Rapid7 MDR Reviews

I can describe many use cases for Rapid7 MDR, as there are multiple times when a person's PC gets compromised. There is an attacker behavior analysis, ABA, which is already part of the specific Rapid7 MDR XDR solution. We define a specific set of built-in rules in the MDR services and remap those rules according to our infrastructure for specific use cases.

We also deal with multiple phishing emails that we receive, and Rapid7 MDR is effective in identifying those specific use cases. In the Fintech sector, we encounter many anomalies from different servers that are publicly exposed on the internet, and Rapid7 MDR provides very beneficial use cases that eliminate the need to write custom use cases. We can define the logic in predefined use cases such as Attacker Behavior Analysis and User Behavior Analytics.

Additionally, when onboarding any log sources, there is a RegEx parser designed for parsing every log source on the built-in platform, making it quite user-friendly.

The best features in Rapid7 MDR are their team, which is made up of professionals. I interact with them whenever we face issues, even though we are running our own SOC, but we sometimes rely on Rapid7. It is having a human eye on everything. The MDR AI platform they recently transformed into is very helpful for defining use cases, real-time detections from a dashboard, and the reporting mechanism they have created within Rapid7 MDR.

Even the orchestrator platform they introduced for playbook creation is very helpful, as I create playbooks on Rapid7 using their predefined orchestrator platform.

Having a dedicated cybersecurity advisor through Rapid7 MDR significantly impacts aligning our security program with business needs because it approaches MDR better for big organizations such as mine. My first organization, Afiniti, was a significant AI-based company where I introduced Rapid7 MDR. The MDR is beneficial for both small and large organizations, unlike Splunk, which has more conditional formatting in their product.

Rapid7 MDR has positively impacted my organization by providing us with very effective management tools. Once we introduced Rapid7 MDR along with their vulnerability assessment tool, IVM, we transitioned from using Qualys and Tenable, which are top-tier tools in the market. The management tool from Rapid7 allows us to access a variety of vulnerabilities in real time to fix them effectively. How we tackle that specific MDR is indicative of its market quality. We analyzed the tool during our POC before purchasing.

We deployed endpoints on a specific server and attacked that machine using different methods, such as Metasploit, conducting DDoS attempts, and generating alerts for every anomaly from Rapid7. While a competitor's solution failed to detect many attacks, Rapid7 identified them in real time, which effectively pushed my management towards choosing Rapid7 MDR.

My experience with detection and response capabilities for Microsoft-centric environments has been positive. While API integration can be challenging with some third-party tools, Microsoft's built-in features facilitate seamless communication. I have found it relatively easy to triage and integrate Microsoft systems with Rapid7 MDR.

In terms of digital forensics and incident response included in the MDR service, my experience is that it is not very robust. We lack a dedicated forensic team, which is essential for thorough investigation. Rapid7 has introduced honeypots, which is an encouraging feature, but it is not a comprehensive solution such as those offered by competitors, such as Palo Alto's Unit 42.

Apart from forensics, I believe Rapid7 MDR should introduce more forensic services. Another area to improve is the active platform's handling of on-premises tools versus cloud-based tools. We prefer on-premises options for data security, and we find limitations in features compared to cloud-based tools, concerning data access and privacy controls.

I have been working with Rapid7 MDR for the last five to six years.

Regarding stability and scalability, I have had no significant issues. Stability is good, and I have not experienced delays, even with on-premises deployments. I did encounter minor latency during a scheduled upgrade but was informed that it would occur.

Evaluating the customer service and technical support teams of Rapid7 MDR, I would rate them a six out of ten. I have previous experience with IBM support, which was excellent and proactive. In contrast, Rapid7 MDR support often takes longer to respond to issues. Despite their large customer base, this highlights a need for enhancement in their support team.

I decided to switch from those products because, while Qualys is a good vulnerability scanner, it is not very user-friendly. When scanning two machines, one with Rapid7 having an agent deployed for a level three scan and another with Qualys, the results were different. Rapid7 MDR indicated more vulnerabilities that were accurate upon verification, whereas Qualys missed many of them. This highlighted that IVM, Rapid7 MDR, and MDR stand out as top products in the market, especially for our financial sector.

The deployment setup process for Rapid7 MDR is straightforward. I have deployed both the cloud environment and on-premises Nexpose service. Their services, whether on-premises or cloud-based, are easy to deploy, and the endpoints are lightweight and compatible with other tools in our environment.

I bought Rapid7 MDR directly from the vendor, which is uncommon for sectors such as Fintech that usually work through intermediaries. I have had direct interactions with the Rapid7 team, specifically with someone named Nikola, and I find that beneficial.

I have seen a positive return on investment concerning Rapid7 MDR, as we have invested wisely, yielding results in detection mechanisms. I can confidently say that investing in Rapid7 MDR has been worthwhile, despite acknowledging that every tool has its flaws. Overall, the category is very good.

Regarding pricing, I manage everything with Rapid7 MDR, and I find their pricing very reasonable compared to the market. They negotiate well with us on various aspects of MDR, and we have received great rates for services such as IVM, including Threat Command.

I am taking advantage of the expanded ecosystem telemetry support in Rapid7 MDR. We have enhanced the logging mechanism within Rapid7 MDR, allowing us to assign projects to different teams with visibility only of their specific assets. This approach supports various vulnerability assessments and compliance achievements. My management is overall pleased as we have managed to meet compliance standards such as ISO 27001 and NIST due to features provided by Rapid7 MDR.

I utilize AI-assisted Risk-Aware Investigation workflows, integrating both our on-prem and cloud infrastructure. By using APIs in our environment, we gain enhanced visibility, giving us detailed insights that greatly assist in real-time monitoring.

This approach impacts my alert triage and prioritization processes since Active Directory is a crucial element in our industry. Rapid7 MDR improves the alerting mechanism for Active Directories and all connected user activities. Previously used SIEM solutions did not adequately capture anomalies on ADs. With Rapid7 MDR, any anomaly triggers escalated alerts in real time.

I am using the Integrated MDR for Microsoft Environments feature, having integrated Microsoft 365 with our MDR and endpoints from Microsoft Active Directory and Azure. This integration provides us with comprehensive visibility into our infrastructure.

Regarding transparency in detection and investigations with Rapid7 MDR, we receive metrics such as MTTR and MTTD (Mean Time to Detect and Mean Time to Respond). We monitor how quickly the tool detects anomalies and how long it takes to respond, which shows improvement due to the specific MDR product. My overall review rating for Rapid7 MDR is 8.5 out of 10.

