Rapid7 InsightVM
Risk-scored vulnerability management — Rapid7 InsightVM ranks findings 0–1000 on evidence of real exploitation, not theoretical CVSS, and Remediation Projects turn the list into assigned work with owners and deadlines. You host the console, so the scan data can stay in India.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Data residency & processing — confirm before the PoC
Where data lives
Your console — India if you choose
The Security Console and its database are hosted by YOU: on-premises, or in AWS Mumbai or Azure Central India. Your asset inventory, scan results and vulnerability database — a complete map of every weakness in your estate — can stay in country. This is the one Rapid7 product where the architecture gives you that answer.
Where it is processed
Some metadata still leaves India
The Rapid7 cloud layer provides dashboards, Remediation Projects, Goals and SLAs, the Executive Risk View and Active Risk scoring — and Rapid7 has no India region. Confirm in writing exactly what that layer holds before you rely on this as a regulatory answer.
Be precise here, because a comfortable answer is easy to reach and wrong. “The scan data stays in India” and “nothing leaves India” are different claims, and an auditor will probe the difference. TechBag obtains Rapid7’s written position on what the cloud platform layer holds as part of the quote. If your obligation requires that nothing at all leaves Indian jurisdiction, look at Qualys VMDR, which runs an India platform.
Quick answer
The Rapid7 platform family
This page covers Rapid7 InsightVM — vulnerability management. The other pillars:
Quick facts
30-second orientation- Category
- Risk-based vulnerability management
- Vendor
- Rapid7 — CEO Wael Mohamed (June 2026)
- Deployment
- HYBRID — self-hosted console plus Rapid7 cloud
- Published price
- From $1.62 per asset per month
- Minimum tier
- 500 assets, annual subscription
- Risk scoring
- Active Risk, 0–1000 scale
- Legacy scoring retired
- 21 January 2026 — no recalculation of history
- Policy benchmarks
- CIS · DISA STIG · USGCB
- Certification
- SCAP validated, USGCB certified by NIST
- Agent limitation
- Local checks only — no remote or unauthenticated checks
- Data residency
- YOURS — console and scan data on your infrastructure, India if you choose
- Data processing
- Cloud layer holds dashboards and Remediation Projects — confirm scope in writing
- Console sizing
- 12 cores / 64 GB / 2 TB at 20,000 assets
- Buy in India via
- TechBag — INR, GST, standalone quote negotiated
Understand vulnerability prioritisation before you buy it
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is it?
Risk-based vulnerability management for hybrid estates. Scans servers, workstations, network devices, containers and cloud instances, scores what it finds, and tracks the fixing to a deadline.
A CVSS-sorted scanner vs InsightVM — the honest table
What changes when findings are ranked on exploitation evidence and assigned to owners.
| Dimension | CVSS-sorted scanner | InsightVM |
|---|---|---|
| Prioritisation | CVSS severity alone | Active Risk 0–1000, weighted on exploitation |
| Evidence | A score you cannot explain | Named sources: CISA KEV, Metasploit, AttackerKB |
| Output | A list of findings | Remediation Projects with named owners |
| Deadlines | Tracked in spreadsheets | Goals and SLAs by asset group |
| Authenticated scans | Stored admin credentials | Scan Assistant — certificates instead |
| Where scan data sits | The vendor’s cloud | Your console — India if you choose |
| Honest caveat | — | Heavy console; weak report builder |
| Best fit | — | Hybrid estates with regulated remediation |
Want no console at all? Weigh Qualys VMDR. Need the deepest plugin coverage or OT? Weigh Tenable. TechBag sells both.
The five pieces of the platform
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
Security Console
The core server, hosted by you on Windows or Linux with PostgreSQL, runs scans and stores data: twelve cores, 64 GB RAM and 2 TB at twenty thousand assets, up to 256 GB and 8 TB.
Scan Engine
Scan Engines across network segments return results to the Console, via TCP 40814 or reverse mode on 40815 behind NAT. Hosted engines scan the perimeter.
Rapid7 Agent
The agent collects on its own schedule, so laptops absent during scan windows are still assessed. It performs local checks only, not network checks.
Scan Assistant
A lightweight service on hosts gives authenticated scan results over ECDSA and AES, without storing admin credentials, faster than credentialed scanning.
