Rapid7 publishes three starting prices in October 2026: InsightVM from $1.62 per asset per month at 500 assets, InsightAppSec at $175 per application per month, and InsightCloudSec at $5,775 per month for up to 500 instances. Its newer packages, Incident Command (the SIEM formerly sold as InsightIDR) and Exposure Command (which now contains InsightVM), are quote-only annual subscriptions priced per asset.
This guide shows what each Rapid7 product costs where a price is published, what drives the quote where it is not, and how the old Insight names map to the current Command packages.
Try UnderDefense MAXI
AI-investigate threats at scale. Escalate only validated incidents to your SOC.
Rapid7 Products Pricing
The table below lists every Rapid7 product with its current name, its published starting price, and the unit Rapid7 bills on. Figures come from Rapid7’s general pricing page and product pricing pages, read in October 2026.
| Product (former name) | What it does | Published starting price | Billed per |
|---|---|---|---|
| Exposure Command (includes InsightVM) | Vulnerability and exposure management | InsightVM card: $1.62 per asset per month at 500 assets. Exposure Command packages: quote only | Billable asset, annual subscription |
| Incident Command (formerly InsightIDR) | Cloud SIEM, with XDR in the top package | Quote only | Asset, annual SaaS subscription |
| InsightAppSec | Dynamic application security testing (DAST) | $175 per app per month, billed annually | Application |
| InsightCloudSec | Cloud security posture and threat detection | $5,775 per month for up to 500 instances | Cloud instance |
| Managed Threat Complete (Rapid7 MDR) | 24/7 managed detection and response | Quote only | Endpoints, servers and networks protected |
On annual terms, the published figures work out to $9,720 a year for 500 InsightVM assets, $2,100 a year per InsightAppSec application, and $69,300 a year for InsightCloudSec at up to 500 instances.
One caveat applies to InsightVM. Rapid7’s general pricing page still shows the $1.62 card, while the InsightVM product page now says InsightVM “is now part of Exposure Command,” and the Exposure Command pricing page lists no figures. Before you compare a quote with $1.62, ask whether it prices standalone InsightVM or Exposure Command Essentials.
Rapid7 Products Overview
Rapid7 now sells most of its portfolio as two platforms. The Command platform covers exposure: Surface Command for asset discovery and attack surface, then Exposure Command Essentials and Ultimate, with a Cyber GRC add-on for governance and compliance workflows. Incident Command covers detection and response in three packages: Essential, Advanced and Ultimate.
InsightAppSec and InsightCloudSec still carry their own published prices, and their capabilities also sit inside Exposure Command Ultimate. Managed Threat Complete is Rapid7’s managed service, delivered on its own SIEM.
Rapid7 SIEM Pricing: InsightIDR, Now Incident Command
Rapid7 renamed InsightIDR to Incident Command in July 2025, and many buyers still search for the old name. Rapid7 publishes no Incident Command price. Its packages page describes “transparent, predictable asset-based pricing” on an annual SaaS subscription, and its FAQ explains how the asset count and the per-asset price work.
Incident Command Packages
The three packages share the same SIEM core and differ in AI investigation, deception, endpoint detection and log retention. The table follows the included, add-on and excluded marks on Rapid7’s Incident Command packages page in October 2026.
| Capability | Essential | Advanced | Ultimate |
|---|---|---|---|
| SIEM detection triage, investigation and reporting | Included | Included | Included |
| Asset and attack surface management (CAASM, EASM) | Included | Included | Included |
| SOAR automation and response | Included | Included | Included |
| User behavior analytics and natural language threat hunting | Included | Included | Included |
| Ransomware Prevention | Add-on | Add-on | Included |
| Intelligence Hub | Add-on | Included | Included |
| AI-assisted alert triage and agentic AI investigation workflows | Not included | Included | Included |
| Deception technology | Not included | Included | Included |
| EDR, NDR, IDS and the hosted Velociraptor DFIR framework | Not included | Not included | Included |
| Log retention | 90 days, more as add-on | 180 days, more as add-on | 180 days, more as add-on |
| Alert and audit retention | 13 months | 13 months | 13 months |
| Quickstart deployment and training | Included in year 1 | Included in year 1 | Included in year 1 |
The jump that changes the quote most is Ultimate, the only package with endpoint detection and response and the embedded DFIR framework. If you already run an EDR such as CrowdStrike or SentinelOne, Advanced may cover what you need from the SIEM.
How Rapid7 Counts SIEM Assets
Rapid7’s FAQ defines an Incident Command asset as a host running a workstation or server operating system with data attributed to it in the last 30 days, such as servers, desktops, laptops and point-of-sale systems. The price does not change by asset type, and the per-asset price drops as you move up asset-count tiers.
