No more typing reviews! Try our Samantha, our new voice AI agent.
reviewer2908983 - PeerSpot reviewer
Cyber Security Engineer at a outsourcing company with 1,001-5,000 employees
Real User
Top 20
Oct 11, 2026
Rapid detection has strengthened cloud investigations and prioritized real threats effectively
Pros and Cons
  • "Rapid7 MDR positively impacts my organization by helping the security team detect threats earlier, investigate suspicious activity faster, and respond before incidents cause significant damage."
  • "Rapid7 MDR can be improved by better integration with existing security tools, clearer reporting for security outcomes, and reducing the number of false positives."

What is our primary use case?

My main use case for Rapid7 MDR is working primarily on investigation, cloud security model, and attack surface model for agent coverage.

For cloud security work, I mainly use Rapid7 MDR on agent coverage, especially for attack surface management, focusing on total instances or servers having missing CrowdStrike and missing Rapid7. The dashboard we have created is very helpful, and regarding investigation, especially on GuardDuty, the alert logs help us analyze and identify anomalous behavior of users.

Currently, there is no additional use case for Rapid7 MDR, and it is functioning smoothly. We are utilizing all the modules from Rapid7, and it helps us analyze in our day-to-day work.

How has it helped my organization?

Rapid7 MDR positively impacts my organization by helping the security team detect threats earlier, investigate suspicious activity faster, and respond before incidents cause significant damage.

Based on the MDR, I have noticed faster outcomes, as it has strengthened our security monitoring by helping investigate suspicious authentication activity such as access key creation and other potential threats. It provides additional investigation expertise and helps us support threat validation, allowing our cybersecurity team to prioritize only genuine security risks using MDR reports and incident records.

The inclusion of digital forensics and incident response within Rapid7 MDR has improved my ability to investigate security incidents, understand potential root causes, and identify affected systems. Investigation findings and response recommendations help my team make informed decisions, prioritize containment, and coordinate remediation more effectively.

Having a dedicated cybersecurity advisor through Rapid7 MDR helps align our security program with business needs by providing guidance on emerging threats, security priorities, and opportunities to improve our overall security posture. Recommendations help us focus on high-risk issues.

What is most valuable?

The best features Rapid7 MDR offers include Bot Factory for automation in cloud security, multiple options in attack surface management such as querying workspace, and very clear investigation logs that we can filter based on our needs.

Automation in cloud security helps me reduce manual work, respond to security findings faster, and improve our AWS security posture. In InsightCloudSec, I can use automation to identify misconfigurations, prioritize risk, and trigger remediation workflows.

Regarding Rapid7 MDR's AI capabilities, it supports compliance monitoring and helps my organization strengthen its posture. The AI capabilities provide reliable security alerts and useful investigation findings that help my team identify suspicious activity and distinguish potential threats from benign events. Investigation insights support informed decisions and incident responses.

Rapid7 MDR provides good visibility into security detection and investigation by delivering alert details, investigation context, and response recommendations, such as investigating suspicious authentication attempts, unusual IAM access creation, and malicious endpoint activity to understand the nature of the threat and its potential impact.

The risk-aware detection features in Rapid7 MDR provide detection capabilities by identifying suspicious activity. Improved attack path context and risk-based alert prioritization help us focus on threats that pose the greatest risk to our organization.

I have not directly evaluated the multi-vector telemetry feature in isolation, but I believe correlating telemetry from multiple sources such as endpoint activity, authentication events, and cloud logs can improve investigation accuracy by providing a more complete picture of suspicious activity.

What needs improvement?

Rapid7 MDR can be improved by better integration with existing security tools, clearer reporting for security outcomes, and reducing the number of false positives.

Buyer's Guide
Rapid7 MDR
October 2026
Learn what your peers think about Rapid7 MDR. Get advice and tips from experienced pros sharing their opinions. Updated: October 2026.
920,223 professionals have used our research since 2012.

For how long have I used the solution?

I have been using Rapid7 MDR for approximately one and a half years.

What do I think about the stability of the solution?

Rapid7 MDR is stable.

What do I think about the scalability of the solution?

Rapid7 MDR's scalability meets our organization's needs. Rapid7 MDR handles our organization's growth or changing needs effectively.

How are customer service and support?

The customer support for Rapid7 MDR is quite good. I would rate the customer support at nine out of ten.

How was the initial setup?

Rapid7 MDR is deployed in my organization using a hybrid cloud approach. We primarily use public cloud infrastructure on AWS alongside on-premise infrastructure, and Rapid7 provides all these features.

What was our ROI?

