Rapid7 MDR Reviews

I can describe many use cases for Rapid7 MDR, as there are multiple times when a person's PC gets compromised. There is an attacker behavior analysis, ABA, which is already part of the specific Rapid7 MDR XDR solution. We define a specific set of built-in rules in the MDR services and remap those rules according to our infrastructure for specific use cases.

We also deal with multiple phishing emails that we receive, and Rapid7 MDR is effective in identifying those specific use cases. In the Fintech sector, we encounter many anomalies from different servers that are publicly exposed on the internet, and Rapid7 MDR provides very beneficial use cases that eliminate the need to write custom use cases. We can define the logic in predefined use cases such as Attacker Behavior Analysis and User Behavior Analytics.

Additionally, when onboarding any log sources, there is a RegEx parser designed for parsing every log source on the built-in platform, making it quite user-friendly.

The best features in Rapid7 MDR are their team, which is made up of professionals. I interact with them whenever we face issues, even though we are running our own SOC, but we sometimes rely on Rapid7. It is having a human eye on everything. The MDR AI platform they recently transformed into is very helpful for defining use cases, real-time detections from a dashboard, and the reporting mechanism they have created within Rapid7 MDR.

Even the orchestrator platform they introduced for playbook creation is very helpful, as I create playbooks on Rapid7 using their predefined orchestrator platform.

Having a dedicated cybersecurity advisor through Rapid7 MDR significantly impacts aligning our security program with business needs because it approaches MDR better for big organizations such as mine. My first organization, Afiniti, was a significant AI-based company where I introduced Rapid7 MDR. The MDR is beneficial for both small and large organizations, unlike Splunk, which has more conditional formatting in their product.

Rapid7 MDR has positively impacted my organization by providing us with very effective management tools. Once we introduced Rapid7 MDR along with their vulnerability assessment tool, IVM, we transitioned from using Qualys and Tenable, which are top-tier tools in the market. The management tool from Rapid7 allows us to access a variety of vulnerabilities in real time to fix them effectively. How we tackle that specific MDR is indicative of its market quality. We analyzed the tool during our POC before purchasing.

We deployed endpoints on a specific server and attacked that machine using different methods, such as Metasploit, conducting DDoS attempts, and generating alerts for every anomaly from Rapid7. While a competitor's solution failed to detect many attacks, Rapid7 identified them in real time, which effectively pushed my management towards choosing Rapid7 MDR.

My experience with detection and response capabilities for Microsoft-centric environments has been positive. While API integration can be challenging with some third-party tools, Microsoft's built-in features facilitate seamless communication. I have found it relatively easy to triage and integrate Microsoft systems with Rapid7 MDR.

In terms of digital forensics and incident response included in the MDR service, my experience is that it is not very robust. We lack a dedicated forensic team, which is essential for thorough investigation. Rapid7 has introduced honeypots, which is an encouraging feature, but it is not a comprehensive solution such as those offered by competitors, such as Palo Alto's Unit 42.

Apart from forensics, I believe Rapid7 MDR should introduce more forensic services. Another area to improve is the active platform's handling of on-premises tools versus cloud-based tools. We prefer on-premises options for data security, and we find limitations in features compared to cloud-based tools, concerning data access and privacy controls.

I have been working with Rapid7 MDR for the last five to six years.

Regarding stability and scalability, I have had no significant issues. Stability is good, and I have not experienced delays, even with on-premises deployments. I did encounter minor latency during a scheduled upgrade but was informed that it would occur.

Evaluating the customer service and technical support teams of Rapid7 MDR, I would rate them a six out of ten. I have previous experience with IBM support, which was excellent and proactive. In contrast, Rapid7 MDR support often takes longer to respond to issues. Despite their large customer base, this highlights a need for enhancement in their support team.

I decided to switch from those products because, while Qualys is a good vulnerability scanner, it is not very user-friendly. When scanning two machines, one with Rapid7 having an agent deployed for a level three scan and another with Qualys, the results were different. Rapid7 MDR indicated more vulnerabilities that were accurate upon verification, whereas Qualys missed many of them. This highlighted that IVM, Rapid7 MDR, and MDR stand out as top products in the market, especially for our financial sector.

The deployment setup process for Rapid7 MDR is straightforward. I have deployed both the cloud environment and on-premises Nexpose service. Their services, whether on-premises or cloud-based, are easy to deploy, and the endpoints are lightweight and compatible with other tools in our environment.

I bought Rapid7 MDR directly from the vendor, which is uncommon for sectors such as Fintech that usually work through intermediaries. I have had direct interactions with the Rapid7 team, specifically with someone named Nikola, and I find that beneficial.

I have seen a positive return on investment concerning Rapid7 MDR, as we have invested wisely, yielding results in detection mechanisms. I can confidently say that investing in Rapid7 MDR has been worthwhile, despite acknowledging that every tool has its flaws. Overall, the category is very good.

Regarding pricing, I manage everything with Rapid7 MDR, and I find their pricing very reasonable compared to the market. They negotiate well with us on various aspects of MDR, and we have received great rates for services such as IVM, including Threat Command.

I am taking advantage of the expanded ecosystem telemetry support in Rapid7 MDR. We have enhanced the logging mechanism within Rapid7 MDR, allowing us to assign projects to different teams with visibility only of their specific assets. This approach supports various vulnerability assessments and compliance achievements. My management is overall pleased as we have managed to meet compliance standards such as ISO 27001 and NIST due to features provided by Rapid7 MDR.

I utilize AI-assisted Risk-Aware Investigation workflows, integrating both our on-prem and cloud infrastructure. By using APIs in our environment, we gain enhanced visibility, giving us detailed insights that greatly assist in real-time monitoring.

This approach impacts my alert triage and prioritization processes since Active Directory is a crucial element in our industry. Rapid7 MDR improves the alerting mechanism for Active Directories and all connected user activities. Previously used SIEM solutions did not adequately capture anomalies on ADs. With Rapid7 MDR, any anomaly triggers escalated alerts in real time.