Rapid7 MDR includes the SIEM and all the Rapid7 products, such as Rapid7 Automation, Rapid7 InsightIDR, Rapid7 AppSec, CloudSec, and Rapid7 SIEM, which has this MDR feature. The customer representative, who serves as a customer advisor for our company, responds very quickly to whatever concerns we have. The SIEM operations are integrated with every event source, starting from the firewalls to all other event sources where we cannot install Rapid7 agents. The SIEM features such as investigations and alerts are segmented properly so even beginners can understand the interface. It is not confusing compared to other MDR or SIEM sources. The UI interface helps you understand everything quickly and in a very short time.

The best features of Rapid7 MDR include its ease of use and UI. However, when it comes to feature-wise comparison, I cannot say it is only the best MDR tool we have. Rapid7 agent should be integrated with everything properly, but we have had issues with inability to integrate event sources from other applications such as AppLocker or host-based firewall logs. In those cases, we had to create a custom script and deploy it on the machines to collect the logs. For a top SIEM MDR solution, one should not need to write custom scripts or put in manual effort. Rapid7 seems difficult in getting logs from all applications, especially third-party or custom applications. Additionally, when comparing AI integrations with others such as CrowdStrike, Rapid7 is lacking. CrowdStrike has integrated AI agents, but Rapid7 is still developing that feature, which they hope to complete by the end of this year. Despite this, it remains easy to understand and operate, even for beginners, but its integration of logs, third-party applications, and AI needs improvement.

I would like to see improvements in AI and the integration of third-party application logs, as there is no proper way to obtain those logs.

In terms of risk-aware detection, Rapid7 MDR operates by having its own managed detection rules and creates investigations on their behalf. If any investigation is managed by Rapid7, they take care of that. However, if we create a custom rule and it is very critical, Rapid7 MDR will not manage it, which is a drawback. While Rapid7 provides insights into attack paths, it is not as efficient as CrowdStrike, which offers detailed attack path analysis, whereas Rapid7 only offers a limited view.

Regarding multi-vector telemetry, when it comes to collecting and analyzing security information from multiple sources, I would say Rapid7 does not improve the investigation process much. It is pre-configured, and the investigation chain is based on the evidence that Rapid7 decides; this does not provide real-time insights. We can only see a list of linked investigations without details on the specific parameters or processes involved.

AI, integration, and logging are definitely key areas for improvement in Rapid7 MDR. However, it is not a platform full of glitches; it is good to start with and is beneficial for any organization looking for SIEM solutions. It helps employees fully understand what is going on with Rapid7 MDR and how it integrates. The integration process is good, and the investigations and collection of event sources are also effective. You can happily start with it, but it needs more in-depth improvements to reach its full potential. If any organization is considering a SIEM solution within their budget, I believe Rapid7 has good capabilities to collect event sources, though there are noticeable differences when working in-depth.

I have been using Rapid7 MDR for one year.

In terms of stability, I can confidently rate Rapid7 MDR a 10. We have never faced any major downtime, bugs, or glitches.

Approximately seven to nine users utilize the solution.

For scalability, I would rate Rapid7 MDR an 8.

On a scale of 1 to 10 for support, I rate Rapid7 MDR a 10. The support I receive is exceptional; when I raise cases to them, regardless of the platform, the response time is usually within two days. Even complicated issues do not take more than two days to resolve. The support team is intellectual and dedicated to ensuring that issues are resolved thoroughly before closing the case.

The deployment of Rapid7 MDR is cloud-based. Rapid7 assists in the installation process by deploying several Rapid7 collectors on cloud infrastructure, whether it is Azure, GCP, or AWS. These collectors are instrumental in gathering logs from devices where we cannot install agents.

When comparing Rapid7 MDR to other solutions such as Arctic Wolf, Sophos, and Huntress, I find that Rapid7 integrates many products well, such as CloudSec, application security, vulnerability management, and automation. Rapid7 is the best for vulnerability management and has a legacy system capable of scanning machines even where we cannot install agents, which makes its architecture very efficient for vulnerability scanning. If an organization is looking to utilize Rapid7, I recommend focusing on its vulnerability management tool, also known as InsightVM. The application security is good, but I would be cautious about recommending CloudSec due to its drawbacks. The Rapid7 Automation tool serves as a SOAR tool and is beneficial for organizations that have multiple Rapid7 products, but if they do not, I would remove it from my recommended list. Overall, I believe Rapid7 vulnerability management is an essential tool for any organization.

My organization is on Azure.

Regarding the maintenance of Rapid7 MDR, it is easy and not complicated. However, ease of maintenance also depends on the setup and the customer advisor assigned to you, who should be attentive to your issues. If you have a great customer advisor, they will respond quickly and ensure any issues are handled efficiently. Thus, while maintaining Rapid7 MDR is straightforward, it relies heavily on the quality of your customer advisor.

My advice for those considering Rapid7 MDR is to pursue it if the organization wants the entire suite, which includes application security, cloud security, automation, vulnerability management, and Rapid7 MDR. If budget constraints arise compared to higher-priced tools, Rapid7 remains a solid option. While I notice slight differences compared to other platforms as an engineer, others such as SOC analysts or managers find Rapid7 a recommended solution. It may not be the best in the market, but within a reasonable budget, it is certainly a viable choice. I have rated Rapid7 MDR a 7 overall.

My main use case for Rapid7 MDR is to monitor incidents and ensure our applications are secured. I also want to make sure we are proactive in identifying threats.

I use Rapid7 MDR daily as part of our security process. My workflow starts on a day-to-day basis by checking the dashboard for overnight alerts to see if there are any incidents and to investigate them. If there is any incident that needs to be escalated to my SOC team, I handle that accordingly. It is mainly to monitor the applications 24/7 for any incidents or alerts. We also use Rapid7 MDR to investigate user activities.

We also use Rapid7 MDR for threat hunting with custom queries and for reports on a weekly and monthly basis to find how many incidents have occurred and to get all those details.

In my opinion, the best features Rapid7 MDR offers are the 24/7 coverage with unlimited incident response and also the latest AI-driven alerts, which is one of the best features I have seen recently. The integration models they have across different endpoints is also valuable.

After the AI-driven alert triage was used, our time spent on identifying false positive alerts was reduced drastically because a large portion of our time was previously spent on identifying false positives and segregating them. After the AI-driven alert triage was implemented, this was directly reduced, which helped us identify actual alerts and work on them quickly. The AI enrichment also provides assets and vulnerability context even before a cybersecurity analyst gets into the picture.

