Rapid7 Exposure Command Reviews

My main use case for Rapid7 Exposure Command involves several different applications within our company. I started by reviewing the vulnerability management component, but have primarily worked with the AppSec portion of the platform.

A specific example of how I use Rapid7 Exposure Command in my AppSec work involves scanning different web applications that our company owns or operates, particularly those related to our subsidiaries and main websites. I scan these applications for vulnerabilities, and the results allow me to identify the responsible parties who need to patch them, whether that's a service provider or someone internally. Once identified, we proceed to fix and patch these vulnerabilities.

I also use Rapid7 Exposure Command on a day-to-day basis by setting up weekly scans for each web application, ensuring that there is always something running to alert us if vulnerabilities emerge. I create a quick report from these scans and open tickets documenting which vulnerabilities are present and what needs to be fixed.

Rapid7 Exposure Command has positively impacted my organization by allowing us to identify where we need to strengthen our security measures. As technology evolves, there is always something that can be exposed. With Rapid7 Exposure Command, we ensure everything is patched and secure across our company, making it a great tool for maintaining our security posture.

While I do not have exact metrics, I would say Rapid7 Exposure Command has helped reduce the number of vulnerabilities in our environment and saved my team considerable time by eliminating the need to go through things manually or find other ways to keep our systems secure. We can see when employees have not updated their computers or when their browsers need updates, and the platform provides a score for our system that shows us how secure we are overall. Each vulnerability comes with a CVSS score, which helps ensure our employees are educated on the importance of updates for both security and company reputation.

Rapid7 Exposure Command offers several best features, including the ability to schedule scans, staying up to date with current vulnerabilities, and providing trustworthy results. It is also easy to set up scans for different applications, and the platform provides recommendations on how to fix vulnerabilities.

Additionally, I can replay the attacks that Rapid7 Exposure Command ran so I can see exactly where the vulnerability is located and what kind of attack it represents, showcasing the thorough information the platform provides.

Regarding Rapid7 Exposure Command's AI features, I find that it runs itself once it is set up. While I did not set it up myself, I run scans, let it operate, view results, and find fixes for the identified vulnerabilities. It truly runs itself and provides the information needed to help us be a more secure company.

I believe the accuracy and reliability of the output from Rapid7 Exposure Command are quite good, and the information we receive is accurate. However, there have been instances where a vulnerability appears as a false positive due to protocols or security configurations that our service provider has in place, which are not visible from our end. While vulnerabilities may appear present, it does not necessarily mean they truly are vulnerable, and it is helpful to know what needs to be handled by our service provider rather than remaining in the dark about potential issues.

Rapid7 Exposure Command could be improved by addressing user error that sometimes results in validated vulnerabilities reappearing after scans have been completed. While it is a very good tool, I would suggest allowing scans to remove items that we have marked as false positives. I can speak most comfortably from the AppSec side, and it appears the platform stays up to date with everything and provides recommendations for fixes.

I have been using Rapid7 Exposure Command for approximately one year and a half.

On a scale of one to ten, I would rate Rapid7 Exposure Command as an eight or nine.

I choose an eight or nine rating for Rapid7 Exposure Command because it is a very good product. While I do not know if I would give anything a perfect score because there is always room for improvement, Rapid7 Exposure Command has been very easy to learn and insightful for someone who is relatively new to cybersecurity. The platform has shown me how vulnerabilities work and how to use similar tools effectively. I would recommend Rapid7 Exposure Command over anything else.

Rapid7 Exposure Command is deployed as a private cloud.

I believe our organization uses Azure as our cloud provider.

My advice for others looking into using Rapid7 Exposure Command is that it is a great tool for companies of any size, helping reduce time spent setting up scans and ensuring constant surveillance of your network. Rapid7 Exposure Command is crucial for any business, especially considering the current cybercrime environment, so my recommendation is to implement Rapid7 Exposure Command.

I use Rapid7 Exposure Command for vulnerability management by managing the priority of risk exposure for several assets.

I decide which assets to prioritize in Rapid7 Exposure Command by checking the most common exploitable vulnerability on an asset that can be in a production environment. This helps me prioritize sensitive assets for the organization.

I also use Rapid7 Exposure Command for the cloud with InsightCloudSec.

These positive impacts include saving time and improving reactivity for taking action.

When notifications are set up, Rapid7 Exposure Command can notify us directly on the facts that we have on the asset and we can get the information quickly. However, this depends on where we are able to communicate and take action.

The features I found most valuable while using Rapid7 Exposure Command are reporting and the dashboard.

What I appreciated most about the reporting and dashboard features in Rapid7 Exposure Command is that they really expose and detail the main assets that are impacted.

I would like to add that Rapid7 Exposure Command's compliance with NIST 2 and ISO 27001 stands out.

I think Rapid7 Exposure Command could be improved by the way asset discovery and agent deployment are conducted.

There are no other improvements needed for Rapid7 Exposure Command that I have not mentioned.

I would rate the customer support of Rapid7 Exposure Command an eight.

For cloud deployment, I use AWS.