I am using the Integrated MDR for Microsoft Environments feature, having integrated Microsoft 365 with our MDR and endpoints from Microsoft Active Directory and Azure. This integration provides us with comprehensive visibility into our infrastructure.

Regarding transparency in detection and investigations with Rapid7 MDR, we receive metrics such as MTTR and MTTD (Mean Time to Detect and Mean Time to Respond). We monitor how quickly the tool detects anomalies and how long it takes to respond, which shows improvement due to the specific MDR product. My overall review rating for Rapid7 MDR is 8.5 out of 10.

My main use case for Rapid7 MDR is to monitor incidents and ensure our applications are secured. I also want to make sure we are proactive in identifying threats.

I use Rapid7 MDR daily as part of our security process. My workflow starts on a day-to-day basis by checking the dashboard for overnight alerts to see if there are any incidents and to investigate them. If there is any incident that needs to be escalated to my SOC team, I handle that accordingly. It is mainly to monitor the applications 24/7 for any incidents or alerts. We also use Rapid7 MDR to investigate user activities.

We also use Rapid7 MDR for threat hunting with custom queries and for reports on a weekly and monthly basis to find how many incidents have occurred and to get all those details.

In my opinion, the best features Rapid7 MDR offers are the 24/7 coverage with unlimited incident response and also the latest AI-driven alerts, which is one of the best features I have seen recently. The integration models they have across different endpoints is also valuable.

After the AI-driven alert triage was used, our time spent on identifying false positive alerts was reduced drastically because a large portion of our time was previously spent on identifying false positives and segregating them. After the AI-driven alert triage was implemented, this was directly reduced, which helped us identify actual alerts and work on them quickly. The AI enrichment also provides assets and vulnerability context even before a cybersecurity analyst gets into the picture.

In terms of how Rapid7 MDR has impacted my organization positively, it has reduced our false positives after the AI feature was implemented. This reduction in false positive alerts gave us 24/7 coverage without having an in-house SOC team. It also helps us connect various endpoints to identify, detect, and monitor various endpoints across multi-cloud environments. It has helped us maintain our security posture on a day-to-day basis to keep our systems safe and secure, monitor our user usage, and identify vulnerabilities and asset criticalities.

Previously, the need for multiple analysts and multiple security personnel was reduced after the AI implementation. It gave us detailed response information, detailed incidents, and reduced false positives. It also provided us with the reports we needed for further analysis and gave us the gist of what the incident would look like and what would possibly be going wrong. It has reduced the number of billable hours and also gave us time to work on other improvement factors, which has actually reduced our overall human billing.

The major improvement I see is that the reporting and dashboarding experience could be more flexible because the needs for various companies would be different. Having a dashboard which is flexible and also having a more user experience friendly dashboard would be one of the major points I would like to see improved. Building custom reports for specific stakeholders is also important, especially because the current reports are generic and default, which are useful but not necessarily for stakeholders because they would like to see summaries, counts, and compliance-focused views.

I would say pricing transparency and a startup package would be great because pricing is one of the major standpoints for every company to adopt tools. Rapid7 does not have a startup package where companies can have lower pricing or a one-year startup trial or credits for new startups who are eligible to onboard. If that would be available, it could help growing companies use security tools like Rapid7. Additionally, log sources and third-party integrations sometimes require more manual work than expected.

I have been using Rapid7 MDR for more than two years currently.

Rapid7 MDR is stable as of now.

We have not seen any issues with Rapid7 MDR's scalability. We tried to add new endpoints and new locations, but we have not seen any issues in terms of adding new users or endpoints.

We have only reached out during onboarding for customer support, so we did not have much experience with having calls or help with support.

We did evaluate other tools in the market such as Fortify, OpenText, and Sonar before choosing Rapid7 MDR.

I would not be the right person to talk about the money saved, but I could say there has been lots of time saved since we have onboarded Rapid7 MDR. The need for cybersecurity personnel has also been reduced.

We were directly using Rapid7 MDR as the first solution.

The inclusion of digital forensics and incident response within Rapid7 MDR service has positively impacted my incident recovery process, both operationally and financially. During an incident, creating a separate retainer or negotiating scopes and often waiting for external responders to onboard before meaningful work could begin could actually delay our recovery time. However, with Rapid7 MDR, DFIR is fully included in the services, which means there is no hourly fee, no caps, or engagement limit. This means our forensics begins immediately, which gives us an upper hand. In terms of financials, we do not pay additional fees for investigators or separate tools to onboard or for negotiations on retainers.

As for my experience with pricing, setup cost, and licensing, it is a corporate pricing structure and it was not startup friendly, which was one of the major issues I mentioned in improvements. The setup was not easy. We had to have someone already experienced in Rapid7 get involved in the setup and licensing. So it is not user friendly.

I would say the input cost could potentially be high when implementing Rapid7 MDR, but in the near future, you would be seeing a bigger saving factor in terms of time spent and the number of resources required.

We have not used the multi-vector telemetry feature in Rapid7 MDR.

We have not used the integrated MDR for Microsoft environments feature.

We use the AI-assisted risk-aware investigation in Rapid7 MDR and it has impacted our triage by providing detailed context. It gives us detailed impact analysis and also does a deep analysis on what the threat could be and what the potential causes are. It also does a root analysis and gives us the impact event, impact asset, and also what a possible solution could be. This has made the security alert solving easier and faster to resolve.

We have not used the expanded ecosystem telemetry support.

I do not have anything else to add about the features.

I do not have any other improvements needed for Rapid7 MDR that we have not discussed yet.

I would need some time to think about the transparency of Rapid7 MDR in terms of gaining visibility into detections and investigations.

Rapid7 MDR's risk-aware detection features have created a very meaningful positive impact. The integration between the detection and exposure management within Rapid7 MDR unified platform means that the team can actually work on threats that impact the business rather than other threats. Vulnerability data, assets, critical user identity context, and attack path information all feed directly into the detections. When an alert actually fires, it evaluates the isolation and gives us the ability to focus on what needs to be fixed.

