Rapid7 Managed Threat Complete
A 24/7 SOC with the vulnerability programme included — Managed Threat Complete commits contractually to 15 minutes to begin a critical investigation and bundles unlimited InsightVM scanning and unlimited incident response into the per-asset price. No pure-play MDR vendor does that.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Data residency & processing — confirm before the PoC
Where data lives
Offshore — there is NO India region
Rapid7’s platform runs in five regions: the United States, Canada, Europe, Japan and Australia. Verified against Rapid7’s own trust page. For an Indian entity that means Tokyo or further afield, and it is the constraint most likely to decide this purchase.
Where it is processed
Rapid7’s cloud; SOC has no contractual geography
Detection and analyst work happen in Rapid7’s cloud. The Pune Global Capability Centre, opened April 2025, is a real SOC delivery node — but Rapid7’s contracts specify no geography, so there is no guarantee your alerts are handled in India, and people in India are not the same thing as data in India.
13-month retention exceeds CERT-In’s 180 days on duration and fails on location — two different tests, and only one is satisfied. One nuance that cuts against our own interest in selling you a second system: CERT-In’s own May 2022 FAQ (Q35) permits storage outside India provided logs remain producible in reasonable time, and many organisations keep source logs on-premises and treat this platform as a copy. Where it becomes unambiguous is sectoral — the 2023 IRDAI audit annexure puts it as a yes/no question insurers must answer with a yes: are ICT infrastructure logs kept in India? If that is you, see InsightVM, where the console is yours, or an India-hosted alternative.
Quick answer
The Rapid7 platform family
This page covers Rapid7 Managed Threat Complete — the managed SOC (MDR). The other pillars:
Quick facts
30-second orientation- Category
- Managed detection and response service
- Vendor
- Rapid7 — CEO Wael Mohamed (June 2026)
- Tiers
- Essential · Advanced · Ultimate
- SOC coverage
- 24/7/365 on all tiers
- Critical investigation SLA
- Begins within 15 minutes — contractual
- Notification
- Phone call within 30 minutes of identifying an incident
- SLAs by tier
- IDENTICAL — upgrading does not buy a faster clock
- Log retention
- 13 months, all tiers
- Bundled
- Unlimited InsightVM scanning — unique in MDR
- Incident response
- Unlimited, no retainer or hour cap — but remote only
- Agent
- Rapid7 Agent MANDATORY — no exceptions
- Containment scope
- Quarantine endpoint · disable user. That is the full list
- Data residency
- NO India region — logs held offshore
- Data processing
- Rapid7 SOC works from Boston, Prague and Pune; no contractual geography
- Buy in India via
- TechBag — INR, GST, tier and asset band negotiated
Understand what MDR covers — and what it does not
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is it?
A 24/7 managed SOC running on Rapid7’s own SIEM, with unlimited InsightVM scanning and unlimited incident response bundled into the per-asset price.
Building your own SOC vs Managed Threat Complete — the honest table
What the service replaces, and what it still leaves with you.
| Dimension | In-house 24/7 SOC | Managed Threat Complete |
|---|---|---|
| Staffing | Eight to ten analysts for 24/7 | Rapid7’s SOC — Boston, Prague and Pune |
| Response clock | Whoever is on shift | 15-minute critical start, contractual |
| Incident response | Retainer hours, drawn down | Unlimited, no retainer — remote only |
| Vulnerability programme | A separate purchase | Unlimited InsightVM bundled |
| Containment | Whatever your tools allow | Quarantine endpoint, disable user — only |
| Agent | Your existing EDR | Rapid7 Agent mandatory as well |
| Honest caveat | — | No India data region |
| Best fit | — | No realistic path to staffing a SOC |
If your logs must stay in India, weigh an India-hosted MDR provider before this one.
The five pieces of the platform
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
Rapid7 SOC
A 24/7/365 SOC staffed from Boston, Prague and Pune works inside Incident Command. Contracts specify no geography, so India handling isn’t guaranteed.
Incident Command
The service runs on Rapid7’s own SIEM, included in the price. Rapid7 won’t close alerts in third-party systems, and you keep the SIEM if you leave.
