The reporting feature needs improvement. The time taken to fetch reports based on the number of events can be extensive, unlike Tenable, which is more user-friendly and faster. 

Additionally, network throttling should also be considered.

View full review »

While Metasploit excels in vulnerability assessment, it could improve in vulnerability management. Nessus currently holds the advantage in management functions. 

Support is another area where improvement is needed, particularly for assisting non-security users.

View full review »

The database is not always updated with the latest vulnerabilities or zero-day exploits. If a vulnerability arises a month or two ago, it might not be included in the database, which is something I would like to see improved.

View full review »

If your company's patch is not up to date, but you have other detection or defense solutions such as endpoint detection and response and antivirus software, the product exploit may not work effectively. This is because its exploit database update process is slow and not real-time. For zero-day vulnerabilities or new security threats, relying on Rapid7 Metasploit alone may not be effective.

Adding features to Rapid7 Metasploit that enhance evasion of Endpoint Detection and Response systems would significantly improve its utility within modern organizations.

View full review »

There are numerous outdated exploits in their database that should be updated.

View full review »

Rapid7 is able to identify vulnerabilities, but the only way to remediate them is to manually apply patches. This can be time-consuming, as evidenced by the six months it took our team to remediate vulnerabilities found in the Tenable ICS and OT security VT. To make this process easier, there should be an automated system or API to align with the PET solution, allowing systems to quickly align with it.

The solution is not user-friendly and has room for improvement.

I would like a feature for mobile tracking, allowing us to operate it from a mobile device or at least track it technologically, the basic functionality would be something I would like. For example, when I execute a vulnerability assessment activity, it takes around two to three days to complete all the plans. In order to track that, I would have to log into my system repeatedly. Therefore, I would like to have a feature that allows me to track it from my mobile device.

View full review »

Advanced Infrastructure should be implemented in the next release for better orchestration. 

View full review »

I would like to see more capabilities, more functions, and more features. More types of attack vectors.

View full review »

The open-source version has reporting limitations. You need to develop these capabilities yourself. Built-in reporting is an excellent feature for penetration testing, but it isn't a must-have. The solution could also cover more vulnerabilities. Metasploit has around 10,000 exploits in its library, but more is always better. 

View full review »

I think areas with shortcomings that need improvement are more integration and automation.

View full review »

It would be better if Metasploit had a wider module, to do explorations of vulnerabilities. We'd like them to offer better coverage of malware.

View full review »

Rapid7 Metasploit can add a GUI feature because it is only available online.

While it is simple to use, including a GUI would make things easier. It would be very helpful.

View full review »

At the time I was using it, the graphical user interface needed some improvements. It might be better now because there was a very big community behind it, and of course, newer versions are always improved. The free, community edition I was using, lacked some very specific exploits but, as I remember, under the commercial version, you could find your exploits.

All the features that are available on the command line could be integrated with the graphical user interface.

View full review »

The solution should be more user friendly. Right now, a user needs a certain level of technicality.

The solution should improve the responsiveness of its live technical support.

View full review »

Integration with popular vulnerability scanners would be a useful feature.

Better automation capabilities would be an improvement. For example, if a project is moving from a development to a testing environment, then automation is crucial. We are using Jenkins, JIRA, and other tools for SecOps and DevOps. If somebody is storing code or a project in SVN then it needs to be fully automated. We need the ability for the scanner to run, then have Checkmarx scan them, then exploit the vulnerabilities if any are found. 

View full review »

• The GUI version is not as effective as a command prompt. For general users, the PT using GUI could be improved. At the same, the track of a phishing emails were not accurate sometimes. Rapid7 could work on this further. 
• Metasploit cannot be installed on a machine with an antivirus. This could be improved. 
• There were times when it hung, then I had to restart the DB service. This leaves an area of improvement for them.
• It is necessary to add some training materials and a tutorial for beginners.

View full review »

Few cons of metasploit are 1) Exploit updates are slow after security patches to a certain OS 2) High resource utilization when run under Window7 and Windows Server 2008 R2 3) Fewer browser exploits 4) Payloads not extremely effective against updated anti viruses. View full review »

Rapid7 Metasploit could be made easier for new users to learn.

View full review »