Rapid7 MDR Reviews

I can describe many use cases for Rapid7 MDR, as there are multiple times when a person's PC gets compromised. There is an attacker behavior analysis, ABA, which is already part of the specific Rapid7 MDR XDR solution. We define a specific set of built-in rules in the MDR services and remap those rules according to our infrastructure for specific use cases.

We also deal with multiple phishing emails that we receive, and Rapid7 MDR is effective in identifying those specific use cases. In the Fintech sector, we encounter many anomalies from different servers that are publicly exposed on the internet, and Rapid7 MDR provides very beneficial use cases that eliminate the need to write custom use cases. We can define the logic in predefined use cases such as Attacker Behavior Analysis and User Behavior Analytics.

Additionally, when onboarding any log sources, there is a RegEx parser designed for parsing every log source on the built-in platform, making it quite user-friendly.

The best features in Rapid7 MDR are their team, which is made up of professionals. I interact with them whenever we face issues, even though we are running our own SOC, but we sometimes rely on Rapid7. It is having a human eye on everything. The MDR AI platform they recently transformed into is very helpful for defining use cases, real-time detections from a dashboard, and the reporting mechanism they have created within Rapid7 MDR.

Even the orchestrator platform they introduced for playbook creation is very helpful, as I create playbooks on Rapid7 using their predefined orchestrator platform.

Having a dedicated cybersecurity advisor through Rapid7 MDR significantly impacts aligning our security program with business needs because it approaches MDR better for big organizations such as mine. My first organization, Afiniti, was a significant AI-based company where I introduced Rapid7 MDR. The MDR is beneficial for both small and large organizations, unlike Splunk, which has more conditional formatting in their product.

Rapid7 MDR has positively impacted my organization by providing us with very effective management tools. Once we introduced Rapid7 MDR along with their vulnerability assessment tool, IVM, we transitioned from using Qualys and Tenable, which are top-tier tools in the market. The management tool from Rapid7 allows us to access a variety of vulnerabilities in real time to fix them effectively. How we tackle that specific MDR is indicative of its market quality. We analyzed the tool during our POC before purchasing.

We deployed endpoints on a specific server and attacked that machine using different methods, such as Metasploit, conducting DDoS attempts, and generating alerts for every anomaly from Rapid7. While a competitor's solution failed to detect many attacks, Rapid7 identified them in real time, which effectively pushed my management towards choosing Rapid7 MDR.

My experience with detection and response capabilities for Microsoft-centric environments has been positive. While API integration can be challenging with some third-party tools, Microsoft's built-in features facilitate seamless communication. I have found it relatively easy to triage and integrate Microsoft systems with Rapid7 MDR.

In terms of digital forensics and incident response included in the MDR service, my experience is that it is not very robust. We lack a dedicated forensic team, which is essential for thorough investigation. Rapid7 has introduced honeypots, which is an encouraging feature, but it is not a comprehensive solution such as those offered by competitors, such as Palo Alto's Unit 42.

Apart from forensics, I believe Rapid7 MDR should introduce more forensic services. Another area to improve is the active platform's handling of on-premises tools versus cloud-based tools. We prefer on-premises options for data security, and we find limitations in features compared to cloud-based tools, concerning data access and privacy controls.

I have been working with Rapid7 MDR for the last five to six years.

Regarding stability and scalability, I have had no significant issues. Stability is good, and I have not experienced delays, even with on-premises deployments. I did encounter minor latency during a scheduled upgrade but was informed that it would occur.

Evaluating the customer service and technical support teams of Rapid7 MDR, I would rate them a six out of ten. I have previous experience with IBM support, which was excellent and proactive. In contrast, Rapid7 MDR support often takes longer to respond to issues. Despite their large customer base, this highlights a need for enhancement in their support team.

I decided to switch from those products because, while Qualys is a good vulnerability scanner, it is not very user-friendly. When scanning two machines, one with Rapid7 having an agent deployed for a level three scan and another with Qualys, the results were different. Rapid7 MDR indicated more vulnerabilities that were accurate upon verification, whereas Qualys missed many of them. This highlighted that IVM, Rapid7 MDR, and MDR stand out as top products in the market, especially for our financial sector.

The deployment setup process for Rapid7 MDR is straightforward. I have deployed both the cloud environment and on-premises Nexpose service. Their services, whether on-premises or cloud-based, are easy to deploy, and the endpoints are lightweight and compatible with other tools in our environment.

I bought Rapid7 MDR directly from the vendor, which is uncommon for sectors such as Fintech that usually work through intermediaries. I have had direct interactions with the Rapid7 team, specifically with someone named Nikola, and I find that beneficial.

I have seen a positive return on investment concerning Rapid7 MDR, as we have invested wisely, yielding results in detection mechanisms. I can confidently say that investing in Rapid7 MDR has been worthwhile, despite acknowledging that every tool has its flaws. Overall, the category is very good.

Regarding pricing, I manage everything with Rapid7 MDR, and I find their pricing very reasonable compared to the market. They negotiate well with us on various aspects of MDR, and we have received great rates for services such as IVM, including Threat Command.

I am taking advantage of the expanded ecosystem telemetry support in Rapid7 MDR. We have enhanced the logging mechanism within Rapid7 MDR, allowing us to assign projects to different teams with visibility only of their specific assets. This approach supports various vulnerability assessments and compliance achievements. My management is overall pleased as we have managed to meet compliance standards such as ISO 27001 and NIST due to features provided by Rapid7 MDR.

I utilize AI-assisted Risk-Aware Investigation workflows, integrating both our on-prem and cloud infrastructure. By using APIs in our environment, we gain enhanced visibility, giving us detailed insights that greatly assist in real-time monitoring.

This approach impacts my alert triage and prioritization processes since Active Directory is a crucial element in our industry. Rapid7 MDR improves the alerting mechanism for Active Directories and all connected user activities. Previously used SIEM solutions did not adequately capture anomalies on ADs. With Rapid7 MDR, any anomaly triggers escalated alerts in real time.

I am using the Integrated MDR for Microsoft Environments feature, having integrated Microsoft 365 with our MDR and endpoints from Microsoft Active Directory and Azure. This integration provides us with comprehensive visibility into our infrastructure.

