We recently published our article Top 5 Best Cybersecurity Micro-Caps to Watch in 2026. This article looks at where Rapid7 Inc. (NASDAQ:RPD) fits as cloud and SaaS data security demand rises and investors hunt for sub-$5B cybersecurity winners.
Valuation has quietly reentered the market conversation at a time when many investors least expected it. After several years in which price momentum, thematic investing, and speculative growth dominated headlines, a growing number of market participants are once again screening for cheap stocks and low P/E stocks that trade at meaningful discounts to their underlying earnings power. This shift has not been driven by panic or crisis, but rather by fatigue with stretched valuations and an increasing emphasis on cash flow, balance sheet discipline, and durable business models. In many portfolios, the “multiple you pay” is starting to matter again, especially when the margin for error is thin and investors are demanding proof rather than promises.
What makes this period unusual is that the market is not behaving like a single unified story. Instead, it has become a collection of mini-markets. A small cluster of high-multiple names continues to attract outsized attention, while a much larger portion of the investable universe trades as if growth is permanently capped. That divergence has created a widening lane for undervalued stocks, particularly those with steady earnings, tangible cash generation, and the kind of predictability that tends to regain popularity when investors become more selective.
Why Cheap Stocks Are Showing Up in More Screens Again
Strategists following sector rotation trends have pointed out that valuation dispersion remains unusually wide. Capital has continued to chase a narrow group of high-multiple names tied to emerging technologies and narrative-driven growth, but this has left behind many profitable businesses that are still executing in the real economy. The result is that cheap P/E ratios are no longer limited to distressed companies or structurally broken industries. More frequently, low forward P/E stocks now include firms with recurring revenue streams, stable end markets, or clear capital return policies that have simply fallen out of favor.
This is the type of setup that tends to trigger broader screening behavior. When investors notice that quality companies are trading at discounted multiples, the next step is usually to ask whether the market is mispricing risk or simply ignoring improvement. That question alone is often enough to bring “best cheap stocks to buy right now” back into the research pipeline, especially for managers who need exposure outside the most crowded trades.
The Interest Rate Lens That Keeps Repricing Multiples
Interest rate expectations have played a central role in this dynamic, and they continue to shape how investors interpret valuation. As inflation pressures show signs of moderation and productivity improvements become more visible across the economy, analysts have increasingly discussed the possibility that restrictive monetary policy may not remain in place indefinitely. Even modest shifts in rate expectations can have an outsized impact on valuation models, particularly for companies with steady earnings and predictable cash flows.
When discount rates stabilize or drift lower, the market often becomes more willing to assign higher multiples to cash flows that appear durable. At the same time, when rates remain elevated, investors often prefer stocks that are already priced conservatively. Either way, low forward earnings multiples can act as a buffer, because they require less “multiple expansion” to generate respectable returns. This is one reason forward P/E has become a popular shortcut for identifying cheap stocks, especially when the market is still debating the path of rates.
Sector Rotation Is Quietly Shifting the Hunting Grounds
Sector by sector, this valuation reset has manifested in different ways, and the differences matter. In healthcare, portions of the sector continue to benefit from non-cyclical demand and pricing resilience, yet still trade at earnings multiples more commonly associated with mature or declining industries. In communications and infrastructure-heavy sectors, high capital intensity and regulatory overhangs can weigh on sentiment even when cash generation is steady. In software and digital services, the market’s skepticism around growth normalization can overshadow improving margins and free cash flow conversion. In industrial and consumer-linked sectors, macro uncertainty can mask company-level execution, operational improvement, and shareholder return programs.
What ties these sectors together is not that they are collapsing. It is that their valuations often reflect an assumption that good news will not last or that improvement will not translate into durable earnings. When sectors fall out of favor, the market sometimes prices in a permanent handicap. That is where valuation gaps can form, and where low P/E stocks can begin to stand out again.