We have seen operational value from Rapid7 MDR through continuous security monitoring and reduced manual effort in validating suspicious activity. While we have not quantified direct cost savings or staffing reductions, the improved visibility and access to specialized investigation expertise provide value to our security operations.

What's my experience with pricing, setup cost, and licensing?

I did not purchase Rapid7 MDR through the AWS Marketplace. Overall, my experience with pricing and licensing has been reasonable for the value provided through continuous security monitoring, although I was not heavily involved while discussing the pricing and licensing.

What other advice do I have?

I would rate Rapid7 MDR at nine out of ten overall. I choose this rating because it provides strong threat monitoring, investigation support, and security visibility, while still leaving room for improvements. I recommend Rapid7 MDR to organizations looking to strengthen their security monitoring, threat detection, and incident response capabilities. I suggest they assess their security requirements, confirm integration with existing tools, and clearly define incident escalation and response processes. My review rating for Rapid7 MDR is nine out of ten.

Which deployment model are you using for this solution?

Hybrid Cloud

If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?

Amazon Web Services (AWS)
Disclosure: My company does not have a business relationship with this vendor other than being a customer.
Last updated: Oct 11, 2026
Flag as inappropriate
PeerSpot user
Aritro Bhattacharjee - PeerSpot reviewer
Product Specialist at Frontier Business Systems
Real User
Top 5
Sep 27, 2026
Managed detection has provided 24x7 protection and enables our team to focus on proactive security
Pros and Cons
  • "Rapid7 MDR has positively impacted our organization by ensuring that alerts can come at any point in time, and we do not have to worry because someone is there to fix it proactively."
  • "Regarding improvements for Rapid7 MDR, the only thing I can mention is the costing structure, which is a little bit premium; I understand that top products come at a premium rate."

What is our primary use case?

My main use case for Rapid7 MDR is providing protection where manual intervention from the company side is almost zero, which is essential for maintaining effective security.

The main point is knowing that someone is managing, not only selling, the complete solution we deployed and are fond of, and that is the backbone of our use case.

How has it helped my organization?

Rapid7 MDR has positively impacted our organization by ensuring that alerts can come at any point in time, and we do not have to worry because someone is there to fix it proactively.

In terms of specific outcomes since using Rapid7 MDR, I can confidently say there is virtually zero reduction in incident response time and no productivity getting hampered, allowing people to work more effectively.

What is most valuable?

The best features Rapid7 MDR offers include proactive threat hunting, as simply reacting to alerts will not work in today's sophisticated security landscape.

There are many instances where proactive threat hunting has helped our organization catch threats that could have been missed; people take their laptops home, and we have zero visibility, but with this MDR solution, we have peace of mind.

Regarding Rapid7 MDR's AI capabilities, I find it very positive and it provides a lot of help in audits and has a robust pre-authorized framework with strict controls.

Speaking about Rapid7 MDR's accuracy and reliability of output, I have to give it a ninety-nine percent rating, as there are very low false positive rates with accurate vulnerability scoring.

The transparency of Rapid7 MDR regarding gaining visibility into detections and investigations is outstanding, with the dashboard being the best in its class and centralizing telemetry data effectively.

The inclusion of digital forensics and incident response within the MDR service significantly improves our incident recovery process by providing historical timelines and root cause analysis.

The risk-aware detection features in Rapid7 MDR are unique, as they eliminate guesswork by cross-referencing alerts and helping to prioritize realistic attack paths.

We have used the multi-vector telemetry feature in Rapid7 MDR, and it greatly improves the accuracy of our investigations through true correlated visibility across platforms.

Having a dedicated cybersecurity advisor through Rapid7 MDR impacts our security program by aligning it with business needs thanks to their industry expertise and knowledge on mitigating attacks.

What needs improvement?

Regarding improvements for Rapid7 MDR, the only thing I can mention is the costing structure, which is a little bit premium; I understand that top products come at a premium rate.

I rate Rapid7 MDR nine out of ten because some networks may have devices that are not up to date, which affects performance, and there is also room for improvement in the costing structure.

For how long have I used the solution?

I have been using Rapid7 MDR for almost four years.

What do I think about the stability of the solution?

Rapid7 MDR is absolutely stable.

What do I think about the scalability of the solution?

The scalability of Rapid7 MDR is very high; you simply need to add licenses and agents to get started.

How are customer service and support?

The customer support for Rapid7 MDR is excellent.

I rate the customer support a perfect ten out of ten.

Which solution did I use previously and why did I switch?

We have not previously used any other XDR solution.

What was our ROI?

I have seen a return on investment; the productivity metric shows that the same teams who used to handle alerts manually can now focus on proactive work because this is taken care of by someone else.

What's my experience with pricing, setup cost, and licensing?

