Rapid7

What Rapid7 actually does

Rapid7 provides a cloud-based security platform covering vulnerability management, detection and response, and managed services. The Insight Platform ties together InsightVM (vulnerability management), InsightIDR (SIEM and XDR), InsightConnect (SOAR), and managed detection and response services.

InsightVM scans for vulnerabilities using a combination of network scanners and the Insight Agent deployed on endpoints. It risk-scores vulnerabilities based on exploitability and asset criticality and integrates with IT ticketing systems for remediation tracking. InsightIDR handles log ingestion, UEBA, and detection rules, with a lightweight SIEM approach that avoids the complexity of traditional log management platforms.

The MDR service — Rapid7 Managed Threat Complete — layers human analysts on top of InsightIDR to provide 24/7 detection and response. For mid-market teams without a full SOC, this is often the entry point into the Rapid7 ecosystem.

Who it’s best for

• Mid-market security teams (1-5 security staff) that need multiple capabilities from one vendor
• Organizations evaluating MDR services that also need vulnerability management
• Companies that want SIEM without the operational burden of managing Splunk or Elastic
• Security teams that value platform integration over point-product depth
• IT teams looking for vulnerability management with built-in remediation workflows

Pricing reality check

Rapid7 prices per-asset for InsightVM and per-asset or per-user for InsightIDR. MDR is priced as a managed service contract. The platform bundle is typically less expensive than buying best-of-breed products separately, which is a big part of the appeal.

Watch out for data ingestion costs on InsightIDR. Like any SIEM, the cost scales with log volume. Rapid7 is more predictable than some competitors, but ingestion-based pricing still requires capacity planning. The MDR service adds a meaningful premium but removes the need for 24/7 analyst coverage internally.

Alternatives to consider

• Tenable + any SIEM — If vulnerability management depth matters most, Tenable’s scanner is stronger. But you lose the platform integration.
• Arctic Wolf — MDR-focused competitor. Stronger managed service, but no self-operated vulnerability management or SIEM option.
• CrowdStrike Falcon — Broader endpoint and identity coverage. Different approach — starts with the endpoint agent rather than the network scanner.
• Microsoft Sentinel + Defender — If you’re a Microsoft shop, the native SIEM and vulnerability management may be more cost-effective, especially with E5 licensing.

The Charting Cyber take

Rapid7’s strength is the platform play. If you’re a mid-market team trying to run vulnerability management, SIEM, and detection and response without a 20-person SOC, consolidating on Rapid7 reduces operational overhead. The products talk to each other natively, and the MDR service fills the staffing gap.

The tradeoff is depth. InsightVM is a solid vulnerability scanner but won’t match Tenable’s coverage breadth. InsightIDR is a competent SIEM but won’t satisfy teams that need the flexibility of Splunk. Each product is good enough, and the integration makes the whole greater than the parts. That’s either a compelling value proposition or a frustrating compromise, depending on your requirements.