Great source of truth for vulnerabilities
We are currently using the software as our primary vulnerability scanner and source of truth for current vulnerabilities in the …
Rapid7 InsightVM (Nexpose)
Rapid7 InsightVM (Nexpose)
Overview
Reviews
Reviewer Pros & Cons
View all pros & consPricing
View all pricingLog Management
$19
Cloud
per GB
Vulnerability Management
$22
Cloud
per asset
insightIDR
$52
Cloud
per asset
Entry-level set up fee?
- No setup fee
Offerings
- Free Trial
- Free/Freemium Version
- Premium Consulting / Integration Services
Features Scorecard
No scorecards have been submitted for this product yet.Start a Scorecard.
Product Details
What is Rapid7 InsightVM (Nexpose)?
InsightVM is presented as the next evolution of Nexpose, by Rapid7. This Insight cloud-based solution features everything included in Nexpose, such as Adaptive Security and the proprietary Real Risk score, and extends visibility into cloud and containerized infrastructure. InsightVM also offers advanced remediation, tracking, and reporting capabilities not included in Nexpose.
Rapid7 InsightVM (Nexpose) Video
Overview Video: InsightVM
Rapid7 InsightVM (Nexpose) Technical Details
| Deployment Types | SaaS |
|---|---|
| Operating Systems | Unspecified |
| Mobile Application | No |
Alternatives
View all alternatives
Frequently Asked Questions
What is Rapid7 InsightVM (Nexpose)?
InsightVM is presented as the next evolution of Nexpose, by Rapid7. This Insight cloud-based solution features everything included in Nexpose, such as Adaptive Security and the proprietary Real Risk score, and extends visibility into cloud and containerized infrastructure. InsightVM also offers advanced remediation, tracking, and reporting capabilities not included in Nexpose.
What is Rapid7 InsightVM (Nexpose)'s best feature?
Reviewers rate Support Rating highest, with a score of 7.2.
Who uses Rapid7 InsightVM (Nexpose)?
The most common users of Rapid7 InsightVM (Nexpose) are from Mid-size Companies and the Financial Services industry.
Reviews and Ratings
(48)
Ratings
Reviews
(1-8 of 48)Companies can't remove reviews or game the system. Here's why
August 24, 2021
Great source of truth for vulnerabilities
We are currently using the software as our primary vulnerability scanner and source of truth for current vulnerabilities in the environment. For new systems, it is required for the system to be registered in Rapid7 InsightVM (Nexpose) and have a scan conducted before it is allowed into production. It is a critical pillar in our environment.
- report on a system vulnerability
- consistent scanning
- easy to understand results
- System management
- UI
- Noise tuning from the scans on systems
February 13, 2020
Rapid7 Nexpose, not all it's cracked up to be
We currently use Rapid7 Nexpose for all Vulnerability scanning for current and new assets. Several asset groups have been created with assets owners receiving weekly reports for just the assets they own for a weekly snapshot to gauge their trending. We also utilize ad-hoc scans to ensure new devices do not have outstanding patches before being deployed.
- Creating Device Groups is very easy.
- The API tie ins work well.
- Frequent updates and console lockups.
- A lot of issues with scans running long out of nowhere, causing resource issues for the next scans.
August 16, 2017
Rapid7 NeXpose
Rapid 7 NeXpose is used in the organization as the powerhouse of vulnerability management. It is used by the Information Security Office to discover vulnerabilities for the enterprise.
- Real-Time Risk views
- Streamlines your view on most vulnerable assets
- Provides the ability to scan for policy configuration and compare with control requirements
- Integration with many other vendors; SIEM, Ticketing, Next gen Firewalls, etc
- Console crashes frequently
- Licensing is very expensive, per asset
September 26, 2019
A very good vulnerability scanner.
I have used Rapid7 Nexpose for performing vulnerability assessment scanning. It is a vulnerability management tool which can perform vulnerability scans and report the vulnerabilities. As a security consultant, I have used this tool to perform scans for our clients.
- Being a vulnerability scanner tool, its purpose is to scan the systems to find the vulnerabilities. We can define the assets like IP address for the scans and it also allows to either schedule the scan at a preferred time or start the scan immediately. Upon completion of the scan, this tool can result provide the details like host type, OS information, hardware address, along with the vulnerabilities.