Regarding the pricing, setup cost, and licensing, I notice a little bit of premiumization, but I firmly believe that the best products require payment for their quality.

Which other solutions did I evaluate?

We evaluated other options such as Sophos, SentinelOne, and CrowdStrike before choosing Rapid7 MDR.

What other advice do I have?

My advice to others looking into using Rapid7 MDR is to go for it; you will love it and not regret your decision. I rate Rapid7 MDR nine out of ten.

Which deployment model are you using for this solution?

Public Cloud

If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?

Disclosure: My company does not have a business relationship with this vendor other than being a customer.
Last updated: Sep 27, 2026
Flag as inappropriate
PeerSpot user
Buyer's Guide
Rapid7 MDR
October 2026
Learn what your peers think about Rapid7 MDR. Get advice and tips from experienced pros sharing their opinions. Updated: October 2026.
920,223 professionals have used our research since 2012.
Shrikrishna Kashid - PeerSpot reviewer
Senior Technical Service Engineer Expert at a tech vendor with 10,001+ employees
MSP
Top 5
May 29, 2026
Threat detection has improved for AI-driven traffic but confidence in AI security remains low
Pros and Cons
  • "All stakeholders claim that Rapid7 MDR is very effective at identifying threats in today's AI era."
  • "We cannot allow it to go outside because we do not have that level of trust at the moment."

What is our primary use case?

Our primary use cases focus on threat detection and network-related security concerns, with an emphasis on cybersecurity-related areas.

What is most valuable?

My team is satisfied with the current capabilities, though there are certainly areas for improvement. Rapid7 MDR has not covered all the areas we need, which is why we also utilize Zscaler. For personalized security for developers, testers, and other audiences who are exposing their network to risk, we definitely need very micro-level monitoring of requests and network activity.

All stakeholders claim that Rapid7 MDR is very effective at identifying threats in today's AI era. It is quite difficult for all of us to identify what type of code or requests are coming through. This improvement is very important to the product itself and its realignment. We raised a request, and Rapid7 MDR has made changes to their product by conducting extensive research and development with thorough testing.

What needs improvement?

There are multiple areas for improvement, especially regarding generative AI-related threats. Secondly, proxy communication happens through agentic AI, making it very difficult to identify whether it is agentic AI, a human, or a hacker. That filtering and identification will need to be improved in Rapid7 MDR. Many products still do not make that effort, but Rapid7 MDR has started to address this; however, this remains a drawback at the moment. We moved our own artificial intelligence product, and our developers and testers are using it, but we still restrict its use to inside our Fujitsu premises. We cannot allow it to go outside because we do not have that level of trust at the moment.

It is quite difficult to specify all areas at the moment, but there are multiple features needed. Based on our transformation with a combination of cloud technology and artificial intelligence, we are using co-pilot and multiple AI models will require many enhancements aligned with new technology trends in the market. I cannot articulate or name all of them, but we are still not confident in asking customers to use AI in their environment. They are reluctant at the moment because of security concerns and other myths around AI. There should definitely be a tool that gives us the confidence that whatever AI model we are using is secured through that tool. That tool should assure customers that there is a 90% or 98% guarantee that their code or utilization of AI technology will meet the mark. Currently, customers are not flexible in beginning to utilize AI, especially for financial institutions, research and development institutes, or places where sensitive business operations occur or large customer volumes exist. No one can risk it at the moment. People are using co-pilot, chatbots, or bot services, but they are still not confident in utilizing them without taking risks. No one can claim that they are 100% secure in providing those services. We are expecting that type of confidence from Rapid7 MDR and other technologies playing a role in the market.

For how long have I used the solution?

We have been using this solution for more than four years.

How are customer service and support?

Getting responses from any service industry is challenging. We have an SLA, especially those SLAs from which we really need support based on our customer expectations, particularly for our developers. Every machine has Rapid7 MDR installed. We have our own IT department that is enabled with all training. The thing is that we do not directly rely on Rapid7 MDR for support, but we have built up our own competency with Rapid7 MDR. Only for very urgent issues do we get support from Rapid7 MDR, but that also depends upon the contract. We do not have extensive experience where we frequently interact with Rapid7 MDR, but wherever there is a setting, configuration management, or something similar, we are getting support from their technical or non-technical staff. It is about how you build your relationship with them. We are training our employees and providing them with training, and once they are trained, we believe this is a common shared responsibility.

What's my experience with pricing, setup cost, and licensing?

The setup cost is reasonable and not so expensive. It is simple and straightforward.

What other advice do I have?

