Listopedia

Rapid7

InsightVM vulnerability management packaged into Rapid7's Exposure Command

Overview

Rapid7 Incident Command is the detection and response product that Rapid7 previously sold as InsightIDR; the InsightIDR product address now presents Incident Command[16]. It packages SIEM detection, triage, investigation and reporting with cyber asset attack surface management (CAASM), external attack surface management (EASM), SOAR automation and AI-powered features, and Rapid7 describes it as combining total attack-surface context with AI that turns signals into action[16].

Unlike most SIEMs in this list, Rapid7 prices by asset rather than by data volume. It sells three packages, Incident Command Essential, Advanced and Ultimate, all with 13 months of searchable retention and the option to add more[16]. Asset-based pricing makes budgets easier to predict for organisations that generate large log volumes from a modest number of endpoints and users. Rapid7 also offers managed detection and response services on the same technology.

Rapid7 reported revenue of US$0.86 billion for 2025, the smallest of the publicly listed vendors here[25]. The product is aimed at mid-market security teams; very large enterprises with complex custom detection engineering requirements more often choose the larger platforms above.

Rapid7 features

  • Scan engines plus endpoint agent
  • Attack surface management in Essentials
  • Cloud and application security in Ultimate
  • Exploit context from Metasploit research
  • Remediation projects and tracking
  • Live dashboards
  • SIEM detection, triage, investigation and reporting
  • Cyber asset attack surface management (CAASM)

Rapid7 pricing

Quote-based. Packaged as Exposure Command Essentials or Ultimate; no per-asset prices published on the pricing page.

Rapid7 strengths and limitations

Strengths

  • Exploit-aware prioritisation
  • Agent and scanner coverage in one product
  • Remediation workflow suited to large IT teams
  • Bundles attack surface management
  • Predictable per-asset pricing rather than per GB
  • Attack-surface context included in higher packages

Limitations

  • No published prices
  • Product renaming makes comparisons harder
  • Smaller vendor than the platform leaders
  • Web app scanning requires a higher package
  • Rename from InsightIDR may confuse buyers and documentation
  • Less flexible for heavy custom detection engineering

Appears in

Rapid7 alternatives and competitors

Alternatives to Rapid7: companies ranked in the same lists.

Is this your company?

Update the description, logo, image and link through the submission form. Editors review every change.

Update this listing

Is your company missing from a list?

Send your logo, description and link. Editors review every submission, and approved listings are clearly labelled.

Add your company