Question 1

What is Rapid7 and what does it actually sell?

Accepted Answer

Rapid7 is an American cybersecurity company, listed on NASDAQ as RPD, founded in Boston in 2000 and public since July 2015. It reported $860M of revenue for FY2025 and serves more than 11,500 customers. Wael Mohamed became chief executive on 1 June 2026, succeeding Corey Thomas, who led the company for thirteen years and now serves as executive chairman. The portfolio divides cleanly into three jobs. The first is finding your weaknesses: InsightVM scans assets for vulnerabilities and scores them, Surface Command discovers what you own and what is exposed to the internet, and Exposure Command bundles those together. The second is catching attacks: Incident Command — the SIEM renamed from InsightIDR in July 2025 — collects logs and endpoint telemetry and raises detections, while Threat Command monitors external digital risk. The third is doing the work for you: Managed Threat Complete is a 24/7 managed SOC built on Rapid7's own tooling. Around this sits an unusually credible open-source estate. Rapid7 has stewarded Metasploit, the penetration testing framework, since 2009, and acquired Velociraptor, an open-source digital forensics tool, in 2021. It runs Project Sonar, which scans the public internet, and AttackerKB, a community vulnerability assessment project. These feed the commercial products directly: exploit evidence from Metasploit and AttackerKB is one of the inputs to the Active Risk score that decides which of your vulnerabilities get fixed first. The honest summary of Rapid7's market position is that it is a strong mid-market platform rather than a top-end specialist. It is a Leader in exposure assessment and in MDR by analyst assessment, and a Challenger rather than a Leader in SIEM. If you are a 200 to 5,000 endpoint organisation with a small security team, that combination is often exactly right. If you are a large bank with a dedicated detection engineering function, you will likely find the SIEM constraining.

Question 2

How is Rapid7 priced, and what will it actually cost in India?

Accepted Answer

Rapid7 publishes list prices for three products and quotes the rest. InsightVM is published from $1.62 per asset per month at 500 assets, InsightAppSec from $175 per application per month, and InsightCloudSec from $5,775 per month for up to 500 instances. Incident Command, Exposure Command and Managed Threat Complete are quote-only. The important structural point is that the SIEM and MDR are metered per monitored asset, not per gigabyte of data ingested. An asset means a host running a workstation or server operating system that has reported data in the last thirty days. This is genuinely unusual and genuinely useful: a chatty firewall or a verbose application does not generate a surprise invoice the way it would on an ingestion-priced SIEM. Volume discounts begin above 500 assets and contracts are annual. For figures Rapid7 does not publish, treat everything you read as reported rather than official. Buyer-reported MDR pricing clusters around $15 to $22 per asset per month with a midpoint near $17, and a 500-asset minimum is commonly applied. Rapid7's own AWS Marketplace listings show SIEM tiers at roughly $21,479, $33,682 and $46,149 for twelve months at up to 500 assets. Enterprise deployments commonly land between $30,000 and $150,000 a year. We quote these because buyers ask, not because Rapid7 stands behind them. Two India-specific costs are routinely missed. First, InsightVM requires a Security Console that you host and maintain, and the hardware is substantial — twelve cores, 64 GB of RAM and 2 TB of storage at twenty thousand assets. The SIEM needs Collectors. That infrastructure is your capital cost, not Rapid7's. Second, if CERT-In log localisation applies to you, budget for a parallel in-India log store, because Rapid7 has no Indian region. Buying through TechBag, you are invoiced in INR by an Indian entity with GST charged and input credit available, so there is no foreign remittance paperwork, no LRS friction and no currency exposure between quote and renewal. We also fix the renewal uplift contractually. Rapid7 states around three percent a year; customers frequently report seven to ten percent when nobody negotiated it in advance.

Question 3

Should I buy the Command Platform bundle or individual products?

Accepted Answer

This is the most consequential commercial decision in a Rapid7 purchase, and the honest answer is that it depends on how many of the components you will genuinely use within twelve months. Rapid7's commercial motion clearly favours the bundle. InsightVM is now described on Rapid7's own site as the vulnerability management technology that powers Exposure Command. Exposure Command Essentials packages InsightVM with attack surface management, and Ultimate adds cloud and application security. Managed Threat Complete bundles the MDR service with unlimited InsightVM scanning and automation. Bundle discounts are real and are commonly reported in the range of eight to fourteen percent for two products, rising with the number of components committed. The case for bundling is genuine when you would otherwise buy the components separately anyway. Managed Threat Complete is the clearest example: unlimited InsightVM scanning is included in the per-asset MDR price, so an organisation that wants both a managed SOC and vulnerability management is frequently better off in the bundle than buying the two products standalone. Similarly, if you truly need external attack surface discovery, Surface Command ships in every Exposure Command tier rather than as a separate line item. The case against is equally real. Buying a platform to use one component is how organisations end up paying for three products and deploying one. If you need vulnerability management and nothing else, InsightVM remains separately purchasable, is not end-of-life, and carries the only published vulnerability management price Rapid7 offers. You will have to ask for that quote specifically, because it is not what the sales motion leads with. There is also a lock-in dimension worth naming. Gartner's 2025 caution on the SIEM states plainly that clients get the most out of the product when it is used alongside the broader Rapid7 suite. That is a fair description of a platform benefit and also a fair description of switching cost. Our practical advice: buy the bundle when you have a dated plan to deploy at least two components, and buy standalone when you do not. TechBag will quote both ways so you can see the actual difference rather than the discount percentage.