We are primarily on Microsoft with a platinum contract, so all products we evaluate are in line with Microsoft's technology stack. Rapid7 MDR and Zscaler are both well-equipped and support Microsoft technology. Since Microsoft has its own products like Defender and others, we still use them for our daily work. I would rate my overall experience with customer service as a 3 out of 10.

Which deployment model are you using for this solution?

On-premises

If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?

Disclosure: My company does not have a business relationship with this vendor other than being a customer.
Last updated: May 29, 2026
Flag as inappropriate
PeerSpot user
AbhijeetSharma - PeerSpot reviewer
Senior Project Engineer at CDACINDIA
Real User
Top 5
May 8, 2026
Security team has gained deeper analytics and now maintains a stronger risk‑based posture
Pros and Cons
  • "The benefits that came with Rapid7 MDR is the analysis we are getting now, which is quite useful."
  • "We currently come across more false positives. The tool is a bit more aggressive than other tools."

What is our primary use case?

I am using Rapid7 MDR for all the devices in a single data center. We have different devices including Windows servers, firewalls, endpoints, and various Arista devices. All those devices log different incidents that are managed by Rapid7 MDR.

We are using a Microsoft environment for our endpoints. We are collecting syslog logs for that. We also use EDR, and the correlation is quite useful. We have been getting new kinds of alerts and more insight into the endpoints. This proved valuable because we integrated EDR with it.

What is most valuable?

We were using an in-house SIEM before with different use cases and analytics. However, it did not give us more insight into the logs that we were fetching. The benefits that came with Rapid7 MDR is the analysis we are getting now, which is quite useful. Apart from that, we also got user behavior analytics and EDR integration, which helped us considerably.

Regulatory compliance basically guides us at the moment. Our infrastructure is quite critical, so security posture needs to be well maintained. We are relying on Rapid7 MDR and have had a good experience. It is fulfilling our strategy. We have a risk matrix ourselves that maps with the risk posture we have. We are relying on our in-house risk matrix at the moment, but we also have a good feature with Rapid7 MDR.

What needs improvement?

We currently come across more false positives. The tool is a bit more aggressive than other tools. However, this can be fixed with tuning. We are working on tuning it better. Our infrastructure is expanding a lot, so we are getting lots of logs. The ingestion then becomes an issue from a cost perspective. These are the main areas for improvement.

For how long have I used the solution?

I have been using the solution for one and a half years now.

How are customer service and support?

If we talk about different vendors, there is competition, but the user interface of Rapid7 MDR is quite useful for us. The support is also good. There are different vendors which have more experienced staff. However, Rapid7 MDR has been the best in zero-day attacks and the vulnerabilities that come into picture. We prefer that.

Which solution did I use previously and why did I switch?

We were using an in-house SIEM before with different use cases and analytics. It did not give us more insight into the logs that we were fetching. The benefits that came with Rapid7 MDR is the analysis we are getting now, which is quite useful.

How was the initial setup?

It is very easy.

What about the implementation team?

We have a team, though we do not have a segregated team for it at the moment. We have around fifty individuals in different places and different responsibilities.

What's my experience with pricing, setup cost, and licensing?

The log ingestion is the main criteria that comes into picture. I would not say it is cheap, but it is more efficient. It is economical for us. We evaluated different tools and services before. If we check the functional requirement and financial perspective, this is the best service.

What other advice do I have?

We generally do not get into the telemetry part of it, and that is impacting a few things that align with our strategy at the moment. However, we should use it more. We will be contacting the support team for that.

Regarding scalability, I would rate it a nine. If an organization is looking for an edge in security and they have any kind of on-prem, hybrid, or cloud solution, I think they should go for Rapid7 MDR. Based on my experience, I have evaluated different vendors and this came out to be the better solution for us. I would recommend this. My overall rating for this product is nine.

Which deployment model are you using for this solution?

Hybrid Cloud

If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?

Other
Disclosure: My company does not have a business relationship with this vendor other than being a customer.
Last updated: May 8, 2026
Flag as inappropriate
PeerSpot user
Prajwal Chougale - PeerSpot reviewer
SOC L2 Analyst at a tech services company with 51-200 employees
MSP
Top 5Leaderboard
Aug 5, 2026
Managed detection has transformed our response speed and reduced false positives dramatically
Pros and Cons
  • "Rapid7 MDR is an excellent choice for organizations that want enterprise-grade threat detection and response without building a 24/7 in-house SOC team, combining expert analysis, high fidelity detections, broad integration support, and actionable incident response."
  • "To improve Rapid7 MDR, I suggest enhancing detection and reporting, including customizable dashboards and more dynamic alert detection rules based on anomalies."

What is our primary use case?

My main use case for Rapid7 MDR is to manage detection and response, SIEM, and other threat management solutions from Rapid7, including the vulnerability part.

