Rapid7 launches Cyber Governance, Risk, and Compliance (GRC) early access program to unify security data, risk context, and Compliance workflows. Rhea-AI Impact (Moderate) Rhea-AI Sentiment Rhea-AI summary. Rapid7 (NASDAQ:RPD) launched an early access Cyber Governance, Risk, and Compliance (GRC) program built on the Rapid7 Command Platform. The offering unifies security operations with governance, risk, and compliance workflows using real-time exposure data as the foundation. Cyber GRC integrates AI-driven third-party risk management, a live threat-aware risk register, and continuous control monitoring. Rapid7 is partnering with HITRUST, Insight Assurance, and 360 Advanced, and adding features like HITRUST control coverage, audit-ready user access exports, unified policy bulk export, and VM Export MCP Server & Skill. Broader availability is planned later in 2026. AI-generated analysis. Not financial advice. News market reaction - RPD. Key figures. Planned broader availability year: 2026 SOC standard: SOC 2 ISO security standard: ISO 27001 +3 more Market reality check. Price: $6.18 Vol: Volume 2244272 is roughly... normal vol Peers on argus. RPD fell 7.68% while key peers showed small mixed moves (e.g., ATEN +1.89%, RDWR... Historical context. 5 past events · Latest: May 05 (Neutral) Pattern 5 events Market pulse summary. This announcement introduces Rapid7's Cyber GRC program, built on the Command Platform to tie real-t... Key terms. governance, risk, and compliance, grc, hitrust, soc 2, +3 more AI-generated analysis. Not financial advice. 05/12/2026 - 06:00 AM New program delivers a preemptive, evidence-backed approach for reducing risk and continuously validating control effectiveness BOSTON, May 12, 2026 (GLOBE NEWSWIRE) - Rapid7, Inc. (NASDAQ: RPD), a global leader in AI-powered managed cybersecurity operations, announced early access to its Cyber Governance, Risk, and Compliance (GRC) program, designed to unify security operations with governance, risk, and compliance workflows. Built on the Rapid7 Command Platform, Cyber GRC uses real time exposure data as the operating foundation for both security and compliance; aligning controls, evidence, and risk decisions to live threats rather than static frameworks to help customers manage their GRC requirements. Regulatory requirements are expanding across jurisdictions and frameworks, while cyber risk continues to scale in complexity. Most compliance processes remain point-in-time and disconnected from live security operations, reinforcing reactive models that lag behind how risk develops. Rapid7's Cyber GRC program replaces reactive compliance with a unified model for risk and controls. By combining AI-driven third-party risk management with a live, threat-aware risk register, it integrates GRC into security operations to provide executives with transparent, data-backed visibility. "Organizations invest heavily in security tools, but many are still left to determine how to validate control effectiveness and demonstrate compliance," said Jon Schipp, Senior Director of Product Management at Rapid7. "Cyber GRC connects fragmented data across assets, exposures, and controls to the attack surface, giving teams a clear view of risk and enabling consistent, evidence-backed outcomes." Rapid7 is building an ecosystem of audit, assurance, and GRC partners on the Command Platform to support continuous assurance: * HITRUST: Provides the industry's most rigorous, certifiable assurance, enabling organizations to demonstrate proven, defensible security and risk management aligned to recognized standards and requirements. * Insight Assurance: A trusted independent assessor, delivering rigorous, technology-enabled assessments across SOC 2, ISO 27001/42001, HITRUST, CMMC and other frameworks It is focused on validating control effectiveness for organizations looking to simplify compliance. * 360 Advanced: Delivers integrated compliance solutions to a global client base across industries ranging from technology startups to Fortune 500 organizations, with cybersecurity and compliance offerings that include ISO 27001, FedRAMP, HITRUST, SOC, penetration testing, risk assessments, and more. 360 Advanced operates under an alternative practice structure in accordance with all applicable laws, regulations, standards, and codes of conduct of the AICPA. In addition, Rapid7 is extending capabilities that support continuous control monitoring, evidence collection, and audit workflows, including: * HITRUST e1, i1, and r2 Control Coverage: Continuously updated dashboards and queries monitor HITRUST controls, automate evidence collection, and detect control drift to support certification readiness. * Audit-Ready User Access Exports: Self-service export provides a consolidated view of users, groups, roles, and access data to support access reviews and compliance audits. * Unified Policy Bulk Export: Standardized bulk export consolidates agent and scan policy data into a single output to simplify policy reporting and support compliance workflows. * VM Export MCP Server & Skill: Enables customers and agents to retrieve Rapid7 data