BOSTON, July 28, 2026 (GLOBE NEWSWIRE) -- Rapid7, Inc. (NASDAQ: RPD), a global leader in AI-powered managed cybersecurity operations, today announced the general availability of Rapid7 Cyber GRC, expanding the Rapid7 Command Platform with native governance, risk, and compliance (GRC) capabilities. The new offering helps organizations continuously understand cyber risk, validate control effectiveness, and simplify compliance by connecting GRC workflows with live security operations data. This shared data foundation gives security and compliance teams a unified, continuously updated view of control performance, active threats, and organizational risk.
With Rapid7 Cyber GRC, Rapid7 becomes the first major security operations platform to unify SecOps and GRC, extending its Preemptive Security strategy across risk, controls, and compliance.
Security operations and governance have historically evolved as separate disciplines, leaving organizations to reconcile security findings, compliance evidence, and business risk across disconnected systems. This fragmentation consumes valuable resources, slows decision-making, and leaves leaders without a current view of whether controls are working. Rapid7 Cyber GRC brings these functions together on a common operational foundation, uniting security operations and governance to support continuous assurance.
Rapid7 Cyber GRC closes that gap by connecting governance workflows directly to live security telemetry. By tying internal controls to current attack-surface visibility, Rapid7 gives security, risk, and compliance teams a shared view of control effectiveness, active threats, and organizational risk.
With Rapid7 Cyber GRC, organizations can:
- Continuously validate security controls using live platform telemetry to identify control deficiencies and drift between formal assessments.
- Automate audit readiness by collecting evidence and mapping controls across multiple compliance frameworks.
- Streamline third-party risk management with an AI Assessment Assistant that accelerates vendor questionnaires and reviews.
- Connect security action to measurable risk reduction by bringing active threats, exposures, and findings into year-round compliance workflows.
The Cyber GRC also uses AI-powered assistants for compliance workflows and third-party assessments. These capabilities support policy management, third-party risk management, risk registers, audit-ready reporting, and optional PCI Approved Scanning Vendor scanning.
“Preemptive security goes beyond detecting and responding to threats. Organizations need to continuously understand where risk exists, whether controls are working, and where action is needed before gaps become incidents,” said Corey Thomas, Executive Chairman of Rapid7. “By bringing GRC into our platform, Rapid7 Cyber GRC connects what teams detect, what they fix, and what they can prove, turning compliance from a point-in-time exercise into an active part of security operations.”
Since launching Cyber GRC in early access in May 2026, Rapid7 has advanced the offering through customer validation, commercial adoption, and an expanding assurance partner ecosystem. Early customers included GetWell Networks and SelectQuote Insurance Services, demonstrating demand among organizations seeking to connect security operations with continuous compliance.
"What excites me most about Rapid7 Cyber GRC is the ability to use the wealth of security data, asset inventories, and API connectivity already available to us to produce more accurate, timely, and defensible risk reporting,” said Bill Theissen, Managing Partner and Vice President of Consulting Services at Cyber Watch. “Just as important, the platform helps bridge the divide between security engineering and GRC teams through a shared view of risk and a common language for communicating it."
Rapid7 is also building an ecosystem of audit, assurance, and GRC partners that extends continuous assurance beyond the platform. Partners including HITRUST, Insight Assurance, and 360 Advanced help organizations support certification and compliance programs across frameworks such as SOC 2, ISO 27001, HITRUST, CMMC, and FedRAMP.
Cyber GRC is one of four platform innovations Rapid7 is showcasing at Black Hat USA 2026 as part of its broader Preemptive Security strategy, alongside:
- AI-Accelerated Exposure Discovery & Visibility, which applies natural language querying and AI-generated summaries to help teams surface exposures faster, identify software risk across the full technology stack, and communicate risk posture clearly to the business.
- Preemptive MDR Alerts, which surface high-confidence threats before they escalate into incidents
- Agentic SOC, which applies AI agents to accelerate investigations and guide response while preserving analyst control over high-impact decisions.
Together, these innovations extend Rapid7’s vision for Preemptive Security; helping organizations anticipate risk, continuously validate defenses, and disrupt attacks before they become incidents.
Attendees can experience live demonstrations and expert-led sessions at Rapid7 Booth #2445 in the Black Hat USA Business Hall, as well as at the company’s private space at Border Grill in Mandalay Bay. Join Rapid7 at Black Hat 2026.
About Rapid7
Rapid7, Inc. (NASDAQ: RPD) is a global leader in AI-powered managed cybersecurity operations, trusted to advance organizations’ cyber resilience. Open and extensible, the Rapid7 Command Platform integrates security data, enriching it with AI, threat intelligence, and 25 years of expertise and innovation to reduce risk and disrupt attackers. As a recognized leader in preemptive managed detection and response (MDR), Rapid7 unifies exposure and detection to transform the cybersecurity operations of more than 11,500 customers worldwide. For more information, visit our website, check out our blog, or follow us on LinkedIn or X.
Media Contact
Christine Nurnberger
SVP Global Marketing and Growth
[email protected]
(857) 216-7804
Rapid7 Investor Contact
Matt Wells
Vice President, Investor Relations
[email protected]
(617) 865-4277