I use Rapid7 MDR in parallel to Rapid7 SIEM, where all the logs are ingested and where I carry out investigations and incident response activities.

The transparency of Rapid7 MDR detection is high, with detailed insights into each incident, including analyst notes, supporting evidence, attack timelines, and recommendations for remediation.

The risk-aware detection features in Rapid7 MDR are effective, as they help me focus on significant threats by correlating telemetry to identify realistic attack paths and prioritize incidents based on actual risk.

Having digital forensics and incident response included in Rapid7 MDR has greatly improved my incident recovery process by helping me determine root causes and the extent of compromises.

I utilize the integrated MDR for Microsoft environments, experiencing great visibility and effective incident response through this enhancement.

What is most valuable?

The best features Rapid7 MDR offers include the ability to configure alerts, log ingestion, monitoring capability, and threat detection that correlates telemetry from multiple security tools to detect advanced attacks, with every high priority incident validated by Rapid7 analysts initially, significantly reducing false positives.

I find myself relying most on the threat detection and investigation quality, as well as the threat intelligence, which has made a significant difference in the effectiveness of my incident response team.

Rapid7 MDR is an excellent choice for organizations that want enterprise-grade threat detection and response without building a 24/7 in-house SOC team, combining expert analysis, high fidelity detections, broad integration support, and actionable incident response.

Rapid7 MDR has positively impacted my organization by containing most of the false positives, as its in-house 24/7 team continuously monitors customer environments, enabling organizations to detect and respond to threats much faster.

Measurable improvements include seeing a reduced number of false positives compared to other tools because Rapid7's in-house team handles most of them, and the faster threat detection reduces the mean time to detect from hours or days to minutes due to continuous monitoring.

What needs improvement?

To improve Rapid7 MDR, I suggest enhancing detection and reporting, including customizable dashboards and more dynamic alert detection rules based on anomalies.

Everything mainly revolves around detections and reporting, and I find the user experience to be great with smooth integration from AWS.

For how long have I used the solution?

I have been working in my current field for almost three years.

What do I think about the scalability of the solution?

Rapid7 MDR is scalable and adapts well to any organization's size.

How are customer service and support?

Customer support is excellent, and they promptly connect whenever I raise a request, which I would rate more than nine.

I chose 9.5 because of their excellent customer support, efficient integration processes, and active communication during high incidents, helping my internal security team effectively handle critical situations.

Which solution did I use previously and why did I switch?

This is the only solution I have used for this particular customer.

What was our ROI?

Rapid7 MDR has provided a clear return on investment by significantly reducing the time my internal security team spends on alert triage through validated investigations and actionable recommendations.

What other advice do I have?

My advice to others is to choose Rapid7 MDR if you want a cost-effective SIEM solution backed by a great security support team.

I benefit from using AI-assisted risk-aware investigation workflows, which streamline investigations by correlating all relevant alerts and details into a single workflow, reducing manual effort in triaging incidents.

I gave this product a rating of 9.5 out of 10.

Which deployment model are you using for this solution?

Public Cloud

If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?

Disclosure: My company does not have a business relationship with this vendor other than being a customer.
Last updated: Aug 5, 2026
Flag as inappropriate
PeerSpot user
JensWolf - PeerSpot reviewer
Systems Administrator at a consultancy with 51-200 employees
Real User
Top 20
Jun 4, 2026
Managed detection has provided constant protection and removes the need for in-house expertise
Pros and Cons
  • "The main benefits that Rapid7 MDR provides for me as an end-user are the security and that they are available 24 hours a day, always."
  • "The price of Rapid7 MDR could definitely be lower, as these are expensive systems, especially if you have the MDR."

What is our primary use case?

Our main use case for Rapid7 MDR is that they serve as our SOC.

What is most valuable?

Rapid7 MDR is an IDR that does what it is supposed to do. The vulnerability management helps us keep our products and systems up to date.

I am satisfied with the risk-aware detection feature in Rapid7 MDR and have no issues with it.

We use the AI-assisted feature in Rapid7 sometimes, mainly to understand the logs from systems that we are not familiar with.

The main benefits that Rapid7 MDR provides for me as an end-user are the security and that they are available 24 hours a day, always. This gives me reassurance because I do not have to be an expert on the cybersecurity part because they are. We are a quite small firm, so we do not have that in-house expertise, which is why we rely on them.

What needs improvement?

Regarding points for improvement in Rapid7 MDR, I do not have to do anything with them unless I have a problem. The less I hear from them, the better, because they contact us when there is a problem. We have our monthly meeting, and that is fine by me. That is pretty much it; I get what I want, and I do not want anything else.

