Rapid7
The mid-market security platform — vulnerability management, a SIEM and a 24/7 managed SOC on one agent and one contract, metered per asset rather than per gigabyte. Strong where a small team needs all three; a Challenger, not a Leader, in SIEM — and there is no India data region. This hub is your complete intel file.
Buy through TechBag
Same software. Better outcome — at a lower cost.
The company, at a glance
Quick answer
Four intel pages. One agent, one contract.
The complete Rapid7 portfolio — every linked card is a full intel page, from vulnerability management to the managed SOC.
Incident Command
The AI-native SIEM formerly called InsightIDR.
Cloud SIEM, renamed from InsightIDR in July 2025, priced per asset not per gigabyte, with UBA, deception and agentic AI investigation.
InsightVM
Risk-scores vulnerabilities across hybrid estates.
Scans on-prem, cloud and remote assets and scores findings on Active Risk (0–1000), using CISA KEV, Metasploit and honeypot evidence.
Managed Threat Complete
A 24/7 SOC with vulnerability management included.
MDR on Rapid7’s SIEM, staffed from Boston, Prague and Pune; unlimited incident response and InsightVM scanning in the per-asset price.
InsightAppSec
Dynamic testing for web applications and APIs.
DAST that crawls and attacks live web apps and APIs across the OWASP Top 10, with attack replay so developers can reproduce findings.
Surface Command
Platform & engineAttack surface management — ships inside every Exposure Command tier
Metasploit
Platform & engineThe framework is free and open source; only Metasploit Pro is commercial
InsightCloudSec
Platform & engineCNAPP — a Forrester Contender; we would point you at Wiz instead
Rapid7 sells across 4 of the categories TechBag carries in security. The Security guide shows how the category splits and which part is yours. →
Why “one agent, one contract, priced per asset” is the whole story
Most security platforms are assembled from acquisitions and priced on the thing you cannot control — how much data you generate. Rapid7 bet the company on the opposite: one agent feeding vulnerability, endpoint and log data, metered per monitored asset rather than per gigabyte ingested— so a chatty firewall never produces a surprise invoice, and a three-person security team can run vulnerability management, a SIEM and a managed SOC under a single contract. That is a genuinely underserved position and Rapid7 holds it well. The honest corollary is that the same design decisions cap the ceiling: this is a strong mid-market platform, not a top-end specialist, and the pages below say exactly where that stops being the right trade.
The Command Platform is the wrapper, not a product
One console over Incident Command, Exposure Command and Surface Command, sharing identity, agent and asset inventory. Sales push bundles, so ask for standalone pricing if you need one part.
One agent serves several products
One Rapid7 Agent on Windows, Linux and macOS feeds vulnerability, endpoint and log data, a real saving for small teams. It runs local checks only, so scan engines are still needed.
Collectors and sensors sit on your network
On-premises Collectors (about 600 endpoints per CPU core) forward events to the cloud; the optional Network Sensor runs Suricata. Neither runs on ARM; hardware isn’t in the licence.
Priced per asset, not per gigabyte
SIEM and MDR are metered per monitored asset, not data volume, so a noisy log source won’t bring a surprise invoice. Marketplace SKUs carry data allowances; check overage terms.
Open source feeds the commercial products
Rapid7 stewards Metasploit and Velociraptor and runs Project Sonar and AttackerKB; their exploit evidence feeds the Active Risk score, a credible basis for its prioritisation.
Start where the gap is — InsightVM for exposure, Incident Command for detection, Managed Threat Complete for 24/7 cover — and settle the India residency question before any of them.
Peer & market recognition
Every claim on this hub traces to one of these public signals.
2025 Gartner MQ for Exposure Assessment
Exposure Command evaluated, November 2025
2025 Frost Radar for MDR
Assessed against a field of 120 vendors
2025 IDC MarketScape Exposure Management
Worldwide vendor assessment
MDR
4.6 out of 5 across 315 reviews
2025 Gartner MQ for SIEM
Seventh year included — but not a Leader
Forrester Wave for Unified VM
2025 wave, not top tier
SCAP validated and USGCB certified by NIST
InsightVM policy assessment
SOC 2 Type II, IRAP, FedRAMP
FedRAMP covers InsightGovCloud only
The company in six figures
See the platform, hear the pitch
Rapid7 Command Platform Capabilities
The platform, presented by Rapid7.
Overview Video: InsightVM
Vulnerability management in the console.
Rapid7 Managed Detection & Response (MDR)
What the managed service actually does.
