Rapid7 and ARMO Enable Organizations to Stop Cloud Attacks Earlier with Runtime Security

New runtime security capabilities reduce cloud risk faster and help security teams respond to active threats with confidence

BOSTON — January 14, 2026 — Rapid7, Inc. (NASDAQ: RPD), a leader in threat detection and exposure management, announced a strategic partnership with ARMO, the creators of the open-source cloud-native security platform Kubescape and Cloud Application Detection & Response (CADR) innovator, to bring full cloud and application runtime security to the Rapid7 Command Platform. This partnership marks the continued evolution of Rapid7’s industry-leading approach to exposure management. With added cloud runtime visibility augmenting the broad attack surface coverage provided by Rapid7 today, organizations can reduce risk earlier, operate more efficiently, and build true cyber resilience.

Modern cloud attacks often exploit small, interconnected gaps across dynamic cloud environments. By adding continuous anomaly detection and real-time threat detection and response (D&R) across active cloud assets and workloads, this new offering gives security, development, and

IT teams unified, threat-prioritized insight and faster response.

“By extending our exposure management leadership with runtime from ARMO, we’re giving organizations clearer visibility, faster response, and better security outcomes,“ said Corey Thomas, CEO at Rapid7. “This is another important step in our commitment to delivering unified, open security with exposure context that enables security teams to move from reactive defense to preemptive response.”

By bringing true CADR to the Rapid7 Command Platform, Rapid7 now enables security teams to:

• Detect active threats in real time with live attack awareness from application-level to cloud-level threats, API attacks, data exfiltration, and container breakout attempts.
• Correlate runtime events with misconfigurations, vulnerabilities, and identity risks to provide a single view of risk and active attacks to unlock faster and more precise response.
• Respond instantly by isolating compromised workloads or terminating malicious processes to stop lateral movement.
• Seamlessly integrate detection and response workflows with existing AWS, Azure, and multicloud environments.

“Our team built ARMO to bring the most advanced runtime-powered, open-source first, behavioral Cloud Runtime Security to every Kubernetes and cloud-native environment,” said Shauli Rozen, co-founder and CEO of ARMO. “Rapid7 shares that philosophy. By combining their breadth—across exposure management, detection and response, and cloud security—with our runtime security technology, we are delivering the most advanced cloud defense solution that is both modern and practical. Together, we’re helping organizations detect real attacks as they happen and protect the infrastructure their businesses rely on.”

“As enterprises face increasingly fragmented and complex cloud threats, the need for full visibility across all cloud environments continues to be paramount. Rapid7’s partnership with ARMO helps to meet that market need by connecting the dots between proactive exposure management and real-time threat detection & response,” said Philip Bues, senior research manager, IDC Security and Trust. “This addition to Rapid7’s capabilities enables security teams to better correlate exposures with active threats and prioritize remediation based on operational risk, supporting both security objectives and business continuity.”

To learn more about how this new cloud runtime security capability, as part of Exposure Command Ultimate, helps organizations reduce risk faster and build resilience against modern attacks, visit https://www.rapid7.com/products/command/exposure-management/.