In terms of how Rapid7 MDR has impacted my organization positively, it has reduced our false positives after the AI feature was implemented. This reduction in false positive alerts gave us 24/7 coverage without having an in-house SOC team. It also helps us connect various endpoints to identify, detect, and monitor various endpoints across multi-cloud environments. It has helped us maintain our security posture on a day-to-day basis to keep our systems safe and secure, monitor our user usage, and identify vulnerabilities and asset criticalities.

Previously, the need for multiple analysts and multiple security personnel was reduced after the AI implementation. It gave us detailed response information, detailed incidents, and reduced false positives. It also provided us with the reports we needed for further analysis and gave us the gist of what the incident would look like and what would possibly be going wrong. It has reduced the number of billable hours and also gave us time to work on other improvement factors, which has actually reduced our overall human billing.

The major improvement I see is that the reporting and dashboarding experience could be more flexible because the needs for various companies would be different. Having a dashboard which is flexible and also having a more user experience friendly dashboard would be one of the major points I would like to see improved. Building custom reports for specific stakeholders is also important, especially because the current reports are generic and default, which are useful but not necessarily for stakeholders because they would like to see summaries, counts, and compliance-focused views.

I would say pricing transparency and a startup package would be great because pricing is one of the major standpoints for every company to adopt tools. Rapid7 does not have a startup package where companies can have lower pricing or a one-year startup trial or credits for new startups who are eligible to onboard. If that would be available, it could help growing companies use security tools like Rapid7. Additionally, log sources and third-party integrations sometimes require more manual work than expected.

I have been using Rapid7 MDR for more than two years currently.

Rapid7 MDR is stable as of now.

We have not seen any issues with Rapid7 MDR's scalability. We tried to add new endpoints and new locations, but we have not seen any issues in terms of adding new users or endpoints.

We have only reached out during onboarding for customer support, so we did not have much experience with having calls or help with support.

We did evaluate other tools in the market such as Fortify, OpenText, and Sonar before choosing Rapid7 MDR.

I would not be the right person to talk about the money saved, but I could say there has been lots of time saved since we have onboarded Rapid7 MDR. The need for cybersecurity personnel has also been reduced.

We were directly using Rapid7 MDR as the first solution.

The inclusion of digital forensics and incident response within Rapid7 MDR service has positively impacted my incident recovery process, both operationally and financially. During an incident, creating a separate retainer or negotiating scopes and often waiting for external responders to onboard before meaningful work could begin could actually delay our recovery time. However, with Rapid7 MDR, DFIR is fully included in the services, which means there is no hourly fee, no caps, or engagement limit. This means our forensics begins immediately, which gives us an upper hand. In terms of financials, we do not pay additional fees for investigators or separate tools to onboard or for negotiations on retainers.

As for my experience with pricing, setup cost, and licensing, it is a corporate pricing structure and it was not startup friendly, which was one of the major issues I mentioned in improvements. The setup was not easy. We had to have someone already experienced in Rapid7 get involved in the setup and licensing. So it is not user friendly.

I would say the input cost could potentially be high when implementing Rapid7 MDR, but in the near future, you would be seeing a bigger saving factor in terms of time spent and the number of resources required.

We have not used the multi-vector telemetry feature in Rapid7 MDR.

We have not used the integrated MDR for Microsoft environments feature.

We use the AI-assisted risk-aware investigation in Rapid7 MDR and it has impacted our triage by providing detailed context. It gives us detailed impact analysis and also does a deep analysis on what the threat could be and what the potential causes are. It also does a root analysis and gives us the impact event, impact asset, and also what a possible solution could be. This has made the security alert solving easier and faster to resolve.

We have not used the expanded ecosystem telemetry support.

I do not have anything else to add about the features.

I do not have any other improvements needed for Rapid7 MDR that we have not discussed yet.

I would need some time to think about the transparency of Rapid7 MDR in terms of gaining visibility into detections and investigations.

Rapid7 MDR's risk-aware detection features have created a very meaningful positive impact. The integration between the detection and exposure management within Rapid7 MDR unified platform means that the team can actually work on threats that impact the business rather than other threats. Vulnerability data, assets, critical user identity context, and attack path information all feed directly into the detections. When an alert actually fires, it evaluates the isolation and gives us the ability to focus on what needs to be fixed.

It has reduced 60 to 65 percent of false positives, which is actually very helpful and is good because it is almost near to accurate. The reasoning is also almost correct. I would say it is learning day by day but it is actually performing well.

In terms of Rapid7 MDR's AI governance and security, it is more transparent because with the AI capabilities, it has made a transparent approach to governance and security. This means it gives us the ability to see how alerts are triggered and on what actions, and also provides a list of details on the transparency of what AI takes action on and what decisions it has made. Every AI-driven triage decision is auditable and gives us a flow of what has been taken. Because auditing is one of the major factors in compliance, we are able to see what all decisions and when and what factors have made that decision. We can see the reasoning, the evidence considered, and the outcome. From the governance standpoint, the human analyst is still in the loop across the triage cycle.

My overall review rating for Rapid7 MDR is seven out of ten.

Network detection and response is basically what I use Rapid7 MDR for, and it is a very good solution for that. I am using Rapid7 MDR for Microsoft environments, confirming its utility within those systems. I take advantage of the expanded ecosystem telemetry support offered by Rapid7 MDR. I have used InsightIDR, which is a SIEM for Rapid7, and InsightVM for vulnerability management. I appreciate their approach to detecting threats, and I consider it one of the best OEMs for threat detection and response, whether dealing with network issues, mobile devices, or user behaviors. Despite the pricing being a consideration, I always recommend Rapid7 MDR first.

The best features for me in Rapid7 MDR are the fact that it automates network traffic with users and the attacker behavior analytics, known as ABA, rather than UBA. The user behavior analytics and the attacker behavior analytics are important because it is a network-focused sensor that measures real-life patterns of users and attackers, which many other products do not provide. Rapid7 MDR has that real-life metrics, and I have gone through their platform, which also allows customers to correlate the newest attack patterns and methods they are using. They update their database periodically and integrate it with their MDR, which is why I appreciate their ABA and UBA so much.

The visibility of Rapid7 MDR is very accurate, and the transparency is commendable. If I am not too sure about its performance, I can correlate it with their cloud platform, which always has an updated dashboard about attacks. I also have access to the government database for correlation, and that shows they are doing real-time updates on these attacks, which is pre-built into the MDR. The accuracy and transparency for tracking are commendable.