The price of Rapid7 MDR could definitely be lower, as these are expensive systems, especially if you have the MDR. They could work on the price.

For how long have I used the solution?

I have been working with Rapid7 MDR for about two years.

What do I think about the stability of the solution?

I would rate Rapid7 MDR as a 10 for stability; it has always been there and has never been down.

What do I think about the scalability of the solution?

The ability to scale Rapid7 MDR is really super easy, so I would rate it a 10 as well.

How are customer service and support?

I would rate Rapid7 technical support as definitely a 10, because whenever we have had any problems, it is really fast and sensitive to our knowledge. I get the help I really need, and it is fast, so it is really good.

Which solution did I use previously and why did I switch?

I have only worked with Rapid7 when it comes to MDR; I have no experience with other products.

How was the initial setup?

Based on my experience, it is really easy to start working with Rapid7 MDR; you are up and running in a day or two.

The initial setup process for Rapid7 MDR is really easy; it was really easy for us.

What about the implementation team?

We did the setup processes in-house for Rapid7 MDR ourselves.

Which other solutions did I evaluate?

The main competitor for Rapid7 MDR would be CrowdStrike, in my opinion.

I have not looked into CrowdStrike; I do not know the specifics of what they call it, but they have the big offerings as well.

What other advice do I have?

I would definitely recommend Rapid7 MDR to other users. I would rate this review a 10.

Disclosure: My company does not have a business relationship with this vendor other than being a customer.
Last updated: Jun 4, 2026
Flag as inappropriate
PeerSpot user
Andrzej Nienaltowski - PeerSpot reviewer
Security Specialist at DB Schenker
Real User
Top 5
Apr 27, 2026
Compliance reporting has become fast and clear while pricing still needs improvement
Pros and Cons
  • "From my perspective, Rapid7 MDR is a really good product that is easy to implement and use."
  • "However, I think the best area for improvement is pricing."

What is our primary use case?

Our use case is to measure our compliance score. We measure our compliance status with CIS benchmarks implemented via Intune and Defender, which was a request from management.

What is most valuable?

I think the best feature of Rapid7 MDR is that it is silent and easy to use. Sometimes I had some problems with it, but I believe that was caused by Microsoft and their policies. It was really fast to measure our compliance.

Rapid7 MDR helped us find some gaps and vulnerabilities in our policies. It helped to make sure that we did not miss anything in our implementation.

It helped us to establish possible outcomes and what might happen if we want to implement something.

What needs improvement?

I did not use all features, so I am not sure what is already implemented or what would be good to implement. However, I think the best area for improvement is pricing.

For how long have I used the solution?

I have been using Rapid7 MDR for half of the year, a few months.

What do I think about the stability of the solution?

There were no problems, so I think stability is nine out of ten.

Which solution did I use previously and why did I switch?

I cannot compare Rapid7 MDR with other solutions because I did not use other detectors. If we are talking about Defender, I think it is really popular. I would say it is in the top five, and that is a really reasonable place for them.

How was the initial setup?

The setup was really quick and easy.

What about the implementation team?

Three people use Rapid7 MDR to manage and verify our compliance status. Three people was enough.

What other advice do I have?

I did not use the Risk-Aware Detection feature at all, so unfortunately I cannot answer questions about that.

Regarding Intune, I have been using it for six years and Defender for two and a half years. Those are the two products I use the most. I also use some admin center, Exchange admin center, and other tools.

I am not sure about certain features because I did not use them all. However, as I have been in a support role, I think I should rate that at eight out of ten.

From my perspective, Rapid7 MDR is a really good product that is easy to implement and use. I achieved everything I needed, prepared the whole report, and it took me a few days. That is pretty fast and awesome.

My overall review rating for this product is seven out of ten.

Disclosure: My company does not have a business relationship with this vendor other than being a customer.
Last updated: Apr 27, 2026
Flag as inappropriate
PeerSpot user
reviewer2811711 - PeerSpot reviewer
Security Analyst at a tech vendor with 10,001+ employees
Real User
Top 20
Mar 27, 2026
Ticket investigations have become richer and faster while query building still needs refinements
Pros and Cons
  • "The enrichment that Rapid7 MDR generates for the client is greater than with other tools, and this has had a big impact."

    What is our primary use case?

    Rapid7 MDR serves as our endpoint security solution. When we receive an alert from Rapid7 MDR, we check the logs of the endpoints that are managed on the client side, which provides us with richer information for the tickets. The enrichment that Rapid7 MDR generates for the client is greater than with other tools, and this has had a big impact.

    Everything works very well with Rapid7 MDR. One day we had an incident related to an attack where Rapid7 MDR detected social engineering in a Teams chat, for which we received a notification by email. By correlating the events in Rapid7 MDR, we identified that it was a call from an unauthorized tenant within the organization.

