Rapid7 Told the Globe 21. The Aug 10 Filing Said 300.

On July 14, 2026, Rapid7 told the Boston Globe it was cutting "21 people, or less than one percent of the staff." Twenty-seven days later, on Aug 10, it filed a 12% workforce reduction alongside Q2 earnings. That is roughly 300 jobs. If your candidate spreadsheet still says "21," you are working from a number that is off by a factor of 14, and every hour that passes narrows the window before 7AI, Realm.Security, and the remote recruiters at CrowdStrike sweep the pool.

What actually happened between July 14 and Aug 10

Rapid7 understated its layoff by roughly 14x, then confirmed the real figure inside its Q2 disclosure. The July 14 Boston Globe article quoted the company describing "relatively modest" cuts of 21 people. On Aug 7 the board approved a broader restructuring, and on Aug 10 the company disclosed a ~300-person reduction (12% of the workforce) with $11M to $12M in severance charges landing across Q3 and Q4 2026.

The company has not publicly clarified whether those 21 sit inside the 300 or preceded it. Treat it as an understatement, not a lie. What matters for sourcing is that the layoff trackers that cached the July number (interviewpal.com/layoffs/rapid7 still lists 21 as of writing) are wrong about candidate volume by more than an order of magnitude.

14.3x

The mechanical consequence is a two-week pricing gap. Most recruiters do not re-check a layoff figure they already logged, especially for a company whose July statement sounded like a nothing-burger. That is the arbitrage.

Why the Aug 10 filing changes the Boston cyber math

Rapid7 is the largest single feeder into Boston's AI-security startup scene, and a 300-person cut roughly triples the local supply of detection and response talent overnight. Rapid7 did $860M in revenue last year and is guiding to as low as $837M for 2026, its first shrink in years. New CEO Wael Mohamed (ex-Trend Micro, ex-BMC) took over from Corey Thomas in June 2026 and is publicly overhauling exec ranks and pushing AI deeper into the product. This is the second major cut in three years; Rapid7 also cut nearly 500 roles in 2023.

Two things follow:

• The cut is strategic, not just cost-driven. Roles inside the classic on-prem InsightVM and MDR stacks are more exposed than roles in the new AI product surface.
• Severance runs out in Q4 2026. Restructuring charges are substantially complete by year end, which means the urgency lever on candidates evaporates by Q1 2027.

That timing is the point. Engineers with a severance cliff eight weeks out reply to messages. Engineers who landed six months ago do not.

The Refolk index view of the Rapid7 pool

In Refolk's index of professional profiles, 109 US-based engineers and PMs currently list Rapid7 in their headline or recent history, and Greater Boston is the #1 region by roughly 3x versus any other metro. The single largest current employer inside that pool is still Rapid7 itself (n=8), which means most alumni have not moved yet. These are live sourcing targets, not people you are trying to poach out of a happy job at Snyk.

The composition matters more than the headcount. The Rapid7-linked pool skews toward Software Engineer (11), Senior SWE (7), and Product Manager (4). Detection-and-response PMs are the scarcest asset in agentic-security startups still figuring out workflow taxonomy, and they almost never surface on Boolean searches because their titles read as generic "Product Manager" without any security keywords. That is the exact gap Refolk closes: you describe the person in plain English ("Boston PMs who shipped detection or MDR at Rapid7 in the last three years") and get a ranked shortlist instead of a keyword lottery.

Where the 300 actually go: 7AI, Realm.Security, and the overflow

7AI can absorb roughly a third of the cohort, Realm.Security absorbs another 40 to 60, and the rest disperses to Cybereason, Snyk, and remote roles at Palo Alto and CrowdStrike. Do the arithmetic: 300 minus roughly 150 local landings leaves half the pool up for grabs, and most of that half is not in Boston-focused ATS pipelines.

7AI

7AI is the most obvious landing zone and already the loudest buyer. Founded by Lior Div (previously cofounder and CEO of Cybereason, which he sold a controlling stake in to SoftBank in 2023), 7AI raised $130M in December, one of the largest early-stage cyber rounds ever, on top of total funding of $166M led by Index Ventures. Headcount crossed 100 in Q2 2026, up 47% in a single quarter, and Div has said publicly he plans to double the workforce by end of year.

7AI's own May 26 press release named Rapid7 as the #1 feeder company for its growth spurt, ahead of Wayfair, DraftKings, MITRE, Amazon, Capital One, and Cybereason. A warm-referral channel already exists, which means a recruiter approaching a Rapid7 alum can credibly cite the pathway rather than cold-pitching a random Series B.

Realm.Security

Realm.Security is the second-most-cited local landing spot but at very different scale. Founded in 2024 by Sanket Choksey, backed by Jump Capital, total funding is $22M across three rounds since Sep 2024. That is a Series A, not the "hundreds of millions" the local press has sometimes implied by lumping it with 7AI. Realistic 2026 hiring is 40 to 60 roles, weighted toward platform and data engineers rather than research.

The overflow nobody is sourcing

This is where the money is. If 7AI and Realm.Security together absorb around 150 people, the other half of the Rapid7 cohort is invisible to any recruiter geo-fenced to Boston. Founders in NYC, Austin, or the Bay Area hiring for cyber detection response engineers can pick up senior Rapid7 talent at Boston comp with no relocation friction because most of these engineers are already remote-capable.