Insight Platform
Rapid7’s cloud adds live dashboards, Remediation Projects, Goals and SLAs and Active Risk scoring. Reviewers report sync lag and imperfect parity.
A console you host, engines you place, an agent for roaming laptops — and Rapid7’s cloud for the remediation workflow.
Twelve capabilities. Find, rank, fix.
InsightVM discovers assets, scores what it finds on Active Risk, checks configuration against CIS and STIG, and turns the result into assigned remediation work with deadlines. Here is what is inside.
Asset discovery and inventory
Finds and catalogues devices across on-premises networks, cloud accounts and remote endpoints into one inventory.
Authenticated network scanning
Logs into targets to enumerate installed software and configuration for accurate local vulnerability detection.
Unauthenticated remote checks
Probes exposed network services from outside the host to find what an attacker without credentials would see.
Continuous agent assessment
Collects vulnerability data from laptops and roaming assets on its own schedule regardless of scan windows.
Scan Assistant
Delivers authenticated scan depth using certificates instead of stored administrative credentials.
Cloud connectors
Pulls asset inventory and configuration from AWS, Azure and GCP so cloud instances appear alongside on-premises assets.
Active Risk prioritisation
Ranks vulnerabilities 0 to 1000 using live exploitation evidence rather than theoretical CVSS severity alone.
Exploit evidence feeds
Weights findings using CISA KEV, Metasploit, ExploitDB, AttackerKB and Rapid7 honeypot telemetry.
CIS and DISA STIG assessment
Tests operating system configuration against recognised hardening benchmarks with SCAP-validated, NIST-certified content.
Remediation Projects
Assigns vulnerabilities to named owners and tracks live progress toward completion rather than producing a static list.
Goals and SLAs
Sets measurable remediation deadlines by asset group and reports whether teams are meeting them.
Ticketing and automation
Creates Jira and ServiceNow tickets automatically and triggers actions such as scanning newly discovered assets.
Watch Rapid7 InsightVM in action
Vulnerability management and Remediation Projects, from Rapid7.
Overview Video: InsightVM
Vulnerability management, demonstrated by Rapid7.
Managing Remediation Activities in InsightVM
Remediation Projects in the console.
Want a live, India-context walkthrough for your environment?
Book a guided demo →Fix the vulnerabilities attackers actually use.
Here’s what genuinely sets InsightVM apart — and where Tenable or Qualys fit better.
Active Risk prioritises by what attackers actually exploit
Active Risk scores 0 to 1000 on real exploitation evidence — CISA’s Known Exploited Vulnerabilities catalogue, Metasploit modules, ExploitDB, AttackerKB and Project Lorelei honeypot traffic — so an unexploited CVSS 9.8 can rank below a 7.5 in the wild. Public sources make priorities explainable. Real Risk was retired on 21 January 2026.
Remediation Projects turn findings into assigned work
Remediation Projects assign vulnerabilities to named owners with live tracking, Goals and SLAs set days to remediate by asset group, and tickets flow into Jira or ServiceNow. That evidences the timelines RBI and SEBI’s CSCRF expect. One caveat: reviewers report the native Jira integration breaks with some regularity.
Scan Assistant removes the credential problem
Scan Assistant gives authenticated-scan depth with no stored administrative credentials: a lightweight service builds a trusted channel to the Scan Engine using ECDSA certificates and AES encryption. It’s faster and lighter, uncommon in the category, and dormant unless called, adding negligible attack surface.
The self-hosted console keeps your data in India
InsightVM still needs a self-hosted Security Console and database, which reviewers criticise. But for Indian buyers that lets asset and vulnerability data stay on-premises or in AWS Mumbai or Azure India — Rapid7 has no India region. The cloud layer still holds some metadata; confirm exactly what with Rapid7 in writing.
The honest caveat: the console is heavy and the reporting is weak
Plan for two weak points. The console is resource-hungry — 64 GB RAM and 2 TB at twenty thousand assets — with reported memory failures and slow scheduled scans. Reporting is inflexible, often needing SQL Query Export. Reviewers also cite lagging Live Monitoring, Cisco false positives and slow support.