    What is most valuable?

    Being able to list the vulnerabilities of the machines, being able to correlate alerts with the respective users who managed them, and having the artificial intelligence for creating query searches in the logs is crucial. The artificial intelligence for creating queries in the logs with Rapid7 MDR has been a great help because normally we use another platform called CrowdStrike, and the queries there are very different. This ultimately helps us create queries faster and more efficiently.

    Rapid7 MDR has had a big impact when handling tickets by enriching them with information for the client. The client has been very pleased when handling tickets with Rapid7 MDR, unlike with other platforms, and this has had a positive impact.

    It has helped with the ease and speed of detections and event correlations. Rapid7 MDR is very transparent. Investigations and detections are always identified normally, and they enrich the tickets.

    What needs improvement?

    I do not feel there is any improvement needed at the moment; all the features, the tools within it, and their functions are satisfactory. Because it is very good, there are always areas to improve, though I cannot point out specific ones at this moment.

    For how long have I used the solution?

    I have been using Rapid7 MDR for almost a year.

    What do I think about the stability of the solution?

    I have not experienced any stability issues.

    Which solution did I use previously and why did I switch?

    We used CrowdStrike previously. We still use CrowdStrike, and we have not moved 100% to Rapid7 MDR; we have a 50/50 split with both tools.

    How was the initial setup?

    The setup was very good. You just install a sensor for Rapid7 MDR and that is it.

    What about the implementation team?

    I have not used the implementation team.

    Which other solutions did I evaluate?

    I recommend reading the documentation, requesting a demo, and comparing Rapid7 MDR with other tools to see which is best for your organization.

    Which deployment model are you using for this solution?

    Public Cloud

    If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?

    Other
    Disclosure: PeerSpot contacted the reviewer to collect the review and to validate authenticity. The reviewer was referred by the vendor, but the review is not subject to editing or approval by the vendor. The reviewer's company has a business relationship with this vendor other than being a customer: Socio
    Last updated: Mar 27, 2026
    Flag as inappropriate
    PeerSpot user
    Marketing Expert at J's communication
    Reseller
    Top 5Leaderboard
    May 20, 2025
    Threat detection benefits stand out while AI capabilities need improvement
    Pros and Cons
    • "The features of Rapid7 MDR that I find most effective for threat detection are the threat intelligence capabilities because it already collects many vulnerabilities and exploitations, as well as the configuration of network devices."
    • "Rapid7 MDR is currently weak in AI solutions and intelligence, which is concerning."

    What is our primary use case?

    The typical use case for Rapid7 MDR is that it is highly valued. It is not so bad, but competition with EDR is tough. Rapid7 MDR does not position itself as EDR or XDR, so it is rather a SIEM type solution, which makes it different from CrowdStrike, SentinelOne, or Microsoft. They are not in the competition listing of EDR products.

    What is most valuable?

    The features of Rapid7 MDR that I find most effective for threat detection are the threat intelligence capabilities because it already collects many vulnerabilities and exploitations, as well as the configuration of network devices. They integrate everything into one solution. The other solutions such as CrowdStrike or SentinelOne don't collect all the vulnerabilities or threat intelligence except within their product itself, making Rapid7 MDR very strong in this aspect.

    I have seen an ROI from this solution in terms of time savings. Because it includes everything, including SIEM, EDR, and vulnerability control, other solutions require integration of every module and vendor. It is easier to implement once they start, as the modules of the EDR can be challenging to implement and may require consulting.

    What needs improvement?

    There are areas of Rapid7 MDR that have room for improvement. The market is now changing very quickly towards artificial intelligence, and all the SIEM, EDR, and XDR vendors are moving to apply artificial intelligence in their solutions. Rapid7 MDR is currently weak in AI solutions and intelligence, which is concerning. It is also somewhat delayed compared to many vendors such as CrowdStrike, SentinelOne, or Microsoft, who are heading in such directions.

    For how long have I used the solution?

    I have worked with Rapid7 MDR for approximately three years.

    What do I think about the stability of the solution?

    I would rate the stability of Rapid7 MDR rather high, approximately six or eight out of ten.

    What do I think about the scalability of the solution?

    I would rate the scalability of Rapid7 MDR very high on a scale of one to 10, approximately eight.

    How are customer service and support?

    The technical support from Rapid7 MDR is adequate, rating approximately six out of ten. The lower tier support is not very good. Additionally, Japanese customers require Japanese representatives as the support is primarily in English.

    How would you rate customer service and support?

    Neutral

    How was the initial setup?

