In April this year, AI startup Anthropic made waves after it revealed that Mythos, one of its most advanced AI models, found thousands of serious flaws in common operating systems and web browsers.

So rather than release the model to the public, Anthropic let a small group of vetted partners use the model.

Wall Street reacted negatively to the headlines, so cybersecurity stocks plunged as a result.

Since then, cybersecurity stocks have recovered. The First Trust Nasdaq Cybersecurity Fund (CIBR) is up 44% this year.

Meanwhile, firms like Palo Alto Networks (PANW) and CrowdStrike (CRWD) have roughly doubled this year.

Unfortunately, Boston-based Rapid7 (RPD) got left behind. Even after rebounding from the cybersecurity scare earlier this year, its shares are still down 7%.

Rapid7 got its start finding software security flaws.

Every piece of software has flaws. “Vulnerability management” tools scan a company’s computers, servers, and apps for known flaws. Then they rank which ones are most dangerous, so the IT team knows what to patch first.

That ranking matters because no IT team can fix everything at once.

Today, Rapid7 sells this as part of its “exposure management” products. Its biggest business is “detection and response,” which watches for intruders who’ve already gotten in.

Investors bet that AI would soon do the scanning for free. In July, investment bank Morgan Stanley (MS) cut Rapid7 to “underweight.” It pointed to new AI-based rivals in vulnerability management.

However, finding flaws faster makes fixing them more urgent. And Rapid7’s own research shows that early this year, exploiting software flaws overtook tricking employees (like phishing emails) as hackers’ top way in.

Flaws were the entry point in 38% of the break-ins Rapid7 investigated in the first quarter. Social engineering accounted for 24%.

Hackers are moving faster, too. Rapid7’s latest report found they exploited high-severity flaws within three days, on average.

Mythos makes that problem worse. An AI that finds thousands of new flaws doesn’t patch any of them.

Instead, each flaw lands on a rapidly-growing to-do list, and companies need help deciding which vulnerability to patch before hackers take advantage—-that’s the kind of service Rapid7 sells.

Rapid7 is already delivering strong returns. Its Uniform return on assets (“ROA”) has been 19% in each of the past three years, up from 14% in 2021 and 2022.

Its new leadership is making moves too. Wael Mohamed, the former CEO of device-security company Forescout, took over as Rapid7’s CEO on June 1.

In August, Rapid7 cut about 12% of its workforce to focus on its core products. It also raised its full-year operating-income forecast to at least $129 million, up from as little as $112 million a quarter earlier.

Analysts expect Uniform ROA of 15% this year and 16% in 2027 (light blue bars). That’s below recent years, partly because sales are shrinking. Rapid7 expects revenue to fall about 2% this year.

Meanwhile, the market expects returns to shrink even further.

We can see this through Valens’ Embedded Expectations Analysis (“EEA”) framework.

The EEA starts by looking at a company’s current stock price. From there, we can calculate what the market expects from the company’s future cash flows. We then compare that with our own cash-flow projections.

In short, it tells us how well a company has to perform in the future to be worth what the market is paying for it today.