- BFSIBanking, Financial Services & Insurance
- IT & ITESIT services, BPM, GCCs & SaaS
- Retail & e-commerceStore chains, D2C brands & marketplaces
- HealthcareComing soon
- ManufacturingComing soon
Rapid7 InsightAppSec
Dynamic testing that reports what actually worked — Rapid7 InsightAppSec attacks your running applications the way an external tester would, and every finding carries the exact request that produced it, so developers reproduce it rather than dispute it. Published at $175 per application per month.
Buy through TechBag
Same software. Better outcome — at a lower cost.
How it’s rated
Full scoreboard ↓Data residency & processing — answered by definition
Where data lives
Offshore — there is NO India region
Rapid7’s platform runs in five regions: the United States, Canada, Europe, Japan and Australia. Verified against Rapid7’s own trust page. For an Indian entity that means Tokyo or further afield, and it is the constraint most likely to decide this purchase.
Where it is processed
On-prem engines scan locally; findings go offshore
Rapid7-hosted engines attack internet-facing applications from Rapid7’s cloud; on-premises engines keep the scanning inside your network. Either way, findings, attack replays and reports are stored on the Insight Platform — which has no India region.
Scan findings are not the ICT logs CERT-In’s 180-day rule is about, so that rule is not the binding test here. What binds is contractual and sectoral — a data-handling clause, or an internal policy that treats vulnerability data as restricted. Take that seriously: findings describe exactly how your applications can be attacked, down to the request that works. TechBag gets Rapid7’s written position on where finding data rests as part of the quote; if it must stay in India, you need a DAST tool you can run entirely on your own infrastructure.
Quick answer
The Rapid7 platform family
This page covers Rapid7 InsightAppSec — dynamic application security testing (DAST). The other pillars:
Quick facts
30-second orientation- Category
- Dynamic application security testing (DAST)
- Vendor
- Rapid7 — CEO Wael Mohamed (June 2026)
- Published price
- $175 per application per month — rare transparency
- Deployment
- Cloud-hosted, with optional on-premises scan engines
- Targets
- Web applications · APIs · single-page apps
- Coverage
- OWASP Top 10 and a broader attack-module library
- Key feature
- Attack replay — developers reproduce the finding themselves
- CI/CD
- Runs inside build pipelines, not as an annual event
- Ticketing
- Jira and ServiceNow integration
- Authentication
- Supports authenticated scanning of logged-in areas
- Data residency
- NO India region — nearest is Tokyo
- Data processing
- Rapid7 cloud; on-prem engines scan locally, findings go to the platform
- What it is not
- DAST only — not SAST, not SCA, not a pen-test replacement
- CERT-In
- Rapid7 is NOT an empanelled auditor — this supplements one
- Buy in India via
- TechBag — INR, GST, per-application scoping
Understand dynamic testing before you buy it
Most product pages skip this. We start here — so you buy a capability, not a buzzword.
What is it?
Dynamic application security testing. It crawls your running web applications and APIs, attacks them the way an external tester would, and reports what actually worked.
An annual external test vs InsightAppSec — the honest table
What changes when application testing runs per release instead of per audit.
| Dimension | Annual external test | InsightAppSec |
|---|---|---|
| Cadence | Once or twice a year | Every build, from the pipeline |
| Evidence | A PDF report | A replayable request per finding |
| Developer response | Disputes the finding | Reproduces it, then fixes it |
| Pricing | Per engagement, quoted | $175 per app/month, published |
| Business-logic flaws | A skilled tester finds them | Mostly missed — keep the tester |
| Source code | Out of scope | Out of scope — DAST only |
| Honest caveat | — | Crawl coverage decides everything |
| Best fit | — | Few internet-facing apps, per-release VAPT |
DAST covers the running application only — pair it with SAST, SCA and a qualified tester.
The six pieces of the platform
Vendors love diagrams; buyers need to know what they’re actually operating. Here’s the whole platform, demystified.
