Activist investor Jana Partners LLC has accumulated a stake in Rapid7 Inc. (RPD) and is agitating to have the cybersecurity company find a buyer, The Deal has confirmed.

Consequently, Boston-based Rapid7, which joined The Deal’s Watch List of possible activist candidates in October, becomes a Direct Hit since it now faces a high-profile insurgent investor. Rapid7 switched from the Watch List to the Crosshairs list in November.

Rapid7 is reportedly working with Cannae Holdings Inc. (CNNE), which teamed up with an activist investor in 2020-2021 in a campaign and unsolicited bid for CoreLogic Inc. At Rapid7, the goal is for Cannae, led by billionaire Bill Foley, to partner with a buyout shop to buy Rapid7, according to The Wall Street Journal, which first reported Jana’s accumulation.

In October, The Deal reported that Rapid7 could soon find itself in the crosshairs of a strategic or financial buyer, or an activist seeking to expedite such a sale. The software sector overall has seen its fair share of private equity and strategic M&A, driven in part by activists, as well.

Rapid7 is a cybersecurity company with a specialization in vulnerability management, or VM, which includes software that scans networks, drives or computers for weak spots to limit cyber risks.

COO Andrew Burton on June 4 notified the company that he’s stepping down from his position to take a role as CEO “at a privately held company.” Wolfe Research analysts cited Burton’s departure in a report Wednesday, saying they believe “a sale to private equity would allow [Rapid7] to revamp its sales efforts outside of the public limelight.” The research firm said it estimated that Rapid7 could be sold for between $50 and $57 a share, well above the company’s share price early Thursday of $40.55. The cybersecurity company’s shares are up 12% on the Jana news but down 10% and 30% over the past 12 months and five years.

A Wednesday Raymond James report suggested that Jana’s involvement could create “rapid change.” The research firm referenced a note it issued last year suggesting that splitting Rapid7’s vulnerability management and cloud security business into two separate companies could extract value. The analysts added that since then, the businesses have become less distinct, but a buyer could be interested in the cloud security business.

“We have also seen strategic optionality over time as cloud security remains a growth pillar, and this nascent market has significant runway for growth that may be of interest for a potential suitor,” they added.

Jana joins Elliott Management Corp. at Rapid7. Elliott on May 15 reported owning about 41.5 million Rapid7 notes as of March 31, the same amount it owned on Dec. 31.

Steven Cohen’s Point72 Asset Management LP reported May 22 acquiring a 5% stake in a passive 13G filing.

Rapid7 continues to be one of a number of private equity takeout targets, RBC Capital Markets said in an April 8 report. In February 2023, Reuters reported the company was exploring strategic options after attracting acquisition interest.

Aside from M&A, Jana is also reportedly pushing Rapid7 to make other changes, such as improving its operations and forecasting. The company announced last year it was laying off about 18% of its workforce.

Rapid7 has been expanding into other cloud security areas, which could make it more attractive to buyout shops, and possibly some large strategic buyers that want to consolidate enterprise security spending, RBC Capital Markets analyst Matt Hedberg told The Deal in October.

“We have seen PE consolidate other areas of cybersecurity, including email security and identity, and they could do the same with vulnerability management. Increasingly platforms are consolidating cyber spending,” Hedberg said.

The company is expected to issue its next earnings report in July.