Regarding transparency in detection and investigations with Rapid7 MDR, we receive metrics such as MTTR and MTTD (Mean Time to Detect and Mean Time to Respond). We monitor how quickly the tool detects anomalies and how long it takes to respond, which shows improvement due to the specific MDR product. My overall review rating for Rapid7 MDR is 8.5 out of 10.

Rapid7 MDR includes the SIEM and all the Rapid7 products, such as Rapid7 Automation, Rapid7 InsightIDR, Rapid7 AppSec, CloudSec, and Rapid7 SIEM, which has this MDR feature. The customer representative, who serves as a customer advisor for our company, responds very quickly to whatever concerns we have. The SIEM operations are integrated with every event source, starting from the firewalls to all other event sources where we cannot install Rapid7 agents. The SIEM features such as investigations and alerts are segmented properly so even beginners can understand the interface. It is not confusing compared to other MDR or SIEM sources. The UI interface helps you understand everything quickly and in a very short time.

The best features of Rapid7 MDR include its ease of use and UI. However, when it comes to feature-wise comparison, I cannot say it is only the best MDR tool we have. Rapid7 agent should be integrated with everything properly, but we have had issues with inability to integrate event sources from other applications such as AppLocker or host-based firewall logs. In those cases, we had to create a custom script and deploy it on the machines to collect the logs. For a top SIEM MDR solution, one should not need to write custom scripts or put in manual effort. Rapid7 seems difficult in getting logs from all applications, especially third-party or custom applications. Additionally, when comparing AI integrations with others such as CrowdStrike, Rapid7 is lacking. CrowdStrike has integrated AI agents, but Rapid7 is still developing that feature, which they hope to complete by the end of this year. Despite this, it remains easy to understand and operate, even for beginners, but its integration of logs, third-party applications, and AI needs improvement.

I would like to see improvements in AI and the integration of third-party application logs, as there is no proper way to obtain those logs.

In terms of risk-aware detection, Rapid7 MDR operates by having its own managed detection rules and creates investigations on their behalf. If any investigation is managed by Rapid7, they take care of that. However, if we create a custom rule and it is very critical, Rapid7 MDR will not manage it, which is a drawback. While Rapid7 provides insights into attack paths, it is not as efficient as CrowdStrike, which offers detailed attack path analysis, whereas Rapid7 only offers a limited view.

Regarding multi-vector telemetry, when it comes to collecting and analyzing security information from multiple sources, I would say Rapid7 does not improve the investigation process much. It is pre-configured, and the investigation chain is based on the evidence that Rapid7 decides; this does not provide real-time insights. We can only see a list of linked investigations without details on the specific parameters or processes involved.

AI, integration, and logging are definitely key areas for improvement in Rapid7 MDR. However, it is not a platform full of glitches; it is good to start with and is beneficial for any organization looking for SIEM solutions. It helps employees fully understand what is going on with Rapid7 MDR and how it integrates. The integration process is good, and the investigations and collection of event sources are also effective. You can happily start with it, but it needs more in-depth improvements to reach its full potential. If any organization is considering a SIEM solution within their budget, I believe Rapid7 has good capabilities to collect event sources, though there are noticeable differences when working in-depth.

I have been using Rapid7 MDR for one year.

In terms of stability, I can confidently rate Rapid7 MDR a 10. We have never faced any major downtime, bugs, or glitches.

Approximately seven to nine users utilize the solution.

For scalability, I would rate Rapid7 MDR an 8.

On a scale of 1 to 10 for support, I rate Rapid7 MDR a 10. The support I receive is exceptional; when I raise cases to them, regardless of the platform, the response time is usually within two days. Even complicated issues do not take more than two days to resolve. The support team is intellectual and dedicated to ensuring that issues are resolved thoroughly before closing the case.

The deployment of Rapid7 MDR is cloud-based. Rapid7 assists in the installation process by deploying several Rapid7 collectors on cloud infrastructure, whether it is Azure, GCP, or AWS. These collectors are instrumental in gathering logs from devices where we cannot install agents.

When comparing Rapid7 MDR to other solutions such as Arctic Wolf, Sophos, and Huntress, I find that Rapid7 integrates many products well, such as CloudSec, application security, vulnerability management, and automation. Rapid7 is the best for vulnerability management and has a legacy system capable of scanning machines even where we cannot install agents, which makes its architecture very efficient for vulnerability scanning. If an organization is looking to utilize Rapid7, I recommend focusing on its vulnerability management tool, also known as InsightVM. The application security is good, but I would be cautious about recommending CloudSec due to its drawbacks. The Rapid7 Automation tool serves as a SOAR tool and is beneficial for organizations that have multiple Rapid7 products, but if they do not, I would remove it from my recommended list. Overall, I believe Rapid7 vulnerability management is an essential tool for any organization.

My organization is on Azure.

Regarding the maintenance of Rapid7 MDR, it is easy and not complicated. However, ease of maintenance also depends on the setup and the customer advisor assigned to you, who should be attentive to your issues. If you have a great customer advisor, they will respond quickly and ensure any issues are handled efficiently. Thus, while maintaining Rapid7 MDR is straightforward, it relies heavily on the quality of your customer advisor.

My advice for those considering Rapid7 MDR is to pursue it if the organization wants the entire suite, which includes application security, cloud security, automation, vulnerability management, and Rapid7 MDR. If budget constraints arise compared to higher-priced tools, Rapid7 remains a solid option. While I notice slight differences compared to other platforms as an engineer, others such as SOC analysts or managers find Rapid7 a recommended solution. It may not be the best in the market, but within a reasonable budget, it is certainly a viable choice. I have rated Rapid7 MDR a 7 overall.

My main use case for Rapid7 MDR is to monitor incidents and ensure our applications are secured. I also want to make sure we are proactive in identifying threats.

I use Rapid7 MDR daily as part of our security process. My workflow starts on a day-to-day basis by checking the dashboard for overnight alerts to see if there are any incidents and to investigate them. If there is any incident that needs to be escalated to my SOC team, I handle that accordingly. It is mainly to monitor the applications 24/7 for any incidents or alerts. We also use Rapid7 MDR to investigate user activities.