It has reduced 60 to 65 percent of false positives, which is actually very helpful and is good because it is almost near to accurate. The reasoning is also almost correct. I would say it is learning day by day but it is actually performing well.

In terms of Rapid7 MDR's AI governance and security, it is more transparent because with the AI capabilities, it has made a transparent approach to governance and security. This means it gives us the ability to see how alerts are triggered and on what actions, and also provides a list of details on the transparency of what AI takes action on and what decisions it has made. Every AI-driven triage decision is auditable and gives us a flow of what has been taken. Because auditing is one of the major factors in compliance, we are able to see what all decisions and when and what factors have made that decision. We can see the reasoning, the evidence considered, and the outcome. From the governance standpoint, the human analyst is still in the loop across the triage cycle.

My overall review rating for Rapid7 MDR is seven out of ten.

Network detection and response is basically what I use Rapid7 MDR for, and it is a very good solution for that. I am using Rapid7 MDR for Microsoft environments, confirming its utility within those systems. I take advantage of the expanded ecosystem telemetry support offered by Rapid7 MDR. I have used InsightIDR, which is a SIEM for Rapid7, and InsightVM for vulnerability management. I appreciate their approach to detecting threats, and I consider it one of the best OEMs for threat detection and response, whether dealing with network issues, mobile devices, or user behaviors. Despite the pricing being a consideration, I always recommend Rapid7 MDR first.

The best features for me in Rapid7 MDR are the fact that it automates network traffic with users and the attacker behavior analytics, known as ABA, rather than UBA. The user behavior analytics and the attacker behavior analytics are important because it is a network-focused sensor that measures real-life patterns of users and attackers, which many other products do not provide. Rapid7 MDR has that real-life metrics, and I have gone through their platform, which also allows customers to correlate the newest attack patterns and methods they are using. They update their database periodically and integrate it with their MDR, which is why I appreciate their ABA and UBA so much.

The visibility of Rapid7 MDR is very accurate, and the transparency is commendable. If I am not too sure about its performance, I can correlate it with their cloud platform, which always has an updated dashboard about attacks. I also have access to the government database for correlation, and that shows they are doing real-time updates on these attacks, which is pre-built into the MDR. The accuracy and transparency for tracking are commendable.

Regarding improvements for Rapid7 MDR, I do not have anything specific for the product, but I would suggest synchronization time improvements for their vulnerability manager. For Rapid7 MDR itself, I am satisfied.

I have not thought about any missing features or functionalities that require enhancement in Rapid7 MDR at this moment.

I have been working in my current field in the industry for six years.

When discussing stability, performance, and reliability specifically for Rapid7 MDR, I would say they are reliable and accurate. However, for other products like the vulnerability manager, I would not extend that same level of confidence.

I find Rapid7 MDR to be very scalable. I can onboard more devices and expand easily.

Regarding Rapid7's support team, I must say that their response time is not as quick as I would prefer. While they do respond, it can take a few days or even a week to get on a call.

On a scale of one to ten for tech support, I would rate them a seven. The support is good overall, but I believe the pace of response could improve.

The setup process for Rapid7 MDR is always easy and straightforward. All their products are quite easy to implement; I do not need to overthink it. Reading the datasheet to understand it shows that it is not difficult at all.

I implemented Rapid7 MDR myself, but for any issues, I can always reach out to Rapid7 support, and they join calls to assist.

The key differences between Rapid7 MDR and competitors such as ManageEngine or Sophos technologies are minimal as both OEMs have different approaches to implementation but aim for the same goal. Rapid7 MDR excels in accuracy over Sophos, especially concerning real-life monitoring, which is a significant differentiator for me.

Having a dedicated security advisor through Rapid7 MDR positively impacts my alignment of security programs with business needs. As a security personnel using this for most of my customers, I can tell that the database is well updated. It gives me the most updated software for security regarding attacks and user behavior, which is crucial for business.

The key benefit of Rapid7 MDR is the way it automatically deploys on a port for me. I look at how to strengthen my customer's environment, ensuring that every IP address internally is accurate. Rapid7 MDR helps eliminate phishing IP addresses on the network, identifying and immediately rectifying them. It also deals with alert fatigue by preventing flooding of the dashboard with raw network anomalies and attacker behaviors. Their incident response is very quick; whenever there is a detection, they respond immediately. Some detections go to the administrator for approval, but with Rapid7 MDR, I can cancel and ask questions later, making it highly recommendable for real-time resolution, reducing alert fatigue, and addressing IP guessing.

With respect to risk-aware detection features, Rapid7 MDR provides full visibility into blind spots. I think I know my network, but I do not; Rapid7 MDR gives me full-time visibility and accurate data about things I am not seeing or paying attention to. Their third-party dashboard allows tracking of specific devices, which is essential in an enterprise environment where I cannot check each endpoint individually. Rapid7 MDR streamlines the information down to the exact affected endpoint and explains why it has been quarantined or removed from the network.

I have utilized the AI assistant for AI-assisted investigation workflow in Rapid7 MDR, and while I think it is a new feature for them, I find it similar to functions in other products. What makes their AI different is that it allows me to design and implement solutions. If there is an issue with the platform, AI can help pinpoint the source of the problem, even if it is a configuration issue. I have not fully used it yet, but I intend to explore its functionality within Rapid7 MDR infrastructure.

I have not actually used the multi-vector telemetry feature in Rapid7 MDR yet, although I have seen it.

My experience with Rapid7 MDR's detection and response capabilities for Microsoft-centric environments has been very smooth. I have not encountered any issues so far, and I believe that Rapid7 MDR and Microsoft have a good synchronization or handshake between their services, which contributes to this smooth operation.

The inclusion of digital forensics and incident response within Rapid7 MDR service impacts my incident recovery process by providing a dashboard that offers insightful reports on incident responses. They have a vast database that is continuously updated, which they incorporate into Rapid7 MDR for threat detection and response capabilities.