Scan Engine
Rapid7 hosts scan engines in its cloud for internet-facing applications, and you can deploy on-premises engines to reach internal applications that are not publicly routable. The on-premises option matters for Indian buyers with internal customer-facing systems, because the scanning itself then happens inside your network even though findings flow to the platform.
Crawler
Before attacking anything, InsightAppSec crawls the application to build a map of pages, forms, parameters and API endpoints. Coverage of that crawl determines everything downstream — a DAST tool cannot test what it never found, which is why authenticated scanning and correct crawl configuration matter more than the size of the attack library.
Attack modules
A library covering the OWASP Top 10 and well beyond it — injection, cross-site scripting, authentication and session handling, access control, misconfiguration. Each module submits real requests against the running application and records what the application did in response, rather than inferring from code.
Attack replay
Every finding is stored with the exact request that produced it, replayable by a developer. This is the difference between a report a development team disputes and a report they act on, and it is the single most useful thing about the product in day-to-day use.
CI/CD integration
Scans trigger from build pipelines so application testing becomes part of the release process rather than a quarterly or annual exercise. For SEBI CSCRF's per-release VAPT expectation this is the mechanism that makes the obligation practical rather than painful.
Insight Platform
Findings, trend reporting and the Jira and ServiceNow integrations live in Rapid7's cloud. This is also where the residency constraint bites: there is no India region, so finding data — which describes exactly how your applications can be attacked — rests offshore.
Crawl first, attack second, and keep the exact request that proves every finding.
Ten capabilities. Crawl, attack, prove.
InsightAppSec maps your running applications and APIs, attacks them with a library well beyond the OWASP Top 10, and stores the request behind every finding so developers can replay it. Here is what is inside.
Application crawling
Maps pages, forms, parameters and API endpoints before any attack module runs, since untested surface is invisible surface.
API testing
Tests REST and API endpoints directly, including those that have no user interface at all.
Single-page app support
Handles JavaScript-driven applications where the traditional crawl-a-link-tree approach finds almost nothing.
Authenticated scanning
Logs into the application so the testing reaches the parts that matter, rather than stopping at the login page.
OWASP Top 10 coverage
Exercises injection, broken access control, misconfiguration and the rest of the canonical list against the running application.
Broad attack modules
Applies a library well beyond the Top 10, recording what the application actually did rather than what the code implies.
Attack replay
Stores the exact request behind every finding so a developer can reproduce it instead of disputing it.
CI/CD pipeline scanning
Triggers scans from builds so testing happens per release rather than per audit cycle.
Jira and ServiceNow tickets
Pushes findings into the systems developers already work in, which is where remediation actually happens.
Trend and compliance reporting
Shows whether application risk is falling over time — the evidence a regulator or a board asks for.
Watch Rapid7 InsightAppSec in action
Dynamic testing, and InsightAppSec wired into a Jenkins pipeline.
Rapid7 InsightAppSec
Application security testing, presented by Rapid7.
Solution Video: Integrating Rapid7 InsightAppSec and Jenkins
Scans triggered from a build pipeline.
Want a live, India-context walkthrough for your environment?
Book a guided demo →Test what is deployed, not what is written.
Here’s what genuinely sets InsightAppSec apart — and what it will never cover.
Attack replay ends the false-positive argument
The recurring failure mode in application security is not detection, it is credibility. A scanner reports an issue, a developer says it is a false positive, and three weeks disappear into a dispute nobody can settle because neither side can reproduce the finding on demand. InsightAppSec stores the exact request that produced each finding, replayable by the developer. The conversation changes from "is your scanner wrong" to "here is the request, run it yourself". That is a small technical feature with a large organisational effect, and it is the thing practitioners consistently cite as what makes the product usable. Dynamic testing helps here structurally too: because it only reports what it actually managed to do against the running application, the base rate of theoretical noise is lower than static analysis produces.
Published pricing, which almost nothing in this category has
Rapid7 publishes InsightAppSec at $175 per application per month. In a category where nearly every competitor is quote-only, that transparency is worth more than it first appears. It means you can size a programme without entering a sales process, start with the three or four applications that genuinely face the internet, prove the value, and expand — rather than negotiating an enterprise agreement for a capability you have not yet demonstrated internally. It also makes the budget conversation simple: per-application pricing is a number a finance function can check against a list of applications. The obvious caveat is the other side of the same coin — a large application portfolio adds up quickly, and at that scale you should be negotiating rather than paying list.
