level of software spending and volatility in the global economy;

• the effects of increased competition as well as innovations by new and existing competitors in our market;

• our ability to effectively restructure our business in alignment with our strategic priorities;

• our ability to adapt to technological change and effectively enhance, innovate and scale our solutions, including our Command Platform;

• our ability to capitalize on customer demand for consolidated security platforms and vendor consolidations;

• our ability to deliver, scale and operate managed services (including managed detection and response (“MDR”) and related offerings, including with respect to service quality, staffing and operating efficiency;

• our ability to effectively manage or sustain our growth and to sustain profitability;

• our ability to diversify our sources of revenue;

• potential acquisitions and integration of complementary business and technologies;

• our expected use of proceeds from future issuances of equity or convertible debt securities;

• our ability to maintain, or strengthen awareness of, our brand;

• perceived or actual security, integrity, reliability, quality or compatibility problems with our solutions, including problems related to systems, unscheduled downtime, outages or security breaches in our customers;

• statements regarding future revenue, hiring plans, expenses, capital expenditures, capital requirements and stock performance;

• our ability to meet publicly announced guidance or other expectations about our business, key metrics and future operating results;

• our ability to maintain an adequate annualized recurring revenue growth;

• our ability to attract and retain qualified employees and key personnel and further expand our overall headcount;

• our ability to grow, both domestically and internationally;

• our ability to stay abreast of new or modified laws and regulations that currently apply or become applicable to our business both in the United States and internationally;

• our ability to maintain, protect and enhance our intellectual property;

• the outcomes of our initiatives that use artificial intelligence (“AI”);

• costs associated with defending intellectual property infringement and other claims; and

• the future trading prices of our common stock and the impact of securities analysts’ reports on these prices.

These statements represent the beliefs and assumptions of our management based on information currently available to us. Such forward-looking statements are subject to risks, uncertainties and other important factors that could cause actual results and the timing of certain events to differ materially from future results expressed or implied by such forward-looking statements. Factors that could cause or contribute to such differences include, but are not limited to, those identified below, and those discussed in the section titled “Risk Factors” included under Part I, Item 1A. Furthermore, such forward-looking statements speak only as of the date of this report. Except as required by law, we undertake no obligation to update any forward-looking statements to reflect events or circumstances that occur after the date of this report.

As used in this report, the terms “Rapid7,” the “company,” “we,” “us,” and “our” mean Rapid7, Inc. and its subsidiaries unless the context indicates otherwise.

Our business is subject to numerous risks and uncertainties, including those described in Item 1A “Risk Factors”. These risks include, but are not limited to, the following:

•Our quarterly operating results may vary from period to period, which could result in our failure to meet expectations with respect to operating results and cause the trading price of our stock to decline.

•Our business and operations have experienced significant growth, and if we do not appropriately manage any future growth, or are unable to maintain and scale our infrastructure, systems and processes, our business and results of operations may be negatively affected. Although we have experienced rapid growth in the past, we cannot provide any assurance that our business will continue to grow at the same rate or at all.

•Prolonged economic uncertainties or downturns could adversely affect our business.

•Actions that we are taking to restructure our business in alignment with our strategic priorities may not be as effective as anticipated.

•Real or perceived failures, errors or defects in our solutions could adversely affect our brand and reputation, which could have an adverse effect on our business and results of operations.

•Our brand, reputation and ability to attract, retain and serve our customers are dependent in part upon the reliable performance of our products and network infrastructure, including our Command Platform.

•Our business and growth depend substantially on customers renewing and expanding their subscriptions with us. Any decline in our customer renewals or failure to convince customers to expand their use of our subscription offerings could adversely affect our future operating results.

•If we or our third-party service providers experience a security breach or unauthorized parties otherwise obtain access to our customers’ data, our reputation may be harmed, demand for our solutions may be reduced and we may incur significant liabilities.

•We face intense competition in our market, which could adversely affect our business, financial condition, and results of operations.

•If we are unable to successfully hire, train, and retain qualified personnel our business may suffer.

•A component of our growth strategy is dependent on our continued international expansion, which adds complexity to our operations.

•Because our products collect and store user and related information, domestic and international privacy and cybersecurity concerns, and other laws and regulations, could have a material adverse effect on our business.

•If our customers are unable to implement our products successfully or we fail to maintain high quality customer support, customer perceptions of our offerings may be impaired or our reputation and brand may suffer.

•We may fail to meet our publicly announced guidance or other expectations about our business and future operating results, which would cause our stock price to decline.

•If we are not able to maintain and enhance our brand, our business and operating results may be adversely affected.

•We may not be successful in our initiatives that utilize AI, which could adversely affect our business, reputation, or

financial results.

•We use third-party software and data to operate certain functions of our business and deliver our offerings that may be difficult to replace or that may cause errors or failures of our solutions, which could lead to lost customers or harm to our reputation and our operating results.

•Assertions by third parties of infringement or other violations by us of their intellectual property rights, whether or not correct, could result in significant costs and harm our business and operating results.

•Organizations may be reluctant to purchase our cloud-based offerings due to the actual or perceived vulnerability of cloud solutions.

•We have a significant amount of debt that may decrease our business flexibility, access to capital, and/or increase our borrowing costs, and we may still incur additional debt in the future, which may adversely affect our operations and financial results. We may not have sufficient cash flow from our business to pay our substantial debt when due.

•We may require additional capital to support business growth, and this capital might not be available on acceptable terms, if at all.

The summary risk factors described above should be read together with the text of the full risk factors below in the section entitled "Risk Factors" and the other information set forth in this Annual Report on Form 10-K (“Form 10-K”), including our consolidated financial statements and the related notes, as well as in other documents that we file with the U.S. Securities and Exchange Commission (“SEC”). The risks summarized above or described in full below are not the only risks that we face. Additional risks and uncertainties not precisely known to us or that we currently deem to be immaterial may also materially adversely affect our business, financial condition, results of operations, and future growth prospects.