We also use Rapid7 MDR for threat hunting with custom queries and for reports on a weekly and monthly basis to find how many incidents have occurred and to get all those details.

In my opinion, the best features Rapid7 MDR offers are the 24/7 coverage with unlimited incident response and also the latest AI-driven alerts, which is one of the best features I have seen recently. The integration models they have across different endpoints is also valuable.

After the AI-driven alert triage was used, our time spent on identifying false positive alerts was reduced drastically because a large portion of our time was previously spent on identifying false positives and segregating them. After the AI-driven alert triage was implemented, this was directly reduced, which helped us identify actual alerts and work on them quickly. The AI enrichment also provides assets and vulnerability context even before a cybersecurity analyst gets into the picture.

In terms of how Rapid7 MDR has impacted my organization positively, it has reduced our false positives after the AI feature was implemented. This reduction in false positive alerts gave us 24/7 coverage without having an in-house SOC team. It also helps us connect various endpoints to identify, detect, and monitor various endpoints across multi-cloud environments. It has helped us maintain our security posture on a day-to-day basis to keep our systems safe and secure, monitor our user usage, and identify vulnerabilities and asset criticalities.

Previously, the need for multiple analysts and multiple security personnel was reduced after the AI implementation. It gave us detailed response information, detailed incidents, and reduced false positives. It also provided us with the reports we needed for further analysis and gave us the gist of what the incident would look like and what would possibly be going wrong. It has reduced the number of billable hours and also gave us time to work on other improvement factors, which has actually reduced our overall human billing.

The major improvement I see is that the reporting and dashboarding experience could be more flexible because the needs for various companies would be different. Having a dashboard which is flexible and also having a more user experience friendly dashboard would be one of the major points I would like to see improved. Building custom reports for specific stakeholders is also important, especially because the current reports are generic and default, which are useful but not necessarily for stakeholders because they would like to see summaries, counts, and compliance-focused views.

I would say pricing transparency and a startup package would be great because pricing is one of the major standpoints for every company to adopt tools. Rapid7 does not have a startup package where companies can have lower pricing or a one-year startup trial or credits for new startups who are eligible to onboard. If that would be available, it could help growing companies use security tools like Rapid7. Additionally, log sources and third-party integrations sometimes require more manual work than expected.

I have been using Rapid7 MDR for more than two years currently.

Rapid7 MDR is stable as of now.

We have not seen any issues with Rapid7 MDR's scalability. We tried to add new endpoints and new locations, but we have not seen any issues in terms of adding new users or endpoints.

We have only reached out during onboarding for customer support, so we did not have much experience with having calls or help with support.

We did evaluate other tools in the market such as Fortify, OpenText, and Sonar before choosing Rapid7 MDR.

I would not be the right person to talk about the money saved, but I could say there has been lots of time saved since we have onboarded Rapid7 MDR. The need for cybersecurity personnel has also been reduced.

We were directly using Rapid7 MDR as the first solution.

The inclusion of digital forensics and incident response within Rapid7 MDR service has positively impacted my incident recovery process, both operationally and financially. During an incident, creating a separate retainer or negotiating scopes and often waiting for external responders to onboard before meaningful work could begin could actually delay our recovery time. However, with Rapid7 MDR, DFIR is fully included in the services, which means there is no hourly fee, no caps, or engagement limit. This means our forensics begins immediately, which gives us an upper hand. In terms of financials, we do not pay additional fees for investigators or separate tools to onboard or for negotiations on retainers.

As for my experience with pricing, setup cost, and licensing, it is a corporate pricing structure and it was not startup friendly, which was one of the major issues I mentioned in improvements. The setup was not easy. We had to have someone already experienced in Rapid7 get involved in the setup and licensing. So it is not user friendly.

I would say the input cost could potentially be high when implementing Rapid7 MDR, but in the near future, you would be seeing a bigger saving factor in terms of time spent and the number of resources required.

We have not used the multi-vector telemetry feature in Rapid7 MDR.

We have not used the integrated MDR for Microsoft environments feature.

We use the AI-assisted risk-aware investigation in Rapid7 MDR and it has impacted our triage by providing detailed context. It gives us detailed impact analysis and also does a deep analysis on what the threat could be and what the potential causes are. It also does a root analysis and gives us the impact event, impact asset, and also what a possible solution could be. This has made the security alert solving easier and faster to resolve.

We have not used the expanded ecosystem telemetry support.

I do not have anything else to add about the features.

I do not have any other improvements needed for Rapid7 MDR that we have not discussed yet.

I would need some time to think about the transparency of Rapid7 MDR in terms of gaining visibility into detections and investigations.

Rapid7 MDR's risk-aware detection features have created a very meaningful positive impact. The integration between the detection and exposure management within Rapid7 MDR unified platform means that the team can actually work on threats that impact the business rather than other threats. Vulnerability data, assets, critical user identity context, and attack path information all feed directly into the detections. When an alert actually fires, it evaluates the isolation and gives us the ability to focus on what needs to be fixed.

It has reduced 60 to 65 percent of false positives, which is actually very helpful and is good because it is almost near to accurate. The reasoning is also almost correct. I would say it is learning day by day but it is actually performing well.

In terms of Rapid7 MDR's AI governance and security, it is more transparent because with the AI capabilities, it has made a transparent approach to governance and security. This means it gives us the ability to see how alerts are triggered and on what actions, and also provides a list of details on the transparency of what AI takes action on and what decisions it has made. Every AI-driven triage decision is auditable and gives us a flow of what has been taken. Because auditing is one of the major factors in compliance, we are able to see what all decisions and when and what factors have made that decision. We can see the reasoning, the evidence considered, and the outcome. From the governance standpoint, the human analyst is still in the loop across the triage cycle.

My overall review rating for Rapid7 MDR is seven out of ten.

Network detection and response is basically what I use Rapid7 MDR for, and it is a very good solution for that. I am using Rapid7 MDR for Microsoft environments, confirming its utility within those systems. I take advantage of the expanded ecosystem telemetry support offered by Rapid7 MDR. I have used InsightIDR, which is a SIEM for Rapid7, and InsightVM for vulnerability management. I appreciate their approach to detecting threats, and I consider it one of the best OEMs for threat detection and response, whether dealing with network issues, mobile devices, or user behaviors. Despite the pricing being a consideration, I always recommend Rapid7 MDR first.

