Rapid7's Aug 10 Cut Hid a Second Boston Security Layoff That Day

The Boston Globe wrote up Rapid7's 12% cut on August 10, 2026. Almost nobody wrote up N-able's ~6% reduction, buried in the same day's 10-Q. If you source security engineers and you only chased the headline, you missed roughly half of a same-day Massachusetts-tied supply shock.

What actually happened on August 10, 2026

Two Massachusetts-tied security vendors surfaced experienced engineers into the same regional pool on the same SEC filing date, but only Rapid7 made the news. Rapid7's board approved a restructuring on August 7 cutting approximately 314 people (12% of its ~2,600 global workforce), with $10M to $11M in charges. N-able's 10-Q, filed the same day, disclosed a plan approved July 20 to reduce global workforce by roughly 6%, with $11M to $13M in annual cash comp savings plus $1.5M to $2.5M in unvested stock-based comp.

The math on N-able implies ~130 to 160 people cut. Combined, that is a same-day disclosure event covering roughly 440 to 470 security-adjacent employees.

New Rapid7 CEO Wael Mohamed, 58, ex-Forescout, replaced Corey Thomas on June 1, 2026. Two months in, he told the market customers want the company to "go deeper in Detection and Response and Exposure Management, not wider." That single sentence is your sourcing map, and I will come back to it.

6,701

The real size of the Aug 10 pool

The honest number is 440 to 470 people, not 314. Recruiters who filter Massachusetts WARN notices will surface Rapid7 cleanly and miss most of N-able, because N-able's cut is global and its MA footprint is unclear on paper.

Here is the dataset side by side.

Two things jump out. First, N-able's cash-savings-to-headcount ratio ($11M to $13M across ~140 people) points to loaded, tenured ICs, not entry-level. The unvested SBC line confirms it: you do not save $1.5M to $2.5M in unvested equity by cutting new hires. Second, N-able Q2 2026 revenue was $138.2M, up 5.9% YoY, with ARR of $544.5M. This is not a distress cut. It is a portfolio reshuffle around new CRO Russell Rosa and the new Bengaluru Global Capability Centre. Departing talent is higher quality than the "quiet 6%" language suggests.

Why "detection engineer" is the wrong search string

If you type "detection engineer" into LinkedIn Recruiter and filter for Rapid7 alumni, you will find the people Rapid7 was least likely to cut. Mohamed said the surviving orgs are Detection & Response and Exposure Management. The available ICs came from adjacent bets: SIEM legacy, Cloud Security, App Sec research, IAM, and the ML platform layer. Search those keywords instead.

The productive Rapid7 sourcing keywords right now:

• SIEM engineer, InsightIDR rules author, log pipeline engineer
• Cloud security engineer, CSPM, CNAPP, InsightCloudSec
• Application security researcher, Metasploit contributor, vulnerability research
• IAM / identity engineer, InsightIDR identity analytics
• ML platform engineer, detection ML, security data platform

For N-able, the trim zones point at Cove Data Protection and N-central engineering, given the CRO reshuffle and the India build-out. That means backup / DR platform engineers, RMM platform engineers, and MSP-tooling SREs.

This is the exact gap Refolk closes for Boston cybersecurity engineers hiring: instead of guessing which title strings recover the displaced ICs, you describe the person in plain English ("Rapid7 or N-able engineer, worked on cloud posture or backup platform, not on core Detection & Response") and get a ranked shortlist across GitHub, LinkedIn, and the open web.

The 3-week window before Rapid7 buys them back

Move in weeks 1 through 3. Rapid7's stock jumped ~18% ($2.08, to $13.70) on the layoff news, which changes retention math for anyone still holding underwater RSUs that just appreciated.

Here is the mechanism. A senior IC at Rapid7 who took an offer in 2023 or 2024 is likely sitting on RSU grants that were struck when the stock was higher. The Aug 10 pop pushes some of those grants back toward or above the strike, which gives Rapid7's HR team something real to counter-offer with. Displaced ICs typically receive that counter 5 to 15 days after their initial exit conversation.

If your outreach lands in week 4, you are competing against a re-priced retention package. If it lands in week 1, you are competing against uncertainty. Same candidate, very different close rate.

Same-day filing does not mean same-day notification. N-able's cut was approved 18 days earlier and hit the SEC window alongside its 10-Q.

The filing-day illusion

The "same-day layoff" framing is a filing-day artifact, not a coincidence of notifications. N-able's board approved its plan on July 20. Rapid7's approved on August 7. Both surfaced publicly on August 10 because that is when Rapid7 disclosed and N-able filed its 10-Q.

Practical implications for sourcing security engineers out of this cohort:

1. N-able affected employees have been on the market up to 3 weeks longer than Rapid7 affected employees. Some already signed.
2. WARN filings in Massachusetts will over-index on Rapid7 and under-index on N-able. Do not use WARN as your primary funnel.
3. LinkedIn "Open to Work" green ring adoption typically lags a layoff by 7 to 21 days. Rapid7 alumni are just entering that window; N-able alumni are exiting it.
4. GitHub is your most honest signal for both cohorts. Metasploit and InsightIDR-rules maintainers whose commit cadence drops off in late July or early August are identifiable and public.

