Rapid7 InsightConnect vs. Tenable Vulnerability Management

Where Rapid7 InsightConnect excels is in environments needing the whole suite of virus protection and monitoring. In our environment we use it to make sure we have visibility over all endpoints, servers, hosts, and clusters to make sure that there are no vulnerabilities being left unattended too. It is also best in large environments. Since there are many endpoints, the automation from Rapid7 helps manage them all in an efficient manner.

Incentivized

I've been using this product since it began as an open source product, I really like it and for the money, I think it's probably the best choice for most companies who need a product like this. Over the years I've seen the interface change quite a bit and sometimes I think it's a bit unclear how to do certain things and the different packages can be confusing, these are the only reasons I'm giving it a 9 instead of a 10.

Incentivized

• The most significant difference is that we no longer have to examine endpoints and devices separately.
• The cost.
• The impact on the safety and efficiency of our business.

Incentivized

• Setup of the internal scanner was fairly simple and straight forward.
• An update came out for the internal scanner that allows you to add an Internal Certificate Authority for lookup.
• Has automated reporting to keep executives and compliance departments informed.
• Internal scanner can be configured to auto-update itself.
• "Recast Rules" allows your organization to redefine a vulnerabilities' classification, if it is not applicable or your disagree.
• External PCI scans allow you to remediate before submitting to Tenable.io for review.
• Tenable.io staff was very patient and helpful. They provided some limited guidance with remediation.
• Internal and External scans can be automated. schedule for the automated scans is very granular.

Incentivized

• It would be great if Rapid7 InsightConnect could be configured based on pre determined specifications when installing the agent.
• We've noticed that at times, there are certain network parameters needed in order for Rapid7 to collect and report data efficiently.
• Sometimes there are issues with the discovery scan in Rapid7 making it hard to configure in the beginning.

Incentivized

• Expensive - You do pay a slight premium for the best product in the space.
• Asset management is difficult to work with if you have a lot of asset turnover, the license can be ''held'' for 3-6 months after the asset is gone from your environment.

Incentivized

We like to renew tenable each year we have had it so far.

Incentivized

It's incredibly easy to set up, to use, to detect threats. It's easy to change, tweek and very quick to resolve all issues

Incentivized

Support is usually really great at walking you through any steps you need to take when you get stuck on something. There are a few false positives and errors that have come up over the years that required their help to get through. Unfortunately, the steps required to diagnose some problems are more tedious than I think should be necessary. (IE: SQL instances can throw errors that clog up your logs because one plugin affects it in a certain way. The process to diagnose this is to watch timestamps of plugins in a log while monitoring the SQL logs at the same time and using your best guess as to what is causing it.)

Incentivized

Palo Alto was slightly cheaper, but more complex and would need the training to be effective. Splunk was comparative from a price standpoint, but the automation features of Rapid7 InsightConnect outweighed those of Splunk SOAR. Honestly, all of these are great choices, but for our environment, it made more sense to go with Rapid7.

Incentivized

Tenable.io has a comparable set of features, with excellent support and a competitive price. After less than desirable experiences with another company, we moved to Tenable and haven't looked back since.

Incentivized

• The automation and integration we set up in the dev cycle helped us provide evidence in audits
• The automation and integration we set up in the dev cycle helped us fix vulns in our software prior to implementation thus increasing our security
• Automations save massive time and headache's between infosec and devs

Incentivized

• Since this is a requirement for our PCI compliance and the cost is relatively low, the ROI isn't really something we need to think too much about, Tenable's pricing is fair and affordable.

Incentivized