The best features for me in Rapid7 MDR are the fact that it automates network traffic with users and the attacker behavior analytics, known as ABA, rather than UBA. The user behavior analytics and the attacker behavior analytics are important because it is a network-focused sensor that measures real-life patterns of users and attackers, which many other products do not provide. Rapid7 MDR has that real-life metrics, and I have gone through their platform, which also allows customers to correlate the newest attack patterns and methods they are using. They update their database periodically and integrate it with their MDR, which is why I appreciate their ABA and UBA so much.

The visibility of Rapid7 MDR is very accurate, and the transparency is commendable. If I am not too sure about its performance, I can correlate it with their cloud platform, which always has an updated dashboard about attacks. I also have access to the government database for correlation, and that shows they are doing real-time updates on these attacks, which is pre-built into the MDR. The accuracy and transparency for tracking are commendable.

Regarding improvements for Rapid7 MDR, I do not have anything specific for the product, but I would suggest synchronization time improvements for their vulnerability manager. For Rapid7 MDR itself, I am satisfied.

I have not thought about any missing features or functionalities that require enhancement in Rapid7 MDR at this moment.

I have been working in my current field in the industry for six years.

When discussing stability, performance, and reliability specifically for Rapid7 MDR, I would say they are reliable and accurate. However, for other products like the vulnerability manager, I would not extend that same level of confidence.

I find Rapid7 MDR to be very scalable. I can onboard more devices and expand easily.

Regarding Rapid7's support team, I must say that their response time is not as quick as I would prefer. While they do respond, it can take a few days or even a week to get on a call.

On a scale of one to ten for tech support, I would rate them a seven. The support is good overall, but I believe the pace of response could improve.

The setup process for Rapid7 MDR is always easy and straightforward. All their products are quite easy to implement; I do not need to overthink it. Reading the datasheet to understand it shows that it is not difficult at all.

I implemented Rapid7 MDR myself, but for any issues, I can always reach out to Rapid7 support, and they join calls to assist.

The key differences between Rapid7 MDR and competitors such as ManageEngine or Sophos technologies are minimal as both OEMs have different approaches to implementation but aim for the same goal. Rapid7 MDR excels in accuracy over Sophos, especially concerning real-life monitoring, which is a significant differentiator for me.

Having a dedicated security advisor through Rapid7 MDR positively impacts my alignment of security programs with business needs. As a security personnel using this for most of my customers, I can tell that the database is well updated. It gives me the most updated software for security regarding attacks and user behavior, which is crucial for business.

The key benefit of Rapid7 MDR is the way it automatically deploys on a port for me. I look at how to strengthen my customer's environment, ensuring that every IP address internally is accurate. Rapid7 MDR helps eliminate phishing IP addresses on the network, identifying and immediately rectifying them. It also deals with alert fatigue by preventing flooding of the dashboard with raw network anomalies and attacker behaviors. Their incident response is very quick; whenever there is a detection, they respond immediately. Some detections go to the administrator for approval, but with Rapid7 MDR, I can cancel and ask questions later, making it highly recommendable for real-time resolution, reducing alert fatigue, and addressing IP guessing.

With respect to risk-aware detection features, Rapid7 MDR provides full visibility into blind spots. I think I know my network, but I do not; Rapid7 MDR gives me full-time visibility and accurate data about things I am not seeing or paying attention to. Their third-party dashboard allows tracking of specific devices, which is essential in an enterprise environment where I cannot check each endpoint individually. Rapid7 MDR streamlines the information down to the exact affected endpoint and explains why it has been quarantined or removed from the network.

I have utilized the AI assistant for AI-assisted investigation workflow in Rapid7 MDR, and while I think it is a new feature for them, I find it similar to functions in other products. What makes their AI different is that it allows me to design and implement solutions. If there is an issue with the platform, AI can help pinpoint the source of the problem, even if it is a configuration issue. I have not fully used it yet, but I intend to explore its functionality within Rapid7 MDR infrastructure.

I have not actually used the multi-vector telemetry feature in Rapid7 MDR yet, although I have seen it.

My experience with Rapid7 MDR's detection and response capabilities for Microsoft-centric environments has been very smooth. I have not encountered any issues so far, and I believe that Rapid7 MDR and Microsoft have a good synchronization or handshake between their services, which contributes to this smooth operation.

The inclusion of digital forensics and incident response within Rapid7 MDR service impacts my incident recovery process by providing a dashboard that offers insightful reports on incident responses. They have a vast database that is continuously updated, which they incorporate into Rapid7 MDR for threat detection and response capabilities.

When it comes to pricing, Rapid7 MDR is known to have higher costs. However, the value is significant, and I believe that pricing should not be a problem if I recognize the worth of what I am paying for. Overall, I feel the value justifies the cost, though I see a need for a pricing reevaluation for some medium-class businesses.

I have seen cost-effectiveness with Rapid7 MDR solutions, comparing it to other options such as ManageEngine and Sophos.

My overall review rating for Rapid7 MDR is 8.5 out of 10.

My primary use case of Rapid7 MDR is to do 24/7 threat monitoring and managed detection and response. We use it to identify suspicious activity across endpoint, network, and cloud environments and investigate the alerts and reduce false positive alerts through analysis.

One of the examples was we used Rapid7 MDR to detect a suspicious malware activity or PowerShell activity on a user's device. Rapid7 MDR can correlate that endpoint element with network authentication and identification, and it finds if it has suspicious activity and then escalates it with details. The alert had already been validated and with context, we were able to isolate the affected endpoint, investigate the user's activity, and confirm the incident. At the same point, Rapid7 MDR filtered several benign administrative activities such as PowerShell execution, which significantly allowed us to focus on genuine threats.

Overall, Rapid7 MDR helps us to strengthen our security operations by providing continuous monitoring, high quality threat detection, and expert analysis support. The contextual investigation and actionable recommendations have improved our SOC response and allowed the SOC team to focus on high priority activities rather than spending time on false positive alerts.