It maps onto the Indian regulatory obligation directly
SEBI's CSCRF expects VAPT after every major release, and RBI expects penetration testing of customer-facing systems on a defined cadence. Both are per-application, per-release obligations, and both are painful if your testing model is an annual engagement with an external firm. InsightAppSec's CI/CD integration makes per-release testing mechanically feasible, and its per-application pricing lines up with a per-application obligation rather than fighting it. Be precise about the limits, though, because this is where vendors overclaim. Automated DAST supplements a penetration test; it does not replace one, and no regulator treats a scanner as equivalent to a qualified tester. Rapid7 is also not a CERT-In empanelled auditor — we verified this against CERT-In's own published empanelment list — so where an empanelled audit is required, you still need one. What this gives you is continuous coverage between those engagements, and the evidence trail to show it.
Testing what is deployed, not what is written
Static analysis and dynamic testing answer different questions, and buying one believing you bought the other is a common and expensive mistake. Static analysis reads source code and flags what might be exploitable — valuable, but it produces volume, and much of that volume is unreachable in practice. Dynamic testing exercises the deployed application, with its real configuration, its real authentication, its real infrastructure in front of it, and reports what actually worked. That means it catches classes of problem static analysis structurally cannot see: a misconfigured server, an authorisation flaw that only appears once the application is assembled, a vulnerable component reachable only through a specific deployed path. The converse is equally true and worth stating plainly: DAST cannot see code it never reaches. If a feature is behind a flag, or a crawl misses a route, it is untested. Coverage of the crawl matters more than the size of the attack library.
The honest caveat: it is one tool, not a programme
InsightAppSec is DAST and nothing else. It is not static analysis, not software composition analysis for your dependencies, and not a penetration test. A complete application security programme needs at least SAST or SCA alongside it — and Rapid7 does not sell those, so this will not be your single-vendor answer. Three more limits. Coverage is bounded by the crawl: authenticated scanning has to be configured correctly or you are testing your login page and little else, and single-page applications need more configuration care than traditional ones. Pricing is per application, so a portfolio of eighty applications is a different commercial conversation from a portfolio of five. And the residency constraint applies here as everywhere else in Rapid7's cloud portfolio — there is no India region, so your finding data, which is a precise description of how your applications can be attacked, rests offshore. On-premises scan engines mean the scanning happens locally, but the findings still flow to the platform.
The honest positioning
InsightAppSec is a good fit for an organisation with a manageable number of internet-facing applications, a development team that will actually act on findings, and a regulatory obligation to test per release. Published pricing lets you start small and prove it. Attack replay makes the findings credible to developers, which is the difference between a tool that gets used and one that gets ignored. It is the wrong choice if you need a single-vendor application security platform covering SAST, SCA and DAST together — Rapid7 does not have that. It is the wrong choice if your portfolio is very large, where the per-application model works against you and you should be negotiating a different structure. And if Indian data residency binds you for finding data specifically, weigh that carefully: the on-premises engine option helps with where scanning happens, but not with where results live. We sell alternatives and will say so where one fits you better.
The numbers behind the platform
What your Rapid7 InsightAppSec rollout looks like
Count the applications that genuinely face the internet
Per-application pricing rewards precision here. Most organisations have far fewer truly internet-facing applications than their application inventory suggests, and starting with those three or four proves the programme without an enterprise commitment.
Settle where finding data may rest
There is no India region. Finding data describes exactly how your applications can be attacked, which is sensitive by any standard. If residency binds you, decide now whether on-premises scan engines — which keep the scanning local but not the results — are sufficient for your obligation.
Configure authenticated scanning properly
This is where DAST deployments succeed or quietly fail. An unauthenticated scan tests your login page. Getting authentication and the crawl configuration right, especially for single-page applications, determines whether you are testing the application or its front door.
