Rapid7 cuts 12% of workforce as it shifts towards AI-first cybersecurity

Ah, Rapid7. There's something almost poetic about a cybersecurity company shedding 12% of its workforce in the name of an 'AI-first' strategy. It's the corporate equivalent of a burglar-alarm firm sacking its installers because it's bought a very clever dog that it hasn't yet taught to bite. The restructuring began in the second quarter of 2026, which is thoughtful — it means the redundancy letters arrive just in time for the autumn, when the existential dread sets in.

Let's examine the logic, such as it is. Rapid7 is 'redirecting resources toward AI-led security capabilities' and 'expanding its use of generative and agentic AI in security operations.' Translation: the algorithms are coming in, and the people who once investigated actual intrusions can collect their things from the gift shop on the way out. The 12% figure is beautifully chosen — small enough to be called a 'strategic rebalancing' in the press release, large enough to make every remaining employee update their CV on company time. Security vendors love to say that AI is a co-pilot, a helper, a force multiplier. They rarely mention that the force being multiplied is the shareholder value, and the co-pilot has a seatbelt and a severance package.

One might ask whether an 'AI-first' security company is actually an improvement or merely a cheaper one. Rapid7 evidently believes that generative and agentic AI can squat in security operations without sleep, without sick days, and without awkward questions about whether the company is cutting its way to greatness. Perhaps it's right. Perhaps the models will catch every threat and never once flag a benign email as a nation-state intrusion. But the rest of us can be forgiven for noticing that the first thing this particular AI-first transformation has generated is a round of redundancy notices. The humans will be fine, presumably — there's always a lovely internal podcast about 'transformation' to listen to on the way out.