Committed to a Better Future for
Cybersecurity and Society

Table ofContents

Table of Contents
Letter from Our CEO4

Our Commitment and Approach

6Social Good

10

Diversity, Equity & Inclusion

10

Key Initiatives | DE&I

12

Rapid Impact Groups 

14

Key Partnerships | DE&I

18

What Rapid7 Looks Like Today

25

Advancing Cybersecurity

28

Key Initiatives | Advancing Cybersecurity

30

Key Partnerships | Advancing Cybersecurity

35

2023 Outlook | Advancing Cybersecurity

36

Purposeful Philanthropy

38

Key Initiatives | Purposeful Philanthropy

40

Environmental Sustainability

44

Key Initiatives and Results | Environmental Sustainability

46

Corporate Citizenship

50

Governance54
Corporate Governance Guidelines

56

Key Initiatives and Results | Governance

56

Looking Ahead

58

2022 Social Good Highlights

61

2023 and Beyond

62

SASB Reporting Metrics

64

3

LE T TER FROM O UR C E O

Welcome to Rapid7’s second
annual Social Good Report.
Last year’s inaugural report was an important first step in our journey
toward collective and transparent reporting around our social
good initiatives. Over the past year, we have remained
steadfast in our values-focused commitment
to creating a secure and resilient future while
promoting access and inclusion in cybersecurity.
As we look back on 2022 and the early part of2023, we’ve made significant strides acrosskey ESG areas, and we’re excited to share
our progress with you.

The first area I want to highlight is around our commitment to environmental sustainability. As
responsible corporate citizens, we understand the urgent need to reduce our greenhouse gas
emissions and take immediate action to address climate change. We are excited to announce
that Rapid7 has pledged to achieve 50% carbon neutrality by 2027 and be carbon neutral by2030. And as part of our commitment to transparency and accountability, we are disclosing
audited carbon emissions data for the first time. This data will be updated and shared annually
as we drive toward our carbon neutrality goal.
On the social side, we now have a dedicated Director of Diversity, Equity, and Inclusion who
is driving meaningful progress, particularly around Inclusion. Last year we introduced Rapid7
Impact Groups and customized company-wide DEI learning tools. We are making a collective
effort toward our ambitious representation goals and providing greater disclosure in this area.
We’re also pleased to report that a comprehensive external pay equity survey was completed
in 2022 found no discrepancies in pay related to race or gender. And lastly, Rapid7 recently
announced a partnership with the University of Southern Florida (USF) to establish a cyberthreat intelligence laboratory, funded by a $1.5 million investment from the Rapid7 Cybersecurity
Foundation.
I am proud of our efforts and progress in driving access and inclusion in cybersecurity alongsidestrengthening relationships with our customers, partners, and shareholders. But we know that
we still have much work to do. Our commitment to social good is ongoing, and we will continue
to take a “Never Done” approach to ensure that we are always improving and advancing.
I would like to extend my thanks to our employees, customers, partners, and shareholders fortheir ongoing support and dedication to our mission of creating a better, safer world. Publishing
this annual report opens the next chapter in building trust, transparency, and dialogue, and weare excited to continue this journey with you.

Corey Thomas, CEO5

Our Commitment
and Approach
Rapid7 is committed to a secure and prosperous digital future
for all—not just our customers, our partners, or those in the techcommunity. As more of our world and more of our interactions
move online every day, we’re working to connect everyone withpowerful security technology and practices.
Creating a secure digital future for all is a massive undertaking—one that impacts every aspect of life and reaches all around theglobe. It takes an unconventional approach to face a challengeof this size. Here’s how we’re doing it:

7

Empowering People
We’re empowering people by building opportunities for those that thecybersecurity community has historically overlooked. Our deep commitment toDiversity, Equity & Inclusion makes our work more impactful while infusing ourindustry with new talent and perspectives. And through innovative partnerships
with schools and philanthropic activities, we’re fostering the development of
the world’s next generation of STEM thinkers and Cybersecurity professionals.

Advancing Cybersecurity
We find ourselves faced with a global challenge—so we’re working to strengthen
a global community to help us face it. Through advocacy, community initiatives,and charitable giving, we seek to advance cybersecurity. Alongside lawmakers
and industry groups, we advocate for policies that protect against emerging
threats while bolstering the vital work of security researchers. Finally, oursupport of free and open source projects helps ensure that more people haveaccess to powerful security information, tools and practices.

Protecting the Future
To create a more secure digital future for everyone, we must also protect the
future of the planet we share. The fates of our digital world and our environment
will always be tied together, so we contribute to the global fight against climatechange by embracing sustainable practices and reduction in the resources we
use and the day-to-day decisions we make at office locations worldwide.

Operating with Integrity
We also must protect the long-term health of our own company, calling fortransparent and ethical engagement with our stakeholders across shareholders,
employees, and the global security community. Our approach, from our Codeof Business Conduct and Supplier Code of Conduct to employee and partner
enablement and Board Oversight, reinforces our integrity and guides how
we engage with these important groups. Through that transparency andaccountability, we’ll ensure we’re moving together toward our common goal.

Our Commitment and Approach9

D

iversity, Equity & Inclusion is central to our core values at Rapid7. To realize our visionof a secure digital future, we believe we have to proactively cultivate a healthy anddynamic work environment in which everyone feels safe and respected. Our vision
doesn’t just focus on making progress internally; it also includes driving impact and shifting
the representation of the cybersecurity space, to further include historically-underrepresented
communities. Here at Rapid7, Diversity, Equity and Inclusion is more than a set of initiatives—it’s part of our DNA. We’re making substantial investments in Diversity, Equity & Inclusion
programs across the organization, not just because it’s the right thing for our people, but also
because we know it serves our customers and ultimately our shareholders and communities.

SO CI AL GOOD

Diversity,
Equity &Inclusion
SNAPSHOTIn 2022, we deepened our commitment to building
opportunities for those that the cybersecurity community
often overlooks.

Diverse teams and a culture of inclusion serve as a catalyst for innovation. We know fromexperience that diversity of thought enables us to produce the best outcomes for ourcustomers and community. Our deep commitment to Diversity, Equity & Inclusion is core to
the strength and success of our business. Cybersecurity, historically and currently, has notbeen reflective of the global population and markets our industry seeks to serve. In order toachieve our objectives we have to not only be diligent about increasing the diversity of our
growing employee base, but we must remain focused on equipping our current employeeswith the tools and education needed to positively impact the work environment, so thatregardless of one’s background and or lived experience, anyone can feel a sense of belonging
and make impact.
We’re committed to recruiting, retaining, and developing high-performing, innovative,and engaged employees with backgrounds and experiences as diverse as those of
our customers.