Wire it into the build pipeline
Scans triggered by builds turn application testing from an annual event into a per-release control, which is what SEBI CSCRF actually expects. Push findings into Jira so the work lands where developers already are rather than in a security tool they will not open.
Pair it with SAST or SCA, and with a real pen test
InsightAppSec is one instrument. Dependencies need software composition analysis, source code needs static analysis, and regulators expect a qualified tester — Rapid7 is not CERT-In empanelled. Plan the programme around it rather than expecting it to be the programme.
The review scoreboard
Modelled on Gartner Peer Insights structure. *Counts and breakdowns are illustrative pending verified review collection.
Quick poll — what’s driving your evaluation?
Talk to an advisor“Attack replay stopped the arguments. Developers run the request themselves and the debate is over in a minute.”
“We started with four internet-facing apps because the price was published. No sales process, no enterprise agreement.”
“CI/CD integration made per-release VAPT feasible for us. Doing that manually was never going to happen.”
“Configuring authenticated scanning on our single-page app took real effort. Budget time for it, not just licence.”
“It is DAST only. We still needed SCA for dependencies, and that was a separate vendor conversation.”
Where everyone sits — the grids
Analyst firms bury this view behind paywalls, and G2 retired its Grid. So here’s TechBag’s synthesis of the security platforms Rapid7 meets in deals — tap any vendor to see why it sits where it does.
TechBag Security-Platform Grid
Execution strength vs product vision — the classic market map, minus the paywall.
Mid-market platform — one agent, one contract.
Depth × Breadth
Depth in each vendor’s strongest discipline vs platform breadth — the context InsightAppSec is sold in.
Breadth over depth — that is the deliberate trade.
Positions are TechBag’s illustrative synthesis of public review-platform data and vendor documentation — not a reproduction of any analyst graphic. Verify before relying on it.
Rapid7 InsightAppSec vs the field
This table compares Rapid7 as a platform; the DAST alternatives are in the verdicts below. InsightAppSec wins on published pricing and attack replay — and it is DAST only.
| Dimension | Rapid7 | Tenable | Qualys | CrowdStrike | Microsoft |
|---|---|---|---|---|---|
| Position | Mid-market platform: exposure, SIEM and MDR on one agent | The strongest scanner in the category | Cloud-native, lowest operational overhead | The endpoint and MDR benchmark | Near-free at the margin with E5 |
| Pricing axis | Per monitored asset — not per GB ingested | Per asset, quote-led | Per asset, reported ~$199–250/yr | $25–45 per endpoint/month for Falcon Complete | Bundled into E5 licensing |
| Vulnerability management | InsightVM — published price, Active Risk scoring | 219,000+ plugins, dedicated OT product | Cloud-native, native patching included | Exposure module if you already run Falcon | Weak on non-Microsoft OS and network devices |
| SIEM | Challenger in the 2025 MQ — not a Leader | Not a SIEM vendor | Not a SIEM vendor | Falcon Next-Gen SIEM | Sentinel — a Leader |
| MDR | Frost Radar Leader; VM and unlimited IR bundled in | Not an MDR vendor | Managed services available | Falcon Complete — the benchmark | Defender Experts |
| Deployment | SIEM and MDR cloud-only; InsightVM console is yours | Cloud or on-premises | Cloud-native only | Cloud-native only | Azure-hosted |
| India data residency | NO India region — InsightVM console is the exception | Region options; verify for your product | India platform, Pune-engineered | Verify per product | Azure India regions |
| The thing to plan around | No India region; agent mandatory; FY26 guided down | Priced above Rapid7 at most tiers | Support quality rated well; scanning less deep | The most expensive option here | Only economic if you already hold E5 |
| Best fit | Mid-market wanting VM, SIEM and MDR from one vendor | Deepest scanning, or operational technology | Lowest operational overhead, native patching | Best-in-class endpoint and managed response | Microsoft-standardised estates with E5 |
Does Rapid7 InsightAppSec fit you?
Honest fit signals — because the fastest way to lose your trust is to pretend one product wins every scenario.