Perception Versus Performance Is Creating Price Gaps
What stands out in the current market is how often price movements reflect perception rather than performance. Many companies now classified as cheap stocks have continued to meet or exceed earnings expectations, strengthen balance sheets, and return capital to shareholders, yet their valuations imply limited future upside. This kind of disconnect tends to happen when investors are focused on what could go wrong rather than what has been going right.
Professional investors, especially those with longer time horizons, often treat valuation as a margin of safety rather than a timing tool. When they see durable earnings trading at compressed multiples, the natural question becomes whether the stock is priced for a downturn that may already be reflected in fundamentals, or whether the business is quietly improving while the market remains distracted. This is why forward P/E ratios and earnings durability have become increasingly important screening criteria. They do not guarantee outperformance, but they help narrow the field to companies where expectations appear unusually low relative to current results.
What “Cheap” Actually Means in This Market
In practice, “cheap” does not simply mean low price. It usually means the market is offering an earnings stream at a discounted multiple compared with peers, history, or the broader index. That is why forward earnings multiples tend to be used more than trailing multiples in screening work. Forward P/E is a shorthand for how the market is pricing the next year of expected profitability, and it can reveal where skepticism is embedded.
It also helps explain why cheap stocks often come in clusters. If an entire sector is viewed as out of favor, multiples compress broadly, even for the strongest operators. If a business is executing but the market is still anchored to an older narrative, the valuation may lag. When the story changes faster than the market’s perception, the valuation gap becomes the opportunity.
Why This Leads Naturally to a “Best Cheap Stocks” Shortlist
Against this backdrop, compiling a list of the 5 Best Cheap Stocks to Buy Right Now is less about making bold predictions and more about identifying where valuation, fundamentals, and market expectations are misaligned. These opportunities tend to emerge when sectors fall out of favor not because of structural decline, but because attention has shifted elsewhere. History suggests that such periods often precede meaningful re-rating cycles, especially when broader market conditions begin to stabilize.
This is also why a shortlist approach matters. Not every low multiple stock is undervalued, and not every discounted company is cheap for the right reasons. The goal is to isolate situations where the business has measurable earnings power, credible cash flow generation, and enough visibility for forward expectations to be judged rationally. When those boxes are checked, a low forward multiple becomes more meaningful as a signal rather than a warning.
Setting the Stage for the 5 Best Cheap Stocks to Buy Right Now
In an environment where uncertainty remains elevated but fundamentals continue to assert themselves, cheap stocks with proven earnings power stand out as a distinct segment of the market worth close examination. With valuation once again playing a central role in portfolio construction, the focus naturally turns to identifying which names offer the most compelling combination of low forward multiples, financial resilience, and potential upside if expectations normalize.
That framework sets the stage for reviewing the 5 Best Cheap Stocks to Buy Right Now, a group defined not by hype or narrative momentum, but by the simple reality that the market is still offering some earnings streams at prices that look unusually conservative relative to their fundamentals.
CHECK THIS OUT: Why Governments Are Betting on Secure Chips Instead of Software — SEALSQ Corp (LAES) Explained and Why QuantumScape (QS) Keeps Disappointing Traders but Fascinating Long-Term EV Investors.
Our Framework
To identify the 5 Best Cheap Stocks to Buy Right Now, the analysis focused on publicly traded companies listed in the United States that meet a clear set of quantitative and coverage based criteria. The initial screen required a minimum market capitalization of approximately $2 billion to ensure sufficient liquidity and institutional relevance. Companies were also required to be covered by at least three sell-side analysts, providing a baseline level of market scrutiny and earnings visibility. Finally, the shortlist was narrowed to stocks trading at forward price to earnings multiples below 15x, reflecting a valuation profile that is meaningfully below broader market averages while still supported by ongoing profitability.