When it comes to pricing, Rapid7 MDR is known to have higher costs. However, the value is significant, and I believe that pricing should not be a problem if I recognize the worth of what I am paying for. Overall, I feel the value justifies the cost, though I see a need for a pricing reevaluation for some medium-class businesses.

I have seen cost-effectiveness with Rapid7 MDR solutions, comparing it to other options such as ManageEngine and Sophos.

My overall review rating for Rapid7 MDR is 8.5 out of 10.

My primary use case of Rapid7 MDR is to do 24/7 threat monitoring and managed detection and response. We use it to identify suspicious activity across endpoint, network, and cloud environments and investigate the alerts and reduce false positive alerts through analysis.

One of the examples was we used Rapid7 MDR to detect a suspicious malware activity or PowerShell activity on a user's device. Rapid7 MDR can correlate that endpoint element with network authentication and identification, and it finds if it has suspicious activity and then escalates it with details. The alert had already been validated and with context, we were able to isolate the affected endpoint, investigate the user's activity, and confirm the incident. At the same point, Rapid7 MDR filtered several benign administrative activities such as PowerShell execution, which significantly allowed us to focus on genuine threats.

Overall, Rapid7 MDR helps us to strengthen our security operations by providing continuous monitoring, high quality threat detection, and expert analysis support. The contextual investigation and actionable recommendations have improved our SOC response and allowed the SOC team to focus on high priority activities rather than spending time on false positive alerts.

The best features that Rapid7 MDR offers are 24x7 alert monitoring, expert threat hunting, and high quality alert validation, which significantly reduces false positive alerts. I also appreciate the detailed incident investigations, actionable remediations and recommendations, and the ability to correlate the data from network and cloud environments. The service integrates all the security tools, and Rapid7 MDR analysts provide timely communication and valuable expertise that helps us to respond to attacks more efficiently.

I think the best feature is reducing the false positive alerts so we, instead of reviewing many alerts ourselves, Rapid7 MDR analysts validate the incidents with the relevant context before escalating them. This significantly reduces the alerts and false positives, allowing the SOC team to work on only high priority alerts.

Rapid7 MDR provides capabilities such as robust alert monitoring and investigation, and the Rapid7 MDR analysts already prioritize alerts and help the security analysts focus on high priority alerts only. Because of this, it improved our overall security posture and reduced the workload of the SOC analysts. With continuous monitoring, faster threat detection, and expert analyst support, we have been identifying security issues more quickly. Overall, it has ensured critical security events are detected and handled promptly.

I think Rapid7 MDR already has a strong managed security service, but I believe things can be improved. More customization options for detection rules and other workflows would help organizations to align their services more closely with the specific environment.

Additionally, improving the speed of the communication for the low priority alerts and providing more self-service investigation capabilities could further enhance the overall user experience.

I think the room for improvement is deeper customization and reporting flexibility. Rapid7 MDR is a solid solution overall. I think they can implement more customization options for detection, logging, workflows, and also the integration with other security platforms that would be helpful.

Rapid7 MDR transparency is quite good. It provides useful visibility into detections and investigations with detailed alert information and analyst notes. It shows severity classification and recommended actions. In these investigations, it helps our team to understand the alert, why it was generated, and what would be the next steps that we can take. For example, during a suspicious endpoint activity alert, the Rapid7 MDR team provides context around the process execution, related user activity, and supporting indicators, which help us quickly validate the incident and take appropriate actions. Additionally, more transparency into the detection logic and more customization visibility would further improve the experience.

I have been working in this field since the last two point eight years.

Rapid7 MDR is quite stable according to my experience. The service has provided consistent monitoring and dependable support from the Rapid7 MDR team. We have not experienced availability issues.

I think Rapid7 MDR is scalable. I have studied that it supports growth by allowing my organization to expand its monitoring coverage as the number of users, endpoints, and security data sources increases. The managed service model reduces the need to continuously scale the internal SOC resources while maintaining consistent monitoring and response capabilities. Also, the onboarding of assets and integration is relatively good, which helps to manage the increased volume of findings and investigations.

Customer support is quite good, which is why I think it is quite good.

We are utilizing the AI-assisted risk-aware investigation workflows in Rapid7 MDR. They help us improve our alert triage and prioritization by providing context around the alerts, identifying the risk factors, and helping analysts to focus on more critical security events. Instead of treating every alert with the same priority, the workflow considers factors such as asset criticality, behavior, threat intelligence, and attack patterns to determine the potential impact. This has helped in reducing false positive alerts and overall alert fatigue, and in speeding up the investigation of the real threats.

Rapid7 MDR AI capabilities are good for improving threat detection and alert prioritization and also in the investigation. From the governance and security perspective, I think they have strong controls around data handling, access management, and transparency, which helps in improving data security. Also, the combination of AI-driven analysis and Rapid7 MDR analysts provides a good balance where AI can help identify attack patterns quickly, while human experts validate findings and make the response decisions.

Rapid7 MDR is quite good and I appreciate the responses. I use it on a daily basis. I think it is really reliable as compared to the other platforms which I use, and it helps in reducing the investigation time by providing additional context and highlighting the important points.

The inclusion of the forensics and incident response capabilities has improved our investigations by providing deeper analysis and helping us to understand the scope of the threat and the impact of that on the environment. The forensic analysis also helps us identify the root cause, the affected systems, attackers' activities, and required remediation steps.

Rapid7 MDR has a few features that I think are very valuable because it goes beyond simple alert generation and focuses on the actual risk and potential impact of that risk in our organization. By considering factors such as important assets and user behavior, threat indicators, and the context of the attack, we can better assess our security posture.

I have used the multi-vector telemetry capabilities in Rapid7 MDR. It has helped me in improving investigation accuracy by correlating the data across different endpoints, user activity, and network activity. Having visibility across different telemetry sources provides better context for the alerts and helps us differentiate between legitimate and potential threats.