At our

WOMEN
make up29%
of our global population*

BLACK OR AFRICAN AMERICAN,HISPANIC OR LATINO, ASIAN,TWO OR MORE RACES, OTHER

make up24%
of our US population*

NEW

Tampa,FL
location, we are dedicatedto building diverse, multidimensional teams anddeveloping emerging talent.
*Based on self-reported data as of 12/31/2022

11

Bring You

Key Initiatives | DE&I

At Rapid7, our core values are integral to the way we operate as a business and as
collaborators. Our core value of “Bring You” is an invitation for everyone who works at Rapid7
to embrace their own uniqueness and feel comfortable bringing their true self to work. We
know that fostering a culture of psychological safety and inclusion lets people be morecreative and generate innovative ideas. By empowering our employees to be their authentic
selves and engage in what can be difficult conversations surrounding cultural competency,
we’re creating the conditions for a dynamic workplace where innovation can thrive.

In our push to drive Diversity, Equity & Inclusion both within Rapid7 and in cybersecurity at large, we engage
with other organizations to show our commitment to creating a positive social impact.
In 2021, we joined the United Nations Global Compact to support and express adherence to the ten
principles of the United Nations Global Compact related to human rights, labor, environment, and anticorruption, and we continue to foster the long-standing engagements we have with other organizations
dedicated to Diversity, Equity & Inclusion efforts:

Bring You is an initiative that builds on the focused efforts we started in 2018 to ensurethat every employee—regardless of their ethnicity, gender identity, religion, sexuality, orbackground—has the opportunity to thrive in their career and feel a sense of belonging within
our community. More than just a set of goals, Bring You is using targeted investments tocultivate an increasingly diverse workforce as we continue to grow. While that overarching
mission speaks to the essence of inclusion, Bring You highlights our focus on continuing tostrengthen our gender and racial diversity in the organization in a measurable, impactful way.

• Founding Host Company, Hack.Diversity. 2017 - present• Inclusion in the Bloomberg Gender Equality Index, every year since 2019
• Inclusion in The Boston Globe Top Places to Work list, every year since 2011
• Inclusion in Boston Business Journal Best Places to Work list, every year since 2011
• Supporter of the Parity Pledge and the United Nations Global Compact

In 2022, our overarching employee representation remained in-line with the prior year, andwe are committed and focused on moving in the right direction. Shifts in hiring plans andcompany focus had us making more progress on the “inclusion” elements of our mission
than the representation metrics we had targeted. While this is not the stellar comprehensive
progress we hoped for, we own it. We are proud that we have taken several impactful steps toensure that we continue to focus and push forward in support of Diversity, Equity and Inclusion
efforts. We now have a dedicated Director of Diversity, Equity and Inclusion, reporting into our
Chief People Officer. We established a strategic framework for the maintenance of current
and creation of new Employee Resource Groups (Rapid7 Impact Groups).

• Irish News Belfast Best Company Connection 2022

COMPARABLYCOMPARABLYCOMPARABLYCOMPARABLYCOMPARABLYCOMPARABLYBUILT IN

#2 Best Workplaces
in BostonBest CEOs
for Women

Best Company
Perks & Benefits

Best Company
Compensation

Company Work-Life
BalanceBest Company
Career Growth

Best Place to Work
(Boston, Austin, LA)

Near the end of 2022, we rolled out a mandatory Global Diversity, Equity and Inclusione-learning titled “Laying the foundation - Diversity, Equity and Inclusion.” This was not an“off the shelf” e-learning program. Our DEI education was built specifically to educate our
employee base with the information they need to support our mission around DEI and equipthem with the foundational tools they need to help us progress on our journey of inclusion.
Education was paired with an open internal board, where Moose posted about their personalcommitment to DEI and how they plan to help Rapid7 progress positively in this space.

Social Good13

Rapid7 Pride

Rapid Impact Groups(Our version of Employee Resource Groups)
Our Rapid Impact Group representation has grown from
Rapid7 Pride, Veterans and Vibranium (Black & LatinX),
to now include Women, Neurodiversity & Diversability
and Mosaic (Pan-Asian).
At Rapid7, we believe that everyone has a role to playin creating an inclusive environment. We regularly
create intentional moments for our people to educate
themselves on the lived experience of others and growon their personal journey of inclusion.

Our goal is that anyone, no matter their background cancome to Rapid7, be proud of who they are and do theirbest work ever.
Community and Culture are a big deal here, our Rapid
Impact Groups (RIGs) are supported by the business,but entirely driven by employees. The only requirement
is that our groups are action-oriented and help in theelevation of the communities they were created tosupport and find meaningful ways to support fellow
RIGs. Below is a list of our Rapid Impact Groups andtheir individual mission statements.

Rapid7 Pride aims to provide education, support, and awareness to all Rapid7
moose, regardless of sexual orientation or gender identity. We hope to provide
all of our LGBTQIA+ Moose with the tools and infrastructure to allow them toBring You every single day. We will vouch for each and every one of you tocreate systems and processes to accommodate your needs, and if processes
need updating, we will work with our colleagues to do so.

Rapid7 Vets
Focused on fostering a welcoming and supportive environment for all those whohave served their country. Rapid7 Vets does this through creating opportunities
for connection, building internal community rooted in understanding,collaborating on programs and events that elevate our community and helping
build pathways for Veterans to enter into cybersecurity and find space here at
Rapid7.

Rapid7 Diversability & Neurodiversity

Rapid7 Vibranium

Rapid7 DiverseAbility and Neurodiversity group aims to level the playing fieldby making the day-to-day experience of ALL employees equivalent in challenge
level regardless of disability or neurodivergence. We want the unique talents ofall to shine and be celebrated for what they bring to the company as a whole.
To do so, we will create intentional space for community, curate impactful
moments to help educate our fellow moose, and advocate for improvements
to support our exceptionally-skilled moose to close the achievement gap.

The Vibranium Rapid Impact Group seeks to build community and connection
for Black and Hispanic Moose as well as to promote awareness, facilitate
dialogue, and drive support generally of Rapid7 DEI initiatives. By driving
inclusion of Vibranium voices at all organizational levels at Rapid7, Vibranium
strives to attract, develop, and retain Black and Hispanic talent for theachievement of Rapid7 objectives as a corporate and community leader.

Rapid7 Women
Rapid7 Mosaic
Rapid7 Mosaic represents the vast tapestry that is the Asian and Pacific Islander
community. We aim to provide resources, events, and open forums to create
camaraderie and a greater sense of belonging for Asian and Pacific Islander
identifying moose. Rapid7 Mosaic fosters a sense of purpose, develops talent
and will empower Rapid7 to become the most inclusive cybersecurity company
in the world.

To support, enable, and empower all Rapid7 Moose identifying as women tobring their best, true selves to work every day through community, action, andactivism. Through our understanding of the unique challenges faced by womenin the workforce, we hope to create connections and use our knowledge to
uplift each other and encourage young girls to consider a career in STEM and/or in the Tech Industry. We embrace the individual, champion gender progressand elevate women by amplifying their voices.
Social Good

15

“

ANIKET MENON | VP, PRODUCTOne of the reasons I’ve been at
Rapid7 for almost a decade isbecause I can show up every
day and be myself.

