Case | HBS Case Collection | February 2017 (Revised May 2017)


by Mitchell Weiss, Paul Gompers and Silpa Kovvali


That Corey Thomas, vice president at Boston-based Rapid7, Inc., was about to enter his investor’s boardroom to negotiate a potential acquisition of Metasploit, LLC, was already an unlikely achievement of sorts. After all, Rapid7 was a venture-backed, corporate client-focused cybersecurity company, and Metasploit was a white-hat hacker community with a reputation that ranged from esoteric to “notorious.” And awaiting Thomas for the deliberations wasn’t a typical business partner, but rather HD Moore, Metasploit’s founder, chief contributor, and in 2009 one of the most well-known hackers on the planet. The groundwork that had been laid to convince Moore to come to Boston for the discussions would all be for naught if Thomas couldn’t come to terms with Moore . . . and if Thomas couldn’t persuade his own executive team and board of directors that whatever package he ultimately agreed to with Moore was a reasonable one, even though an acquisition of Metasploit would come with no meaningful revenue and considerable execution, legal, and reputational risks.

Keywords: acquisition; cybersecurity; computer hacking; open-source; Corey Thomas; Rapid7; exploit testing; Mergers and Acquisitions; Computer Industry; North and Central America; Boston;


Weiss, Mitchell, Paul Gompers, and Silpa Kovvali. "Rapid7." Harvard Business School Case 817-077, February 2017. (Revised May 2017.)