Cybersecurity advisor helps us make decisions by providing expert guidance and helping us focus on the risks and threats that matter the most to our business. They help us understand our security gaps, identify additional improvements, and also align our security strategy with the business requirements. This also ensures that our resources are used effectively and that security supports the organization's overall goals.

Currently, we are not using the integrated Rapid7 MDR for Microsoft environments feature. I think our team will be enabling that in the upcoming time.

My advice is that Rapid7 MDR is a good fit for organizations that want to use it for 24/7 security monitoring and expert investigation support. It also helps in reducing the workload of the internal SOC teams. With the help of this, SOC teams can mostly focus on the high priority alerts instead of wasting time on the false positives. I think this is a really good tool to have. I would give Rapid7 MDR a rating of eight out of ten because of its 24x7 monitoring capability and valuable analyst expertise that improves our security operations.

My main use case for Rapid7 MDR is to onboard all new applications, both built in-house and third-party acquired. As part of the onboarding process, I run them through a sandboxed environment and allow Rapid7 MDR to do an initial scan, looking for vulnerabilities that might not otherwise be publicly announced. Then, on an ongoing basis, while applications live and survive within the McKesson environment, I use Rapid7 MDR to aggregate data about new vulnerabilities or things that may have been discovered to determine if I have to do any kind of hardening or shelf the application.

A specific example of how I used Rapid7 MDR during the onboarding process involves a large number of applications within the healthcare environment, particularly information technology, that come from companies that may have a less than reputable stance as it pertains to their security. Change Healthcare would be a very good example. I had just purchased or acquired a new practice in the United States that was still using Change Healthcare software. I started an onboarding process of all the applications they have in their environment, and I used Rapid7 MDR in a sandbox to figure out if those were still vulnerable to the breach that occurred in 2024. It turned out that almost all of the applications that practice was using were in fact filled with the vulnerabilities that caused the 2024 breach.

Rapid7 MDR offers excellent features including a cloud-based platform that provides quite a bit of detailed ways to break information down into more digestible little bits. It is very user-friendly, very broad, and it has a lot of tools. It does require quite a bit of a learning curve, but it allows me to aggregate data and put it into presentations to send to the executives to let them know where their security stands as a whole across the entire enterprise.

My favorite aspect of the user-friendly interface is that the primary cloud-based dashboard is my most useful one that I tend to work with. I love the fact that even inside of a browser, the intuitive help options for figuring out what things are, whether it is hovering over a particular option and it giving me insight as to what I am looking at or even all the right-click features that offer tools and tips on how to interact or manage the vulnerabilities when I find them, are extremely helpful.

I would add that the interface is very clean; it is not overly convoluted or difficult to navigate, so I do enjoy interfaces that do not muddle things up.

Rapid7 MDR has positively impacted my organization because we migrated from several different platforms previously. When I started using Rapid7 MDR as my primary option, I still have other tools in the environment, but I think the impact has been that we are discovering all of the vulnerabilities that are out there, whether they are publicly or even zero-day, a lot faster and more efficiently than I ever did in the past, which is saving the company a lot of money in compliance issues and fines and possibly even lawsuits.

Regarding specific outcomes or metrics, I cannot speak to the financial aspect as that is an entirely different department. However, I can speak to the number of vulnerabilities that I am discovering. Discovery and remediation have improved by almost thirty-seven percent just in the last two years alone. Remediation especially has gone up significantly because I am finding these things and because Rapid7 MDR gives me tips on how to remediate or harden against them, whether that could be hardening options or upgrading to a better version if it is available. It does save the company money; I just do not know how much.

All software has its limitations, and Rapid7 MDR, although it is getting better every time a new update or version comes out, needs to improve on its zero-day detection for anomalous things without the use of other third-party software like Veracode or things that I would have to purchase. Having that in-house with Rapid7 MDR would be a much better feature. That is the only thing I can think of outside of maybe a couple of menu options that need to be cleaned up on the cloud platform.

Regarding additional improvements, it would be really beneficial if the integration with ServiceNow and OneTrust as a GRC platform would be significantly valuable to a lot of enterprises, especially McKesson.

I have been working in the fields of cybersecurity on and off for about twelve years, sometimes as a project or program manager and sometimes as an information security officer.

Rapid7 MDR is a very stable platform, and thanks to its continuous updates and the transparency from the company, I have not had any real issues with it at all.

Rapid7 MDR's scalability is very good; it works for small enterprise solutions and large enterprise solutions. McKesson is a very big global company, and I was able to put it out there almost within less than three months. I was able to scale it up between fourteen different countries and over fifty thousand endpoints and employees.

Customer support from Rapid7 is superb. I am not an expert at everything, so when I get confused or have issues, an email or even a phone call takes no more than fifteen minutes to get the issue resolved, and I have never had a problem getting the right answers from somebody.

I was only part of the team long enough to see the end of the previous solution; I did not get to use quite a bit of it, but it revolved around RSA's Archer platforms.

I can give a general amount of the return on investment, only speaking from an information security officer's point of view. It does not necessarily reduce the number of staff because I have always operated pretty lean as it is, but it does reduce the amount of issues that face the company, particularly when it comes to compliance or any laws or even lawsuits. I would imagine there has probably been a significant amount of money saved from a legal and compliance aspect and definitely as far as time, because I am able to fix things faster, identify things quicker, and remediate those things even faster than I could possibly imagine. That has to save a lot of time because it frees me up to do other things like forensic investigations or rebuilding of the enterprise.

Regarding Rapid7 MDR's AI capabilities, I think the governance and security is very malleable, which can be valuable to a lot of my teams. Because of that, I can also lock it down and harden it, which I find very useful. The tool itself or the AI integration has been very useful for simulations and for other areas where I might be installing a piece of software and it going out and finding the dependencies that software is going to need to operate correctly and then identifying the vulnerabilities in those dependencies.

Concerning the accuracy and reliability of Rapid7 MDR's AI capabilities, I think the accuracy and reliability is decent for an AI platform, but it does require and will, I think, always require double-checking the sources of the information to make sure that I am not getting AI slop.