“

We celebrate one another for our differences, and truly
believe that our diverse perspectives and experiences makeour work more impactful and our customers more secure.

Social Good

17

Key Partnerships | DE&I
We need to make investments that will expand educational opportunities to awide variety of populations that may not otherwise pursue STEM-related jobs.
Over the last several years, we’ve joined forces with schools and universities
globally to fuel STEM interest in youth from underserved and marginalized
communities, providing support and guidance in the form of donations,
volunteer work, mentoring, and education. A sampling of these organizations
include:BoSTEM
A Boston based program led by the United Way, focusing on providing robust
STEM education to Boston Public School children.

BUILD
Providing entrepreneurial skills to at-risk high school students with the goal ofcollege and career success.

AUTUMHQ
Austin Urban Technology Movement (AUTMHQ) bridges the gap between theBlack and Hispanic communities and the technology industry through job
placement, career development, and networking opportunities.

Queen’s University, Belfast
Supporting their computer science and security programming curriculum, andhiring of over 100 placement students into our Belfast office.

University of Canberra
Our funds support a program called ELSA, an online educational STEM
framework for preschool and grade 1 students.

Hack.Diversity
When Hack.Diversity was launched in Boston, MA, in 2017 withthe aim of becoming a talent provider connecting high-performingBlack and LatinX technical people with Boston’s fastest growing
companies, Rapid7 joined as a founding partner. Hack.Diversity and
Rapid7’s partnership was featured as an Action in The CEO Act!onfor Diversity & Inclusion website and you can read more here.
Image Courtesy of Hack.Diversity

Social Good

19

Talent Acquisition

Employee Experience

Our Talent Acquisition organization focuses on “how” weare hiring top talent at Rapid7, in order to continue andenhance our commitment to building multi-dimensional
and inclusive teams. We evaluate our recruitment
life cycle, to better understand our strengths andweaknesses. We build out best practices and resources
centered around diversity sourcing, to make sure ourteams are equipped to support the broader Rapid7
mission.

At Rapid7, we value collaboration, innovation, teamwork,and trust. That’s why we’re committed to bringing people
together from different backgrounds and investing inprograms that nurture the future talent of our community.
We’re always striving to create a more connected andcollaborative experience for all Rapid7 employees.

We’ve had positive anecdotal feedback and continue
to collect data to plan how to most effectively apply it
more broadly across hiring teams at Rapid7. We run
training sessions to ensure that our hiring managers
are aligned and enabled to partner with TA to achieve
the outcomes to which we’ve all committed and we plan
to prioritize running wider scale enablement sessions
across the manager cohort. We’ve also created aresource to educate our Talent Acquisition Partners
on available accommodations that may be requiredby candidates throughout the interview process, aspart of our ongoing commitment to provide equitable
experiences for all candidates. Our goal is to continue
to enhance much of the work we’ve already done andscale updated practices and processes across thebroader TA team and Rapid7.

We believe that a big part of ensuring that Rapid7
employees are having a positive experience is fostering
a culture where feedback is welcomed. We encourage
employees to engage in open and honest conversations
with their leaders and one another, take part in ourannual Manager Effectiveness Survey, share anonymous
feedback via our internal Inclusion site and join the
different discussions happening across the company,
led by our Rapid Impact Groups. In 2023, we will be rollingout a global engagement survey, another opportunity for
our Moose to help impact company culture. Employee
engagement is about understanding the emotional andmental connection members of our organization feel inregards to their teams, co-workers, leaders and the overall
function of the company. These might be elements we canglean from 1:1 conversations, but offering employees ananonymous way to provide feedback, in key areas suchas Employee Empowerment, Team Dynamics, Trust in
Leadership, Skills Development, Manager Effectiveness,
Communication and Inclusion (to name a few), will help
us pinpoint key areas affecting employees across thebusiness. We believe understanding high-level trends
isn’t enough. We hope to pair this information with ourrepresentation data, so we can gain greater insight into
how our underrepresented communities are doing andhow we can better support them.

The worldwide health crisis of COVID-19 has had adramatic impact on society, business, and our personal
lives. We understand the complexities of modern life
don’t always align with traditional 9-to-5 working hours.
We give our teams the flexibility to do their best workby supporting a hybrid working model for most roles.
With a hybrid model, our employees can collaborate,
network, and build amazing teams while having theoption to work remotely for part of the week. With thatin mind, we’re retaining our global office locations andcontinuing to expand, giving every team member the
chance to experience the dynamic Rapid7 culture andthe tangible benefits of working together in person.

Social Good21

Inclusive Benefits

Pay Equity

At Rapid7, our benefits are designed to be inclusive toall employees. We offer eligible employees competitive
benefits packages such as comprehensive healthcare
coverage, life and disability insurance, retirementsavings plans, generous time off and leave policies andmore. Our offices feature gender-neutral restrooms
and showers, as well as mothers’ suites. Rapid7
employees can also engage in curated and gamified
courses on diversity, inclusion, and belonging throughLinkedIn Learning. We aim to provide competitive andcomprehensive benefits to our employees across theglobe, adjusting where appropriate to comply withcountry-specific standards and laws.

At Rapid7, pay equity means fair and equal pay for
employees in the same job, level, and location controllingfor pay differentiators such as performance andexperience, regardless of gender or race. In 2022, wecompleted our second comprehensive pay equity survey(the previous one having been completed in 2020), led
by our Total Rewards and Legal team and working withcompensation experts. A comprehensive statisticalanalysis was conducted using regression models
with consideration of legitimate, non-discriminatory
drivers of pay. We did this to determine whether there
were any differences in pay based on gender or race.
The extensive survey and the review that followed, in
collaboration with our external specialists, confirmedthat people of color and women were not paid less inany of the groups analyzed due to their race or gender.
The external review was performed on all US-based
employees and supplemented with a further internal
review of all non-US employees to ensure pay equity
globally. We intend to continue performing a review likethis every few years, in addition to reinforcing internal
processes to ensure that we maintain pay equity.

What Rapid7 Looks Like TodayEntering 2023, our company has stronger diversity than ever before.*
Global Gender Diversity

Global Gender Diversity

29%

27%

WOMEN (TOTAL HEADCOUNT: 2,629)

OF DIRECTOR & ABOVEWOMEN (TOTAL HEADCOUNT: 216)

Racial / Ethnic Diversity in the U.S.

Racial / Ethnic Diversity in the U.S.

