Rapid7 has launched Rapid7 Intelligence, a unified threat-intelligence engine that fuses threat intelligence, vulnerability research, and the 13-year legacy of Rapid7 Labs into a single system designed to move enterprise defenses from reactive monitoring to proactive prevention.
The Boston-based cybersecurity company, listed on Nasdaq as RPD, announced the launch on October 2.
The pitch is that static indicators of compromise — the IP addresses and file hashes filling traditional threat feeds — expire faster than defenders can act, while attacker behavior stays recognizable.
With AI compressing exploitation windows to minutes and 8,539 critical vulnerabilities tracked in the second quarter alone, Rapid7 says attackers are already using automation to scale phishing, reconnaissance, and script development.
Its answer is an engine that watches those behaviors in real time and turns them into AI-powered actions that anticipate and disrupt attacks before they execute.
Indicators expire, behavior doesn't
"Static threat intelligence isn't completely dead — it's just sitting in standard dashboards doing what it's always done, giving organizations a false sense of security while autonomous threat agents burn down their perimeters," said Christiaan Beek, vice president of Rapid7 Intelligence.
Beek argued the differentiator is not stockpiling raw feeds but curating vetted intelligence focused on true signals.
"Rapid7 Intelligence isn't built to generate another 50-page PDF report for security teams to ignore; it aggressively converts real-time operational adversary insight into a proactive, preemptive shield," he said.
A hidden Linux malware ecosystem at the network edge
To illustrate the engine in action, Rapid7 pointed to new research in which its analysts uncovered a modular Linux malware ecosystem targeting telecom and network-edge devices — new BPFDoor variants, BPF Rekoobe, droppers, and AVERAT implants.
Researchers identified two campaigns linked by a common focus on the network edge.
By analyzing their shared behaviors, the team uncovered an emerging pattern: threat actors using SMTP to blend into a victim's DMZ, targeting mail security appliances, and maintaining long-term access.
The new BPFDoor variants suggest the malware family is evolving into an ecosystem where each sample is tailored to the telco plane — control, management, or data — it targets, with actors apparently knowing exactly which software runs at each layer.
Protection, unification, and open research
Rapid7 Intelligence is built around three deliverables.
The first, "Immediate Protective Force," pipes frontline intelligence directly into Rapid7's products, managed detection and response, and exposure management to neutralize adversary infrastructure before attacks run.
The second, a "Unified Intelligence Engine," embeds threat intelligence, vulnerability analysis, and engineering inside the products customers already run, rather than shipping reports teams must translate into action themselves.
The third, "Uncompromised Community Arsenal," keeps critical advisories, vulnerability research, and exploitation insights open — building on the legacy of Metasploit and Rapid7 Labs — so the wider industry can push back too.
"In a world of infinite telemetry and automated attacks, playing defense with traditional tools is an exercise in futility," said Mel Stone, Rapid7's chief global services officer.
"By fusing machine-scale observation with frontline human expertise, we turn raw threat data into immediate, actionable intelligence — empowering security teams to disrupt adversaries before they establish a foothold."
The launch lands in a crowded year for AI-driven security operations.
Rapid7 has spent 2026 positioning its Command Platform as an open, AI-enriched system serving more than 11,500 customers, and Rapid7 Intelligence is now its central research engine.
Whether behavior-based defense can keep pace with the same AI automation now arming attackers is the test every vendor faces — Rapid7's bet is that curated, expert-validated behavior data beats another dashboard of expiring indicators.