The transparency of Rapid7 MDR in terms of gaining visibility into detections and investigations is wonderful. The support that comes from Rapid7 as a company is also wonderful. When I have massive audits or things that are flagged that might cause problems in the future where I might need some assistance from the software itself or from the providers, the vendor, I have had nothing but astounding support and transparency when it comes to those things, especially concerning the findings that Rapid7 MDR is producing.

In terms of how the inclusion of digital forensics and incident response within the MDR service has impacted my incident recovery process, I have only been on the incident recovery team for a short while, less than six months. But in the short time that I have been working with incident response and incident recovery, the tools that Rapid7 MDR provides allow me to rapidly pull all the data necessary, whether it is the drives, the RAM, everything, and then coalesce it into a report that allows me to break that data down into smaller bytes and figure out exactly what had happened, when it happened, and who did it.

Regarding my impression of the risk-aware detection features in Rapid7 MDR, I find that report very valuable. The fact that Rapid7 MDR includes that on all platforms, whether it is the on-prem or the cloud or hybrid, gives me great insight on what to look for. I can narrow those things down specifically to software that revolves around the healthcare industry because that is my primary focus, but I can also widen it to a global set too.

Currently, I am not using the AI-assisted risk-aware investigation workflows as it has not been enabled. That is going through an AI review board to make sure that it is going to be useful and that it is secure. Once that is approved, I am sure I will start using it.

I am taking advantage of the expanded ecosystem telemetry support, and as far as the correlation and visibility, I would say that it has made it significantly more efficient. It also allows me to create or generate reports when necessary and on the spot to take to executives, vice presidents, even senior managers to say, "Hey, we need to make a change," or, "Hey, this is going to be a problem," which has sped up the process of my remediation techniques considerably.

I unfortunately did not sit in the seat for licensing or pricing or anything, so I do not really have enough authority to speak on that.

If you are looking for a solution that is going to help you identify and even give remediation tips or hardening tips to the vulnerabilities that exist within your infrastructure, Rapid7 MDR does a phenomenal job. I do not know much about the costs or the licensing or the seats behind it, but I have to imagine that the costs are a great deal less than a federal lawsuit. I would rate this product nine out of ten based on my overall experience.

I use Rapid7 MDR for security monitoring and easy onboarding and deployment. We primarily use Rapid7 MDR for threat detection and incident response, where it helps us to investigate deeply into those incidents.

One of the best features of Rapid7 MDR is 24/7 security monitoring, expert-led threat detection and response, AI-accelerated investigations, multi-vector visibility, informed defense, and incident response support. The full visibility of SIM, SIEM, and threat hunting is one of the features of Rapid7 MDR, and it has a strong customer partnership.

AI processes a large volume of security telemetry and helps us to speed up the triage and investigation, allowing human analysts to validate findings before action is taken. AI-accelerated investigation helps us significantly.

I particularly like the incident response support, as Rapid7 analysts assist with the investigation, containment, and remediation parts. The detailed incident reports and forensic analysis are very helpful and aid organizations in recovering from security events.

Rapid7 MDR has improved many policies in our organization and enhanced our ability to detect threats early before they become major incidents. It has increased our visibility across our environment, including servers, cloud resources, and user activities. Rapid7 MDR integration reduces the risk of security breaches through constant monitoring and proactive threat hunting, and it reduces filtering out false positives by focusing only on actionable threats. It saves valuable time for our internal security team because Rapid7 analysts perform initial investigations and triage, resulting in faster incident response due to timely detection.

The overall impact increases confidence in our security posture, enabling the security team to focus on strategic initiatives instead of spending excessive time reviewing alerts. It improves compliance readiness through detailed reporting and incident investigations and reduces our operational overhead by leveraging a team of security experts without needing to expand internal staffing.

Rapid7 MDR has helped our team to save approximately 10 to 15 hours per week by reducing the time spent on alert triage and initial investigation. It allows our security team to focus on remediation efforts and strategic security initiatives, whereas before implementing Rapid7 MDR, our security analysts used to spend significant time reviewing security alerts and triaging potential threats, which we estimate was nearly 30 to 40% of their time.

The biggest benefit has been operational efficiency. Instead of dedicating resources for around-the-clock monitoring, Rapid7 MDR acts as an extension of our security team, saving man-hours each month while improving detection and response capabilities. It has significantly reduced the time required for threat monitoring, alert validation, and incident investigation. The platform and analyst support help focus only on verified and actionable security incidents, which has improved efficiency and saved a considerable amount of our security operations team's time.

There are still a couple of areas where Rapid7 MDR can be improved. The visibility of the dashboard should be improved, and faster threat detection can also be enhanced. The dashboard visibility can be improved further, and the threat detection time also needs to be reduced to some extent.

I have been using Rapid7 MDR for three years in my current organization.

This is a good return on investment, as Rapid7 MDR has saved a lot of money for this project.

I feel the pricing cost of Rapid7 MDR is reasonable.

Rapid7 MDR provides valuable visibility into security events, vulnerabilities, and risks, which relates to governance and security. The reporting and logging capabilities support all our readiness, help demonstrate security controls, and efficiently manage processes in our organization. The combination of AI-driven insights and expert analyst validation provides a well-balanced approach where automation improves speed while human expertise ensures accuracy. I particularly appreciate the Rapid7 analyst detections and investigations, which reduce alert fatigue, improve threat visibility, and speed up our security operations. Rapid7 MDR is a primary detection response service that makes it safer to say that our organization is well-protected.

For compliance support, Rapid7 MDR provides good visibility into vulnerabilities, threats, and security. When suspicious login activity is detected by Rapid7 MDR, the MDR team provides detailed information, including the affected user account, source IP address, and timeline of events, which helps us validate the event. The transparency is very good for Rapid7 MDR.