The honest positioning
InsightVM suits hybrid estates under RBI, SEBI or IRDAI where remediation workflow and in-India data matter, and typically prices below Tenable and Qualys. Choose Qualys VMDR for no console to host, Tenable for breadth (219,000+ plugins, OT), or Wiz for cloud-native estates. We sell all of them.
The numbers behind the platform
What your Rapid7 InsightVM rollout looks like
Size the console properly
Rapid7 advises twelve cores, 64 GB RAM and 2 TB at twenty thousand assets. Host it on-premises or in an India cloud region.
Deploy engines and agents by segment
Place Scan Engines across segments, reverse mode behind NAT, and add the agent for roaming laptops; it checks locally only.
Turn on Scan Assistant before credentialed scanning
Credentialed scanning is one of InsightVM’s harder tasks; Scan Assistant uses certificates, not stored credentials, and is faster.
Build Remediation Projects and SLA goals
Assign owners, set days-to-remediate per asset group, and wire Jira or ServiceNow, then test it, as reviewers report breakage.
Expect a trend discontinuity at the scoring change
Real Risk and other legacy models retired on 21 January 2026, and old scores can’t be recalculated. Prepare to explain the step.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“Active Risk let us argue for a patch order with evidence instead of opinion. The infrastructure team stopped pushing back.”
“Remediation Projects put the work in Jira where our engineers actually live. That alone changed our close rate.”
“The console is a real server and it behaves like one. Budget the hardware properly or it will bite you during a big scan.”
“Scan Assistant meant we stopped storing domain admin credentials in a scanner. Our auditor was noticeably happier.”
“Reporting is the weak point. We ended up writing SQL exports because the report builder could not do what we needed.”
“Keeping scan data on our own console in Mumbai answered the localisation question that ruled out two other vendors.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and review-site grids score satisfaction, not fit for your estate. So here’s TechBag’s synthesis of the security platforms Rapid7 meets in deals — tap any vendor to see why it sits where it does.
TechBag Security-Platform Grid
Execution strength vs product vision — the classic market map, minus the paywall.
Mid-market platform — one agent, one contract.
Depth × Breadth
Depth in each vendor’s strongest discipline vs how much of VM, SIEM and MDR it covers — where InsightVM’s platform sits.
Breadth over depth — that is the deliberate trade.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
Rapid7 InsightVM vs the field
Platform-level lanes; the scanner specifics are in the verdicts below. InsightVM wins on remediation workflow and a console you host; Tenable on scan depth, Qualys on operational overhead.
| Dimension | Rapid7 | Tenable | Qualys | CrowdStrike | Microsoft |
|---|---|---|---|---|---|
| Position | Mid-market platform: exposure, SIEM and MDR on one agent | The strongest scanner in the category | Cloud-native, lowest operational overhead | The endpoint and MDR benchmark | Near-free at the margin with E5 |
| Pricing axis | Per monitored asset — not per GB ingested | Per asset, quote-led | Per asset, reported ~$199–250/yr | $25–45 per endpoint/month for Falcon Complete | Bundled into E5 licensing |
| Vulnerability management | InsightVM — published price, Active Risk scoring | 219,000+ plugins, dedicated OT product | Cloud-native, native patching included | Exposure module if you already run Falcon | Weak on non-Microsoft OS and network devices |
| SIEM | Challenger in the 2025 MQ — not a Leader | Not a SIEM vendor | Not a SIEM vendor | Falcon Next-Gen SIEM | Sentinel — a Leader |
| MDR | Frost Radar Leader; VM and unlimited IR bundled in | Not an MDR vendor | Managed services available | Falcon Complete — the benchmark | Defender Experts |
| Deployment | SIEM and MDR cloud-only; InsightVM console is yours | Cloud or on-premises | Cloud-native only | Cloud-native only | Azure-hosted |
| India data residency | NO India region — InsightVM console is the exception | Region options; verify for your product | India platform, Pune-engineered | Verify per product | Azure India regions |
| The thing to plan around | No India region; agent mandatory; FY26 guided down | Priced above Rapid7 at most tiers | Support quality rated well; scanning less deep | The most expensive option here | Only economic if you already hold E5 |
| Best fit | Mid-market wanting VM, SIEM and MDR from one vendor | Deepest scanning, or operational technology | Lowest operational overhead, native patching | Best-in-class endpoint and managed response | Microsoft-standardised estates with E5 |
