Rapid7 Cut 314. The Boston Pool 7AI Actually Wants Is Smaller.

On August 7, 2026, Rapid7's board approved a 12% workforce cut, roughly 314 roles and $10-11M in severance charges, as new CEO Wael Mohamed pivots the company toward an AI-first detection and exposure-management platform. Every security recruiter in Boston opened the same tab. Almost all of them are going to source it wrong.

The mistake is treating 314 as one pool. It isn't. Mohamed said the quiet part loudly on the investor call: Rapid7 will go "deeper in Detection and Response and Exposure Management, not wider." The functions being protected are exactly the ones 7AI and Realm.Security want. The functions being cut mostly aren't.

What Rapid7 actually announced on August 7

Rapid7's board approved a restructuring plan on August 7, 2026 that cuts about 314 roles (12% of headcount) and books $10-11 million in charges, mostly cash severance and transition costs. The company finished 2025 at roughly $860M in revenue but has guided 2026 sales as low as $837M as some customers held off switching to newer offerings, so this is demand-driven, not a pure efficiency play.

The leadership context matters more than the number:

• Wael Mohamed took over as CEO on June 1, 2026, replacing 13-year CEO Corey Thomas. He previously ran ops at Forescout and spent 11 years at Trend Micro, including as president and COO.
• Dejan Deklich is the new Chief Product and Technology Officer, brought in specifically to build the AI-first platform.
• Rafe Brown (CFO) and Allan Peters (CCO) round out the new team.

Deklich is the name to watch. If you are recruiting into an AI-native security startup, the org he is building is the org whose adjacent teams are getting thinned. That is your map.

Why 314 is the wrong number to source against

The hireable pool inside Rapid7's cut is smaller than 314 and structurally different from what the headlines suggest. Mohamed's "deeper, not wider" framing tells you which functions are protected and which are exposed:

Recruiters who cold-blast every "Rapid7" LinkedIn profile with a detection-engineer pitch are going to hit the protected class first and burn goodwill. The hireable pool sits in adjacent functions, and the sub-segmentation is the entire game.

17.96%

That stock pop is the second reason 314 overstates the pool. Retention just got a tailwind. The window to poach protected-function engineers is narrower than the WARN clock implies, because their equity is quietly worth more this week than last.

What the Refolk index actually shows for this pool

The national US pool of titled vulnerability researchers, security researchers, and detection engineers is 899 profiles, and it is distributed, not concentrated. Filtering Refolk's index on those titles across the United States surfaces 899 people. The top single employer (Intel) accounts for only about 0.3% of the pool, and the rest is spread across Microsoft, Cerebras, Zscaler, Bishop Fox, Block, and mid-market employers. There is no logo you can raid to solve this hire.

A separate pass keyed on Rapid7-adjacent Boston signals surfaces 21 profiles, with Boston, Greater Boston, and Cambridge accounting for roughly 24% of the regional distribution. Treat that 24% as a directional Boston-metro share, not a hard count. The Boston cybersecurity talent pool for AI-native buyers is real, but it is measured in tens, not hundreds.

The arithmetic that AI security startup recruiting decks are built on (899 nationally, ~24% Boston-adjacent, minus the protected class inside Rapid7, minus everyone who moved to Denver during COVID) collapses fast.

899

The 7AI hiring plan is bigger than the sourceable Rapid7 cut

7AI plans to add 100 Boston roles in 2026, which alone would absorb roughly 32% of Rapid7's 314-person cut if the functional overlap were total. It isn't total. That is why segmentation matters.

The relevant 7AI facts:

• Three-year-old Boston firm, celebrated its 100th hire earlier in 2026, cofounder/CEO Lior Div plans to double headcount by year end.
• Headcount grew 47% quarter over quarter, with named hires from Rapid7, Wayfair, DraftKings, MITRE, Amazon, CapitalOne, and Cybereason.
• $130M Series A on December 4, 2025, led by Index Ventures with Blackstone Innovations, the largest cybersecurity Series A on record, ten months after emerging from stealth.
• Explicit in-person mandate. Engineers, security researchers, and GTM in one Boston building. No remote.

Rapid7 is already a named feeder for 7AI. The poach path is proven. That is the single most useful fact in this entire piece for anyone sourcing ex-Rapid7 engineers.

But the in-person mandate is a filter that most sourcing tools ignore. Any ex-Rapid7 engineer who relocated to Austin, Denver, or Raleigh during the 2021-2023 remote wave is functionally out of pool for 7AI, regardless of their title or GitHub graph. Refolk lets you ask for "ex-Rapid7 detection or vuln research engineers currently living within commuting distance of Boston" and get back only the profiles that clear that geo filter, which is the exact gap the LinkedIn title-and-company search leaves open.

The poach path from Rapid7 to 7AI is already proven. The question is who else is in commuting distance.

Realm.Security and the second tier can't outbid, so they have to out-story

Realm.Security has raised $22M in 15 months and grown headcount 250%, which sounds impressive until you notice 7AI has raised roughly 7.5x more cash. That funding gap defines the entire second tier of AI security startup recruiting in Boston.