The best features that Rapid7 MDR offers are 24x7 alert monitoring, expert threat hunting, and high quality alert validation, which significantly reduces false positive alerts. I also appreciate the detailed incident investigations, actionable remediations and recommendations, and the ability to correlate the data from network and cloud environments. The service integrates all the security tools, and Rapid7 MDR analysts provide timely communication and valuable expertise that helps us to respond to attacks more efficiently.

I think the best feature is reducing the false positive alerts so we, instead of reviewing many alerts ourselves, Rapid7 MDR analysts validate the incidents with the relevant context before escalating them. This significantly reduces the alerts and false positives, allowing the SOC team to work on only high priority alerts.

Rapid7 MDR provides capabilities such as robust alert monitoring and investigation, and the Rapid7 MDR analysts already prioritize alerts and help the security analysts focus on high priority alerts only. Because of this, it improved our overall security posture and reduced the workload of the SOC analysts. With continuous monitoring, faster threat detection, and expert analyst support, we have been identifying security issues more quickly. Overall, it has ensured critical security events are detected and handled promptly.

I think Rapid7 MDR already has a strong managed security service, but I believe things can be improved. More customization options for detection rules and other workflows would help organizations to align their services more closely with the specific environment.

Additionally, improving the speed of the communication for the low priority alerts and providing more self-service investigation capabilities could further enhance the overall user experience.

I think the room for improvement is deeper customization and reporting flexibility. Rapid7 MDR is a solid solution overall. I think they can implement more customization options for detection, logging, workflows, and also the integration with other security platforms that would be helpful.

Rapid7 MDR transparency is quite good. It provides useful visibility into detections and investigations with detailed alert information and analyst notes. It shows severity classification and recommended actions. In these investigations, it helps our team to understand the alert, why it was generated, and what would be the next steps that we can take. For example, during a suspicious endpoint activity alert, the Rapid7 MDR team provides context around the process execution, related user activity, and supporting indicators, which help us quickly validate the incident and take appropriate actions. Additionally, more transparency into the detection logic and more customization visibility would further improve the experience.

I have been working in this field since the last two point eight years.

Rapid7 MDR is quite stable according to my experience. The service has provided consistent monitoring and dependable support from the Rapid7 MDR team. We have not experienced availability issues.

I think Rapid7 MDR is scalable. I have studied that it supports growth by allowing my organization to expand its monitoring coverage as the number of users, endpoints, and security data sources increases. The managed service model reduces the need to continuously scale the internal SOC resources while maintaining consistent monitoring and response capabilities. Also, the onboarding of assets and integration is relatively good, which helps to manage the increased volume of findings and investigations.

Customer support is quite good, which is why I think it is quite good.

We are utilizing the AI-assisted risk-aware investigation workflows in Rapid7 MDR. They help us improve our alert triage and prioritization by providing context around the alerts, identifying the risk factors, and helping analysts to focus on more critical security events. Instead of treating every alert with the same priority, the workflow considers factors such as asset criticality, behavior, threat intelligence, and attack patterns to determine the potential impact. This has helped in reducing false positive alerts and overall alert fatigue, and in speeding up the investigation of the real threats.

Rapid7 MDR AI capabilities are good for improving threat detection and alert prioritization and also in the investigation. From the governance and security perspective, I think they have strong controls around data handling, access management, and transparency, which helps in improving data security. Also, the combination of AI-driven analysis and Rapid7 MDR analysts provides a good balance where AI can help identify attack patterns quickly, while human experts validate findings and make the response decisions.

Rapid7 MDR is quite good and I appreciate the responses. I use it on a daily basis. I think it is really reliable as compared to the other platforms which I use, and it helps in reducing the investigation time by providing additional context and highlighting the important points.

The inclusion of the forensics and incident response capabilities has improved our investigations by providing deeper analysis and helping us to understand the scope of the threat and the impact of that on the environment. The forensic analysis also helps us identify the root cause, the affected systems, attackers' activities, and required remediation steps.

Rapid7 MDR has a few features that I think are very valuable because it goes beyond simple alert generation and focuses on the actual risk and potential impact of that risk in our organization. By considering factors such as important assets and user behavior, threat indicators, and the context of the attack, we can better assess our security posture.

I have used the multi-vector telemetry capabilities in Rapid7 MDR. It has helped me in improving investigation accuracy by correlating the data across different endpoints, user activity, and network activity. Having visibility across different telemetry sources provides better context for the alerts and helps us differentiate between legitimate and potential threats.

Cybersecurity advisor helps us make decisions by providing expert guidance and helping us focus on the risks and threats that matter the most to our business. They help us understand our security gaps, identify additional improvements, and also align our security strategy with the business requirements. This also ensures that our resources are used effectively and that security supports the organization's overall goals.

Currently, we are not using the integrated Rapid7 MDR for Microsoft environments feature. I think our team will be enabling that in the upcoming time.

My advice is that Rapid7 MDR is a good fit for organizations that want to use it for 24/7 security monitoring and expert investigation support. It also helps in reducing the workload of the internal SOC teams. With the help of this, SOC teams can mostly focus on the high priority alerts instead of wasting time on the false positives. I think this is a really good tool to have. I would give Rapid7 MDR a rating of eight out of ten because of its 24x7 monitoring capability and valuable analyst expertise that improves our security operations.

Rapid7 MDR has been our primary 24/7 managed detection and response solution software throughout the two and a half years we have been using it.

Recently, Rapid7 MDR flagged and automatically contained a suspicious PowerShell execution on an endpoint device. Once Rapid7 MDR contained the endpoint, the team provided a full forensics summary showing the malicious script that was attempted, which was basically a credential harvesting attack. Our internal team removed the compromised user tokens and re-imaged the machine, then pushed the updated detection rules that resulted in zero lateral data movement or data loss.

Beyond the standard endpoint detection, Rapid7 MDR acts as a true extension of our lean security team and is integrated directly into our SIEM and Slack for instant escalation.

We primarily run on AWS alongside some Microsoft Azure workloads integrated with our on-premises data centers. Rapid7 MDR ingests CloudTrail logs and monitors identity and activity across all those environments.