YOU MUST READ THIS!!! – 5 Best Cheap Stocks to Buy Right Now
Top 2: Rapid7 Inc. (NASDAQ:RPD)
Market Cap: $700 M
Calling Rapid7, Inc. a high-growth cybersecurity stock in 2026 can sound controversial if you focus only on the metric that spooked investors: annualized recurring revenue (ARR) was flat at roughly $840 million in the fourth quarter of 2025. Flat ARR naturally raises the most important question in cybersecurity investing: is the company struggling to add new customers, expand within existing accounts, or defend its footprint against bigger platform competitors. That concern is real, and the market is right to take it seriously. But the bullish thesis for Rapid7 is not that ARR is already accelerating again. The bullish thesis is that Rapid7 is deliberately optimizing its business around platform consolidation, measurable security outcomes, and durable profitability, and that this transition can create a temporary “growth pause” that later turns into a better-quality, more defensible growth engine.
In other words, Rapid7’s story in 2026 is not simply about being a “high growth stock” in the traditional sense. It is about being a cybersecurity company with a credible path to re-accelerate without sacrificing free cash flow, while modernizing its platform to match where attacks are happening now: cloud workloads, applications in production, and real-time runtime threats. If you’re searching for the best cybersecurity stocks to buy with a balance of growth potential and financial durability, Rapid7 deserves attention because it is aligning its strategy with the three biggest buyer trends in the security operations market: tool consolidation, exposure-based prioritization, and faster incident detection and response.
Rapid7’s Q4 2025 Earnings Beat Shows Execution and Margin Discipline
Rapid7 reported its fourth-quarter 2025 results on February 10, delivering earnings per share of $0.44, which came in above Wall Street expectations, and revenue of about $217.39 million, which narrowly topped consensus estimates. Those numbers matter because they show the company can still deliver quarter-to-quarter execution even while it is reshaping its go-to-market approach and platform focus. Many cybersecurity companies can talk about product vision. Fewer can consistently land above expectations and protect margins when growth is uneven.
The more important context is that Rapid7 is not presenting itself as an “all gas, no brakes” growth story. It is presenting itself as a disciplined cybersecurity platform business. That matters in the current market environment, where investors have become less tolerant of pure narrative and more focused on operating leverage, recurring revenue quality, and real free cash flow. Rapid7’s profitability profile signals that it has room to invest in product expansion and partnerships without depending on constant dilution, which is a key advantage versus smaller or less efficient high-growth cybersecurity names.
ARR Held Steady, But ARR Per Customer Tells a More Bullish Story
ARR holding steady around $840 million is the biggest headline risk in the Rapid7 story because ARR is the heartbeat of subscription cybersecurity companies. When ARR stalls, investors immediately assume weaker new customer acquisition, softer upsells, or higher churn. Rapid7’s stable ARR invites skepticism, and it is rational for analysts to question whether the company is gaining enough momentum in customer adds and account expansion.
But there is a key internal quality signal that supports a bullish thesis: Rapid7’s ARR per customer has risen substantially over the past few years, increasing to roughly $72,000 from around $58,000 in 2021. That shift matters because it suggests Rapid7 is increasing wallet share in the accounts it retains. In practical terms, customers are buying more modules, expanding usage across more teams, or standardizing more security workflows on the platform. This is often what happens when a cybersecurity vendor becomes more “platform-like” rather than remaining a collection of point solutions.
The bullish interpretation is not that Rapid7 has already solved growth. The bullish interpretation is that Rapid7 is improving the depth and value of its customer relationships, and that the company can later turn that improved account economics into renewed ARR growth once packaging, positioning, and product consolidation become simpler to buy and easier to adopt.
Rapid7’s 2026 Guidance Looks Conservative, and That Can Create Upside
For 2026, Rapid7 guided to first-quarter revenue of about $207 to $209 million and full-year revenue of about $835 to $843 million, implying slightly lower revenue than 2025. ARR is expected to decline to around $830 million, while profitability remains solid, with operating income projected around $108 to $116 million and free cash flow projected around $125 to $135 million. On the surface, that guidance reads like a company bracing for a difficult year. And for investors who only want accelerating top-line growth, it can look like a reason to avoid the stock.