Rapid7 Agent
The agent is required on every covered asset, even with a third-party EDR; uncovered assets miss analytics, hunts and investigation. Eighty percent deployment is required.
Active Response
Automated containment does exactly two things: quarantine an endpoint and disable a user, optionally via one EDR such as CrowdStrike or Defender. You own un-quarantining.
Velociraptor
Rapid7’s open-source DFIR tool is embedded in the Ultimate tier only. It is tooling, not consulting hours: contracts include no DFIR hours.
Rapid7’s analysts, working inside Rapid7’s own SIEM, on assets that carry the Rapid7 Agent.
Twelve capabilities. Watch, investigate, contain.
Managed Threat Complete puts Rapid7 analysts on your telemetry around the clock, investigates what fires, contains through Active Response — and bundles InsightVM scanning into the price. Here is what is inside.
Endpoint and log collection
Gathers endpoint activity and log data from across the estate into Rapid7's SIEM for analyst review.
Third-party product monitoring
Ingests alerts from your existing security tools — two products at Advanced and four at Ultimate.
Cloud and identity sources
Monitors cloud platforms, Microsoft 365 and identity providers alongside on-premises infrastructure.
24/7/365 SOC monitoring
Keeps human analysts watching your environment continuously, including nights, weekends and Indian public holidays.
Alert validation and triage
Investigates raised alerts and separates genuine incidents from noise before contacting you.
Proactive threat hunting
Searches for attacker activity that has not triggered an alert, across assets carrying the Rapid7 Agent.
Attacker behaviour analytics
Applies detection content built from Rapid7's own SOC experience across its full customer base.
Emergent threat notification
Alerts customers when a significant new vulnerability or campaign is relevant to their environment.
Active Response containment
Quarantines a compromised endpoint or disables a compromised user account automatically.
Unlimited incident response
Provides incident response with no hour cap or retainer, delivered remotely with a report within ten business days.
Cybersecurity advisor
Assigns a named advisor for a monthly meeting and posture guidance, at Advanced and Ultimate tiers.
Bundled vulnerability management
Includes unlimited InsightVM scanning so exposure reduction runs alongside detection.
Watch Rapid7 Managed Threat Complete in action
The managed service, and the SOC behind it, from Rapid7.
Rapid7 Managed Detection & Response (MDR)
The managed service, presented by Rapid7.
SOC Overview — Rapid7 MDR
How the analyst team actually works.
Discover Rapid7 Managed Detection & Response
What the service covers.
Want a live, India-context walkthrough for your environment?
Book a guided demo →A SOC on contract, not on promises.
Here’s what genuinely sets Managed Threat Complete apart — and the two constraints buyers miss.
The SLAs are contractual, not marketing
Rapid7’s published MDR clocks are contractual: critical alerts investigated within fifteen minutes, high within one hour, a phone call within thirty minutes and a report within ten business days — identical across all three tiers. That gives a realistic path to CERT-In’s six-hour reporting window, though the duty to file stays yours.
Unlimited incident response with no retainer
Managed Threat Complete includes unlimited incident response — no hour cap or retainer to draw down, so you call for help early, which limits damage. The honest boundary: it is all remote. If your risk profile demands on-site forensic attendance, scope that separately with an Indian DFIR provider.
Vulnerability management is bundled, not extra
The per-asset price includes unlimited InsightVM scanning, which no pure-play MDR — not Arctic Wolf, Expel or Red Canary — bundles. One agent and risk score link detection to exposure, so price it against MDR plus vulnerability management. It also covers RBI’s assessment cadence and 24/7 SOC expectation under one contract.
Predictable per-asset pricing with unlimited ingestion
Managed Threat Complete is priced per monitored asset, with unlimited log ingestion and thirteen months’ retention at every tier, so better logging never touches the invoice; discounts begin above 500 assets. But duration isn’t location: data held in Tokyo doesn’t meet CERT-In’s 180 days of logs within Indian jurisdiction.
The honest caveat: the agent is mandatory and containment is narrow
The Rapid7 Agent is mandatory: assets without it, even under CrowdStrike or Defender, are outside the service, and eighty percent deployment is needed before the posture assessment runs. Containment is exactly two actions — quarantine an endpoint, disable a user. Reviewers also report incidents closed without sufficient explanation.