Five moves for the next two weeks

The playbook is straightforward if you move before Q4 severance payments complete. Every step below is time-boxed against the Aug 10 disclosure date.

1. Refresh your Rapid7 candidate list against the 300 figure, not 21. Any list built off the July Globe piece is quietly under-scoped by an order of magnitude. Delete the old snapshot.
2. Prioritize PMs, not just ICs. The Rapid7-linked PM pool is small (four in Refolk's index) but disproportionately valuable to any agentic-security startup that has not yet locked in a workflow taxonomy. These are the scarcest profiles and the least likely to be found by Boolean.
3. Use 7AI's May 26 press release as social proof. Naming a real, public poaching path ("7AI named Rapid7 as its #1 feeder company last quarter") converts colder than a generic pitch.
4. Hunt the overflow outside Boston. Assume 7AI and Realm.Security cover 150 landings between them. The other ~150 are the actual arbitrage. This is another place Refolk earns its keep: sourcing laid-off engineers by intent signal ("Rapid7 alum, remote-ok, actively looking, not yet at a new company") instead of by keyword.
5. Show up at the Boston Tech Week Cyber Summer Kickoff. 7AI leaned into the a16z-backed event for GTM visibility, and the Massachusetts AI Coalition (of which 7AI is a founding member alongside WHOOP) runs recurring events. Both are legitimate in-person sourcing venues.

Severance cliffs are the strongest sourcing signal cyber recruiters ignore, and Rapid7's runs out in Q4.

Why keyword sourcing misses half of this pool

Boolean-style sourcing on LinkedIn misses a large fraction of the Rapid7 alumni because the most valuable profiles do not use security-native titles. A Rapid7 senior engineer who owned the InsightIDR pipeline usually writes "Senior Software Engineer, Distributed Systems" on their profile. A detection-and-response PM writes "Senior Product Manager." Neither shows up on searches for "SOC engineer" or "MDR PM," which are the queries most sourcers actually run.

The mechanism is title compression. Rapid7 uses internal titles that flatten a lot of specialization into generic engineering job families, so the domain expertise lives in the bullet points and the company history, not the headline. Semantic search over profile text recovers those people; keyword search does not. This is why Refolk's index shows only 109 US-based profiles when the layoff itself is 300: the rest are sitting one layer below the searchable surface, still findable, just not by the tools most Boston recruiters use.

The two-week window

The window is roughly 14 days from the Aug 10 disclosure before the pool saturates with "Open to Work" tags and every in-house recruiter at every AI-security startup in the country notices. After that, the response rate on cold outreach drops sharply because candidates are triaging inbound, not evaluating options.

Combine that with the Q4 severance cliff and the shape of the arbitrage is clear:

• Week 1 to 2: Highest reply rate, lowest saturation. Move now.
• Week 3 to 8: Reply rates decline as inbound floods hit. Warm referrals still work.
• Q4 2026: Severance ending drives a second wave of urgency, but the best profiles are gone.
• Q1 2027: Pool is picked over. Anyone still available is available for a reason.

Rapid7 will keep being a large Boston cyber employer, and this is not the end of the company. But it is a specific, dated, quantifiable window where a 14x mispricing of layoff size, a $130M-funded local buyer that has publicly named Rapid7 as its top feeder, and a severance cliff eight weeks out all line up. That combination does not repeat often.

FAQ

How is the Rapid7 layoff different from the 2023 cut of nearly 500?

The 2023 cut was straightforward cost-reduction under Corey Thomas with the company still growing revenue. The Aug 10, 2026 cut lands alongside a revenue shrink (guidance as low as $837M against $860M last year), a brand-new CEO in Wael Mohamed, and an explicit AI product pivot. That means the roles being cut are more likely to be legacy product and support functions than across-the-board headcount, so the surviving pool skews toward classic InsightVM and MDR expertise, which is exactly what 7AI and Realm.Security want.

Should I trust the 7AI "doubling headcount" claim for sourcing planning?

Directionally yes, literally no. 7AI's headcount grew 47% in a single quarter and Lior Div is publicly committed to doubling by year end, but every startup CEO over-forecasts hiring. Plan against ~100 net new roles in 2026, weighted toward Boston, and assume Realm.Security absorbs another 40 to 60. That still leaves roughly half of the 300 Rapid7 cut as overflow to source against.

Why does Refolk's index only show 109 Rapid7-linked profiles when the layoff is 300?

Refolk's index counts are directional snapshots of professionally active engineers and PMs with Rapid7 in their headline or recent history, not a census of every current or former employee. Support, sales, marketing, and non-engineering roles are outside that 109. It also excludes people whose profiles are stale or private. Use 109 as a floor for the engineering-relevant pool, not as a ceiling for the layoff itself.

What is the single highest-leverage move in the first week?

Rebuild your Rapid7 candidate list from scratch against the Aug 10 disclosure, filter for PMs and platform leads first, and use 7AI's public naming of Rapid7 as a warm-referral pretext in outreach. If you only have time for one thing, do that. The 300-not-21 correction alone will 14x your working pool, and the PM filter will surface the four to six profiles that every Boston AI-security founder actually wants to hire this quarter.