I chose seven out of 10 because most of it relates to the rapid way to take action on the console and the notification.

My advice for others looking into using Rapid7 Exposure Command is to be able to customize reporting to monitor the asset.

My primary use case for Rapid7 Exposure Command includes internal vulnerability management, external vulnerability management, EASM, and automation.

With Rapid7 Exposure Command, I have access to InsightVM, where I deploy a security console at the customer's location, multiple scan engines, and connect the platforms to the console, then proceed with scans and maintain the customer's vulnerability management updates.

InsightVM is utilized for internal vulnerability management; for external vulnerability management, I use EASM, which is part of Rapid7's exposure management package. It is not as accurate and useful as internal management, but it still gives you an attack surface to consider. You need to be prepared to understand what it tells you. It is not straightforward.

Rapid7 Exposure Command has had a positive impact on my organization, as I am able to offer customers a 360-degree vulnerability management or vulnerability assessment service, and I am also able to provide EASM coverage to customers. What I cannot do is perform assessments on web applications, so DAST cannot be done with these tools. It is necessary to purchase other tools separately.

I have measured the positive impact of this solution through risk reduction, which is the number one task of vulnerability management, and after that I can also say that it is an excellent product for asset inventory, even though that is not its specific primary function.

The competitive price compared to purchasing only one of the three packages is one of the best features offered by Rapid7 Exposure Command. I would not consider the automation part particularly effective, while vulnerability management is, I would say, a seven, quite good.

Regarding vulnerability management, all the vulnerability management solutions I have used are very valid. Rapid7's strength lies in continuous scanning performed with agents and an excellent scan profile provided by the internal scan engines on many devices, so we span from Windows to all Linux interfaces, to roughly all appliances on the market, including network hardware, hypervisors, cameras, and printers. It is a very diverse ecosystem that allows you to scan everything.

Regarding the accuracy and reliability of the results obtained with Rapid7 Exposure Command, it is not fantastic, but it does not say nonsense. Everything it says reflects reality.

Rapid7 Exposure Command could absolutely be improved by giving it the ability to perform controlled scans with agents, because currently agents self-report to the console every six hours. They do it on their own; they decide when to do it. Instead, I would like a product where I ask the agent to do an internal report and not a scan executed by the scan engine toward the asset.

The graphical interface of Rapid7 Exposure Command is terrible right now.

I have been using Rapid7 Exposure Command for one year.

Rapid7 Exposure Command is stable in my experience.

Based on my experience, I would give Rapid7 Exposure Command a rating of four point five for scalability in terms of complexity.

The customer support of Rapid7 Exposure Command is very good; they always respond quickly and competently.

On a scale from one to ten, I would rate the customer support of Rapid7 Exposure Command as an eight.

I was not actually using a different solution. I started with Rapid7 and I am continuing to use it, although I am exploring other options.

Everything can be managed by a single competent person, so I have already achieved a return on investment.

My experience with prices, setup costs, and licenses is good.

Before choosing Rapid7 Exposure Command, I evaluated other options such as Qualys and Tenable.

On a scale from one to ten, I would give Rapid7 Exposure Command a seven point five.

The reason I assign seven point five is that it could be better, as I mentioned, given that it has the capability but not the ability to control agents; however, it is still an excellent product, it is solid because it does not crash, it works well, the customer is happy, and we know how to use it effectively. Then there are improvements, of course. For example, they could improve the APIs a bit; they are quite poor, but overall, it is good, so seven point five.

Rapid7 Exposure Command is implemented in my organization using all options based on usage, including public cloud, private cloud, hybrid, and on-premises.

If you want something that works and costs little, I recommend going ahead and taking Rapid7. If, instead, you want a Ferrari or something super fancy, take Tenable.

I use the product on and off as we are Trillium, a Rapid7 distributor. For pre-sales purposes and to study the features, we maintain contact with Rapid7 Exposure Command.

I find two to three features of Rapid7 Exposure Command most valuable. First, the attack surface management is exceptional. Rapid7 is fundamentally a vulnerability management product, and this represents their unique strength. When they perform attack surface management through scanning of public IPs, DNS reputation, and public domains of a customer, they excel at finding vulnerabilities and relating them to relevant CVEs and CVSS scoring systems, providing appropriate risk ratings. This attack surface management feature is quite strong.

Another valuable feature is dark web exposure monitoring. They scan and crawl dark web channels such as Telegram and other dark web forums and leak forums to check whether particulars linked with a customer's domain, credentials, or other IPs are for sale on the dark web or if data has leaked elsewhere. They report these findings comprehensively.

Rapid7 Exposure Command provides me with satisfaction knowing that my external attack surface and digital risk are being monitored. Every organization is exposed to the internet world, and Rapid7 Exposure Command provides visibility into how much we are exposed to the internet and whether our critical data or critical vulnerabilities are exposed to the public. If they are exposed publicly, both good actors and malicious actors operate online, and the malicious actors will leverage such exposure. This visibility is necessary and is being provided effectively by Rapid7 Exposure Command.