Rapid7 MDR follows a structured risk detection process that combines automated analysis and threat intelligence. It collects data, logs, and telemetry from endpoints, servers, and cloud environments, then enriches the data against multiple data sources and analyst validation.

The multi-vector feature is one of the best features, as it analyzes and correlates data across multiple attack vectors such as endpoints, identity, cloud environments, network, email systems, and other security tools. For example, an attacker may compromise a user account through phishing email, log in from an unusual location, and then try to access sensitive cloud resources. Individually, these events might appear harmless, but Rapid7 MDR correlates and analyzes data from email, identity, and cloud environments to recognize this attack chain and generate a high-fidelity alert. The benefits of multi-vector detection include better visibility across the attack, detection of complex attack chains, reduction of blind spots, improved threat detection accuracy, faster incident investigation, and providing better context for analysts.

The ecosystem is supported through endpoint telemetry, processing, and file activity, which has a significant positive impact on our security program. Rapid7 MDR is integrated with Microsoft and our other security tools. We are using AI-assisted risk workflows, including data ingestion, AI-based analysis, risk scoring and prioritization, analyst validation, investigation, and containment. The ecosystem supports endpoint telemetry, processing, file activity, and user behavior.

My overall review rating for Rapid7 MDR is 7 out of 10.

Our primary use cases focus on threat detection and network-related security concerns, with an emphasis on cybersecurity-related areas.

My team is satisfied with the current capabilities, though there are certainly areas for improvement. Rapid7 MDR has not covered all the areas we need, which is why we also utilize Zscaler. For personalized security for developers, testers, and other audiences who are exposing their network to risk, we definitely need very micro-level monitoring of requests and network activity.

All stakeholders claim that Rapid7 MDR is very effective at identifying threats in today's AI era. It is quite difficult for all of us to identify what type of code or requests are coming through. This improvement is very important to the product itself and its realignment. We raised a request, and Rapid7 MDR has made changes to their product by conducting extensive research and development with thorough testing.

There are multiple areas for improvement, especially regarding generative AI-related threats. Secondly, proxy communication happens through agentic AI, making it very difficult to identify whether it is agentic AI, a human, or a hacker. That filtering and identification will need to be improved in Rapid7 MDR. Many products still do not make that effort, but Rapid7 MDR has started to address this; however, this remains a drawback at the moment. We moved our own artificial intelligence product, and our developers and testers are using it, but we still restrict its use to inside our Fujitsu premises. We cannot allow it to go outside because we do not have that level of trust at the moment.

It is quite difficult to specify all areas at the moment, but there are multiple features needed. Based on our transformation with a combination of cloud technology and artificial intelligence, we are using co-pilot and multiple AI models will require many enhancements aligned with new technology trends in the market. I cannot articulate or name all of them, but we are still not confident in asking customers to use AI in their environment. They are reluctant at the moment because of security concerns and other myths around AI. There should definitely be a tool that gives us the confidence that whatever AI model we are using is secured through that tool. That tool should assure customers that there is a 90% or 98% guarantee that their code or utilization of AI technology will meet the mark. Currently, customers are not flexible in beginning to utilize AI, especially for financial institutions, research and development institutes, or places where sensitive business operations occur or large customer volumes exist. No one can risk it at the moment. People are using co-pilot, chatbots, or bot services, but they are still not confident in utilizing them without taking risks. No one can claim that they are 100% secure in providing those services. We are expecting that type of confidence from Rapid7 MDR and other technologies playing a role in the market.

We have been using this solution for more than four years.

Getting responses from any service industry is challenging. We have an SLA, especially those SLAs from which we really need support based on our customer expectations, particularly for our developers. Every machine has Rapid7 MDR installed. We have our own IT department that is enabled with all training. The thing is that we do not directly rely on Rapid7 MDR for support, but we have built up our own competency with Rapid7 MDR. Only for very urgent issues do we get support from Rapid7 MDR, but that also depends upon the contract. We do not have extensive experience where we frequently interact with Rapid7 MDR, but wherever there is a setting, configuration management, or something similar, we are getting support from their technical or non-technical staff. It is about how you build your relationship with them. We are training our employees and providing them with training, and once they are trained, we believe this is a common shared responsibility.

The setup cost is reasonable and not so expensive. It is simple and straightforward.

We are primarily on Microsoft with a platinum contract, so all products we evaluate are in line with Microsoft's technology stack. Rapid7 MDR and Zscaler are both well-equipped and support Microsoft technology. Since Microsoft has its own products like Defender and others, we still use them for our daily work. I would rate my overall experience with customer service as a 3 out of 10.

I am using Rapid7 MDR for all the devices in a single data center. We have different devices including Windows servers, firewalls, endpoints, and various Arista devices. All those devices log different incidents that are managed by Rapid7 MDR.

We are using a Microsoft environment for our endpoints. We are collecting syslog logs for that. We also use EDR, and the correlation is quite useful. We have been getting new kinds of alerts and more insight into the endpoints. This proved valuable because we integrated EDR with it.

We were using an in-house SIEM before with different use cases and analytics. However, it did not give us more insight into the logs that we were fetching. The benefits that came with Rapid7 MDR is the analysis we are getting now, which is quite useful. Apart from that, we also got user behavior analytics and EDR integration, which helped us considerably.

Regulatory compliance basically guides us at the moment. Our infrastructure is quite critical, so security posture needs to be well maintained. We are relying on Rapid7 MDR and have had a good experience. It is fulfilling our strategy. We have a risk matrix ourselves that maps with the risk posture we have. We are relying on our in-house risk matrix at the moment, but we also have a good feature with Rapid7 MDR.

We currently come across more false positives. The tool is a bit more aggressive than other tools. However, this can be fixed with tuning. We are working on tuning it better. Our infrastructure is expanding a lot, so we are getting lots of logs. The ingestion then becomes an issue from a cost perspective. These are the main areas for improvement.

I have been using the solution for one and a half years now.