Does Rapid7 InsightVM fit you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose InsightVM if…
- ✓Remediation workflow matters as much as detection — assigned owners and deadlines, not a list
- ✓You want prioritisation grounded in real exploitation evidence you can show an auditor
- ✓Keeping vulnerability data in India has regulatory value — the console is yours
- ✓You want a published entry price rather than a quote-only negotiation
Choose Tenable if…
- ✓You need the deepest scanning coverage — 219,000+ plugins
- ✓You have operational technology or industrial environments
- ✓Dashboard flexibility and scan efficiency are your priorities
Choose Qualys if…
- ✓You want no console to host, patch and size — it is cloud-native
- ✓Native patch management matters rather than integrating out to SCCM
- ✓An India platform answers your residency question directly
Choose CrowdStrike if…
- ✓You already run Falcon, so there is no second agent to deploy
- ✓You want best-in-class endpoint detection and managed response
- ✓You can accept the premium — $25–45 per endpoint per month
Choose Microsoft if…
- ✓You hold E5 licences, which changes the economics entirely
- ✓Your estate is standardised on Microsoft 365 and Azure
- ✓Azure India regions answer a residency obligation Rapid7 cannot
Rapid7 InsightVM is one of 23 vulnerability management products TechBag carries. The Vulnerability Management guide narrows them to a shortlist and shows the reasoning. →
The licence is published — the console is yours to run
InsightVM is one of the few vulnerability tools with a published price: from $1.62 per asset per month at 500 assets. That makes the licence line simple arithmetic. The line buyers leave out is the Security Console and Scan Engines you host — the patching, sizing, scan scheduling and report work they consume every week. Move both sliders to see the licence and the engineer time side by side. Indicative Indian-market rates, not a quote.
Two things this does not include: console hardware — Rapid7’s own sizing calls for twelve cores, 64 GB RAM and 2 TB at twenty thousand assets — and the volume discount above 500 assets, which will bring the real licence below this line. Engineer time costed at ₹15 lakh CTC; adjust for your market.
Three ways to consume it
InsightVM carries one of the few published prices in this category: from $1.62 per asset per month at 500 assets, roughly $19 per asset per year, on an annual term. What the licence does not include is the infrastructure — you host a Security Console and a PostgreSQL database, and Rapid7’s own sizing calls for twelve cores, 64 GB RAM and 2 TB of storage at twenty thousand assets. Budget that explicitly, or a comparison against cloud-native Qualys is not a comparison. Ask for the standalone quote specifically; the sales motion leads with Exposure Command. TechBag quotes in INR with GST.
InsightVM
Published, from 500 assets
- Roughly $19 per asset per year at the entry band
- Active Risk scoring and Remediation Projects included
- Volume discounts above 500 assets
Your infrastructure
The line buyers forget
- 12 cores / 64 GB / 2 TB at 20,000 assets
- 256 GB / 8 TB at 400,000 assets
- Plus scan engines across your network segments
Exposure Command
Only if you will use it
- Adds Surface Command attack-surface discovery
- Bundle discounts reported at 8–14% for two products
- Buying a platform to use one component is how budgets are wasted
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 10 questions to ask every vulnerability-management vendor
Take this into your next vendor call — including ours.
Have we budgeted the hardware Rapid7's own guidance calls for at our asset count?
Where will the Security Console sit, and does that satisfy our localisation obligation?
Have we confirmed IN WRITING what the Rapid7 cloud layer holds, given the console stays ours?
Are we deploying scan engines as well as agents? Agent-only silently misses exposed network services.
Will we use Scan Assistant rather than storing domain administrative credentials in the scanner?
Who owns the fixing, and what days-to-remediate SLA applies to each asset group?
Have we tested the Jira or ServiceNow integration specifically? Reviewers report it breaking.
Can we explain the trend discontinuity from the January 2026 Real Risk retirement?
Have we produced the exact reports our auditors demand, or will we need SQL Query Export?
Have we asked for a standalone InsightVM quote, not just the Exposure Command bundle?
Questions buyers ask
Ready to evaluate Rapid7 InsightVM?
Size the console properly, get the standalone InsightVM quote alongside Exposure Command, or get an honest InsightVM-vs-Tenable-vs-Qualys comparison — in INR/GST.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.