Rapid7 MDR has slashed our mean time to respond from several hours down to minutes. It gives us an enterprise-grade 24/7 SOC coverage without the massive overhead of hiring and staffing internally.

We save roughly 25 to 30 engineering hours each week by offloading initial tier-one alert triage and investigation to their SOC. Financially, it eliminated the need to hire at least three to four full-time security analysts to maintain 24/7 shift coverage. In terms of dollars, we save several hundreds of thousands annually.

The standout feature is their Insight Agent with Active Response, which lets their SOC isolate compromised endpoints immediately and without needing any manual intervention from us. Active Response stopped a potential ransomware outbreak over a long weekend by instantly isolating the endpoint.

I also value the Attacker Model and endpoint visibility for strategic posture and guidance rather than just reactive alerts. Their AI governance is solid because they maintain a strict human-in-the-loop model, using AI for pattern recognition while keeping the expert analyst at the center.

The accuracy and reliability have been excellent over the past few years. The AI triages quite dependably, classifying noise and correlating multi-vector events. I would rate the accuracy and reliability an eight out of ten. The AI triage is quite dependable at classifying noise and correlating multi-vector events, but it still requires human analyst validation, which ensures we avoid catastrophic false positives or missed threats.

Their transparency is excellent because we share the exact same InsightIDR platform that their SOC uses to triage alerts. This means there is zero black box mystery. For example, when they isolated the endpoint for suspicious PowerShell activity, the investigation timeline laid out the precise command flags, the triggering user account, and the SOC analyst's commentary within minutes.

The primary improvement would be deeper native integration with third-party non-Rapid7 cloud security tools to reduce the portal pivoting. Additionally, giving customers more granular self-service customization for automated response playbooks would help streamline workflows.

Reporting could be more customizable, especially for a non-technical executive audience.

Fine-grained Active Response exclusions would be welcome, streamlined agent deployment because the initial update lifecycle on older Linux distros especially feels a bit clunky, and a unified console workflow would be beneficial.

We have been using Rapid7 MDR for about two and a half years.

Rapid7 MDR has proven highly stable with virtually zero unplanned cloud platform downtime or service interruptions over our two and a half years of use.

Rapid7 MDR scales exceptionally well and handles increases in cloud workloads and data volume seamlessly.

Customer support and the SOC are both top-notch and quite responsive. They respond within minutes, especially for critical escalations, and are backed by a dedicated customer success manager for regular check-ins. I would give the customer support a nine out of ten.

We previously managed an on-premises SIEM using Splunk with fragmented endpoint tools. We switched because the operational overhead of tuning custom correlation rules, constant log ingestion cost spikes, and staffing were becoming quite unsustainable for our team.

We use a hybrid architecture for deployment.

We have seen definitive ROI across key metrics. Head-count avoidance as a primary metric has saved us three to four SOC analysts, which equates to roughly $400,000 to $500,000 in salaries and overhead. Engineering hours saved amount to almost 25 to 30 hours per week. Speed to resolution has increased quite dramatically, with MTTR down from several hours to just minutes.

We procured Rapid7 MDR directly through the AWS Marketplace.

We evaluated CrowdStrike Falcon Complete and Arctic Wolf.

Ensure that you negotiate pre-authorized containment thresholds clearly during onboarding and use marketplace commits like CTP to simplify procurement. I would rate Rapid7 MDR overall an eight out of ten.

I use Rapid7 MDR for security monitoring and easy onboarding and deployment. We primarily use Rapid7 MDR for threat detection and incident response, where it helps us to investigate deeply into those incidents.

One of the best features of Rapid7 MDR is 24/7 security monitoring, expert-led threat detection and response, AI-accelerated investigations, multi-vector visibility, informed defense, and incident response support. The full visibility of SIM, SIEM, and threat hunting is one of the features of Rapid7 MDR, and it has a strong customer partnership.

AI processes a large volume of security telemetry and helps us to speed up the triage and investigation, allowing human analysts to validate findings before action is taken. AI-accelerated investigation helps us significantly.

I particularly like the incident response support, as Rapid7 analysts assist with the investigation, containment, and remediation parts. The detailed incident reports and forensic analysis are very helpful and aid organizations in recovering from security events.

Rapid7 MDR has improved many policies in our organization and enhanced our ability to detect threats early before they become major incidents. It has increased our visibility across our environment, including servers, cloud resources, and user activities. Rapid7 MDR integration reduces the risk of security breaches through constant monitoring and proactive threat hunting, and it reduces filtering out false positives by focusing only on actionable threats. It saves valuable time for our internal security team because Rapid7 analysts perform initial investigations and triage, resulting in faster incident response due to timely detection.

The overall impact increases confidence in our security posture, enabling the security team to focus on strategic initiatives instead of spending excessive time reviewing alerts. It improves compliance readiness through detailed reporting and incident investigations and reduces our operational overhead by leveraging a team of security experts without needing to expand internal staffing.

Rapid7 MDR has helped our team to save approximately 10 to 15 hours per week by reducing the time spent on alert triage and initial investigation. It allows our security team to focus on remediation efforts and strategic security initiatives, whereas before implementing Rapid7 MDR, our security analysts used to spend significant time reviewing security alerts and triaging potential threats, which we estimate was nearly 30 to 40% of their time.

The biggest benefit has been operational efficiency. Instead of dedicating resources for around-the-clock monitoring, Rapid7 MDR acts as an extension of our security team, saving man-hours each month while improving detection and response capabilities. It has significantly reduced the time required for threat monitoring, alert validation, and incident investigation. The platform and analyst support help focus only on verified and actionable security incidents, which has improved efficiency and saved a considerable amount of our security operations team's time.

There are still a couple of areas where Rapid7 MDR can be improved. The visibility of the dashboard should be improved, and faster threat detection can also be enhanced. The dashboard visibility can be improved further, and the threat detection time also needs to be reduced to some extent.

I have been using Rapid7 MDR for three years in my current organization.

This is a good return on investment, as Rapid7 MDR has saved a lot of money for this project.

I feel the pricing cost of Rapid7 MDR is reasonable.