The math:

• 7AI: ~$166M raised total, $130M Series A led by Index Ventures with Blackstone Innovations, Greylock (Asheem Chandna), CRV, Spark Capital.
• Realm.Security: $22M raised, founded 2023 by Pete Martin, Jeff Kraemer, and Sanket Choksey, backed by Jump Capital, Glasswing Ventures, Accomplice, and Presidio Ventures/Sumitomo. Targeting SOC and SIEM data-overload, has helped CISOs cut six figures in SIEM ingestion costs.

Realm cannot win on cash comp against a firm sitting on a $130M Series A. It has to win on equity upside and problem novelty. SIEM cost reduction is a concrete, sellable pain that a detection engineer who spent five years wrangling InsightIDR log volumes will recognize instantly. That is a legitimate pitch. It is not a legitimate bidding war.

The playbook for the second tier:

1. Identify ex-Rapid7 engineers who worked on the InsightIDR data pipeline, not the detection content team.
2. Lead with the problem, not the TC.
3. Skip anyone whose LinkedIn shows a relocation out of the Northeast in the last 36 months, or plan to fund relocation, which few can.
4. Move before RSU vesting events close the poach window.

The non-obvious signal: Rapid7's careers page

The "AI-first pivot" language is a hiring signal, not just PR, and the 314 number understates net technical churn. Deklich was brought in explicitly to build the AI-first platform, which means Rapid7 is opening new AI and ML roles at the same time it is closing older ones. Recruiters watching only the WARN notices are missing half the movement.

Two implications for sourcing ex-Rapid7 engineers:

• Some cut employees will be quietly re-slotted into the new AI org. They will show up on LinkedIn as "still at Rapid7" with a new title in Q4 2026 or Q1 2027. If you don't catch them in the 60-90 day window post-notice, you lose them for a year.
• The new AI roles are competing with 7AI for the same national pool. Rapid7 is now a buyer in the same market where it used to be a feeder. Candidates comparing offers may see the "join Rapid7's AI reboot under Deklich" story as a real option, not a legacy trap.

For anyone running an AI security startup recruiting motion, the practical move is to monitor Rapid7's careers page weekly and cross-reference new AI/ML job families against former Rapid7 engineers still on the market before Rapid7's internal recruiter does.

The full picture in one table

What to actually do this quarter

Segmentation before outreach. That is the whole play. Concretely:

1. Filter for function, not just company. Legacy InsightVM/InsightIDR, MDR tier 2-3, sales engineering, and international roles are the exposed classes. Detection content and exposure-management PM are not.
2. Filter for location within the first pass, not the second. In-person Boston shops like 7AI need commuting-distance profiles. Hybrid shops like Realm can stretch to the Northeast corridor. Remote-friendly buyers can ignore the geo filter entirely, but there are fewer of those in AI security than in general enterprise software.
3. Move within 60 days of the August 7 board approval. RSU math, internal re-slotting into Deklich's new AI org, and 7AI's active poach pipeline all compress the window.
4. Track named individuals, not requisitions. Deklich for org signal at Rapid7, Div for buyer signal at 7AI, Martin/Kraemer/Choksey for second-tier buyer signal at Realm.

The 314 headline is easy to write about. The real sourceable Boston number, once you subtract the protected class, the relocators, and the loyalists, is the number you actually recruit against. Get that number right and the rest of the pipeline builds itself.

FAQ

How many of Rapid7's 314 layoffs are actually hireable for AI security startups?

Meaningfully fewer than 314. Mohamed's "deeper in Detection and Response and Exposure Management, not wider" framing means detection engineers and exposure-management PMs are the protected class inside Rapid7, not the exposed one. The hireable pool sits in legacy InsightVM/InsightIDR engineering, MDR analyst tiers, sales engineering, and international roles. Layer on Boston-metro geo filters for 7AI's in-person mandate and the sourceable pool shrinks further. Treat 314 as an upper bound, not a target list.

Why is 7AI a bigger buyer in this market than Realm.Security?

Cash. 7AI has raised roughly $166M (including a $130M Series A led by Index Ventures in December 2025, the largest cybersecurity Series A on record) versus Realm.Security's $22M. That 7.5x funding gap means 7AI can outbid Realm on total comp for the same candidate. Realm's counter is problem novelty (SIEM cost reduction, a concrete pain) and equity upside, not TC. If you are recruiting for Realm or another second-tier buyer, lead with the problem and the equity story, not the base.

Should I still cold-outreach detection engineers currently at Rapid7?

Only if you have a specific angle. Rapid7's stock jumped 17.96% on the layoff news to $13.70, so unvested RSUs for stayers are worth more than they were a week ago, and the detection engineering function is exactly the org Mohamed is protecting. Generic pitches will hit loyalists first. If your buyer has a genuine differentiator (in-person Boston collaboration, a novel data problem, a bigger equity slice) that specific message can still land, but the base rates on generic outreach into the protected class are worse than they look.

What is the fastest way to find ex-Rapid7 engineers who fit a specific role?

Describe the person in plain English rather than fighting a keyword search. Something like "ex-Rapid7 detection engineers in Boston metro, worked on InsightIDR data pipeline, active on GitHub in the last year" collapses former employer, function within that employer, location, and recency signal into one query. That is what Refolk is built for, and it is the difference between working from a list of 899 and a list of the 15 people who actually fit.