JPMorgan Chase CEO Jamie Dimon thinks cyber risk is up 10-fold...
In a recent interview with Bloomberg TV, Dimon blamed one AI model for it... Claude Mythos Preview.
Mythos comes from Anthropic, the AI company behind the Claude chatbot. In April, Anthropic said the model had found thousands of serious flaws in common operating systems and web browsers.
In one case, Mythos discovered a flaw that sat undetected for 16 years in a piece of video software. That line of code had been executed 5 million times without getting flagged.
Rather than release Mythos to the public, Anthropic let a small group of partners use it to fix their own systems.
Wall Street panicked immediately that AI could upend the cybersecurity industry. After all, if AI can find flaws that security firms are missing, these firms may become obsolete without it. Cybersecurity stocks plunged as a result.
Back in April, we explained that Mythos would split this sector into winners and losers. We pointed to cybersecurity giants Palo Alto Networks (PANW) and CrowdStrike (CRWD) as winners, as they got early access to the model. Both have roughly doubled this year.
The rest of the sector has roared back, too. The First Trust Nasdaq Cybersecurity Fund (CIBR) is up 40% in the same span.
But one cyber company that should benefit from Mythos got left behind... Boston-based Rapid7 (RPD) fell as much as 67% this year. Even after a rebound, its shares are still down 6.9%.
As we'll explain today, the market sorted cyber stocks into Mythos winners and losers... and put Rapid7 in the wrong pile.
Rapid7 got its start finding software flaws...
Every piece of software has them. That's what "vulnerability management" tools are for... They scan a company's computers, servers, and apps for weaknesses. Then they rank which ones are most dangerous, so the IT team knows what to patch first.
That ranking matters because no IT team can fix everything at once.
Today, Rapid7 sells vulnerability-management tools as part of its "exposure management" products. It also specializes in "detection and response," which watches for intruders who have already gotten in.
Investors sold off Rapid7 en masse because they bet that AI has the potential to do both of these tasks for free. In July, investment bank Morgan Stanley even cut Rapid7 to "underweight," citing new AI-based rivals as a key concern.
But finding flaws faster makes fixing them more urgent...
Rapid7's own research shows that, earlier this year, exploiting software flaws overtook social engineering as hackers' top way in. (Social engineering means tricking employees, like with phishing e-mails.)
Flaws were the entry point in 38% of the break-ins Rapid7 investigated in the first quarter. Social engineering accounted for 24%.
Hackers are moving faster, too. Rapid7's latest report found that these cybercriminals exploited high-severity flaws within three days, on average.
Mythos makes that problem worse. An AI that finds thousands of new flaws doesn't patch any of them... It leaves companies with a growing list of vulnerabilities to sort through while hackers race to exploit them.
That means companies will need help deciding which flaws pose the biggest risk and which to fix first. That's exactly the problem Rapid7 addresses with its vulnerability-management tools.
The business has been earning strong returns...
Rapid7's Uniform return on assets ("ROA") has been 19% in each of the past three years. That's up from 14% in 2021 and 2022.
And new leadership is cleaning house. Wael Mohamed, the former CEO of device-security company Forescout, took over as Rapid7's CEO on June 1.
Just two months later, Rapid7 cut about 12% of its workforce to focus on its core products. It also raised its full-year operating-income forecast to at least $129 million, up from as little as $112 million a quarter earlier. Yesterday, the stock closed 20% above its previous price.
Despite the positive developments, investors expect the worst for Rapid7...
They believe its Uniform ROA will drop to 15% this year and 16% in 2027. That's understandable, partly because sales are shrinking... Rapid7 expects revenue to fall about 2% this year.
However, that doesn't justify the market's extremely negative long-term expectations...
We can see this through our Embedded Expectations Analysis ("EEA") framework.
The EEA starts by looking at a company's current stock price. From there, we can calculate what the market expects from the company's future cash flows. We then compare that with our own cash-flow projections.
In short, it tells us how well a company has to perform in the future to be worth what the market is paying for it today.
As you can see, investors expect Rapid7's Uniform ROA to fall to just 8% by 2030. Take a look...
An 8% ROA is less than half what the company has earned in recent years. It would also be Rapid7's lowest return since first turning profitable on a Uniform basis in 2019.
In other words, investors are pricing the cybersecurity firm as if AI will gut its business.
Mythos hasn't sounded the death knell for Rapid7...
Yes, the AI model can find more flaws, faster. But that doesn't mean Rapid7 is doomed... If anything, it means the company will be more essential than ever in helping customers manage cyber threats.
Of course, Rapid7 isn't immune to falling sales, and the new CEO still has to turn that around. The telltale sign will be whether the company's subscription revenue, which is a major chunk of its sales, stops shrinking over the next two quarters. That'll show whether their customers are sticking around or not.
But Rapid7 doesn't need a miracle to stay afloat. It doesn't even have to grow its returns to win... It only needs to hold them near where they are today... roughly double what the market is pricing in.
So the next time an AI scare splits a sector into winners and losers, don't blindly follow the crowd. Instead, think about whether the "loser" will become more necessary in the future.
Because when it comes to Rapid7, AI could actually help its business in the long term.
Regards,
Joel Litman
October 27, 2026