Regarding improvements for Rapid7 MDR, I do not have anything specific for the product, but I would suggest synchronization time improvements for their vulnerability manager. For Rapid7 MDR itself, I am satisfied.

I have not thought about any missing features or functionalities that require enhancement in Rapid7 MDR at this moment.

I have been working in my current field in the industry for six years.

When discussing stability, performance, and reliability specifically for Rapid7 MDR, I would say they are reliable and accurate. However, for other products like the vulnerability manager, I would not extend that same level of confidence.

I find Rapid7 MDR to be very scalable. I can onboard more devices and expand easily.

Regarding Rapid7's support team, I must say that their response time is not as quick as I would prefer. While they do respond, it can take a few days or even a week to get on a call.

On a scale of one to ten for tech support, I would rate them a seven. The support is good overall, but I believe the pace of response could improve.

The setup process for Rapid7 MDR is always easy and straightforward. All their products are quite easy to implement; I do not need to overthink it. Reading the datasheet to understand it shows that it is not difficult at all.

I implemented Rapid7 MDR myself, but for any issues, I can always reach out to Rapid7 support, and they join calls to assist.

The key differences between Rapid7 MDR and competitors such as ManageEngine or Sophos technologies are minimal as both OEMs have different approaches to implementation but aim for the same goal. Rapid7 MDR excels in accuracy over Sophos, especially concerning real-life monitoring, which is a significant differentiator for me.

Having a dedicated security advisor through Rapid7 MDR positively impacts my alignment of security programs with business needs. As a security personnel using this for most of my customers, I can tell that the database is well updated. It gives me the most updated software for security regarding attacks and user behavior, which is crucial for business.

The key benefit of Rapid7 MDR is the way it automatically deploys on a port for me. I look at how to strengthen my customer's environment, ensuring that every IP address internally is accurate. Rapid7 MDR helps eliminate phishing IP addresses on the network, identifying and immediately rectifying them. It also deals with alert fatigue by preventing flooding of the dashboard with raw network anomalies and attacker behaviors. Their incident response is very quick; whenever there is a detection, they respond immediately. Some detections go to the administrator for approval, but with Rapid7 MDR, I can cancel and ask questions later, making it highly recommendable for real-time resolution, reducing alert fatigue, and addressing IP guessing.

With respect to risk-aware detection features, Rapid7 MDR provides full visibility into blind spots. I think I know my network, but I do not; Rapid7 MDR gives me full-time visibility and accurate data about things I am not seeing or paying attention to. Their third-party dashboard allows tracking of specific devices, which is essential in an enterprise environment where I cannot check each endpoint individually. Rapid7 MDR streamlines the information down to the exact affected endpoint and explains why it has been quarantined or removed from the network.

I have utilized the AI assistant for AI-assisted investigation workflow in Rapid7 MDR, and while I think it is a new feature for them, I find it similar to functions in other products. What makes their AI different is that it allows me to design and implement solutions. If there is an issue with the platform, AI can help pinpoint the source of the problem, even if it is a configuration issue. I have not fully used it yet, but I intend to explore its functionality within Rapid7 MDR infrastructure.

I have not actually used the multi-vector telemetry feature in Rapid7 MDR yet, although I have seen it.

My experience with Rapid7 MDR's detection and response capabilities for Microsoft-centric environments has been very smooth. I have not encountered any issues so far, and I believe that Rapid7 MDR and Microsoft have a good synchronization or handshake between their services, which contributes to this smooth operation.

The inclusion of digital forensics and incident response within Rapid7 MDR service impacts my incident recovery process by providing a dashboard that offers insightful reports on incident responses. They have a vast database that is continuously updated, which they incorporate into Rapid7 MDR for threat detection and response capabilities.

When it comes to pricing, Rapid7 MDR is known to have higher costs. However, the value is significant, and I believe that pricing should not be a problem if I recognize the worth of what I am paying for. Overall, I feel the value justifies the cost, though I see a need for a pricing reevaluation for some medium-class businesses.

I have seen cost-effectiveness with Rapid7 MDR solutions, comparing it to other options such as ManageEngine and Sophos.

My overall review rating for Rapid7 MDR is 8.5 out of 10.

My primary use case of Rapid7 MDR is to do 24/7 threat monitoring and managed detection and response. We use it to identify suspicious activity across endpoint, network, and cloud environments and investigate the alerts and reduce false positive alerts through analysis.

One of the examples was we used Rapid7 MDR to detect a suspicious malware activity or PowerShell activity on a user's device. Rapid7 MDR can correlate that endpoint element with network authentication and identification, and it finds if it has suspicious activity and then escalates it with details. The alert had already been validated and with context, we were able to isolate the affected endpoint, investigate the user's activity, and confirm the incident. At the same point, Rapid7 MDR filtered several benign administrative activities such as PowerShell execution, which significantly allowed us to focus on genuine threats.

Overall, Rapid7 MDR helps us to strengthen our security operations by providing continuous monitoring, high quality threat detection, and expert analysis support. The contextual investigation and actionable recommendations have improved our SOC response and allowed the SOC team to focus on high priority activities rather than spending time on false positive alerts.

The best features that Rapid7 MDR offers are 24x7 alert monitoring, expert threat hunting, and high quality alert validation, which significantly reduces false positive alerts. I also appreciate the detailed incident investigations, actionable remediations and recommendations, and the ability to correlate the data from network and cloud environments. The service integrates all the security tools, and Rapid7 MDR analysts provide timely communication and valuable expertise that helps us to respond to attacks more efficiently.

I think the best feature is reducing the false positive alerts so we, instead of reviewing many alerts ourselves, Rapid7 MDR analysts validate the incidents with the relevant context before escalating them. This significantly reduces the alerts and false positives, allowing the SOC team to work on only high priority alerts.

Rapid7 MDR provides capabilities such as robust alert monitoring and investigation, and the Rapid7 MDR analysts already prioritize alerts and help the security analysts focus on high priority alerts only. Because of this, it improved our overall security posture and reduced the workload of the SOC analysts. With continuous monitoring, faster threat detection, and expert analyst support, we have been identifying security issues more quickly. Overall, it has ensured critical security events are detected and handled promptly.

I think Rapid7 MDR already has a strong managed security service, but I believe things can be improved. More customization options for detection rules and other workflows would help organizations to align their services more closely with the specific environment.