But conservative guidance can also create a powerful setup for outperformance. In many software and cybersecurity names, the biggest stock moves happen when expectations are low and execution is steady. If Rapid7 maintains profitability, protects free cash flow, and shows even early signs of ARR stabilization, sentiment can shift quickly. A company does not need to be the fastest-growing cybersecurity platform in the market to deliver strong returns. It needs to be a credible platform vendor with improving unit economics and a realistic path to re-accelerate.
The other reason this matters is strategic flexibility. Strong free cash flow and operating income allow Rapid7 to keep investing in product innovation, threat detection improvements, partner integrations, and cloud security capabilities even while it is tightening operational efficiency. That “self-funding” capability is rare enough in cybersecurity that it can be an advantage when competition intensifies.
Platform Consolidation Is a Major Cybersecurity Trend, and Rapid7 Is Leaning Into It
Cybersecurity buyers are facing tool sprawl, alert fatigue, and staffing shortages in the security operations center. Most organizations do not want more dashboards. They want fewer tools that deliver clearer, prioritized actions and faster response. This is why platform consolidation has become one of the most important trends in cybersecurity, especially in exposure management, SIEM modernization, XDR workflows, and incident detection and response.
Rapid7’s strategy aligns with this trend through platform consolidation and operational efficiency. Instead of competing as a single-purpose product vendor, Rapid7 is positioning itself as a cloud-native security platform that unifies vulnerability management, detection and response, threat intelligence, and security operations workflows. The goal is not to win on buzzwords. The goal is to help security teams connect exposure data to real threats, prioritize what matters, and respond quickly with less manual work.
From an SEO perspective, this is where the Rapid7 thesis connects strongly with what people actually search for: vulnerability management software, cloud security platform, SIEM and XDR solutions, security operations center tools, incident response automation, threat intelligence, exposure management, and attack surface visibility. Rapid7’s product direction is targeted at the buyer problem behind those keywords: reducing risk faster with fewer tools.
The ARMO Partnership Strengthens Cloud Runtime Security and Real-Time Threat Detection
A major bullish catalyst mentioned in your notes is the partnership Rapid7 announced on January 14 with ARMO. The purpose is to add cloud and application runtime security to the Rapid7 Command platform, improving visibility into cloud environments, strengthening threat detection, and giving IT teams clearer, prioritized insights that support faster response. The integration also aims to allow security teams to detect active threats in real time and respond instantly by isolating compromised workloads.
This matters because cloud security is evolving. It is no longer enough to know what is misconfigured or theoretically vulnerable. Security teams want to know what is actively being exploited right now and what needs to be stopped immediately. Runtime security is increasingly central to modern cloud defense because it captures what is happening in real time inside running workloads, containers, and applications. That is where many high-impact breaches originate, and it is where time-to-detection and time-to-response are the difference between containment and catastrophe.
For Rapid7, the ARMO partnership is important because it strengthens the platform’s relevance in cloud-native environments and can become a practical upsell driver. If Rapid7 can tie runtime security signals into exposure management and detection workflows, it can deliver a more complete story: not just “what could be risky,” but “what is risky right now,” prioritized with context and paired with response actions. That is a compelling value proposition for customers under pressure to improve cloud security posture without adding more headcount or more disconnected tools.
Rapid7’s Competitive Position: Broad Capabilities, Real Customers, Real Use Cases
Rapid7 operates across several major cybersecurity categories: vulnerability management, incident detection and response, application security, cloud security, SIEM-like analytics, and threat intelligence. It serves over 11,500 customers and integrates with a large partner ecosystem, which matters because security operations is inherently ecosystem-based. A modern SOC depends on integrations across cloud providers, identity platforms, endpoints, ticketing systems, and threat intelligence feeds. Vendors that integrate well tend to become stickier, because replacing them means breaking workflows.
