Rapid7 InsightAppSec Reviews

To scan our Web applications.

Opportunity to find vulnerabilities and procedures of remediation for our web applications,

The most common attack templates are easy to access and apply. For example, the OWASP 2017 template contains up to 64 opponent techniques that we can evaluate in our applications.

I find the AppSec interface for defining scans and targets a bit confusing at first, but with practice the logic of the operation flow is understood.

I have been using this solution for about four to six months.

We haven't had any issues about this.

Because is a cloud solution, scalability is not an issue.

We have not yet had experience with Insight AppSec support cases.

The initial setup is very easy and straightforward.

We primarily used the solution to help us with analysis on our customer website. We also used it for our internal website in order to check security.

The way the solution arranged the web scanning was the most valuable aspect for us.

The reporting is definitely an aspect of the solution that's in need of some work. We found that we'd try to use widgets, but often getting them to work for us wasn't very clear. They need to be more user friendly or offer better instructions. 

The solution needs to have a softcore scan or scan that integrates better with the content.

In total, I've used the solution for about one year.

The solution is stable. It's good in terms of stability. That's not really any cause for concern. For users, if the internet connection becomes an issue, they will run into problems. If the internet is interrupted, they will have to re-scan. For us, we had some issues and had to reconfigure part of the scan. I'm not sure if the bandwidth of the internet was an issue on our side (in the office) or if something was happening with Rapid7. 

It's quite easy to scale up for businesses that need to grow out the product. Users can just buy more licenses. It's quite easy, but of course, it will cost more. That would be the only prohibitive factor for some people or companies.

We would sometimes need to reach out to technical support. This was only in instances when the product would crash or come down. Overall, I can say they were pretty good. We didn't have any issues with them and always found them helpful.

We haven't used a similar product to Rapid7. This was our first time using this type of technology, so we have nothing to compare it to.

The initial setup for us was easy enough. We didn't face too many issues. Deployment took maybe 30 minutes. It's quite quick and doesn't cause too much trouble at the outset.

One or two people handled the deployment process. You don't need too many people or too many work hours to get everything up and running.

We didn't need any outside help. Our company is quite technical and we have an IT engineer as part of the team. We have the knowledge in-house to handle implementations in general.

We had a yearly license for a team of five or six people. I'm not sure what the cost was for Rapid7 overall as I don't handle the finances in my company.

I'm not sure of what version of the solution we had been using at our organization previously. As of right now, the license has expired on Rapid7. We haven't been using it for about one month. It hasn't been too long since we stopped with regular usage.

We used Rapid7's cloud when we were running the program.

We had a team of about five or six people that had access to the product when we were using it.

If a company needs an effective product for web scanning, I can recommend this product. It's a great product. We found it to be quite effective in that regard. However, it did not help us to understand the web availability. This was something it lacked.

I would rate the solution eight out of ten.

The primary use case is vulnerability scanning and discovering.

• Visibility
• Realization of how my systems are developed.
• An identification of vulnerabilities.

How it integrates with the rest of my systems. I like how they have done some scanning which is reaching into my environment.

I would like more details of what the product can do.

For the new vulnerabilities and information which comes out, I would like to see them do some specific in-house application testing for companies who do their own application development.

The technical support is very helpful. I have used them in the last month.

Our previous solution was not as robust, so we needed this solution in order to achieve our goals and objectives.

I think the initial setup was straightforward.

We did it ourselves.

We have seen measurable decrease in the mean time to respond to threats by 20 percent.

We have seen staff productivity increase by approximately one team member.

We were kind of adopted into this because a sister company of ours also had this solution. Therefore, we just integrated and adopted it instead of looking for others.

Give it a try. It exceeds my expectations, and I'm curious to see what else they can release.