I believe there are two to three areas where Rapid7 Exposure Command can be improved. First, cloud integrations and the ability to assess cloud posture are essential components of an organization's external attack surface nowadays. Rapid7 Exposure Command has the cloud posture assessment feature, but in my opinion, it should be linked with cloud compliance requirements being introduced locally and internationally.

Secondly, regarding data criticality, Rapid7 Exposure Command integrates the DSPM feature, which stands for Data Security Posture Management. I believe this feature is present, but it requires enhancement with global data protection regulations such as GDPR.

I am learning about more features in products such as Rapid7 Exposure Command. I mentioned cloud posture assessment across Oracle Cloud, Azure Cloud, and AWS Cloud. Features specific to these cloud offerings would be beneficial. With AWS having separate cloud offerings, Rapid7 Exposure Command must cover all available AWS offerings and relevant services. To be honest, this is an area where I am still learning, so I cannot provide a precisely detailed answer.

I first worked on Rapid7 Exposure Command around one and a half years ago.

Rapid7 has very good technical support staff, and I would rate their job at nine out of ten.

Intelligent automation plays a very crucial role in refining my risk prioritization process because, in recent years, security researchers and leaders have realized that security tools alone are insufficient to deal with security threats. We must stay ahead of attackers, and achieving this requires very effective threat intelligence automation operations, which are directly linked with countermeasures to threats. The term threat hunting emphasizes the need for proactiveness in our daily conversations. Cybersecurity is not simply about a reactive approach; we must be proactive, and to effectively address cyber threats, threat intelligence is a key requirement.

I use two to three metrics to measure the effectiveness of Rapid7 Exposure Command's real-time reporting capabilities. I assess how good the reports are, how concise they are, and whether the information is relevant. There is a possibility of many false positives when dealing with attack surface management and internet crawling, including deep and dark web crawling. Therefore, report quality depends on how effectively false positives are being filtered, and a very concise, actionable, and to-the-point report is a key metric for determining a good product.

Rapid7's user-friendly interface has helped my security team make informed decisions. I have been working with Rapid7 products for seven to eight years. One of their very good features is that their products are user-friendly, and I require around three to four days maximum to become familiar with their products. If a new product is released, I need only three to four days to become accustomed to the interface. The interface is very user-friendly, and there are informational texts where further details are helpful; hovering over them provides very good explanations as well as definitions of technical terms.

In the Pakistani market, Rapid7 Exposure Command's pricing is on the expensive side, and that represents one of the challenges we are facing.

I have not checked the simulation feature in Rapid7 Exposure Command, but I believe it was not included in the first release of the product.

My overall rating for this product is seven point five out of ten.

I am specifically providing feedback on Rapid7 Exposure Command. We are using Rapid7 Exposure Command mostly for vulnerability detection and scanning.

The role of intelligent automation in this product is good, and we received feedback on actively exploited CVEs and vulnerabilities, so I would consider it around seven to eight. We usually measure the effectiveness of real-time reporting by using the latest available dump or when we share the vulnerabilities with governance teams or remediation teams. How quickly and easily we are able to filter the data and pass it on to remediation teams for their planning is one of the KPIs we set, so it is good, not that great, but it is good.

Rapid7 Exposure Command is not as easy to deploy compared to Qualys, and the detection rates are lower than Qualys. Rapid7 Exposure Command is not exactly complex, but it is medium complex when I compare it to Qualys, where the deployment procedure is quite straightforward.

Detection needs more depth in Rapid7 Exposure Command, and when I compare it with Qualys, the output of vulnerabilities can be improved at a depth level. That is one of the major pieces of feedback I have. The detection rate of vulnerabilities is not up to par, and that is one of the most important things that every firm looks for.

I have been working with this solution for a couple of years.

Since we are basically a reseller for Rapid7, we have prioritized technical SPOCs who are assigned to our organization, and we get a response on an immediate basis when we report a challenge. Usually within three to four hours, we receive a remote response, and through troubleshooting, they get the issue fixed.

For me and my team, the deployment is quite simple in terms of setup.

The deployment is done by different folks in the account, and I am mostly managing support and other areas. For one of the accounts, two folks were deployed, and they completed the implementation within two to three weeks.

Currently, I have multiple accounts where Rapid7 is actually used less, but Wiz tool is gaining traction, so more focus and attention is happening currently than Rapid7, which has only a couple of accounts where it is deployed.

Compared to Tenable or Qualys, Rapid7 Exposure Command is definitely affordable for small-sized or mid-sized engagements, although there are some challenges with detection. These challenges are in line with what the vulnerability management framework is expected to do and the vulnerability detection required to be done, matching the expectations of a client about eighty to ninety percent.

With Qualys or others, the APIs are open, but I have not seen much integration in my project, so I am not sure about that. It is mostly referencing excels and the data dumps. I would rate the user-friendly interface between eight and nine.

The licensing cost for Rapid7 Exposure Command is lower compared to Qualys, so it is not a challenge for the customer. Teams and organizations that use Rapid7 Exposure Command do get a comparatively cost benefit. I would rate this product overall as an eight.