Additionally, improving the speed of the communication for the low priority alerts and providing more self-service investigation capabilities could further enhance the overall user experience.

I think the room for improvement is deeper customization and reporting flexibility. Rapid7 MDR is a solid solution overall. I think they can implement more customization options for detection, logging, workflows, and also the integration with other security platforms that would be helpful.

Rapid7 MDR transparency is quite good. It provides useful visibility into detections and investigations with detailed alert information and analyst notes. It shows severity classification and recommended actions. In these investigations, it helps our team to understand the alert, why it was generated, and what would be the next steps that we can take. For example, during a suspicious endpoint activity alert, the Rapid7 MDR team provides context around the process execution, related user activity, and supporting indicators, which help us quickly validate the incident and take appropriate actions. Additionally, more transparency into the detection logic and more customization visibility would further improve the experience.

I have been working in this field since the last two point eight years.

Rapid7 MDR is quite stable according to my experience. The service has provided consistent monitoring and dependable support from the Rapid7 MDR team. We have not experienced availability issues.

I think Rapid7 MDR is scalable. I have studied that it supports growth by allowing my organization to expand its monitoring coverage as the number of users, endpoints, and security data sources increases. The managed service model reduces the need to continuously scale the internal SOC resources while maintaining consistent monitoring and response capabilities. Also, the onboarding of assets and integration is relatively good, which helps to manage the increased volume of findings and investigations.

Customer support is quite good, which is why I think it is quite good.

We are utilizing the AI-assisted risk-aware investigation workflows in Rapid7 MDR. They help us improve our alert triage and prioritization by providing context around the alerts, identifying the risk factors, and helping analysts to focus on more critical security events. Instead of treating every alert with the same priority, the workflow considers factors such as asset criticality, behavior, threat intelligence, and attack patterns to determine the potential impact. This has helped in reducing false positive alerts and overall alert fatigue, and in speeding up the investigation of the real threats.

Rapid7 MDR AI capabilities are good for improving threat detection and alert prioritization and also in the investigation. From the governance and security perspective, I think they have strong controls around data handling, access management, and transparency, which helps in improving data security. Also, the combination of AI-driven analysis and Rapid7 MDR analysts provides a good balance where AI can help identify attack patterns quickly, while human experts validate findings and make the response decisions.

Rapid7 MDR is quite good and I appreciate the responses. I use it on a daily basis. I think it is really reliable as compared to the other platforms which I use, and it helps in reducing the investigation time by providing additional context and highlighting the important points.

The inclusion of the forensics and incident response capabilities has improved our investigations by providing deeper analysis and helping us to understand the scope of the threat and the impact of that on the environment. The forensic analysis also helps us identify the root cause, the affected systems, attackers' activities, and required remediation steps.

Rapid7 MDR has a few features that I think are very valuable because it goes beyond simple alert generation and focuses on the actual risk and potential impact of that risk in our organization. By considering factors such as important assets and user behavior, threat indicators, and the context of the attack, we can better assess our security posture.

I have used the multi-vector telemetry capabilities in Rapid7 MDR. It has helped me in improving investigation accuracy by correlating the data across different endpoints, user activity, and network activity. Having visibility across different telemetry sources provides better context for the alerts and helps us differentiate between legitimate and potential threats.

Cybersecurity advisor helps us make decisions by providing expert guidance and helping us focus on the risks and threats that matter the most to our business. They help us understand our security gaps, identify additional improvements, and also align our security strategy with the business requirements. This also ensures that our resources are used effectively and that security supports the organization's overall goals.

Currently, we are not using the integrated Rapid7 MDR for Microsoft environments feature. I think our team will be enabling that in the upcoming time.

My advice is that Rapid7 MDR is a good fit for organizations that want to use it for 24/7 security monitoring and expert investigation support. It also helps in reducing the workload of the internal SOC teams. With the help of this, SOC teams can mostly focus on the high priority alerts instead of wasting time on the false positives. I think this is a really good tool to have. I would give Rapid7 MDR a rating of eight out of ten because of its 24x7 monitoring capability and valuable analyst expertise that improves our security operations.

Rapid7 MDR has been our primary 24/7 managed detection and response solution software throughout the two and a half years we have been using it.

Recently, Rapid7 MDR flagged and automatically contained a suspicious PowerShell execution on an endpoint device. Once Rapid7 MDR contained the endpoint, the team provided a full forensics summary showing the malicious script that was attempted, which was basically a credential harvesting attack. Our internal team removed the compromised user tokens and re-imaged the machine, then pushed the updated detection rules that resulted in zero lateral data movement or data loss.

Beyond the standard endpoint detection, Rapid7 MDR acts as a true extension of our lean security team and is integrated directly into our SIEM and Slack for instant escalation.

We primarily run on AWS alongside some Microsoft Azure workloads integrated with our on-premises data centers. Rapid7 MDR ingests CloudTrail logs and monitors identity and activity across all those environments.

Rapid7 MDR has slashed our mean time to respond from several hours down to minutes. It gives us an enterprise-grade 24/7 SOC coverage without the massive overhead of hiring and staffing internally.

We save roughly 25 to 30 engineering hours each week by offloading initial tier-one alert triage and investigation to their SOC. Financially, it eliminated the need to hire at least three to four full-time security analysts to maintain 24/7 shift coverage. In terms of dollars, we save several hundreds of thousands annually.

The standout feature is their Insight Agent with Active Response, which lets their SOC isolate compromised endpoints immediately and without needing any manual intervention from us. Active Response stopped a potential ransomware outbreak over a long weekend by instantly isolating the endpoint.

I also value the Attacker Model and endpoint visibility for strategic posture and guidance rather than just reactive alerts. Their AI governance is solid because they maintain a strict human-in-the-loop model, using AI for pattern recognition while keeping the expert analyst at the center.

The accuracy and reliability have been excellent over the past few years. The AI triages quite dependably, classifying noise and correlating multi-vector events. I would rate the accuracy and reliability an eight out of ten. The AI triage is quite dependable at classifying noise and correlating multi-vector events, but it still requires human analyst validation, which ensures we avoid catastrophic false positives or missed threats.

Their transparency is excellent because we share the exact same InsightIDR platform that their SOC uses to triage alerts. This means there is zero black box mystery. For example, when they isolated the endpoint for suspicious PowerShell activity, the investigation timeline laid out the precise command flags, the triggering user account, and the SOC analyst's commentary within minutes.

The primary improvement would be deeper native integration with third-party non-Rapid7 cloud security tools to reduce the portal pivoting. Additionally, giving customers more granular self-service customization for automated response playbooks would help streamline workflows.