- Rapid7 Nexpose has a list of templates to perform the scan. Once the templates are defined then the scans are performed accordingly.
- It also contains an option to add credentials/authentication using passwords, usernames, private keys to perform the credential-based scans which I think is a great feature.
- From my experience of using this tool, sometimes it gives more false positives. A few times I had performed the scan on the same IP address using Qualysguard and Nexpose, but after comparing the scan results I had found that Qualysguard had provided more accurate vulnerability information.
May 15, 2018
NeXpose - Its almost there
This tool is being used across a subset of the organization; it is an intuitive vulnerability scanner with amazing support service and solves the purpose. However it has a few downsides when it comes to the level of reporting etc., we expect from a vulnerability management solution.
- Intuitive
- End point agent deployment and management is easy
- RBAC on the console is great
- Scanning capabilities like specific vulnerabilities & compliance etc. are good
- In comparison to Tenable SecurityCenter we saw it didn't exactly find the same vulnerabilities which we would assume it should have
- We rely on a ticketing system and not our VM tool to assign tasks so wasn't too useful having that in there
- Filtering capabilities aren't as good as its competitors
May 14, 2018
Dream or nightmare. Flip a coin.
Rapid7 NeXpose performs discovery and vulnerability assessment of devices on a network. This data can be exported into other tools, or produce reports for threat remediation. The software supports physical servers, virtual servers, and cloud-based servers. For large environments, additional scanners can be deployed with the same options. Multiple OSs are supported and backups can be enabled for restoration across platforms.
- Queries against inventory are easy and useful
- Most threats discovered a have plenty of detail about the nature of the problem and how to mitigate
- Dashboards are abundant
- Once the organization of the tool is understood, operation is easy
- Devices found and scanned are never removed. Removal must be done manually with no option for automation.
- The database can be fragile. Ours quietly corrupted and progressively degraded until we had to restore and lose 6 months of data. Still didn't fix it and had to be rebuilt again losing all data.
- Workflow for delegating remediation is supposed to be helpful, but can also become cumbersome.
- Scheduling can become a nightmare if not monitored closely. We found jobs had failed to run because the server had gone offline. When the server came online, it did not try to run missed jobs. Running missed jobs all at once can overload the server, but searching for and launching a large number of missed jobs manually is a pain.
June 21, 2017
Expose on Nexpose
Nexpose from Rapid7 is a vulnerability scanner that supports the vulnerability management lifecycle. It addresses discovery, detection, verification, risk classification, impact analysis, reporting and mitigation. There are a wide variety of versions available: standalone software, an appliance, virtual machine, a managed service, or a private cloud deployment. User interaction is through a web interface. There is a free (but limited) community edition. It integrates Metasploit for vulnerability exploitation which provides very timely results against known and active vulnerabilities.
- Timely content by virtue of being tied to metasploit
- Easy to use interface
- Depth across the security life cycle
- Management side of things is a bit less functional than [Nexus]
- Perhaps more robust reporting for higher level reporting
- The alerting/messaging system could use additional flexibility
Rapid7 NeXpose is being used across the whole organization directly or indirectly by multiple departments. It is being used to scan the current assets and new build servers for vulnerabilities. It is also the main tool to find the vulnerabilities for PCI compliance and remediation. In addition, we utilize its tagging features to help sort out scans and reports for different asset owners or teams. We also use its features of services and software inventory findings to assist incident response in case any assets need a more deeper info, which may compensate some missing features in the product in case you can't find a away to achieve in the GUI.
- The API is also a great tool for us to automate lots of routine procedures like scan and report of asset(s) BY EMAIL.
- Tagging. It helps sort out results and reports for respective assets Owner for remediation without a lengthy report including unnecessary information for that particular team.
- SQL Reporting. It provides advanced reporting and export capabilities that you can not find in the stock report template.
- Scan for individual asset(s) (with schedule) should be more friendly and easy in GUI rather than going through its corresponding site for scheduling.
- Scan with Credentials can not be customized or prioritized the use of credentials for different sites or assets. How credentials are applied or the order of applying is still not very customizable.
- SQL database (PostgreSQL) should be opened to customer, since it lives on customer's appliance, so that we can do live monitoring and query in a more robust way.