for compliance, vulnerability management operations, and reporting in a highly efficient way. "Organizations today are in a constant tug of war between regulatory requirements and daily security operations. With Rapid7 Cyber GRC, the Command Platform now provides a unified place where controls, vulnerability insights and audit details live together. The benefit to practitioners is a single place that not only implements controls but also helps prove them with examination readiness and defensible reporting, " said Christopher Conklin, VP, Chief Information Security Officer, Chemung Canal Trust Company. "Today's organizations need a partner that brings together security operations, risk management, and governance into a cohesive strategy. This technology allows us to deliver on that vision," said Mat Cornish, Managing Director, Longwall Security, Rapid7 EMEA Services Partner of the Year, 2026 The Cyber GRC Program is currently available for early access, with broader availability planned for later in 2026. About Rapid7 Rapid7, Inc. (NASDAQ: RPD) is a global leader in AI-powered managed cybersecurity operations, trusted to advance organizations' cyber resilience. Open and extensible, the Rapid7 Command Platform integrates security data, enriching it with AI, threat intelligence, and 25 years of expertise and innovation to reduce risk and disrupt attackers. As a recognized leader in preemptive managed detection and response (MDR), Rapid7 unifies exposure and detection to transform the cybersecurity operations of more than 11,500 customers worldwide. For more information, visit our website, check out our blog, or follow us on LinkedIn or X. Rapid7 Media Relations Alice Randall Director, Global Communications [email protected] (857) 216-7804 Rapid7 Investor Contact Matt Wells Vice President, Investor Relations [email protected] (617) 865-4277 Faq. What is Rapid7's Cyber GRC early access program announced in May 2026 for RPD? Rapid7's Cyber GRC early access program offers a unified platform for security, governance, risk, and compliance. According to Rapid7, it uses real-time exposure data to align controls, evidence, and risk decisions with live threats instead of static, point-in-time compliance frameworks. How does Rapid7's Cyber GRC unify security operations and compliance workflows for RPD customers? Cyber GRC connects security operations directly to governance, risk, and compliance workflows. According to Rapid7, it leverages the Command Platform to link assets, exposures, and controls to the attack surface, enabling evidence-backed risk decisions and continuous validation of control effectiveness for organizations. What key features are included in Rapid7's Cyber GRC capabilities for early access users? Rapid7 Cyber GRC includes HITRUST control coverage dashboards, audit-ready user access exports, unified policy bulk export, and VM Export MCP Server & Skill. According to Rapid7, these features support continuous control monitoring, automated evidence collection, and streamlined audit and compliance reporting workflows. Which partners are involved in Rapid7's Cyber GRC ecosystem as of the May 2026 launch? Rapid7 is building a Cyber GRC ecosystem with HITRUST, Insight Assurance, and 360 Advanced. According to Rapid7, these partners provide assurance, independent assessments, and integrated compliance solutions across frameworks like SOC 2, ISO 27001, HITRUST, CMMC, FedRAMP, and related cybersecurity services. When will Rapid7's Cyber GRC move beyond early access to broader availability? Rapid7 Cyber GRC is currently in early access with broader availability targeted for later in 2026. According to Rapid7, interested organizations can request participation and learn more through the company's website to prepare for full rollout of the program. How does Rapid7's Cyber GRC help organizations validate control effectiveness and compliance? Cyber GRC supports continuous control monitoring and evidence-backed validation of controls. According to Rapid7, features such as HITRUST dashboards, automated evidence collection, and consolidated access and policy exports are designed to simplify audits, support certification readiness, and demonstrate defensible security and risk management.

Insight Assurance, a global cybersecurity compliance and assurance services provider, has appointed Ben Wright as chief revenue officer. The appointment supports the company's global expansion and enterprise go-to-market strategy as it navigates increasingly complex compliance requirements. Wright brings extensive experience from SaaS and technology companies, including leadership roles at Sendspark and Levanta. At Sendspark, he contributed to over 200% revenue growth and supported a successful private equity exit. He previously founded a SaaS platform automating security questionnaire processes. As CRO, Wright will focus on strengthening ecosystem relationships, expanding enterprise initiatives, and building scalable revenue operations. He will also support Insight Assurance's expansion across North America, Latin America, Europe, the Middle East, Africa and Asia-Pacific.