Reporting could be more customizable, especially for a non-technical executive audience.

Fine-grained Active Response exclusions would be welcome, streamlined agent deployment because the initial update lifecycle on older Linux distros especially feels a bit clunky, and a unified console workflow would be beneficial.

We have been using Rapid7 MDR for about two and a half years.

Rapid7 MDR has proven highly stable with virtually zero unplanned cloud platform downtime or service interruptions over our two and a half years of use.

Rapid7 MDR scales exceptionally well and handles increases in cloud workloads and data volume seamlessly.

Customer support and the SOC are both top-notch and quite responsive. They respond within minutes, especially for critical escalations, and are backed by a dedicated customer success manager for regular check-ins. I would give the customer support a nine out of ten.

We previously managed an on-premises SIEM using Splunk with fragmented endpoint tools. We switched because the operational overhead of tuning custom correlation rules, constant log ingestion cost spikes, and staffing were becoming quite unsustainable for our team.

We use a hybrid architecture for deployment.

We have seen definitive ROI across key metrics. Head-count avoidance as a primary metric has saved us three to four SOC analysts, which equates to roughly $400,000 to $500,000 in salaries and overhead. Engineering hours saved amount to almost 25 to 30 hours per week. Speed to resolution has increased quite dramatically, with MTTR down from several hours to just minutes.

We procured Rapid7 MDR directly through the AWS Marketplace.

We evaluated CrowdStrike Falcon Complete and Arctic Wolf.

Ensure that you negotiate pre-authorized containment thresholds clearly during onboarding and use marketplace commits like CTP to simplify procurement. I would rate Rapid7 MDR overall an eight out of ten.

My main use case for Rapid7 MDR is that I was selling and positioning this solution to mid-market customers that had a global footprint and obviously needed security to lock down all of their endpoints and manage them through AI and a 24/7 SOC team located throughout the globe.

A specific example of how one of my customers used Rapid7 MDR in their environment includes a customer in the auto financing credit space located in Utah who were looking for a solution that would allow them to monitor all of their endpoints globally, including anyone located in the US or outside of the US, and manage their entire network using software. That is how they were leveraging Rapid7 MDR to monitor their network and all their endpoints, also leveraging the global security operations center that has offices throughout the globe.

Rapid7 MDR has impacted my organization and my customers positively by giving them peace of mind that everything in their network and all their endpoints are completely secure. If any situation is detected where AI senses that there is potentially a rogue element trying to gain access to the network, they can immediately shut down that endpoint without any issue or problem.

Specific outcomes or metrics I have seen from using Rapid7 MDR include that it will allow customers to rapidly respond to any potential threat in an organized and quick fashion. Customers have told me it gives them the peace of mind that they can manage their network quickly, in any potential attack, shutting it down immediately without taking hours and days to resolve.

The inclusion of digital forensics and incident response within the MDR service has impacted my customers' incident recovery process by giving them real key insights into how a situation or incident happened, which is critical to understanding why a specific incident occurred and where it originated from.

The best features Rapid7 MDR offers include managing, detecting, and quickly responding to any potential cybersecurity threat initiated by a hacker that is trying to break into a company's global network.

In terms of detection and quick response, I have seen Rapid7 MDR stand out all the time, and it competes really well against Arctic Wolf, another competitor that is doing a lot of business. However, I think Rapid7 MDR is better than even Arctic Wolf.

Regarding Rapid7 MDR's AI capabilities, I think its governance and security are top notch. I know people who worked at Rapid7 in US government areas with three-letter acronyms, and they believe and trust it, so that says everything.

Regarding Rapid7 MDR's AI capabilities, I think its accuracy and reliability of output are great, as it combines AI capabilities with a security operations team geographically dispersed throughout the world, allowing them to respond faster and predict potential issues before they happen.

I would assess the transparency of Rapid7 MDR in terms of gaining visibility into detections and investigations as crucial. While I cannot provide specifics due to privacy and confidentiality, the key to gaining a customer's trust is being proactive and responsive to their cybersecurity needs.

I think the risk-aware detection features in Rapid7 MDR are monumental and extremely important, which is why Rapid7 continues to be a top-notch provider when it comes to managing incidents and detection.

Personally, I have not used the multi-vector telemetry feature in Rapid7 MDR; however, my customers have used that feature.

Regarding how Rapid7 MDR can be improved, I have seen in the industry that other technologies like Tanium have a unique solution that can shut down an endpoint in under 60 seconds using AI, which I think is a game changer. I am sure Rapid7 is currently competing and knows what Tanium can offer, but Tanium is definitely a next-generation technology.

Improvements needed for Rapid7 MDR that I have not mentioned yet, based on my conversations, include that while the technology is sound, the biggest questions arise when customers are using Arctic Wolf and they experience a decline in support over time. Rapid7 needs an excellent customer success team to help customers realize the full potential of Rapid7 MDR.

I have been using Rapid7 MDR for several years, positioning it as a cybersecurity solution in addition to software-defined wide area network solutions.

Rapid7 MDR is stable.

In terms of scalability, I think the product itself is scaling nicely with no issues.

I think one of the areas that Rapid7 shines is their customer support and proactive positioning, which is a significant reason why one of my customers chose Rapid7 over Arctic Wolf.

I would rate the customer support a nine on a scale of one to ten.

Some customers that were using other tools like Arctic Wolf switched to Rapid7 MDR because they felt they were not receiving the needed attention over time to help them grow and get more value from the product.

I personally cannot share specific ROI information at this point, but many customers I have worked with have noted substantial ROI with the technology.

My experience with pricing, setup cost, and licensing with Rapid7 MDR really depends on whether you purchase it directly from Rapid7 or if you are getting it from a strategic partner, such as Amazon or a telco like Comcast Business. Flexible licensing is critical to avoid huge upfront costs to take advantage of the product itself.

Before choosing Rapid7 MDR, my customers evaluated other options including Arctic Wolf, CrowdStrike, and several other platforms, but they chose Rapid7 for its flexibility, detection capabilities, and particularly the ease of use and the AI feature which aids forensic investigations.

I would rate Rapid7 MDR a nine on a scale of one to ten. I choose nine for my rating because I think Rapid7 gives security professionals the ability to see any potential threats to the network quickly, and its ability to lock down the network fast is super important. For these reasons, I think Rapid7 deserves a nine.