Rapid7 MDR provides valuable visibility into security events, vulnerabilities, and risks, which relates to governance and security. The reporting and logging capabilities support all our readiness, help demonstrate security controls, and efficiently manage processes in our organization. The combination of AI-driven insights and expert analyst validation provides a well-balanced approach where automation improves speed while human expertise ensures accuracy. I particularly appreciate the Rapid7 analyst detections and investigations, which reduce alert fatigue, improve threat visibility, and speed up our security operations. Rapid7 MDR is a primary detection response service that makes it safer to say that our organization is well-protected.

For compliance support, Rapid7 MDR provides good visibility into vulnerabilities, threats, and security. When suspicious login activity is detected by Rapid7 MDR, the MDR team provides detailed information, including the affected user account, source IP address, and timeline of events, which helps us validate the event. The transparency is very good for Rapid7 MDR.

Rapid7 MDR follows a structured risk detection process that combines automated analysis and threat intelligence. It collects data, logs, and telemetry from endpoints, servers, and cloud environments, then enriches the data against multiple data sources and analyst validation.

The multi-vector feature is one of the best features, as it analyzes and correlates data across multiple attack vectors such as endpoints, identity, cloud environments, network, email systems, and other security tools. For example, an attacker may compromise a user account through phishing email, log in from an unusual location, and then try to access sensitive cloud resources. Individually, these events might appear harmless, but Rapid7 MDR correlates and analyzes data from email, identity, and cloud environments to recognize this attack chain and generate a high-fidelity alert. The benefits of multi-vector detection include better visibility across the attack, detection of complex attack chains, reduction of blind spots, improved threat detection accuracy, faster incident investigation, and providing better context for analysts.

The ecosystem is supported through endpoint telemetry, processing, and file activity, which has a significant positive impact on our security program. Rapid7 MDR is integrated with Microsoft and our other security tools. We are using AI-assisted risk workflows, including data ingestion, AI-based analysis, risk scoring and prioritization, analyst validation, investigation, and containment. The ecosystem supports endpoint telemetry, processing, file activity, and user behavior.

My overall review rating for Rapid7 MDR is 7 out of 10.

My main use case for Rapid7 MDR is log collection and alerting. I have a specific example of how I use it for log collection and alerting, such as sending all logs and creating custom alerts, including Duo fraud alerts.

Rapid7 MDR allows for 24/7 coverage so that I do not have to pay for 24/7 coverage separately.

I cannot share any specific outcomes or metrics, such as time saved, cost savings, or improved detection rates since I started using Rapid7 MDR.

The inclusion of digital forensics and incident response within the MDR service has helped during incidents, as we were able to stand up queries to find what we needed a couple of times; other times, it has mostly just been the alert.

The best features Rapid7 MDR offers are seeing our own data and custom alerting. I find the process of setting up and tuning those custom alerts to be straightforward.

I do not know what risk-aware detection features in Rapid7 MDR are, so I cannot say how they help prioritize realistic attack paths. I do not know if I have used the multi-vector telemetry feature in Rapid7 MDR.

I understand that multi-vector telemetry means Rapid7 MDR pulls data from many sources, and it does include data from multiple sources, but it has never been helpful because of our environment; we do not necessarily sync all of our systems.

Having a dedicated cybersecurity advisor through Rapid7 MDR is not useful in aligning our security program with business needs; however, they do show us new features coming out and how to use the tool, so they are a valuable resource when I do not want to waste time with support.

An improvement for Rapid7 MDR would be to make it work with Orchestrator more easily, as it is currently cumbersome and confusing. I would like to add that we are trying to get custom alerting to our ticketing system, but all the options are not efficient.

The accuracy and reliability of output in Rapid7 MDR are trustworthy, although the query builder could use some work. There are no other improvements needed for Rapid7 MDR that we have not discussed.

I assess the transparency of Rapid7 MDR in terms of gaining visibility into detections and investigations as somewhat slow; we usually find issues before the team does.

I have been using Rapid7 MDR since 2021.

Rapid7 MDR is stable for me; there are no issues and no downtime.

Rapid7 MDR's scalability is strong and has kept up as my organization has grown or changed.

The customer support is inconsistent. I would rate the customer support a seven on a scale of one to ten.

Before Rapid7 MDR, I used Arctic Wolf because they are the worst in the industry and they raise their costs eight percent every year.

We have custom alerts which save time, but I have not really saved time in the sense of auto-closing because Orchestrator is not set up efficiently.

My experience with pricing and setup cost was good, as pricing includes licensing. However, setup was slow.

I evaluated Red Canary and some other options before choosing Rapid7 MDR.

On a scale of one to ten, I would rate Rapid7 MDR a nine. I would rate it a nine because Orchestrator implementation would make it a ten for me. I do not know what governance and security regarding Rapid7 MDR's AI capabilities mean or how to answer that. I have no concerns about the AI features in Rapid7 MDR being secure and managed well.

Rapid7 MDR is deployed in my organization with on-site collectors that send to a public cloud. I do not know which cloud provider is used, but I know Rapid7 hosts it. My advice to others looking into using Rapid7 MDR is that it is what you make of it. I rate Rapid7 MDR a nine out of ten overall.

My main use case for Rapid7 MDR is working primarily on investigation, cloud security model, and attack surface model for agent coverage.

For cloud security work, I mainly use Rapid7 MDR on agent coverage, especially for attack surface management, focusing on total instances or servers having missing CrowdStrike and missing Rapid7. The dashboard we have created is very helpful, and regarding investigation, especially on GuardDuty, the alert logs help us analyze and identify anomalous behavior of users.

Currently, there is no additional use case for Rapid7 MDR, and it is functioning smoothly. We are utilizing all the modules from Rapid7, and it helps us analyze in our day-to-day work.

Rapid7 MDR positively impacts my organization by helping the security team detect threats earlier, investigate suspicious activity faster, and respond before incidents cause significant damage.

Based on the MDR, I have noticed faster outcomes, as it has strengthened our security monitoring by helping investigate suspicious authentication activity such as access key creation and other potential threats. It provides additional investigation expertise and helps us support threat validation, allowing our cybersecurity team to prioritize only genuine security risks using MDR reports and incident records.

The inclusion of digital forensics and incident response within Rapid7 MDR has improved my ability to investigate security incidents, understand potential root causes, and identify affected systems. Investigation findings and response recommendations help my team make informed decisions, prioritize containment, and coordinate remediation more effectively.