Choose InsightAppSec if…
- ✓You have a manageable number of genuinely internet-facing applications
- ✓SEBI CSCRF per-release VAPT or RBI penetration testing is a live obligation
- ✓You want published pricing so you can start with four apps and prove the programme
- ✓Your developers need reproducible evidence, not a report they will dispute
Choose Tenable Web App Scanning if…
- ✓You already run Tenable for vulnerability management
- ✓You want web-app findings in the same console as your infrastructure scans
Choose Qualys WAS if…
- ✓You already run Qualys VMDR and want one vendor for both
- ✓Qualys’s India platform answers where finding data may rest
Add SAST and SCA if…
- ✓You need to find flaws in source code before it is deployed
- ✓Your dependencies need scanning — Rapid7 sells neither
Commission an empanelled auditor if…
- ✓Your regulator requires a CERT-In empanelled audit — Rapid7 is not empanelled
- ✓You need business-logic testing no scanner performs
Rapid7 InsightAppSec is one of 20 vulnerability management products TechBag carries. The Vulnerability Management guide narrows them to a shortlist and shows the reasoning. →
Per application — so count the ones that face the internet
InsightAppSec is published at $175 per application per month, so the licence is simple arithmetic — and the number that matters is how many applications you actually test. Start with the ones that genuinely face the internet, not the whole inventory. The second slider turns the licence into a cost per release tested, which is the unit SEBI CSCRF’s per-release VAPT expectation is really asking about. List price, converted at indicative rates.
The more often you release, the cheaper each tested release becomes — which is the argument for wiring scans into the pipeline rather than running them before an audit. What this does not buy: SAST, dependency scanning, or the qualified tester your regulator still expects. Above a few dozen applications, negotiate a structure rather than paying list.
Three ways to consume it
InsightAppSec is published at $175 per application per month, roughly $2,100 per application per year — genuine transparency in a category where almost everything is quote-only. That lets you size a programme without a sales process, start with the three or four applications that genuinely face the internet, and expand once findings are being acted on. The same fact scales against you: an eighty-application portfolio is a very different conversation, and at that point you should be negotiating a structure rather than paying list. TechBag quotes in INR with GST.
Per application
Published — rare in DAST
- Roughly $2,100 per application per year
- Start with only the apps that genuinely face the internet
- Attack replay on every finding, so developers reproduce it
Scan engines
Reaching internal apps
- Rapid7-hosted engines for internet-facing applications
- On-premises engines for apps that are not publicly routable
- Scanning stays local; findings still flow to the platform
What it is not
DAST only
- Not SAST — it never reads your source code
- Not SCA — dependencies need separate tooling
- Not a pen test, and Rapid7 is not CERT-In empanelled
Buy it for less — TechBag pricing beats list
Whatever the list prices above, TechBag negotiates a significantly better deal — with GST-compliant INR invoicing and local support. Ask us for your discounted quote.
Get an India-ready quote
Tell us your requirements and current tools — we’ll model it against what you spend today.
The 10 questions to ask every DAST vendor
Take this into your next vendor call — including ours.
How many applications genuinely face the internet, as opposed to sitting in the inventory?
At $175 per application per month, what does our real portfolio cost — and should we be negotiating?
Where may finding data rest? There is no India region, and findings describe how to attack us.
Do we need on-premises scan engines for internal applications that are not publicly routable?
Who will configure authenticated scanning, and have we budgeted time for single-page apps?
Have we verified the crawl reaches the application, not just the login page?
Which build pipelines will trigger scans, and does that satisfy our per-release obligation?
What covers SAST and dependency scanning? Rapid7 does not sell either.
Do we still need a CERT-In empanelled auditor? Rapid7 is not empanelled.
Who fixes what the scans find, and within what agreed timeframe?
Questions buyers ask
Ready to evaluate Rapid7 InsightAppSec?
Scope the applications that genuinely face the internet, settle where finding data rests, or plan the SAST and SCA that sit alongside — in INR/GST.
Stats, ratings, review counts and pricing are illustrative and sourced from public materials; verify before purchase.