    The initial setup of Rapid7 MDR is relatively easy because it integrates everything. However, the complete setup process is challenging due to the numerous modules involved. This includes cloud deployment, on-premises implementation of network devices, data collection, and agent installation. Implementation is manageable for existing Rapid7 customers, but it can be very challenging for new customers.

    What other advice do I have?

    I have knowledge of CrowdStrike solutions as a competitor, though not direct experience.

    I would recommend Rapid7 MDR to others, but this market is changing quickly due to artificial intelligence. I cannot say it is the best solution for customers as the market is evolving, with new solutions emerging and existing vendors improving their offerings in the near future.

    Overall, I would rate Rapid7 MDR a seven out of ten. Once customers can implement it, it becomes a good solution for them, though implementation remains a significant consideration.

    Disclosure: My company has a business relationship with this vendor other than being a customer. reseller
    PeerSpot user
    reviewer2686596 - PeerSpot reviewer
    Security Engineer at a retailer with 201-500 employees
    Real User
    Top 20
    Jun 3, 2026
    Managed detection has transformed our soc by improving visibility and speeding incident response
    Pros and Cons
      • "AI is present, and I think Rapid7 MDR could add good reporting, more reporting, and perhaps more templates in the future to make the product even better."

      What is our primary use case?

      Rapid7 MDR is our managed service that serves as our SOC and represents our starting point in utilizing a solution for cybersecurity. Rapid7 MDR is the primary use case for our company's SOC.

      What is most valuable?

      The consulting and monthly consulting and reporting are very useful features that we find most valuable.

      Having a dedicated cybersecurity advisor through Rapid7 MDR helps us align our cybersecurity strategy to the up-to-date measurements and controls that we can take, which impacts how we align our security program with business needs.

      With a very small IT operations team, we have experienced a positive impact from Rapid7 MDR. In the past, we had much effort to handle incidents, and now with the SOC on our side, the process is more streamlined, and we are much faster than before.

      My impression of the Risk-Aware Detection features is positive; they work well for us.

      We are starting to get into the AI solutions from Rapid7 MDR for our SIEM, but we are in the very beginning stages, focusing on AI-assisted Risk-Aware Investigation workflows.

      We are using the integrated MDR for Microsoft environments feature. Up to now, it works well regarding its detection and response capabilities for Microsoft-centric environments.

      Now we have a clear view of what has happened in our tenant, which has impacted our incident recovery process positively; before, we did not have this view. We have many signals, so we can control them and check if we are on the right path or if it is just a false incident, and it works very well. In the last several months, we have seen more than we have seen in the previous two years.

      What needs improvement?

      AI is present, and I think Rapid7 MDR could add good reporting, more reporting, and perhaps more templates in the future to make the product even better.

      For how long have I used the solution?

      Since the beginning of the year, we have been using this tool.

      What do I think about the stability of the solution?

      Rapid7 MDR works really well; we are completely satisfied with it. It is a nice service and I believe we have everything we need. From my perspective, I have no improvements to suggest. There is much more we have to discover.

      What do I think about the scalability of the solution?

      I do not think there are scalability issues regarding extending usage in the future.

      How are customer service and support?

      When ten is the best, I would rate their technical support at a ten.

      Which solution did I use previously and why did I switch?

      We have Rapid7 IVM and SIEM, and we are still using them. We have now added Rapid7 MDR as a service, which reflects our previous positive experience with Rapid7 solutions.

      How was the initial setup?

      I cannot speak to how the initial setup was because we had Rapid7 IVM and SIEM before, and that setup occurred before my time. The setup for Rapid7 MDR was very simple because we already had half of the infrastructure in place.

      Which other solutions did I evaluate?

      We evaluated many other solutions for various situations, but ultimately we chose Rapid7 MDR because of the price and the service, which were perfect for us.

      What other advice do I have?

      I find the pricing reasonable and competitive.

      Rapid7 MDR is hybrid regarding whether it is on-premises, cloud-based, or hybrid.

      I purchased Rapid7 MDR through our IT supplier.

      Five people, at most, are working with the product in our company, indicating the usage is currently pretty limited.

      The interface is very handy and user-friendly.

      I would say Rapid7 MDR is popular; Rapid7 is a well-known name in my region.

      I would rate this product a ten out of ten.

      Disclosure: My company does not have a business relationship with this vendor other than being a customer.
      Last updated: Jun 3, 2026
      Flag as inappropriate
      PeerSpot user
      Buyer's Guide
      Download our free Rapid7 MDR Report and get advice and tips from experienced pros sharing their opinions.
      Updated: October 2026
      Buyer's Guide
      Download our free Rapid7 MDR Report and get advice and tips from experienced pros sharing their opinions.