The 2023 alumni are also in play

Rapid7 has a 3-year pattern of Aug-7 board-approved cuts, and the 2023 cohort just hit its poaching sweet spot. In August 2023, Rapid7's board approved a restructuring that reduced the workforce by approximately 18%, close to 470 people, with $24M to $32M in charges. Both plans were approved on August 7, three years apart.

Engineers who took a new role in September or October 2023 are now 34 to 36 months into that role. That is the exact window where equity cliffs are behind them, the "prove myself" phase is over, and the honest question "should I still be here?" gets asked. Layer on the emotional signal of watching an ex-employer cut again, and you have a warm poaching cohort sitting on top of the fresh August 2026 cohort.

The named-entity signals worth searching:

• Peter "Mudge" Zatko joined Rapid7 in January 2023, which broadened the alumni graph considerably. His network is a legitimate sourcing surface for the 2023 cohort.
• Corey Thomas-era leaders who left with him in Q2 2026 are 3 to 5 months into either a job search or a stealth advisory role.
• N-able's Russell Rosa CRO appointment displaced GTM leadership; those leaders' direct reports (sales engineers with real security depth) are underrated hires for founder-led security startups.

A concrete Aug 10 sourcing playbook

Run these five queries in the next 21 days, in this order, and you will cover the honest cybersecurity talent pool from this event.

1. Rapid7 non-DR/EM ICs, weeks 1 to 3. Cloud, SIEM, App Sec, IAM, ML platform. Filter for tenure > 2 years so you catch senior comp brackets. This is where the underwater-RSU-turned-appreciated dynamic bites hardest, so speed matters.
2. N-able Cove and N-central engineers, weeks 1 to 4. Backup platform, RMM, MSP tooling. Bias toward engineers with US-based LinkedIn locations, since the India build-out is what displaced them.
3. Rapid7 August 2023 alumni now at 34-plus month tenure. Search for engineers whose current role start date is between Aug 2023 and Nov 2023 and whose prior employer is Rapid7. Warm outreach, not cold.
4. GitHub commit-cadence drops on Rapid7 open-source repos. Metasploit and InsightIDR content projects. Public maintainers whose activity dropped in late July or early August.
5. N-able GTM engineers (sales engineers with hands-on security depth). Underrated hires for Series A / B security startups that need a founding SE.

For any of these, Refolk will let you skip the query construction step. Ask in plain English, get a ranked list back across GitHub, LinkedIn, and the open web, and dedupe against the roles you have already reached out to.

What most recruiters will get wrong

Three predictable mistakes will play out over the next 30 days.

The first is treating this as a Rapid7 story. It is a Boston security vendor story, and half the displaced ICs work at the company you did not read about. Widen the search.

The second is over-indexing on the "detection engineer" title, because the CEO said "detection." He said Rapid7 is keeping detection. The people you can hire are from every team that was not detection.

The third is waiting. The N-able cohort has a 3-week head start, and the Rapid7 cohort is about to receive counter-offers priced against a 17.96% stock pop. If you have a security engineer req open, the honest cybersecurity talent pool for this event is at its most reachable in the next 14 days, not the next 60.

FAQ

How many people did Rapid7 actually lay off on August 10, 2026?

Rapid7's board approved a restructuring on August 7, 2026, disclosed August 10, cutting approximately 12% of workforce, or around 314 people out of ~2,600 employees globally, with $10M to $11M in charges. New CEO Wael Mohamed framed the cut as a pivot toward Detection & Response and Exposure Management, which means the ICs actually available came from adjacent orgs: SIEM legacy, Cloud, App Sec, IAM, and the ML platform layer.

Did N-able really lay off people the same day, and how many?

Yes. N-able's 10-Q filed August 10, 2026 disclosed a plan approved July 20, 2026 to reduce global workforce by approximately 6%, with $11M to $13M in annual cash compensation savings plus $1.5M to $2.5M in unvested stock-based comp. Derived headcount is roughly 130 to 160 people. The cut aligns with new CRO Russell Rosa's GTM overhaul and the opening of a Bengaluru Global Capability Centre, which points at Cove Data Protection and N-central engineering as the likely trim zones.

Why is "detection engineer" the wrong search string for Rapid7 alumni?

Because Mohamed explicitly said the surviving orgs are Detection & Response and Exposure Management. The available ICs came from the teams that were trimmed to fund those bets. Search SIEM, cloud security, application security research, IAM, and ML platform titles instead, and cross-reference against Rapid7's open-source contributions on Metasploit and InsightIDR content repos to surface named engineers who are actually on the market.

How urgent is the outreach window?

Weeks 1 through 3 are the real window for Rapid7. The stock jumped ~18% on the layoff news, which repriced underwater RSUs upward and gave Rapid7 room to write meaningful retention counter-offers. N-able alumni have been on the market up to 3 weeks longer (approval was July 20, not August 10), so the top ICs there may already be in final rounds elsewhere. If you have a security engineer req open, this cohort is at its most reachable in the next 14 days.