24%

17%

REPRESENTATION BY RACE / ETHNICITY(TOTAL HEADCOUNT: 1,673)

Black or African
American18%>1% Other
11% Two or

29%

23%
Hispanic or
Latino*Based on self-reported data as of 12/31/2022

20%

0% Other
10% Two or
More
Races

Hispanic or
Latino42% Asian

REPRESENTATION BY RACE / ETHNICITY(TOTAL HEADCOUNT: 168)Black or African
American

More
Races

OF DIRECTOR & ABOVE

47% AsianSocial Good23

2023 Outlook | DE&I
Diverse Expansion: Tampa, FL
In our commitment to generating more cybersecurity jobs, we’re
expanding our presence in North America by opening a new
Rapid7 office in Tampa, FL. As one of the top emerging cities fortech, Tampa is on a journey to becoming a major US innovation
hub. We’re excited to be a part of this journey and the role wecan play to support the community in these efforts. To do that,
we’re not just building an office and creating jobs—we’re putting a
stake in the ground to help shape the future of Tampa.
To bring this vision to life, Rapid7 is partnering with Tampa-areacolleges and universities to support the growth of local talentand build a stronger security community in the city. Our goal isto have 30% or more of our Tampa team be emerging talent and/or recently retired military. We’re also planning to partner withinclusion-focused STEM programs to help create a more diverseand supportive tech community through leadership and service.
We believe a diverse workforce is integral to the success of ourorganization and the culture we want to build. That’s why we’rebuilding something truly unique and prioritizing diversity in our
hiring plan so the Rapid7 team reflects the rich, diverse characterof Tampa.

Tampa, FL Hiring Goals• Target 100 new hires• Target 30% or more of our new hires will be emerging talent
and/or recently retired military• Target 50% or more of our new hires will be women and/or
people from historically marginalized communities in terms ofrace and ethnicity

Global Diversity, Equity & Inclusion Goals
Our Bring You commitment from 2022 will continue to be our North Star, as wehave made progress and believe we can ultimately meet our previously statedgoals of:

18% marginalized communities in terms of race and ethnicity
of our US employees will be from historicallyIn the US, we’ll continue to invest in people from historically marginalized andunderrepresented communities, with specific efforts focused on recruiting
talent who identify as Black, LatinX and or two or more races. At the end of2020 the three aforementioned communities represented 12% of our US teamand at the end of 2022 increased to 14%. We are confident that the changes
and investments we are making as a company will help us achieve our goal of 18%

35% of our global population will be women
In the United States, approximately one third of our employees are women andglobally, make up 29% of our staff. Our goal is to reach 35% representation
globally, at that point we will establish a new goal. #NeverDone

We will continue to drive momentum around our “Bring You” representation
goals with specific initiatives. These efforts include scaling our educational
content to better equip our hiring teams and managers, growing our Rapid
Impact Group programming, and working with our Executive Leadership Teamin order to prioritize these goals. We also give quarterly updates to our Boardof Directors on employee representation and current and future DEI initiatives.
Another core value of ours is “Never Done,” we will continue to be transparent
around progress and push forward to create more inclusive environments,
build a workforce that reflects all communities and create a culture committed
to educating ourselves to better empathize and support one another.

Social Good25

Advancing
CybersecurityEvery day, Rapid7 works to advance cybersecurity, striving
toward a safer and more secure digital future for all. To
face this global challenge, we identify and promote big-

picture solutions that infuse security best practices on a systemiclevel. From advocating for adoption of secure-by-design principles
to lending our support to critical infrastructure organizations,
we focus on initiatives with far-reaching impacts across ourinterconnected society and remain committed to Open Source.

We do this in a number of ways, including public policy engagement;
partnering with government cybersecurity agencies, technology
and business leaders; working closely with nonprofit advocacy
groups; and supporting free and open source tools.
Fueled by our passion for protecting people and our industryleading insights, our engagement extends to activities like cochairing the Ransomware Task Force and working with US
lawmakers to strengthen legal protections for cybersecurity
research.

SNAPSHOTThroughout 2022, we partnered with around the world to
advocate for cybersecurity advancements.

As co-chair of

RANSOMWARE TASK FORCE
we helped develop recommendations to
ransomware attacks
DETER & DISRUPTat scale

Led a successful campaign to

STRENGTHEN

LEGAL

protections for independent
security researchers in the US

CONTINUED TOSUPPORT THE
		OPEN
CY BERSE CURIT Y ALLIANCE

to help create a more open andinteroperable cybersecurity ecosystem

27

Key Initiatives |Advancing Cybersecurity
Public Policy and Advocacy

Better information sharing for EU essential services

Our public policy program advocates for global policies,
standards, and best practices that protect people and businesses
in an increasingly interconnected digital world. These efforts
include working with policymakers to ensure that critical services
have the resources and requirements they need to operate
effectively and protect against cybersecurity threats. They also
include advocating for balanced computer access laws that
support independent security research and don’t criminalize
regular internet users.

Rapid7 worked with EU policymakers to help ensure essential
services—health, energy, transport, banking, digital infrastructure,public administration, space sectors—can share and receive
cybersecurity threat information and vulnerability disclosures
under the NIS 2 directive.

Critical infrastructure funding and security
Rapid7 led a coalition of organizations to persuade Congress
to add cybersecurity funding and standards into the 2021
infrastructure legislation.

Supporting independent security research
Rapid7 led a campaign to strengthen legal protections forindependent cybersecurity testing under DMCA Section 1201,
resulting in the Librarian of Congress lifting key restrictions
that had put independent security testing of consumer smart
products at risk.

High-profile cyberattacks on infrastructure providers led to asignificant US government focus on the cybersecurity of these
critical industries. Rapid7 supports policy efforts to direct funding
and other resources to critical services to strengthen their cyberdefenses, and provides input to policy proposals to requirethat critical services maintain safeguards and processes suchas security incident reporting. We also continued to advocate
for independent security research through the triennial DMCA
exemption review process.
At the same time, Rapid7 continued to build its policy engagementin the European Union, providing support on proposals to update
the EU Network and Information Security Directive (NIS), as
well as legislation proposed for Artificial Intelligence (AI). In the
UK and Australia, we provided input on proposed approaches
to advancing cybersecurity around consumer smart products,
supply chain risk, digital service providers, and ransomware
attacks.

Advancing Cybersecurity

29

Free and Open Source Tools
To help bring powerful security to all, Rapid7 maintains and supports numerous open source andcommunity-sourced cybersecurity projects. These free tools give people access to the capabilities
and information they need to defend themselves, regardless of their location or background.

Metasploit
Rapid7 has continued to invest in maintaining and developing the open source penetration testing
framework Metasploit since its acquisition in 2009. In the years since acquiring it, we’ve remainedcommitted to keeping Metasploit open source to ensure the entire security community can continue
to benefit from, and contribute to, its capabilities.

Velociraptor

Open Cybersecurity Alliance
Rapid7 continues to support the Open Cybersecurity Alliance for the development of an open
ecosystem where cybersecurity products interoperate without the need for customized integrations.
We also supported the addition of the Posture Attribute Collection and Evaluation (PACE) project,which helps organizations assess and communicate the status of business process assets forstronger decision-making in zero-trust environments.