Rapid7’s thesis becomes stronger when you think like a security buyer rather than a stock trader. Buyers want fewer tools that connect smoothly and drive measurable outcomes. If Rapid7 continues to improve platform consolidation, simplify packaging, and increase the “time to value” customers get from deployment, the company can strengthen retention, increase expansion, and regain a healthier growth profile.
The market it is targeting is large: security operations spending continues to expand as organizations respond to ransomware, cloud breaches, identity attacks, and application-layer threats. Rapid7’s strategy is essentially to be a practical, outcomes-driven platform in that expanding market rather than a niche, single-product vendor.
What Would Make the Rapid7 Bullish Thesis Win in 2026
The Rapid7 bullish thesis becomes compelling when you define what success actually looks like. First, the company needs to stabilize ARR and show signs that account expansion is becoming more consistent again, even if growth remains modest. Second, Rapid7 needs to keep pushing ARR per customer higher, because that is a direct signal that platform consolidation is working inside existing accounts. Third, the company needs to show that cloud runtime security and modern cloud threat detection workflows are not just marketing, but a real adoption driver tied to measurable customer outcomes. Fourth, Rapid7 needs to sustain profitability and free cash flow, because that is what gives it the strategic freedom to compete and invest without sacrificing shareholder value.
If those four elements come together, Rapid7 can re-rate as a stronger “efficient growth” cybersecurity stock even without returning to hypergrowth. In that scenario, the company’s value is not based on hope. It is based on recurring revenue durability, deeper customer relationships, and a platform that matches how security teams operate in 2026.
Risks That Can Break the Thesis
Rapid7 is not risk-free, and the risks are straightforward. If ARR continues to stagnate or declines more than expected, the market will assume platform consolidation is not converting into momentum. If customer acquisition remains weak and expansion slows, ARR per customer could plateau, removing a key bullish datapoint. If cloud runtime security fails to turn into a meaningful differentiator, Rapid7 could struggle to stand out in a crowded cloud security landscape. Competitive pressure from larger platform vendors is also real, especially in categories like SIEM modernization and XDR-adjacent workflows where buyers are comparing many tools.
There is also execution risk in any consolidation strategy. When companies simplify platforms and prioritize efficiency, they must maintain customer success quality and product innovation at the same time. If they cut too aggressively or fail to improve product experience, retention can suffer. Rapid7’s ability to keep delivering measurable outcomes for customers is the core defense against those risks.
Bottom Line: Rapid7 as a High-Upside Cybersecurity Stock with “Efficient Growth” Potential
Rapid7’s bullish thesis in 2026 is not that it is already in a perfect growth phase. The thesis is that the company is building a stronger foundation for durable cybersecurity platform growth by focusing on operational efficiency, platform consolidation, and measurable security results, while maintaining strong profitability and free cash flow. The Q4 2025 earnings beat shows execution. The flat ARR headline creates skepticism, but rising ARR per customer suggests expanding platform value within existing accounts. Conservative 2026 guidance may look cautious, but it also lowers expectations and creates room for upside if execution remains steady and ARR stabilizes. The ARMO partnership adds a meaningful cloud runtime security angle that aligns with where attacks are happening and where security budgets are increasingly directed.
For investors searching for cybersecurity stocks to buy that can balance platform relevance, cloud-native security evolution, vulnerability management strength, incident detection and response capabilities, and real free cash flow, Rapid7 is a name that can surprise to the upside if it proves that this transition year is setting up the next cycle of healthier ARR growth.
READ ALSO: The Quiet Semiconductor Disruptor You’ve Never Heard Of: Aeluma Inc (ALMU) and Air Industries Group (AIRI) Narrows Losses to Just $44K — Is This Aerospace Microcap Entering a Turnaround Phase?
Disclosure: No material interests to disclose. This article was originally published on Global Market Bulletin.