The honest positioning
Fits mid-market teams needing 24/7 coverage plus vulnerability management, with no path to a SOC and logs allowed offshore. Wrong if Indian data localisation binds you (no India region), if you want a vendor-neutral service inside your own tools, or need on-site forensics. We also sell CrowdStrike Falcon Complete and Sophos MDR.
The numbers behind the platform
What your Rapid7 Managed Threat Complete rollout looks like
Settle residency before anything else
Rapid7 has no India region. If CERT-In’s 180-day in-India rule binds you, establish it now; it can end the evaluation early.
Plan the mandatory agent rollout
The agent is needed on every asset even beside CrowdStrike or Defender, with eighty percent coverage before the assessment.
Choose the tier on advisor and forensics, not speed
SLAs are the same across Essential, Advanced and Ultimate; tiers differ on third-party coverage, a named advisor and Velociraptor.
Agree containment scope and exclusions in writing
Active Response only quarantines endpoints and disables users. Set your one containment tool, exclusions and who un-quarantines.
Use the bundled InsightVM properly
Unlimited vulnerability scanning is included but under-used. Run it and wire Remediation Projects to real owners.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“The SLAs are in the contract, not the brochure. Fifteen minutes to start on a critical, and they have met it.”
“Bundled vulnerability scanning changed the maths entirely. We were about to buy both separately.”
“Nobody told us the Rapid7 agent was mandatory on top of our existing EDR. That was a rollout we had not planned.”
“Unlimited IR with no retainer meant we called them early instead of arguing internally about burning hours.”
“Containment is quarantine and disable-user. That is it. Read that list carefully before you assume more.”
“Our logs sit outside India. For our regulator that was the end of the conversation, however good the service was.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and review-site grids score satisfaction, not fit for your estate. So here’s TechBag’s synthesis of the security platforms Rapid7 meets in deals — tap any vendor to see why it sits where it does.
TechBag Security-Platform Grid
Execution strength vs product vision — the classic market map, minus the paywall.
Mid-market platform — one agent, one contract.
Depth × Breadth
Depth in each vendor’s strongest discipline vs how much of VM, SIEM and MDR it covers — why the MDR bundle exists.
Breadth over depth — that is the deliberate trade.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
Rapid7 Managed Threat Complete vs the field
Platform-level lanes; the MDR alternatives are in the verdicts below. Managed Threat Complete wins on contractual SLAs and bundled InsightVM, and loses on India residency and containment breadth.
| Dimension | Rapid7 | Tenable | Qualys | CrowdStrike | Microsoft |
|---|---|---|---|---|---|
| Position | Mid-market platform: exposure, SIEM and MDR on one agent | The strongest scanner in the category | Cloud-native, lowest operational overhead | The endpoint and MDR benchmark | Near-free at the margin with E5 |
| Pricing axis | Per monitored asset — not per GB ingested | Per asset, quote-led | Per asset, reported ~$199–250/yr | $25–45 per endpoint/month for Falcon Complete | Bundled into E5 licensing |
| Vulnerability management | InsightVM — published price, Active Risk scoring | 219,000+ plugins, dedicated OT product | Cloud-native, native patching included | Exposure module if you already run Falcon | Weak on non-Microsoft OS and network devices |
| SIEM | Challenger in the 2025 MQ — not a Leader | Not a SIEM vendor | Not a SIEM vendor | Falcon Next-Gen SIEM | Sentinel — a Leader |
| MDR | Frost Radar Leader; VM and unlimited IR bundled in | Not an MDR vendor | Managed services available | Falcon Complete — the benchmark | Defender Experts |
| Deployment | SIEM and MDR cloud-only; InsightVM console is yours | Cloud or on-premises | Cloud-native only | Cloud-native only | Azure-hosted |
| India data residency | NO India region — InsightVM console is the exception | Region options; verify for your product | India platform, Pune-engineered | Verify per product | Azure India regions |
| The thing to plan around | No India region; agent mandatory; FY26 guided down | Priced above Rapid7 at most tiers | Support quality rated well; scanning less deep | The most expensive option here | Only economic if you already hold E5 |
| Best fit | Mid-market wanting VM, SIEM and MDR from one vendor | Deepest scanning, or operational technology | Lowest operational overhead, native patching | Best-in-class endpoint and managed response | Microsoft-standardised estates with E5 |