For more information on our open source cybersecurity tools and communities, please visit
https://www.rapid7.com/open-source/.

In April 2021, Rapid7 welcomed Velociraptor, an open source endpoint forensics and incident response
solution, to our open source family. As with Metasploit, we’re committed to keeping the Velociraptor
platform open source so it can continue to improve through input from security practitioners aroundthe world.

AttackerKB
Rapid7 invested in expanding AttackerKB, an open platform for vulnerability data sharing. The security
community has added more than 1200 CVE assessments to AttackerKB, offering expert insight on
both known and new vulnerabilities. Rapid7’s own research teams also published more than 30 indepth technical analyses of high-priority threats such as Log4Shell to help the community understand,prioritize, and detect risk in their environments.

Recog
Rapid7 committed significant resources to ensure that the multi-language network fingerprinting
library Recog gets the ongoing support and quality assurance that its users have come to expect.
Recog continues to expand its test coverage across Go, Java, and Ruby programming languages so
concurrent development across organizations in the languages they choose is both possible and easy.

Advancing Cybersecurity

31

Key Partnerships | Advancing Cybersecurity

Community Collaboration
Creating change that advances cybersecurity on
a societal level is a team sport. Rapid7 partners
extensively across the cybersecurity, business, andcivil society communities to develop or participate ininitiatives that are driving social change to create asafer internet for all.

Cyber 4 Healthcare

Ransomware Task ForceThe CVE Program

Rapid7 team members participated in and co-chaired
the Ransomware Task Force (RTF), a group of morethan 60 experts from a variety of sectors formed in
response to the high volume of extortion-based attacks
against critical infrastructure organizations. With
insights from law enforcement, critical infrastructure,
victim organizations, and more, the initiative developed
a set of recommendations for governments and otherleaders to take action to deter and disrupt ransomware
attacks at scale, as well as to help organizations prepare
for and respond to attacks. The RTF published its 48
recommendations in this 2021 report.
Rapid7 continues to participate in the Task Force,building out pragmatic approaches to adopting key
recommendations from the report and collaboratingwith various governments to explore policy implications.

Throughout the pandemic, Rapid7 has participated in
the CyberPeace Institute’s Cyber 4 Healthcare initiative,
which partnered with tech companies to provide pro
bono security assistance to healthcare organizations
assisting with the COVID response around the world.

In 2016, Rapid7 became one of the first non-government,
researcher-focused CVE Numbering Authorities (CNAs),
based largely on our demonstrated commitment toadvancing and maturing the state of coordinatedsoftware vulnerability disclosure. Since then, we’vebeen a leading voice in the global federation of over 200
CNAs and we continue to advocate for the researcher
and hacker communities by shaping the direction andgoals of the CVE Project through Research Director Tod
Beardsley’s positions as Chair of the CNA Coordination
Working Group and CNA Liaison to the CVE Board.

Rapid7 works alongside a legion of organizations andindividuals to advance cybersecurity. We partner withgovernments’ operational cybersecurity agencies andcybersecurity policy development agencies that share
our commitment to building a secure digital future. We
also work with nonprofits representing cybersecurity
advancement interests and civil society. In the private
sector, we partner with organizations that share ourvision for, and commitment to investing in, a moresecure internet ecosystem.

In 2022, we partnered with:
Nonprofits

NGOs

including the Institute for Security and Technology on
ransomware; the Global Cyber Alliance on ransomware,
IoT security, and other security challenges; the CyberPeace
Institute in supporting the Cyber Peace Builders program;the NoMoreRansom initiative, and the Cyber Threat Allianceon ransomware, cyber threat information sharing, incident
reporting, and other cybersecurity issues.

Rapid7 supports the Cyber Peace Institute’s Cyber Peace
Builders initiative matching volunteers from the cyber industry
with NGOs who need help maturing their Cybersecurity.

Academia
including the University of South Florida through the launch of
the Rapid7 Cyber Threat Intelligence Lab. This lab becomesan integral​​
component in real-time threat tracking but acts as adriver to promote diversity within the cybersecurity workforce.
With the intention of opening doors to individuals from
historically underrepresented groups within the cybersecurity
workforce.

The Council for Foreign Relations
The Council for Foreign Relations, a think tank focused on US
foreign policy and international relations where Rapid7 CEOCorey Thomas is a member.

Government advisory groups
Rapid7 helps ensure that policy initiatives avoid unintended
negative consequences and help advance cybersecurity.
These advisory groups include the Information Systems
Technical Advisory Committee and the International Trade
Advisory Committee for the US Department of Commerce, theGovernment Cyber Security Strategy External Challenge Panelfor the UK Cabinet Office, and the UK Department for Digital,
Culture, Media and Sport’s Cyber Resilience Expert Advisory
Group.
Advancing Cybersecurity33

2023 Outlook |Advancing Cybersecurity
Our work to strengthen the global cybersecurity community has
never been more urgent, and its potential impact has never been
greater.
In 2023, we aren’t letting up. We’ll keep advancing cybersecurity
through existing advocacy, public policy, and engagement
initiatives, and keep collaborating to find new ways to empower
the security community.

Ransomware Task Force (RTF)
The RTF will continue to engage with governments around theworld, particularly in the G7 nations, following a G7 event on
ransomware held in December 2021. The RTF and Rapid7 will
also continue to explore pragmatic approaches to disrupting thepaths to monetizing cybercrime, driving adoption of preventative
best practices, and encouraging greater transparency andinformation sharing.

Professionalization of Cybersecurity
In early 2022, the UK Government opened a consultation on theprofessionalization of cybersecurity. This is expected to be a focus
for the UK Government through 2023, potentially resulting in future
proposed legislation. This effort also has the potential to influence
policy in other jurisdictions and will likely create significant impact forthe security community. Rapid7 is leading and participating in several
community response initiatives to try to ensure that unintended
negative outcomes are avoided.

Public Policy• Critical infrastructure
We’ll keep working with policy makers to safeguard critical infrastructure and essential services from cyberattacks
through infrastructure modernization legislation and agency regulatory updates, as well as advancement of the EU’s
and UK’s updates to the NIS directive.
• Protecting personal information

Internet of Things (IoT) and Smart Products
As adoption of connected smart devices grows around theworld, there are numerous efforts to drive greater agreement
on, and adoption of, secure-by-design principles that reduce
opportunities for attackers to exploit these technologies. In
2023, Rapid7 will support these efforts by publishing researchon systemic cybersecurity threats and challenges, supporting the
UK’s Product Security and Telecommunications Infrastructure(PSTI) Bill, and advocating for consistent international standards
to support interoperability in the global digital economy.