Question 4

How does Rapid7 compare with Tenable, Qualys, CrowdStrike and Microsoft?

Accepted Answer

We sell several of these, so here is the comparison as we give it privately. For vulnerability management, Tenable is the closest competitor and generally the stronger scanner. It carries the largest plugin library in the market at over 219,000, has a purpose-built operational technology product, and rates 4.6 out of 5 across more than 1,300 Gartner reviews against Rapid7's 4.3 across roughly 750. Buyers who move from InsightVM to Tenable typically cite dashboard flexibility and scan efficiency. Rapid7 answers with Remediation Projects and SLA goals, which turn findings into assigned, deadlined work better than most competitors, and with Scan Assistant, which achieves authenticated scanning without storing administrative credentials. Qualys VMDR's structural advantage is architectural: it is cloud-native, so there is no Security Console for you to host, patch and size. That directly answers InsightVM's most persistent criticism. Qualys also includes native patch management rather than integrating to SCCM or BigFix, and is rated notably better on support quality. If you want the lowest operational overhead, Qualys usually wins. For SIEM, be clear-eyed. Rapid7 is a Challenger in the 2025 Gartner Magic Quadrant; the Leaders are Microsoft, Splunk, Google, Securonix, Exabeam and Gurucul. Microsoft Sentinel wins Azure and Microsoft 365 estates on native integration and bundled economics. Splunk wins large multi-vendor enterprises. Rapid7 wins the mid-market team that wants working detections without a detection engineering function, and IDC named it a Leader specifically for SIEM in the SMB segment, which is the more defensible accolade. CrowdStrike is the strongest endpoint and MDR competitor and prices accordingly, typically $25 to $45 per endpoint per month for Falcon Complete against Rapid7's reported $15 to $22. If you already run Falcon, its exposure management module costs you no additional deployment. Microsoft Defender Vulnerability Management is close to free at the margin if you hold E5 licences, though it is weak on non-Microsoft operating systems, network devices and unmanaged assets. Where Rapid7 genuinely wins: one agent and one contract across vulnerability management, SIEM and MDR; per-asset rather than per-gigabyte metering; unlimited incident response with no retainer; and bundled vulnerability management inside MDR, which no pure-play MDR vendor offers. Where it loses: deep detection engineering, cloud-native application protection, and any deal where Indian data residency is mandatory.

Question 5

What are Rapid7's real limitations?

Accepted Answer

Six, stated plainly. The first and most important for Indian buyers is data residency. Rapid7's platform runs in five regions — the United States, Canada, Europe, Japan and Australia — and there is no India region. CERT-In's 2022 Directions require ICT logs to be maintained for 180 days within Indian jurisdiction. Rapid7's thirteen-month retention exceeds that duration but not the location requirement, so a regulated Indian entity generally needs a parallel in-India log store. The Pune Global Capability Centre provides people and support hours; it does not change where data sits. Second, the SIEM is not built for deep customisation. Gartner's published cautions state it lacks advanced analytics such as supervised machine learning and custom deep-learning models, and lacks the breadth of out-of-the-box compliance reports its competitors offer. Reviewers consistently report that reports group by only one field at a time, so you cannot group by user and destination simultaneously, and there is a default limit of 200 custom detection rules. Third, the vulnerability management product is hybrid, not SaaS. You must run a Security Console with a PostgreSQL database, and the sizing is heavy — 256 GB of RAM and 8 TB of storage at 400,000 assets. Reviewers report console memory exhaustion during parallel scans, report generation failing on memory, and scheduled scans taking twenty hours where a manual run takes three or four. Despite the Live Monitoring branding, users describe it as not genuinely real-time. Fourth, agent coverage has a real hole. The Rapid7 Agent performs local checks only and cannot perform remote or unauthenticated network checks, so an agent-only deployment misses exposed network services and TLS misconfigurations entirely. Fifth, MDR containment is narrower than most buyers assume. Active Response quarantines endpoints and disables users. That is the complete list. Incident response is remote-only, and the Rapid7 Agent remains mandatory even when a third-party EDR performs containment — assets without it are excluded from threat hunts and investigations. Reviewers on Gartner and G2 also report that the SOC sometimes closes incidents without sufficient explanation. Sixth, company context. Rapid7 guided FY2026 revenue to $835–843M, a two to three percent decline, and announced a roughly twelve percent workforce reduction in August 2026 to refocus on detection and response plus exposure management. Cloud security is not named as a strategic pillar, and InsightCloudSec sits well behind Wiz and Sysdig in analyst assessments. If cloud-native application protection is your primary requirement, look elsewhere. None of this affects the products we recommend above, but you should know it before signing a three-year term.