Where Rapid7 sits — the grids
Two company-level views you won’t find on any vendor site — tap any dot for the rationale. The category-level grid lives on the product page.
Rapid7 Across Its Platform
Each dot is a Rapid7 product: competitive position vs category momentum.
The strongest product in the portfolio.
The Depth × Mid-Market Fit Map
Depth in each vendor’s strongest category vs fit for a mid-sized team buying several products at once.
One agent, one contract, mid-market fit.
Positions are TechBag’s illustrative synthesis of public review-platform standings and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
New to this? Learn it properly.
Zero-jargon starting points, in reading order. Each links into the deep education on the product page.
Where should you start with Rapid7?
Answer three questions; we’ll point you at the right starting product. No email required — this isn’t that kind of quiz.
1. What is the gap you are trying to close?
2. How big is your security team?
3. Does an Indian regulator or contract bind where your logs sit?
What Rapid7 actually sells in 2026
A plain map of the Command Platform, which products are real SKUs, and which names are marketing wrappers.
Read →InsightIDR is now Incident Command
Why the SIEM changed name in July 2025, and why the documentation still shows both names.
Read →How Rapid7 charges per asset
What counts as an asset, why per-asset beats per-gigabyte for predictable budgets, and where overage still bites.
Read →Rapid7 and CERT-In log localisation
Why the absence of an India data region matters for the 180-day in-India log rule, and what buyers do about it.
Read →InsightVM or Exposure Command
When the standalone vulnerability product is enough, and when the bundle genuinely earns its price.
Read →MDR versus building your own SOC
An honest cost comparison for an Indian mid-market team, including what MDR does not cover.
Read →The acronym decoder
Every term on these pages, in one place- Command Platform
- Rapid7’s shared console and data layer for Incident Command, Exposure Command and Surface Command.
- Incident Command
- Rapid7’s SIEM, renamed from InsightIDR in July 2025, covering logs, endpoints and users.
- InsightVM
- Rapid7's vulnerability management product; scans assets, scores risk and tracks remediation to a deadline.
- Active Risk
- Rapid7’s 0–1000 vulnerability score, weighting real exploitation over CVSS; replaced Real Risk in January 2026.
- Rapid7 Agent
- The single endpoint agent, formerly Insight Agent, feeding vulnerability, endpoint and log data to the platform.
- Collector
- An on-premises virtual machine that aggregates log sources and forwards them to Rapid7's cloud.
- LEQL
- Log Entry Query Language — Rapid7's search syntax for the SIEM, using select, where and groupby clauses.
- Deception technology
- Decoys such as honeypots, honey users and honey credentials that raise a high-confidence alert when touched.
- Managed Threat Complete
- The commercial name for Rapid7's MDR bundle: managed SOC plus InsightVM plus automation.
- Surface Command
- Attack surface management; combines external attack surface discovery with internal asset inventory.
- Metasploit
- The open-source penetration testing framework Rapid7 has stewarded since 2009; also sold commercially as Metasploit Pro.
- CERT-In Directions
- India’s 2022 rules: six-hour incident reporting and 180 days of ICT logs kept within Indian jurisdiction.
Buy it like you’ve done this before
The procurement playbook TechBag runs with IT buyers — steps, licensing cheat-sheet, and the pitfalls that cost quarters.
Settle the data residency question first
Rapid7 has no India region. If CERT-In’s 180-day in-India log rule binds you, decide on a parallel log store or another vendor before any demo.
Count your assets honestly
Rapid7 prices per asset: a workstation or server host that reported data in the last thirty days. Undercounting breaks the quote; overcounting costs you every year.
Decide standalone or platform
Sales push Exposure Command and Managed Threat Complete bundles. Ask for standalone InsightVM or Incident Command pricing too; you may buy three to use one.
Run a proof of concept on real assets
Scan a real slice of your estate, including noisy servers and network appliances. Scan time, false positives and console load only show at your scale.
Size the infrastructure you must supply
InsightVM needs a self-hosted Security Console (twelve cores, 64 GB RAM, 2 TB storage at twenty thousand assets); the SIEM needs Collectors. Cost that in.
Negotiate the renewal, not just year one
Rapid7 states about three percent uplift; buyers report seven to ten. Fix it for the full term and agree terms for asset growth. TechBag negotiates it in INR.