We expect 2023 policy developments aimed at strengthening security requirements to protect consumers’ personal
information, with action being taken through US state legislation, FTC regulatory action, or international adoption of
GDPR-like privacy laws. Rapid7 expects to advocate safeguards that effectively secure consumers’ information frombreaches.
• Cyber incident reportingIncident reporting is a key component of proposed updates to the NIS Directive in both the EU and the UK. In the US,
the Cyber Incident Reporting Act for Critical Infrastructure of 2022 was signed into law on 3/15/2022. US regulatory
agencies such as FTC and SEC are also proposing new incident reporting requirements. Rapid7 supports incident
reporting to help contain and track cyberattacks and enhance transparency. We expect to advocate for progress andalignment in these efforts in 2023.

Advancing Cybersecurity

35

PurposefulPhilanthropy

While Rapid7’s efforts to realize our vision of a secure
digital future are rooted in active participation andeducation, we also engage in a variety of philanthropic

activities to support Diversity, Equity & Inclusion and advancecybersecurity.
We give back to the communities where we live and work, andbelieve this commitment helps us empower people and attract
and retain diverse talent. We also partner with a variety of STEM
and inclusion-focused programs to promote technology education
for all. To facilitate these philanthropic efforts, Rapid7 formed the
Rapid7 for Good Fund in 2020 through the Tides Foundation andcontributed an initial sum of $350,000. In the fourth quarter of2022, Rapid7 contributed an additional $250,000 to the Rapid7
for Good Fund, which we have since contributed to non-profit
organizations in our communities.

SNAPSHOTWe forged new philanthropic pathways to support
Diversity, Equity & Inclusion and advance cybersecurity in
2023 and beyond.

FORMED THE RAPID7CYBERSECURITY
FOUNDATION

and seeded it with

$1,000,000
to expand our work at the intersectionof cybersecurity and social good

DONATEDan additional$500,000
to various charitableorganizations

Supported our employees’ commitment
to social good with Quarterly

CORE VALUE AWARDAND

SOCIAL GOOD CHAMPION
37

Key Initiatives | Purposeful Philanthropy
Since 2021, we donated a total of over 2 million dollars to various charitable organizations, including:We’ve also incorporated charitable giving into our internal awards
programs by donating to deserving organizations in the names of
exceptional employees. These include:

Quarterly Core Value Award
Each quarter, Rapid7 leaders review thousands of employee
Core Value Award nominations submitted by our people, for ourpeople. Multiple winners each quarter are given an opportunity
to donate to their preferred STEM, Diversity, Equity & Inclusion, or
cybersecurity organization. In their names, we contribute many
thousands of dollars to these organizations each year.

Social Good Champion
Every October, Rapid7 leaders select one global Social GoodChampion based on an employee’s overall commitment andeffort toward changing the world. Rapid7 donates $10,000 (orcountry equivalent) in the name of the winner to the STEM,
Diversity, Equity & Inclusion, or cybersecurity organization of theirchoosing.

Beyond contributions of cash, we continued to encourage
employee volunteerism at all of our office locations around theworld.

Nonprofit Workspace
We provide workspace and event-hosting in our Boston office(desks, conference rooms, amenities) to 4 local nonprofits. Our
goal is to provide support to worthy causes in our community
through a temporary office home and access to our officeamenities.
Purposeful Philanthropy

39

Initially formed in late 2021 and announced in early 2022, the Rapid7
Cybersecurity Foundation expands our efforts and commitment to empower
people and advance cybersecurity. With a focus on promoting a diverse
and inclusive cyber workforce, supporting free and open security solutions,and advocating for those that often lack a voice in the security community,
we’re making cybersecurity easier to access for the underserved andunderrepresented.

The foundation supports organizations in the following three key
areas:• We fund and promote STEM education, Diversity, Equity & Inclusion intechnology, and efforts by organizations to make careers in cybersecurity
welcoming to all.
• We develop and promote open source tools and volunteering to help makeeffective cybersecurity solutions available to under-resourced organizations,
including nonprofits and municipalities.
The Rapid7 Cybersecurity Foundation is a 501(c)(3) and set up as a private
foundation. It received $1 million in initial funding from Rapid7, Inc. in 2021, andan additional $500,000 in 2022.
In 2022, the Rapid7 Cybersecurity Foundation was able to form The Rapid7
Cyber Threat Intelligence Lab at University of South Florida with a $1.5 million
investment. This joint endeavor will catalyze new collaborative research efforts
in cyber threat detection and support an inclusive approach to diverse talentdevelopment in cybersecurity. It will also provide USF students the opportunity
for hands-on learning and cybersecurity skills development as well as realworld experience tracking global threat actors..
Purposeful Philanthropy

41

Environmental
Sustainability
Rapid7 wants to create a secure digital future
for all. This challenge is so massive that it
requires people, companies, and governments
working side by side for us to accomplish it
together. The same is true of protecting thefuture of our planet’s environment. At Rapid7,
we embrace environmentally sustainable
practices with our partners and at our offices
around the world to contribute to the global
fight against climate change.

43

Emissions Data

Scope 2: Electricity Consumption• Our near term targets of carbon neutrality are built on our
momentum in tracking, reporting, and ultimately reducing, Scopes
1 and 2 GHG emissions.. Our strategy outlines several pathways toreducing our environmental impact, including reducing our energy
inputs through renewable alternatives in our offices, minimizing ourwaste, and exploring and investing in quality carbon offsets.
• In fiscal years 2019-2022 we have engaged a consultant,
CarbonFootprint, who has expertise in the GHG monitoring field,
to assess our GHG emissions. We are strategically formulating ourbaseline emissions to account for the increase in office usage postCovid 19 closures. Our Scope 1 and 2 emissions data for 2019
through 2021 are included herein.

• We minimize waste sent to landfill through recycling in all locations
and composting of food waste at our headquarters and certain
other Rapid7 offices.

100%

tC02e Per Employee

Carbon Neutral by 2030

• We conduct waste audits at our headquarters and in larger Rapid7
offices to measure waste reduction.
7k

7

6k

• We switched from single use dishware and cutlery to reusable
products, reducing the amount of waste we send to landfills.

6• We measure major greenhouse gas emissions with the aim ofcontinual reduction of carbon-intensive activities, improved energy
efficiencies, and the procurement of renewable energy.

5,081

TC02E (location-baed)• As a software and services company, our carbon footprint and useof water is relatively small. Nevertheless, we believe that climatechange presents a significant environmental and financial risk
to the global economy and we have a collective role to play inprotecting our planet. Our focus on reducing our carbon footprint
is an important component of our ESG approach and we intend tocontribute to the net-zero goals of our customers, investors and oursociety. For that reason, Rapid7 has pledged to achieve 50% carbon
neutrality by 2027 and be carbon neutral by 2030. Additionally, we
intend to make progress toward a net-zero carbon future, on ourpath to carbon neutrality.