Rapid7 MDR is not currently used at my company, but I know my customers have different environments, some private and some hybrid. For the most part, my customers are in private or hybrid cloud environments, not on-premise at all.

The cloud providers my customers use for their hybrid cloud environments include AWS, Microsoft Azure, and some also use Google Cloud.

My advice to others looking into using Rapid7 MDR is to evaluate your current investment and whether it is delivering the ROI expected. If customer support is not meeting your needs, Rapid7 will definitely show positive improvements when it comes to connecting with customers and proactively identifying potential threats to the network. My overall rating for Rapid7 MDR is nine out of ten.

I use Rapid7 MDR for security monitoring and easy onboarding and deployment. We primarily use Rapid7 MDR for threat detection and incident response, where it helps us to investigate deeply into those incidents.

One of the best features of Rapid7 MDR is 24/7 security monitoring, expert-led threat detection and response, AI-accelerated investigations, multi-vector visibility, informed defense, and incident response support. The full visibility of SIM, SIEM, and threat hunting is one of the features of Rapid7 MDR, and it has a strong customer partnership.

AI processes a large volume of security telemetry and helps us to speed up the triage and investigation, allowing human analysts to validate findings before action is taken. AI-accelerated investigation helps us significantly.

I particularly like the incident response support, as Rapid7 analysts assist with the investigation, containment, and remediation parts. The detailed incident reports and forensic analysis are very helpful and aid organizations in recovering from security events.

Rapid7 MDR has improved many policies in our organization and enhanced our ability to detect threats early before they become major incidents. It has increased our visibility across our environment, including servers, cloud resources, and user activities. Rapid7 MDR integration reduces the risk of security breaches through constant monitoring and proactive threat hunting, and it reduces filtering out false positives by focusing only on actionable threats. It saves valuable time for our internal security team because Rapid7 analysts perform initial investigations and triage, resulting in faster incident response due to timely detection.

The overall impact increases confidence in our security posture, enabling the security team to focus on strategic initiatives instead of spending excessive time reviewing alerts. It improves compliance readiness through detailed reporting and incident investigations and reduces our operational overhead by leveraging a team of security experts without needing to expand internal staffing.

Rapid7 MDR has helped our team to save approximately 10 to 15 hours per week by reducing the time spent on alert triage and initial investigation. It allows our security team to focus on remediation efforts and strategic security initiatives, whereas before implementing Rapid7 MDR, our security analysts used to spend significant time reviewing security alerts and triaging potential threats, which we estimate was nearly 30 to 40% of their time.

The biggest benefit has been operational efficiency. Instead of dedicating resources for around-the-clock monitoring, Rapid7 MDR acts as an extension of our security team, saving man-hours each month while improving detection and response capabilities. It has significantly reduced the time required for threat monitoring, alert validation, and incident investigation. The platform and analyst support help focus only on verified and actionable security incidents, which has improved efficiency and saved a considerable amount of our security operations team's time.

There are still a couple of areas where Rapid7 MDR can be improved. The visibility of the dashboard should be improved, and faster threat detection can also be enhanced. The dashboard visibility can be improved further, and the threat detection time also needs to be reduced to some extent.

I have been using Rapid7 MDR for three years in my current organization.

This is a good return on investment, as Rapid7 MDR has saved a lot of money for this project.

I feel the pricing cost of Rapid7 MDR is reasonable.

Rapid7 MDR provides valuable visibility into security events, vulnerabilities, and risks, which relates to governance and security. The reporting and logging capabilities support all our readiness, help demonstrate security controls, and efficiently manage processes in our organization. The combination of AI-driven insights and expert analyst validation provides a well-balanced approach where automation improves speed while human expertise ensures accuracy. I particularly appreciate the Rapid7 analyst detections and investigations, which reduce alert fatigue, improve threat visibility, and speed up our security operations. Rapid7 MDR is a primary detection response service that makes it safer to say that our organization is well-protected.

For compliance support, Rapid7 MDR provides good visibility into vulnerabilities, threats, and security. When suspicious login activity is detected by Rapid7 MDR, the MDR team provides detailed information, including the affected user account, source IP address, and timeline of events, which helps us validate the event. The transparency is very good for Rapid7 MDR.

Rapid7 MDR follows a structured risk detection process that combines automated analysis and threat intelligence. It collects data, logs, and telemetry from endpoints, servers, and cloud environments, then enriches the data against multiple data sources and analyst validation.

The multi-vector feature is one of the best features, as it analyzes and correlates data across multiple attack vectors such as endpoints, identity, cloud environments, network, email systems, and other security tools. For example, an attacker may compromise a user account through phishing email, log in from an unusual location, and then try to access sensitive cloud resources. Individually, these events might appear harmless, but Rapid7 MDR correlates and analyzes data from email, identity, and cloud environments to recognize this attack chain and generate a high-fidelity alert. The benefits of multi-vector detection include better visibility across the attack, detection of complex attack chains, reduction of blind spots, improved threat detection accuracy, faster incident investigation, and providing better context for analysts.

The ecosystem is supported through endpoint telemetry, processing, and file activity, which has a significant positive impact on our security program. Rapid7 MDR is integrated with Microsoft and our other security tools. We are using AI-assisted risk workflows, including data ingestion, AI-based analysis, risk scoring and prioritization, analyst validation, investigation, and containment. The ecosystem supports endpoint telemetry, processing, file activity, and user behavior.

My overall review rating for Rapid7 MDR is 7 out of 10.

My main use case for Rapid7 MDR is log collection and alerting. I have a specific example of how I use it for log collection and alerting, such as sending all logs and creating custom alerts, including Duo fraud alerts.

Rapid7 MDR allows for 24/7 coverage so that I do not have to pay for 24/7 coverage separately.

I cannot share any specific outcomes or metrics, such as time saved, cost savings, or improved detection rates since I started using Rapid7 MDR.

The inclusion of digital forensics and incident response within the MDR service has helped during incidents, as we were able to stand up queries to find what we needed a couple of times; other times, it has mostly just been the alert.

The best features Rapid7 MDR offers are seeing our own data and custom alerting. I find the process of setting up and tuning those custom alerts to be straightforward.

I do not know what risk-aware detection features in Rapid7 MDR are, so I cannot say how they help prioritize realistic attack paths. I do not know if I have used the multi-vector telemetry feature in Rapid7 MDR.

I understand that multi-vector telemetry means Rapid7 MDR pulls data from many sources, and it does include data from multiple sources, but it has never been helpful because of our environment; we do not necessarily sync all of our systems.