The licensing cheat-sheet
| Product | Licensing model | How you enter | Best for |
|---|---|---|---|
| InsightVM | Published from $1.62 per asset/month at 500 assets | 500-asset minimum, annual term | Hybrid estates owning their scan data |
| InsightAppSec | Published at $175 per application/month | Per application — start with the internet-facing ones | Few web apps, tested every release |
| Incident Command | Quote-only, per monitored asset — not per GB ingested | Essentials, Advanced or Ultimate; volume discounts above 500 assets | Mid-market, no detection engineers |
| Managed Threat Complete | Quote-only; buyer-reported ~$15–22 per asset/month | 500-asset minimum commonly applied; three tiers with identical SLAs | 24/7 cover plus vulnerability programme |
Rapid7 publishes list prices for InsightVM and InsightAppSec only; Incident Command and Managed Threat Complete are quote-only, metered per monitored asset rather than per gigabyte. The costs that surprise are the infrastructure you host — InsightVM’s console and the SIEM’s Collectors — and the renewal uplift. TechBag quotes standalone and bundle side by side, in INR with GST.
Five pitfalls that cost buyers quarters
Assuming 13-month retention satisfies CERT-In
Rapid7’s thirteen-month retention beats CERT-In’s 180 days on duration but fails on location: logs must stay in India, and the nearest region is Tokyo. Ask in writing early, not during an audit.
Buying the SIEM expecting deep customisation
Gartner’s 2025 caution: no advanced analytics such as supervised machine learning, and reports group by one field. Custom rules default to 200. For complex correlation, evaluate Splunk or Sentinel.
Deploying agents only and calling it coverage
The Rapid7 Agent runs local checks only, so exposed services, TLS misconfigurations and network appliances go unassessed. Deploy scan engines alongside agents and set up credentials properly.
Missing the Active Risk score migration
Rapid7 retired Real Risk and other scoring models on 21 January 2026, leaving Active Risk. Old scores can’t be recalculated, so be ready to explain the step in trend data to a board.
Expecting MDR to contain more than it does
Active Response only quarantines endpoints and disables users, incident response is remote-only, and assets without the Rapid7 Agent are left out of hunts, even with a third-party EDR.
The evaluation kit
Each product intel page carries a buyer checklist and a cost model:
Skip the homework entirely
Bring your requirements and current tool bills — a TechBag advisor models the whole decision for you.
Book a discovery call →The forces shaping this market
Six trends with momentum scores (TechBag’s read of analyst and market signals) — and what each means for your next decision.
Category momentum — estimated market growth
Illustrative CAGR synthesis**Directional synthesis of public analyst forecasts for Rapid7’s categories; verify exact figures before relying on them. Exposure management is the fastest line — the category Rapid7 now leads with through Exposure Command.
Exposure management absorbs vulnerability management
Standalone vulnerability scanning is being folded into exposure platforms with attack surface discovery and attack paths.
What it means for you
Rapid7 calls InsightVM the engine of Exposure Command; Gartner now has a Magic Quadrant for it.
Agentic AI moves into the SOC workflow
Rapid7 built agentic investigation workflows from its own SOC playbooks; AI triage sits in its Advanced and Ultimate tiers.
What it means for you
The pitch is analyst hours saved, not better detection; treat vendor accuracy stats as unaudited.
Indian data localisation reshapes shortlists
CERT-In log localisation, RBI outsourcing rules and the DPDP Act increasingly decide Indian deals before features are compared.
What it means for you
Vendors with no India region lose regulated buyers, and some global platforms are opening one.
Managed detection displaces the in-house SOC
A 24/7 SOC needs roughly eight to ten analysts, beyond the reach of most mid-market Indian firms.
What it means for you
RBI and SEBI both expect continuous monitoring, pushing regulated buyers toward managed services.
Per-asset SIEM pricing challenges per-gigabyte
Ingestion-based billing has made SIEM budgets unpredictable for a decade.
What it means for you
Rapid7 meters per monitored asset, and buyers now shortlist on pricing model first.
Consolidation pressure on mid-market security spend
Mid-sized Indian teams are cutting vendors, picking one adequate platform over four specialist tools they can’t staff.
What it means for you
Rapid7 is built for this; it is its clearest edge over point-solution specialists.
Questions buyers ask about Rapid7
Ready to shortlist Rapid7?
Open any of the five intel pages for the deep dive, or let a TechBag advisor build the case with you — asset counting, standalone-versus-bundle quotes, the residency answer in writing, a fixed renewal uplift, GST invoicing and support included.
Stats, positions and figures are illustrative syntheses of public materials; verify before purchase.