Having a dedicated cybersecurity advisor through Rapid7 MDR helps align our security program with business needs by providing guidance on emerging threats, security priorities, and opportunities to improve our overall security posture. Recommendations help us focus on high-risk issues.

The best features Rapid7 MDR offers include Bot Factory for automation in cloud security, multiple options in attack surface management such as querying workspace, and very clear investigation logs that we can filter based on our needs.

Automation in cloud security helps me reduce manual work, respond to security findings faster, and improve our AWS security posture. In InsightCloudSec, I can use automation to identify misconfigurations, prioritize risk, and trigger remediation workflows.

Regarding Rapid7 MDR's AI capabilities, it supports compliance monitoring and helps my organization strengthen its posture. The AI capabilities provide reliable security alerts and useful investigation findings that help my team identify suspicious activity and distinguish potential threats from benign events. Investigation insights support informed decisions and incident responses.

Rapid7 MDR provides good visibility into security detection and investigation by delivering alert details, investigation context, and response recommendations, such as investigating suspicious authentication attempts, unusual IAM access creation, and malicious endpoint activity to understand the nature of the threat and its potential impact.

The risk-aware detection features in Rapid7 MDR provide detection capabilities by identifying suspicious activity. Improved attack path context and risk-based alert prioritization help us focus on threats that pose the greatest risk to our organization.

I have not directly evaluated the multi-vector telemetry feature in isolation, but I believe correlating telemetry from multiple sources such as endpoint activity, authentication events, and cloud logs can improve investigation accuracy by providing a more complete picture of suspicious activity.

Rapid7 MDR can be improved by better integration with existing security tools, clearer reporting for security outcomes, and reducing the number of false positives.

I have been using Rapid7 MDR for approximately one and a half years.

Rapid7 MDR is stable.

Rapid7 MDR's scalability meets our organization's needs. Rapid7 MDR handles our organization's growth or changing needs effectively.

The customer support for Rapid7 MDR is quite good. I would rate the customer support at nine out of ten.

Rapid7 MDR is deployed in my organization using a hybrid cloud approach. We primarily use public cloud infrastructure on AWS alongside on-premise infrastructure, and Rapid7 provides all these features.

We have seen operational value from Rapid7 MDR through continuous security monitoring and reduced manual effort in validating suspicious activity. While we have not quantified direct cost savings or staffing reductions, the improved visibility and access to specialized investigation expertise provide value to our security operations.

I did not purchase Rapid7 MDR through the AWS Marketplace. Overall, my experience with pricing and licensing has been reasonable for the value provided through continuous security monitoring, although I was not heavily involved while discussing the pricing and licensing.

I would rate Rapid7 MDR at nine out of ten overall. I choose this rating because it provides strong threat monitoring, investigation support, and security visibility, while still leaving room for improvements. I recommend Rapid7 MDR to organizations looking to strengthen their security monitoring, threat detection, and incident response capabilities. I suggest they assess their security requirements, confirm integration with existing tools, and clearly define incident escalation and response processes. My review rating for Rapid7 MDR is nine out of ten.

My main use case for Rapid7 MDR is providing protection where manual intervention from the company side is almost zero, which is essential for maintaining effective security.

The main point is knowing that someone is managing, not only selling, the complete solution we deployed and are fond of, and that is the backbone of our use case.

Rapid7 MDR has positively impacted our organization by ensuring that alerts can come at any point in time, and we do not have to worry because someone is there to fix it proactively.

In terms of specific outcomes since using Rapid7 MDR, I can confidently say there is virtually zero reduction in incident response time and no productivity getting hampered, allowing people to work more effectively.

The best features Rapid7 MDR offers include proactive threat hunting, as simply reacting to alerts will not work in today's sophisticated security landscape.

There are many instances where proactive threat hunting has helped our organization catch threats that could have been missed; people take their laptops home, and we have zero visibility, but with this MDR solution, we have peace of mind.

Regarding Rapid7 MDR's AI capabilities, I find it very positive and it provides a lot of help in audits and has a robust pre-authorized framework with strict controls.

Speaking about Rapid7 MDR's accuracy and reliability of output, I have to give it a ninety-nine percent rating, as there are very low false positive rates with accurate vulnerability scoring.

The transparency of Rapid7 MDR regarding gaining visibility into detections and investigations is outstanding, with the dashboard being the best in its class and centralizing telemetry data effectively.

The inclusion of digital forensics and incident response within the MDR service significantly improves our incident recovery process by providing historical timelines and root cause analysis.

The risk-aware detection features in Rapid7 MDR are unique, as they eliminate guesswork by cross-referencing alerts and helping to prioritize realistic attack paths.

We have used the multi-vector telemetry feature in Rapid7 MDR, and it greatly improves the accuracy of our investigations through true correlated visibility across platforms.

Having a dedicated cybersecurity advisor through Rapid7 MDR impacts our security program by aligning it with business needs thanks to their industry expertise and knowledge on mitigating attacks.

Regarding improvements for Rapid7 MDR, the only thing I can mention is the costing structure, which is a little bit premium; I understand that top products come at a premium rate.

I rate Rapid7 MDR nine out of ten because some networks may have devices that are not up to date, which affects performance, and there is also room for improvement in the costing structure.

I have been using Rapid7 MDR for almost four years.

Rapid7 MDR is absolutely stable.

The scalability of Rapid7 MDR is very high; you simply need to add licenses and agents to get started.

The customer support for Rapid7 MDR is excellent.

I rate the customer support a perfect ten out of ten.

We have not previously used any other XDR solution.

I have seen a return on investment; the productivity metric shows that the same teams who used to handle alerts manually can now focus on proactive work because this is taken care of by someone else.

Regarding the pricing, setup cost, and licensing, I notice a little bit of premiumization, but I firmly believe that the best products require payment for their quality.

We evaluated other options such as Sophos, SentinelOne, and CrowdStrike before choosing Rapid7 MDR.

My advice to others looking into using Rapid7 MDR is to go for it; you will love it and not regret your decision. I rate Rapid7 MDR nine out of ten.