What is our primary use case?
My main use case for Rapid7 MDR is working primarily on investigation, cloud security model, and attack surface model for agent coverage.
For cloud security work, I mainly use Rapid7 MDR on agent coverage, especially for attack surface management, focusing on total instances or servers having missing CrowdStrike and missing Rapid7. The dashboard we have created is very helpful, and regarding investigation, especially on GuardDuty, the alert logs help us analyze and identify anomalous behavior of users.
Currently, there is no additional use case for Rapid7 MDR, and it is functioning smoothly. We are utilizing all the modules from Rapid7, and it helps us analyze in our day-to-day work.
How has it helped my organization?
Rapid7 MDR positively impacts my organization by helping the security team detect threats earlier, investigate suspicious activity faster, and respond before incidents cause significant damage.
Based on the MDR, I have noticed faster outcomes, as it has strengthened our security monitoring by helping investigate suspicious authentication activity such as access key creation and other potential threats. It provides additional investigation expertise and helps us support threat validation, allowing our cybersecurity team to prioritize only genuine security risks using MDR reports and incident records.
The inclusion of digital forensics and incident response within Rapid7 MDR has improved my ability to investigate security incidents, understand potential root causes, and identify affected systems. Investigation findings and response recommendations help my team make informed decisions, prioritize containment, and coordinate remediation more effectively.
Having a dedicated cybersecurity advisor through Rapid7 MDR helps align our security program with business needs by providing guidance on emerging threats, security priorities, and opportunities to improve our overall security posture. Recommendations help us focus on high-risk issues.
What is most valuable?
The best features Rapid7 MDR offers include Bot Factory for automation in cloud security, multiple options in attack surface management such as querying workspace, and very clear investigation logs that we can filter based on our needs.
Automation in cloud security helps me reduce manual work, respond to security findings faster, and improve our AWS security posture. In InsightCloudSec, I can use automation to identify misconfigurations, prioritize risk, and trigger remediation workflows.
Regarding Rapid7 MDR's AI capabilities, it supports compliance monitoring and helps my organization strengthen its posture. The AI capabilities provide reliable security alerts and useful investigation findings that help my team identify suspicious activity and distinguish potential threats from benign events. Investigation insights support informed decisions and incident responses.
Rapid7 MDR provides good visibility into security detection and investigation by delivering alert details, investigation context, and response recommendations, such as investigating suspicious authentication attempts, unusual IAM access creation, and malicious endpoint activity to understand the nature of the threat and its potential impact.
The risk-aware detection features in Rapid7 MDR provide detection capabilities by identifying suspicious activity. Improved attack path context and risk-based alert prioritization help us focus on threats that pose the greatest risk to our organization.
I have not directly evaluated the multi-vector telemetry feature in isolation, but I believe correlating telemetry from multiple sources such as endpoint activity, authentication events, and cloud logs can improve investigation accuracy by providing a more complete picture of suspicious activity.
What needs improvement?
Rapid7 MDR can be improved by better integration with existing security tools, clearer reporting for security outcomes, and reducing the number of false positives.
Buyer's Guide
Rapid7 MDR
October 2026
Learn what your peers think about Rapid7 MDR. Get advice and tips from experienced pros sharing their opinions. Updated: October 2026.
920,223 professionals have used our research since 2012.
For how long have I used the solution?
I have been using Rapid7 MDR for approximately one and a half years.
What do I think about the stability of the solution?
What do I think about the scalability of the solution?
Rapid7 MDR's scalability meets our organization's needs. Rapid7 MDR handles our organization's growth or changing needs effectively.
How are customer service and support?
The customer support for Rapid7 MDR is quite good. I would rate the customer support at nine out of ten.
How was the initial setup?
Rapid7 MDR is deployed in my organization using a hybrid cloud approach. We primarily use public cloud infrastructure on AWS alongside on-premise infrastructure, and Rapid7 provides all these features.
What was our ROI?
We have seen operational value from Rapid7 MDR through continuous security monitoring and reduced manual effort in validating suspicious activity. While we have not quantified direct cost savings or staffing reductions, the improved visibility and access to specialized investigation expertise provide value to our security operations.
What's my experience with pricing, setup cost, and licensing?
I did not purchase Rapid7 MDR through the AWS Marketplace. Overall, my experience with pricing and licensing has been reasonable for the value provided through continuous security monitoring, although I was not heavily involved while discussing the pricing and licensing.
What other advice do I have?
I would rate Rapid7 MDR at nine out of ten overall. I choose this rating because it provides strong threat monitoring, investigation support, and security visibility, while still leaving room for improvements. I recommend Rapid7 MDR to organizations looking to strengthen their security monitoring, threat detection, and incident response capabilities. I suggest they assess their security requirements, confirm integration with existing tools, and clearly define incident escalation and response processes. My review rating for Rapid7 MDR is nine out of ten.
Which deployment model are you using for this solution?
Hybrid Cloud
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Amazon Web Services (AWS)
Disclosure: My company does not have a business relationship with this vendor other than being a customer.