If we talk about different vendors, there is competition, but the user interface of Rapid7 MDR is quite useful for us. The support is also good. There are different vendors which have more experienced staff. However, Rapid7 MDR has been the best in zero-day attacks and the vulnerabilities that come into picture. We prefer that.

We were using an in-house SIEM before with different use cases and analytics. It did not give us more insight into the logs that we were fetching. The benefits that came with Rapid7 MDR is the analysis we are getting now, which is quite useful.

It is very easy.

We have a team, though we do not have a segregated team for it at the moment. We have around fifty individuals in different places and different responsibilities.

The log ingestion is the main criteria that comes into picture. I would not say it is cheap, but it is more efficient. It is economical for us. We evaluated different tools and services before. If we check the functional requirement and financial perspective, this is the best service.

We generally do not get into the telemetry part of it, and that is impacting a few things that align with our strategy at the moment. However, we should use it more. We will be contacting the support team for that.

Regarding scalability, I would rate it a nine. If an organization is looking for an edge in security and they have any kind of on-prem, hybrid, or cloud solution, I think they should go for Rapid7 MDR. Based on my experience, I have evaluated different vendors and this came out to be the better solution for us. I would recommend this. My overall rating for this product is nine.

My main use case for Rapid7 MDR is to manage detection and response, SIEM, and other threat management solutions from Rapid7, including the vulnerability part.

I use Rapid7 MDR in parallel to Rapid7 SIEM, where all the logs are ingested and where I carry out investigations and incident response activities.

The transparency of Rapid7 MDR detection is high, with detailed insights into each incident, including analyst notes, supporting evidence, attack timelines, and recommendations for remediation.

The risk-aware detection features in Rapid7 MDR are effective, as they help me focus on significant threats by correlating telemetry to identify realistic attack paths and prioritize incidents based on actual risk.

Having digital forensics and incident response included in Rapid7 MDR has greatly improved my incident recovery process by helping me determine root causes and the extent of compromises.

I utilize the integrated MDR for Microsoft environments, experiencing great visibility and effective incident response through this enhancement.

The best features Rapid7 MDR offers include the ability to configure alerts, log ingestion, monitoring capability, and threat detection that correlates telemetry from multiple security tools to detect advanced attacks, with every high priority incident validated by Rapid7 analysts initially, significantly reducing false positives.

I find myself relying most on the threat detection and investigation quality, as well as the threat intelligence, which has made a significant difference in the effectiveness of my incident response team.

Rapid7 MDR is an excellent choice for organizations that want enterprise-grade threat detection and response without building a 24/7 in-house SOC team, combining expert analysis, high fidelity detections, broad integration support, and actionable incident response.

Rapid7 MDR has positively impacted my organization by containing most of the false positives, as its in-house 24/7 team continuously monitors customer environments, enabling organizations to detect and respond to threats much faster.

Measurable improvements include seeing a reduced number of false positives compared to other tools because Rapid7's in-house team handles most of them, and the faster threat detection reduces the mean time to detect from hours or days to minutes due to continuous monitoring.

To improve Rapid7 MDR, I suggest enhancing detection and reporting, including customizable dashboards and more dynamic alert detection rules based on anomalies.

Everything mainly revolves around detections and reporting, and I find the user experience to be great with smooth integration from AWS.

I have been working in my current field for almost three years.

Rapid7 MDR is scalable and adapts well to any organization's size.

Customer support is excellent, and they promptly connect whenever I raise a request, which I would rate more than nine.

I chose 9.5 because of their excellent customer support, efficient integration processes, and active communication during high incidents, helping my internal security team effectively handle critical situations.

This is the only solution I have used for this particular customer.

Rapid7 MDR has provided a clear return on investment by significantly reducing the time my internal security team spends on alert triage through validated investigations and actionable recommendations.

My advice to others is to choose Rapid7 MDR if you want a cost-effective SIEM solution backed by a great security support team.

I benefit from using AI-assisted risk-aware investigation workflows, which streamline investigations by correlating all relevant alerts and details into a single workflow, reducing manual effort in triaging incidents.

I gave this product a rating of 9.5 out of 10.

Our main use case for Rapid7 MDR is that they serve as our SOC.

Rapid7 MDR is an IDR that does what it is supposed to do. The vulnerability management helps us keep our products and systems up to date.

I am satisfied with the risk-aware detection feature in Rapid7 MDR and have no issues with it.

We use the AI-assisted feature in Rapid7 sometimes, mainly to understand the logs from systems that we are not familiar with.

The main benefits that Rapid7 MDR provides for me as an end-user are the security and that they are available 24 hours a day, always. This gives me reassurance because I do not have to be an expert on the cybersecurity part because they are. We are a quite small firm, so we do not have that in-house expertise, which is why we rely on them.

Regarding points for improvement in Rapid7 MDR, I do not have to do anything with them unless I have a problem. The less I hear from them, the better, because they contact us when there is a problem. We have our monthly meeting, and that is fine by me. That is pretty much it; I get what I want, and I do not want anything else.

The price of Rapid7 MDR could definitely be lower, as these are expensive systems, especially if you have the MDR. They could work on the price.

I have been working with Rapid7 MDR for about two years.

I would rate Rapid7 MDR as a 10 for stability; it has always been there and has never been down.

The ability to scale Rapid7 MDR is really super easy, so I would rate it a 10 as well.

I would rate Rapid7 technical support as definitely a 10, because whenever we have had any problems, it is really fast and sensitive to our knowledge. I get the help I really need, and it is fast, so it is really good.

I have only worked with Rapid7 when it comes to MDR; I have no experience with other products.

Based on my experience, it is really easy to start working with Rapid7 MDR; you are up and running in a day or two.

The initial setup process for Rapid7 MDR is really easy; it was really easy for us.

We did the setup processes in-house for Rapid7 MDR ourselves.

The main competitor for Rapid7 MDR would be CrowdStrike, in my opinion.

I have not looked into CrowdStrike; I do not know the specifics of what they call it, but they have the big offerings as well.

I would definitely recommend Rapid7 MDR to other users. I would rate this review a 10.