The Bending Spoons Screen, Applied: Rapid7 at 1.1× ARR

In October 2024, Advent, Bain and EQT looked at Rapid7 at a market value around $2.5 billion. Nobody transacted. Today the entire enterprise — equity plus $900 million of convertible notes, less $703 million of cash — is priced near $0.9 billion. Same company, same 11,500-plus customers, roughly the same $824 million of ARR. The interest arrived at nearly three times today's enterprise value, and then the price fell out from under the process rather than the other way around.

That makes Rapid7 the first name to run through the screen I described on the value-creation page: what would an acquirer built like Bending Spoons — one shared operating platform, radical opex replacement, monetization science, permanent hold — actually do with a discounted public cybersecurity company? Not as a prediction of any transaction. As a way to see where the value sits, and which levers are real.

The screen, briefly

The Bending Spoons trade has five levers, and they are not equally available on every asset: buy mature recurring revenue at a depressed multiple; replace most of the acquired cost base with a shared platform; reprice a captive installed base; convert labor-delivered revenue into software economics; and finance the whole thing so the cash flows carry it through a permanent hold. On its consumer targets the second and third levers do the work. On an enterprise security company the mix is different — and that difference is the analysis.

Lever 1 — entry price: the strongest card on the table

At roughly 1.1× ARR and 6.8× guided free cash flow, Rapid7 is the cheapest genuinely recurring software business on the public cyber tape — the group of fourteen names I screened carries a median near 5× revenue. The business earns its discount: ARR shrank 2% year over year in Q2 2026, guidance points lower, and the company has been the share donor to CrowdStrike and Microsoft in detection and to Tenable and Qualys in vulnerability management. But the screen's first question is only whether you are paying for growth you don't need. At this price you are paying for none. Roughly 97% of revenue is recurring, free cash flow of ~$130 million is already real, and the FY26 profit guide was just raised. The entry check clears with room to be wrong.

Lever 2 — the cost base: a 7.8× productivity gap

Rapid7 generated $329,000 of revenue per employee in FY2025 across 2,613 people. Bending Spoons disclosed $2.57 million per employee in its IPO prospectus. Nobody should read that gap as fully closable — a consumer app factory and an enterprise security vendor are different animals — but the direction and the order of magnitude are the point. Operating expenses ran $593 million in FY2025, 69% of revenue: R&D at 22%, sales and marketing at 37%, G&A at 10%. Management has already conceded the direction twice, cutting 12% of the workforce in August 2023 and announcing another ~12% (about 310 roles) in August 2026, explicitly refocusing on the core platform and an AI-first SOC.

Here is the modeled version, clearly labeled as modeled: hold revenue flat at ~$840 million, hold the non-GAAP gross margin at 74%, and ask what happens if a platform owner runs total opex at 45% of revenue instead of 69% — aggressive by public-company standards, conservative by Bending Spoons standards. Operating income goes from the guided ~$130 million to roughly $244 million, and the entry multiple on that number is about 3.6× — before touching the two levers that follow. The math is arithmetic; whether the revenue holds while you do it is the entire bet, and I return to that below.

Lever 3 — repricing: the lever that does not transfer

This is where honesty about the framework matters. Bending Spoons' repricing works on captive consumer bases with high switching friction and no procurement department — Evernote's plan went from roughly $37 to $250 a year and the base largely stayed. Rapid7's customers average ~$72,000 of ARR, employ buyers whose job is to resist exactly this, and sit inside the most aggressively bundled competitive market in software, with Microsoft giving away adjacent capability inside the E5 license. Repricing a shrinking enterprise base donates share faster. On this asset, the third lever is close to worthless, and any underwriting that leans on it is self-deception. Score it zero and move on.

Lever 4 — labor conversion: the lever Bending Spoons doesn't even have

What the consumer playbook lacks, security supplies. Detection and response is about 55% of Rapid7's ARR — roughly $453 million — and a substantial share of it is managed detection and response: revenue delivered by shifts of human analysts watching consoles. Professional services gross margin is 20% on a non-GAAP basis, against ~74% for the blended company. Agentic SOC tooling — the layer that triages, investigates and closes tier-1 and tier-2 alerts autonomously — is exactly the technology that converts that labor cost into platform cost, and it is commercializing now across the industry. An owner who converts even half of the MDR delivery cost into software economics is executing the trade I called the unbuilt archetype on the value-creation page: services revenue in at a services price, platform economics out. On Rapid7 the archetype comes pre-assembled — the MDR book, the installed sensor estate, and a management team already saying "AI-first SOC" out loud.

It also carries the failure mode the consumer version never faces: an autonomous responder that quarantines the wrong subnet creates liability, not just churn. Anyone underwriting this lever prices errors and omissions, contractually and actuarially, or they have not underwritten it.

Lever 5 — structure: a forcing event with a countdown

The capital structure does the scheduling. $600 million of 0.25% converts mature in March 2027 and become a current liability this coming quarter; another $300 million matures in 2029. Both are far out of the money — straight debt now. Against that: $703 million of cash and investments, ~$130 million of free cash flow, an undrawn $200 million revolver. The company can handle the 2027s, but not invisibly, and refinancing zero-coupon 2021 paper at 2026 prices will mark the cost of standing still. Meanwhile Jana Partners holds 10.1% with a settlement that already reshaped the board, and the activist-installed operator — Wael Mohamed, who ran Forescout and was COO of Trend Micro — took the CEO seat in June. A dormant sale process, a forcing maturity, an activist at cost above the current price, and a self-help plan already cutting: the situation is pre-configured for exactly one kind of buyer.

The verdict, and the queue

Scored honestly: entry price, strongest on the tape. Cost base, large and demonstrably compressible. Repricing, unavailable — score it zero. Labor conversion, the single richest application of the AI-acquirer trade anywhere in public cyber. Structure, a catalyst rather than an obstacle. The bet that everything rests on is retention: Rapid7 stopped disclosing net revenue retention around 2022, which is itself a data point, and a cut-heavy owner who lets gross retention slip five points has destroyed the arithmetic above faster than any cost program can rebuild it. The screen says you are paying ~6.8× current free cash flow for a free option on platform economics. Options are cheap for a reason. This one is priced like the market believes no one will ever exercise it.

Rapid7 is the first pass, not the last. The same tape holds Trend Micro near 2× revenue with a failed auction behind it, N-able near 2× with a leveraged balance sheet, and Tenable at 3.9× as the control case — cheap but not broken, where the conventional LBO math still competes with the platform math. Those are the next passes through the screen.