Carbon Neutral by 2027

Scope 1: Natural Gas Consumption, Refrigerants

Engagement• We reuse, recycle, and responsibly dispose of electronic waste.
Rapid7 is committed to using third-party vendors that allow us
to recycle our outdated electronics according to internationalguidelines.

50%

Net Total Emissions in tCO2e

The fates of our digital world and our environment will always betied together. Here’s how we’re working today to help protect against
tomorrow’s climate risks.

How we use resources

N E A R T E R M TA R G E T S

5k

5

4k

4

3k

3
2.2

2k
1k

1,664
1.1

2

1,496

1

0.8

0

0
2019

tCO2e Emissions Per
Employee

1.1

2020

TC02E (per employee)

Key Initiatives and Results |Environmental Sustainability

2021

0.8
2.2

• As a provider of software and services, We require negligible water
usage. We do not currently measure the specific amount, but ourbusiness activities require only those of normal office use.

Rapid7 recognizes its largest
environmental impact:• We recognize that our largest environmental impact comes fromhosting our customers’ data.
• Our cloud hosted solutions operate principally on Amazon Web
Services, our partners in cloud computing, which has made acommitment to be run 100% by renewable energy by 2025.

We engaged a third party to help us complete our baseline greenhouse gas (GHG) emissions inventory, including Scope 1 and Scope 2.
As we analyze the results, we are looking at possible reduction opportunities and greater clarity into our Scope 3 emissions as well.
Note: emissions decreased in relative terms in 2020 due to the global pandemic resulting in our offices largely being unoccupied. From 2020 to 2021
we significantly expanded our office spaces globally, which resulted in a material increase in the consumption of electricity. 2021 will be considered a
representative/baseline year for future analysis.

Environmental Sustainability

45

Our offices• We develop goals, practices, and metrics to measure and create more sustainable workplaces at Rapid7 offices globally.
• We rely on video conferencing technology to reduce carbon emissions from non-essential business travel.
• We locate offices near transportation hubs to maximize the number of employees who use public transportation.
• We locate offices in areas with easy, walkable access to a wide range of amenities.
• We use sustainable materials and systems when completing new office builds, as well as retrofitting where appropriate.
TORONTO, CANADABOSTON, MA
ARLINGTON, VA

Environmental Sustainability
AUSTIN, TX

BOSTON, MA

47

Corporate
CitizenshipI

n 2022, in addition to our long-standing focus on social good,as covered above, we continued to advance ESG more broadly
at Rapid7. We assessed our performance against leading

frameworks, including SASB and GRI and industry benchmarks,
identified material priorities, and began to make initial investments.
We hired our first Vice President of ESG, to help drive the programand met periodically with the Nominating and GovernanceCommittee, whose charter includes direct oversight of our ESG
efforts. In 2023, our Board, our leader of ESG and the various
cross functional teams that support the effort will continue to
execute against our ESG priorities, and we will continue to raise
the bar on our various ESG goals and targets.
While we have focused on social good including, diversity, equity
and inclusion, environmental sustainability, and philanthropic
efforts in past years, this is the first time we’ve publicly reported
on our ESG approach in a comprehensive way. This document
contains disclosures of ESG metrics relevant to Rapid7, as wellas those included in the Sustainability Accounting Standards
Board (SASB) standards for the Software & IT Services sector. The
disclosures herein also illustrate how Rapid7 activities align with
the United Nations Sustainable Development Goals (UN SDGs).

Corporate Citizenship49Materiality Assessment & Priorities

Importance to stakeholders

CRITICAL

In 2022, we completed our first materiality assessment.
This enables us to understand the priorities of ourinternal and external stakeholders, and to evaluate
how impactful these topics could be on our business.

External Alignment
The resulting materiality matrix (pictured) guides us
to prioritize the most important ESG areas for ourbusiness and our stakeholders, and helps guide our
ESG roadmap.

We are signatories of the United Nations Global Compact and support and express adherence to the ten principles of theUnited Nations Global Compact related to human rights, labor, environment, and anti-corruption. Furthermore we alignour efforts to the United Nations Sustainable Development Goals. We currently have programs in place that contribute toprogress against many of the SDGs. Rapid7 is also a signatory to the United Nations Women’s Empowerment Principles.
The company has also taken the CEO Action for Diversity and Inclusion Pledge, and is member to the Parity Pledge.

• Expanding Access to Cybersecurity to All• Board Management Oversight andAccountability• Regulatory and Legal Compliance• Operational Resilience & BusinessContinuity• Diversity, Equity, and Inclusion• Data Privacy and Security• Purposeful Philanthropy• Workplace Culture• Pay Equity• Ethical Business Practices• Commitment to Open Source• Advancing Cybersecurity through Public
Policy• Employee Development andEngagement• Competitive Behavior• Carbon Footprint

HIGH• Supply Chain Governance• Community Engagement• Employee Volunteerism

HIGH

CRITICAL

Importance to business successCorporate Citizenship51

GovernanceOur approach to governance at Rapid7 is rooted ina deep commitment to transparency, accountability,
and our core values. Through continual engagement,
we’re working to fully consider the perspectives ofour many stakeholders—both inside Rapid7 as wellas in the cybersecurity and investment communities—
as we realize our vision of a secure and prosperous
digital future for all.

53

Corporate Governance Guidelines
The Board has adopted Corporate Governance Guidelines to assure that the Board will have the necessary authorityand practices in place to review and evaluate our business operations as needed and to make decisions independentof our management. The guidelines are also intended to align the interests of directors and management with those of
our shareholders. The Corporate Governance Guidelines set forth the practices the Board intends to follow with respect
to board composition and selection, board meetings and involvement of senior management, Chief Executive Officer
performance evaluation and succession planning, and board committees and compensation. The Corporate Governance
Guidelines, as well as the charters for each committee of the Board, may be viewed on our investor website.

Key Initiatives and Results |Governance
Updated Code of Business Conduct andEthicsWe’ve updated the Rapid7 employee handbook to include a revised
Code of Business Conduct and Ethics covering policies on antiharassment, whistleblower, anti-corruption, disclosures, insider
trading, business conduct and ethics, and equal opportunity.
The Code of Business Conduct and Ethics is available on our
website, and we believe following our Code of Conduct helps
ensure that we operate with integrity. If we make any substantive
amendments to the Code of Business Conduct, or if we grant any
waiver from a provision of the Code of Business Conduct to any
executive officer or director, we’ll promptly disclose the nature of
the amendment or waiver on our website.

Active Engagement with Shareholders
We value feedback from our shareholders and are committed tomaintaining an active dialogue to understand their priorities andconcerns, particularly around topics of corporate governance,
executive compensation, and environmental/social matters.
We believe that transparency, accountability, and ongoingengagement build mutual trust and understanding with ourshareholders. As part of our shareholder engagement and in
response to the support received for our director elections at ourlast annual meeting, we reached out to our largest shareholders
to gain a better understanding of their views regarding ourcorporate governance policies and practices. Specifically, wereached out to shareholders representing approximately 57%
of our issued and outstanding shares as of December 31, 2022.
We engaged in substantive discussions with over 30% of ourshareholder base.