Does Rapid7 Managed Threat Complete fit you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose Managed Threat Complete if…
- ✓You need a 24/7 SOC and a vulnerability programme, and want them in one contract
- ✓Contractual SLAs matter to you — 15 minutes to begin a critical investigation
- ✓Unlimited incident response with no retainer changes how early you call for help
- ✓Your logs may legally sit offshore — if not, look at an India-hosted MDR instead
Choose CrowdStrike Falcon Complete if…
- ✓You already run Falcon, so there is no second agent to deploy
- ✓You want broader containment than two actions
- ✓You can accept the premium — a reported $25–45 per endpoint per month
Choose Sophos MDR if…
- ✓Indian data residency is mandatory — Sophos has a Mumbai region
- ✓You want third-party telemetry ingested without a second agent everywhere
Choose an India-hosted MDR if…
- ✓IRDAI’s audit annexure or a contract requires logs stored in India
- ✓You need on-site forensic attendance — Rapid7’s IR is remote-only
Choose Incident Command alone if…
- ✓You can staff alert triage yourself, around the clock
- ✓You want the SIEM without the managed service
Rapid7 Managed Threat Complete is one of 19 managed detection & response products TechBag carries. The Managed Detection & Response guide narrows them to a shortlist and shows the reasoning. →
Buy the SOC, or build it?
Round-the-clock cover needs roughly eight to ten analysts once shifts, leave and attrition are counted. Managed Threat Complete replaces that rota — and bundles InsightVM scanning and unlimited incident response on top. Move the sliders: the assets you would cover, and what an analyst costs you. The MDR figure uses the buyer-reported midpoint of about $17 per asset per month, which Rapid7 does not stand behind; treat both columns as directional.
The in-house column is salaries only — before a SIEM licence, tooling, training or the manager the rota needs — so it flatters building. The MDR column includes what a pure-play service would charge extra for: vulnerability scanning and incident response. It does not change the residency answer: Rapid7 has no India data region.
Three ways to consume it
Managed Threat Complete is quote-only. Buyer-reported pricing clusters around $15–22 per asset per month, midpoint near $17, with a 500-asset minimum commonly applied — directional rather than official, since Rapid7 does not stand behind those figures. The comparison mistake we see most often is pricing this against MDR alone: it bundles unlimited InsightVM scanning and unlimited incident response with no retainer, so price it against that pair. Note also that the SLAs are identical across all three tiers, so you are never buying a faster clock by upgrading. TechBag quotes in INR with GST.
Essential
The same SLAs as Ultimate
- 15-min critical investigation start — contractual, every tier
- Unlimited InsightVM scanning included
- Unlimited incident response, no retainer or hour cap
Advanced
Adds an advisor
- Two third-party products monitored
- A named cybersecurity advisor rather than a support pool
- Monthly meeting and posture guidance
Ultimate
Forensics and warranty
- Four third-party products monitored
- Velociraptor DFIR tooling — tooling, not consulting hours
- Breach protection warranty
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 10 questions to ask every MDR provider
Take this into your next vendor call — including ours.
Does CERT-In's in-India log rule or a sectoral obligation bind us? Rapid7 has no India region.
Have we planned a Rapid7 Agent rollout even though we already run another EDR? It is mandatory.
Which assets will NOT carry the agent, and do we accept they are outside the service entirely?
Have we read that Active Response is quarantine-endpoint and disable-user, and nothing else?
Which single third-party EDR will we configure, and who owns un-quarantining?
Are we choosing the tier on advisor and forensics rather than on response speed? The SLAs are identical.
Do we need on-site forensic attendance? All Rapid7 incident response is remote.
Are we pricing this against MDR plus vulnerability management, not against MDR alone?
Do we expect alerts closed in our other tools? Rapid7 works only inside its own platform.
Understood that we keep Incident Command if we leave the service?
Questions buyers ask
Ready to evaluate Rapid7 Managed Threat Complete?
Price it against MDR plus vulnerability management, check the residency answer first, or compare it with Falcon Complete and Sophos MDR — in INR/GST.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.