Rapid7 launches Rapid7 Intelligence: an AI-powered threat engine that hunts attacker behavior, not indicators

Rapid7 announced today the launch of Rapid7 Intelligence — a unified engine designed to move enterprise threat defense from reactive monitoring to proactive prevention. It combines the company’s threat intelligence, vulnerability research, and the 13-year legacy of Rapid7 Labs, converting insights on attacker behavior into AI-powered action meant to anticipate and disrupt attacks.

The framing is aimed squarely at the agentic era. Rapid7 says AI has compressed exploitation windows to minutes, while the company tracked 8,539 critical vulnerabilities in Q2 alone — and attackers are using automation to scale phishing, reconnaissance, and script development faster than dashboard-based, indicator-fed defenses can keep up.

“Indicators expire. Behavior doesn’t”#

The launch thesis is that static indicators of compromise decay too fast to be the backbone of defense, especially when “autonomous threat agents” are the adversary. The engine monitors threats in real time and turns attacker behavior into scalable protection — curated, expert-validated signals instead of raw feeds.

“Static threat intelligence isn’t completely dead — it’s just sitting in standard dashboards doing what it’s always done, giving organizations a false sense of security while autonomous threat agents burn down their perimeters,” said Christiaan Beek, vice president of Rapid7 Intelligence. “The real differentiator isn’t hoarding more raw feeds; it’s having curated, vetted intelligence focused relentlessly on true signals rather than waiting around for alerts to trigger after the damage is done.”

Proof case: a hidden Linux malware ecosystem#

Rapid7 put a concrete finding behind the launch. Its researchers uncovered a modular Linux malware ecosystem — spanning new BPFDoor variants, BPF Rekoobe, droppers, and AVERAT implants — actively targeting telecom and network-edge devices. Two campaigns, linked by their focus on the network edge, were correlated through shared behaviors: the emerging pattern uses SMTP to blend into the victim’s DMZ, targets mail security appliances, and maintains long-term access.

The BPFDoor family is evolving into a per-plane ecosystem, Rapid7 says: each sample tailored to the telco plane it targets — control, management, or data — with threat actors mapping exactly which software runs at each layer. Rapid7 Intelligence will keep tracking and disrupting tactics like this, the company said.

What the engine delivers#

Three components carry the workload. Immediate Protective Force routes frontline intelligence directly into Rapid7’s products, its managed detection and response (MDR), and exposure management — bypassing the research-to-product lag to neutralize adversary infrastructure before attacks execute. The Unified Intelligence Engine puts threat intelligence, vulnerability analysis, and engineering inside the products customers already run, instead of shipping a report they must translate into action themselves. And the Uncompromised Community Arsenal keeps the Metasploit and Rapid7 Labs foundation open — critical advisories, vulnerability research, and exploitation insights remain public.

“In a world of infinite telemetry and automated attacks, playing defense with traditional tools is an exercise in futility,” said Mel Stone, Rapid7’s chief global services officer. “By fusing machine-scale observation with frontline human expertise, we turn raw threat data into immediate, actionable intelligence — empowering security teams to disrupt adversaries before they establish a foothold.”

Rapid7 (NASDAQ: RPD) describes itself as a global leader in AI-powered managed cybersecurity operations; its Command Platform unifies security data enriched with AI, threat intelligence, and 25 years of expertise for more than 11,500 customers worldwide. Announcement: GlobeNewswire release.