Having a dedicated cybersecurity advisor through Rapid7 MDR is not useful in aligning our security program with business needs; however, they do show us new features coming out and how to use the tool, so they are a valuable resource when I do not want to waste time with support.

An improvement for Rapid7 MDR would be to make it work with Orchestrator more easily, as it is currently cumbersome and confusing. I would like to add that we are trying to get custom alerting to our ticketing system, but all the options are not efficient.

The accuracy and reliability of output in Rapid7 MDR are trustworthy, although the query builder could use some work. There are no other improvements needed for Rapid7 MDR that we have not discussed.

I assess the transparency of Rapid7 MDR in terms of gaining visibility into detections and investigations as somewhat slow; we usually find issues before the team does.

I have been using Rapid7 MDR since 2021.

Rapid7 MDR is stable for me; there are no issues and no downtime.

Rapid7 MDR's scalability is strong and has kept up as my organization has grown or changed.

The customer support is inconsistent. I would rate the customer support a seven on a scale of one to ten.

Before Rapid7 MDR, I used Arctic Wolf because they are the worst in the industry and they raise their costs eight percent every year.

We have custom alerts which save time, but I have not really saved time in the sense of auto-closing because Orchestrator is not set up efficiently.

My experience with pricing and setup cost was good, as pricing includes licensing. However, setup was slow.

I evaluated Red Canary and some other options before choosing Rapid7 MDR.

On a scale of one to ten, I would rate Rapid7 MDR a nine. I would rate it a nine because Orchestrator implementation would make it a ten for me. I do not know what governance and security regarding Rapid7 MDR's AI capabilities mean or how to answer that. I have no concerns about the AI features in Rapid7 MDR being secure and managed well.

Rapid7 MDR is deployed in my organization with on-site collectors that send to a public cloud. I do not know which cloud provider is used, but I know Rapid7 hosts it. My advice to others looking into using Rapid7 MDR is that it is what you make of it. I rate Rapid7 MDR a nine out of ten overall.

My main use case for Rapid7 MDR involves points in our infrastructure level, specifically all infrastructure level.

A specific example of how I'm using Rapid7 MDR at the infrastructure level is that it helped us identify and investigate unusual internal activities such as suspicious login attempts and abnormal server-to-server communication. The 24/7 monitoring and alerting enabled our team to quickly validate the threat, contain the affected assets, and reduce the response time significantly compared to manual monitoring.

Rapid7 MDR's threat detection and response capability improves our security operation efficiency by providing continuous monitoring, expert analysis, and timely incident guidance, helping us to reduce response times.

Rapid7 MDR positively impacts my organization by improving our threat detection and response capabilities, enhancing security visibility, reducing false positives, and enabling faster incident handling, resulting in a stronger overall security posture.

In terms of impact, I have noticed specific improvements in response times, with reduced incidents and optimized workload for our internal security team through continuous monitoring and analysis, validated alerts, improved threat visibility, and lower false positive investigations.

The integration of digital forensics and incident response within the MDR service has improved our incident recovery process by enabling faster root cause analysis, quicker threat containment, and more effective remediation through expert forensic support and incident response guidance.

Having a dedicated cybersecurity advisor through Rapid7 MDR helps align my security program with business needs by providing strategic guidance, best practice recommendations, and prioritization of security issues, improving the effectiveness of our security program and ensuring better alignment with business objectives.

The best features Rapid7 MDR offers are continuous monitoring, high-quality threat detection, expert analysis and support, actionable incident recommendations, and improved visibility across the environment.

Of the features I mentioned, I find myself relying most on 24/7 threat monitoring and analyst validation because it helps focus on the real security incidents, reduce alert fatigue, and improve response.

The combination of advanced detection capability and expert SOC analyst support is a particular advantage, as it helps improve threat visibility and streamline investigation and response to security incidents more efficiently.

Regarding Rapid7 MDR's AI capabilities, I think its governance and security are enhanced by maintaining appropriate human oversight and security controls while supporting effective governance and operational reliability.

For threat detection and prioritization, Rapid7 MDR's AI capabilities, combined with analyst validation, help reduce false positives and improve the efficiency of security operations.

Rapid7 MDR offers strong visibility into detections and investigations through detailed alerts, analyst insights, investigation timelines, and actionable recommendations, helping us understand the root cause of security events and respond more effectively.

The risk-aware detection feature helps me prioritize realistic attack paths by correlating threat activity with the asset risk context, which improves threat prioritization, reduces alert fatigue, and enables more efficient incident response.

I have used the multi-vector telemetry feature in Rapid7 MDR, which improves investigation accuracy by correlating data from multiple sources, providing better context, reducing false positives, and helping us identify and respond to threats more efficiently.

I believe Rapid7 MDR could be improved through enhanced dashboard customization, additional automation capabilities, deeper third-party integration, and more detailed executive reporting for better visibility and decision-making.

I would like to see more automation, greater customization of detection rules and dashboards, deeper integration with third-party tools, and enhanced threat intelligence with more environment-specific recommendations.

I have been using Rapid7 MDR for two years.

Rapid7 MDR is stable.

Rapid7 MDR is scalable and effectively supports my growing environment across on-premises and cloud infrastructure while maintaining strong visibility, threat detection, and managed security coverage without requiring a significant increase in internal staff.

The customer support is excellent, as the team is responsive, knowledgeable, and provides timely assistance, detailed threat analysis, and actionable guidance, helping us resolve security issues efficiently.

I would rate the customer support as a nine on a scale of one to ten.

I previously did not use a different solution.

Rapid7 MDR has delivered a strong ROI by reducing alert triage efforts, improving response times, enhancing threat visibility, and providing 24/7 expert monitoring without the need to significantly expand my internal security staff.

My experience with pricing, setup cost, and licensing is that the pricing model is clear and manageable, and the setup process is smooth. While it is a strategic security investment, the value gained through continuous monitoring, expert support, and improved threat detection makes it cost-effective.

Before choosing Rapid7 MDR, we evaluated solutions such as Microsoft Defender, CrowdStrike Falcon Complete, and Arctic Wolf, and we chose Rapid7 MDR because of its strong managed service capabilities, threat detection quality, analyst support, and overall fit for our security operation requirements.

Rapid7 MDR is a good product and I recommend using it in your environment to provide more security. I rate Rapid7 MDR an eight out of ten because it provides strong 24/7 monitoring, quality threat detection, and valuable analyst support that has improved my security operations. The main areas for improvement are increased automation, more customization options, and deeper third-party integration.