Question 6

Why buy Rapid7 through TechBag?

Accepted Answer

We are a software reseller based in Bengaluru, and we sell Rapid7's competitors too — Tenable, Qualys, CrowdStrike and Microsoft security among them. That is the first reason to talk to us. We have no incentive to steer you to Rapid7 when Qualys removes an on-premises console you do not want to run, or when your Microsoft E5 licences already cover most of what you were about to buy. We will tell you that before you spend, and we would rather sell you the right product this year than the wrong one once. The commercial mechanics matter in India. We invoice in INR from an Indian entity, with GST charged correctly and available as input credit. There is no foreign remittance, no Form 15CA/CB paperwork, and no exchange rate gap between the quote you approve and the invoice you pay. For quote-only products — which includes Incident Command, Exposure Command and Managed Threat Complete — we run the pricing conversation with the vendor, including asset-band placement and bundle structure, and we fix the renewal uplift contractually rather than letting it float to the seven to ten percent buyers commonly report. We are also direct about the residency question, which is the one most likely to derail a Rapid7 purchase in India. Before you invest weeks in an evaluation, we will establish whether CERT-In's 180-day in-India log rule binds your entity, and what the architecture has to look like if it does. If that answer rules Rapid7 out for your SIEM but leaves InsightVM perfectly viable, we will scope it that way rather than losing the deal quietly. On the technical side, we size the proof of concept against your real estate — your noisiest servers, your network appliances, your actual asset count — because scan duration, false positive volume and console resource consumption only show their true shape at your scale. We help you count assets correctly, since both undercounting and overcounting are expensive in different ways. And we map what you buy to the frameworks you actually report against: RBI's vulnerability assessment and penetration testing cadence, SEBI's CSCRF SOC efficacy requirements, and DPDP's reasonable security safeguards. Same licences, same vendor support, Indian paperwork, and honest advice about when a competitor fits you better.

Product	Licensing model	How you enter	Best for
InsightVM	Published from $1.62 per asset/month at 500 assets	annual term	annual term
InsightAppSec	Published at $175 per application/month	Published at $175 per application/month	Published at $175 per application/month
Incident Command	Quote-only, per monitored asset	not per GB ingested	not per GB ingested
Managed Threat Complete	Quote-only; buyer-reported ~$15–22 per asset/month, 500-asset minimum	Quote-only; buyer-reported ~$15–22 per asset/month, 500-asset minimum	Quote-only; buyer-reported ~$15–22 per asset/month, 500-asset minimum

Rapid7

Five intel pages. One unified observability platform.

Incident Command

InsightVM

Managed Threat Complete

InsightAppSec

Surface Command

Metasploit

InsightCloudSec

Why “one agent, one contract, priced per asset” is the whole story

The Command Platform is the wrapper, not a product

One agent serves several products

Collectors and sensors sit on your network

Priced per asset, not per gigabyte

Open source feeds the commercial products

Peer & market recognition

2025 Gartner MQ for Exposure Assessment

2025 Frost Radar for MDR

2025 IDC MarketScape Exposure Management

MDR

2025 Gartner MQ for SIEM

Forrester Wave for Unified VM

SCAP validated and USGCB certified by NIST

SOC 2 Type II, IRAP, FedRAMP

The company in six figures

See the platform, hear the pitch

Rapid7 Command Platform Capabilities

Overview Video: InsightVM

Rapid7 Managed Detection & Response (MDR)

Where Rapid7 sits — the grids

Rapid7 Across Its Platform

The Unification × Breadth Map

New to this? Learn it properly.

Where should you start with Rapid7?

What Rapid7 actually sells in 2026

InsightIDR is now Incident Command

How Rapid7 charges per asset

Rapid7 and CERT-In log localisation

InsightVM or Exposure Command

MDR versus building your own SOC

The acronym decoder

Buy it like you’ve done this before

Settle the data residency question first

Count your assets honestly

Decide standalone or platform

Run a proof of concept on real assets

Size the infrastructure you must supply

Negotiate the renewal, not just year one

The licensing cheat-sheet

Five pitfalls that cost buyers quarters

Assuming 13-month retention satisfies CERT-In

Buying the SIEM expecting deep customisation

Deploying agents only and calling it coverage

Missing the Active Risk score migration

Expecting MDR to contain more than it does

The evaluation kit

Skip the homework entirely

The forces shaping this market

Category momentum — estimated market growth

Exposure management absorbs vulnerability management

Agentic AI moves into the SOC workflow

Indian data localisation reshapes shortlists

Managed detection displaces the in-house SOC

Per-asset SIEM pricing challenges per-gigabyte

Consolidation pressure on mid-market security spend

Questions buyers ask about Rapid7

Ready to shortlist Rapid7?