Ongoing Oversight of ESG by Nominating
and Corporate Governance Committee
To ensure clear oversight of our ESG program, in 2021, theCompany modified the NCGC Charter to explicitly have oversightof our ESG efforts. In 2022, we continued to meet with the NCGC
throughout the year to provide updates to the Committee about
our various ESG efforts, which in turn were communicated to thefull board.

Governance55

Looking Ahead
As we navigate a dynamic macroeconomic environment,
we remain focused on making significant strides acrossall of our social good and ESG initiatives.

Looking Ahead

57

2022 Social Good Highlights• 29% of our US-based employees are women and 24% are people of color as we enter 2023*• Diverse, equitable, and inclusive hiring practices recognized by the Bloomberg Gender Equality
Index• Transformative expansion into new communities including Tampa, FL• Successful advocacy to ensure legal protections for security researchers like those found in therevised DMCA Section 1201
• Continue to support critical open source projects like Metasploit, Velociraptor and Recog,
allocating millions to maintaining these projects for the purpose of advancing cybersecurity
for all.
• Formed the Rapid7 Cyber Threat Intelligence Lab at the University of South Florida by way of$1.5 million grant to catalyze new collaborative research efforts in cyber threat detection andsupport an inclusive approach to diverse talent development in cybersecurity.
• Developed an ESG Materiality Matrix to provide focus and transparency around the company’s
ESG efforts.
• Completed third-party audit of our carbon footprint, and continued to focus efforts to drive ourenvironmental efforts on a path toward net zero.
• Established Carbon Footprint targets of 50% carbon neutrality by 2027 and carbon neutral by2030.
• Increased levels of shareholder engagement, with continued oversight and review of our ESG
efforts by the Nominating and Corporate Governance Committee.
We’re proud of the progress we’ve made, encouraged by the contributions of our employees,
customers, and shareholders, and energized to do so much more.

*Based on self-reported data as of 12/31/2022

Looking Ahead

59

2023 and Beyond
In 2023, we’ll keep pioneering new ways to empower people—at our company,
in cybersecurity, and in our communities. We’ll never stop holding ourselves
accountable as we transform the makeup of our industry to better reflect our
vibrant world.
We’ll continue to embrace our role and responsibility as leaders advancing
cybersecurity through our advocacy, commitment to open source, collaboration
to tackle the world’s most pressing threats, and financial support for causesthat make all people more secure.
We’ll make new commitments in the areas of carbon neutrality, waste reduction,and renewable energy to combat climate change and protect the future of ourenvironment.
These initiatives are about more than checking boxes—they’re the embodimentof our passion. As the challenges we face grow, as our company grows, and as
the role of cybersecurity in society grows, our deeply held belief in our vision for
the future will keep inspiring us to scale with soul.
Our hope is that our pioneering approach to Diversity, Equity & Inclusion
empowers our own employees, and that our continuing transparency creates agold standard and clear blueprint that all of cybersecurity can look to. And wehope our continued commitment to sharing and collaborating inspires the restof our industry to do the same.
We’ve already come a long way, but our work for social good is “Never Done.”The best is still ahead. We’re excited to partner with people and organizations
across the globe to make our vision a reality. Together we’ll make the world abetter, safer place and create a secure digital future for all.

Looking Ahead

61

SASB Reporting Metrics
Rapid7 is committed to sharing ESG information with investors and other stakeholders. Unless otherwise noted, data anddescriptions are current as of the end of our fiscal year 2022.

Code

Accounting Metric(1) Total energy consumed, (2) percentage gridelectricity, (3) percentage renewable

GHG-related statistics in the Environmental Footprintindex.

TC-SI-130a.2(1) Total water withdrawn, (2) total water consumed,
percentage of each in regions with High or ExtremelyHigh Baseline Water StressOutside of normal employee water usage in our offices,
Rapid7’s operations do not require water withdrawal or
consumption.

TC-SI-130a.3

Discussion of the integration of environmental
considerations into strategic planning for data center
needs

AWS, our primary cloud-computing data center, hascommitted to powering their operations with 100%
renewable energy by 2025 and achieving net-zero carbon
across all operations by 2040.

Location and/or information
Data Security

TC-SI-230a.2

TC-SI-220a.1

Description of policies and practices relating tobehavioral advertising and user privacy

Rapid7 Privacy Policy

TC-SI-220a.2

Number of users whose information is used forsecondary purposes

Rapid7 Privacy Policy

TC-SI-220a.3

Total amount of monetary losses as a result of legal
proceedings associated with user privacy

There have been no material monetary losses associatedwith any legal proceedings, including any proceedings
related to user privacy or anticompetitive behavior
regulations or significant instances of non-compliancewith laws and regulations during this reporting period.
(Please see “Legal Proceedings” sections in our latest
10-Q and 10-Ks filed with the SEC.)

List of countries where core products or services are
subject to government-required monitoring, blocking,content filtering, or censoring

Description of approach to identifying and addressing
data security risks, including use of third-party
cybersecurity standards

Rapid7 Trust Page

Recruiting & Managing a Global, Diverse & Skilled Workforce
TC-SI-330a.1

Percentage of employees that are (1) foreign nationals
and (2) located offshore

The Human Capital section of the company’s Annual
Report (10k) notes that as of 12/31/2022 we had 2623
full time employee of which 951 (36%) were locatedoutside of the United States.

TC-SI-330a.2

Employee engagement as a percentage

Please see the “Social Good” section.

TC-SI-330a.3

Percentage of gender and racial/ethnic grouprepresentation for (1) management, (2) technical staff,and (3) all other employees

Please see demographics within the “Social Good”
section.

Data Privacy & Freedom of Expression

TC-SI-220a.5

Accounting Metric

Location and/or information
Environmental Footprint of Hardware Infrastructure

TC-SI-130a.1

CodeIntellectual Property Protection & Competitive Behavior
TC-SI-520a.1

Total amount of monetary losses as a result of legal
proceedings associated with anticompetitive behavior
regulations

There have been no material monetary losses associatedwith any legal proceedings, including any proceedings
related to user privacy or anticompetitive behavior
regulations or significant instances of non-compliancewith laws and regulations during this reporting period.
(Please see “Legal Proceedings” sections in our latest
10-Q and 10-Ks filed with the SEC.)Managing Systemic Risks from Technology Disruptions
TC-SI-550a.1

Number of (1) performance issues and (2) service
disruptions; (3) total customer downtime

Rapid7 Status Page

TC-SI-550a.2

Description of business continuity risks related todisruptions of operations

Rapid7 Trust Page

None.

Looking Ahead

63