Data volume is handled through a fair use monthly data policy that scales with the asset tier. Rapid7 says it does not throttle ingestion and works with customers who need more data. Customer support runs 8 a.m. to 6 p.m. regionally, and the subscription does not include managed detection and response.
A principal security architect at an enterprise customer wrote on G2 in January 2026 that its pricing “is not based on log ingestion.”
What an InsightIDR Budget Looked Like
The most recent figure on record is old. G2’s pricing page for Rapid7 Next-Gen SIEM shows a vendor-supplied InsightIDR price of $2,156 per month, billed annually, with a 500-asset minimum. G2 marks that information as last updated in October 2024, before the rename and the new packages.
At 500 assets, that listing comes to $25,872 a year, or about $4.31 per asset per month. Use it as a historical reference point for a conversation with Rapid7’s sales team, and confirm the current package, asset tier and minimum in the quote.
InsightVM (Exposure Command) Pricing and Features
InsightVM’s last published price is $1.62 per asset per month at 500 assets, the card still shown on Rapid7’s general pricing page. Rapid7 now sells InsightVM inside Exposure Command Essentials, priced by billable asset on an annual subscription, with volume discounts available for larger asset counts.
| Package | What it adds |
|---|---|
| Surface Command | Asset discovery and unified inventory, internal and external attack surface visibility, asset graph and blast radius analysis, remediation hub |
| Exposure Command Essentials | Everything in Surface Command, plus agent-based and network vulnerability scanning, threat-aware risk scoring, policy and configuration assessment, remediation workflows and SLAs |
| Exposure Command Ultimate | Everything in Essentials, plus multi-cloud and container security, cloud posture and compliance, attack path analysis, identity risk, infrastructure-as-code scanning, DAST and API testing, automated cloud remediation |
Rapid7 defines an Exposure Command asset more broadly than a SIEM asset: devices, software, identities, cloud compute instances and applications discovered in your environment, with an asset ratio that maps each use case to an asset type. Its general pricing page lists what comes with an Insight plan: unlimited user accounts, shared data across tools, single sign-on, 24/7 technical support, a customer-success team, and a central account dashboard.
Pros: risk-based prioritization tied to threat data, and room to grow from vulnerability management into cloud and application coverage without re-licensing the whole environment.
Cons: no published price for the current packages, and the broad asset definition means you need Rapid7’s asset ratio in writing to forecast the bill.
InsightAppSec Pricing and Features
InsightAppSec starts at $175 per application per month, billed annually, according to its pricing page, which notes that international prices vary. It is Rapid7’s dynamic application security testing (DAST) tool, scanning running web applications for vulnerabilities.
Pros: a published per-application price, so cost scales directly with the number of applications you test.
Cons: cost grows linearly with your application count, and teams that also need cloud coverage may find Exposure Command Ultimate, which includes DAST and API testing, a better fit.
InsightCloudSec Pricing and Features
InsightCloudSec starts at $5,775 per month for up to 500 instances, or $69,300 a year, according to its pricing page in October 2026. It covers cloud asset inventory across providers, policy management and automated remediation of non-compliant configurations.
The same cloud capabilities, including multi-cloud and container security, posture and compliance checks, and automated cloud remediation, now also sit in Exposure Command Ultimate.
Pros: a published starting price for a cloud security product, and inventory standardized across cloud providers.
Cons: the entry tier is sized for 500 instances, so smaller cloud estates pay for capacity they may not use.
Factors Influencing Rapid7 Pricing
Rapid7 publishes few prices, but its own FAQs explain what moves a quote. The table collects those factors from the Incident Command, Exposure Command and MDR pricing pages, read in October 2026.
| Factor | How it moves the price | Source |
|---|---|---|
| Asset count | Priced per asset; the per-asset price drops at higher count tiers | Incident Command FAQ |
| Volume | Volume discounts are commonly available for larger asset counts, such as above 1,000 assets | Exposure Command FAQ |
| What counts as an asset | SIEM: hosts with a workstation or server OS seen in the last 30 days. Exposure Command: devices, software, identities, cloud instances and apps, weighted by an asset ratio | Incident Command and Exposure Command FAQs |
| Package tier | Essential, Advanced or Ultimate for Incident Command; Essentials or Ultimate for Exposure Command | Packages pages |
| Add-ons | Ransomware Prevention and Intelligence Hub below the top tiers, extra log retention, Cyber GRC | Packages pages |
| Region | Pricing may vary by region | Exposure Command FAQ |
| Contract | Annual subscriptions | Incident Command and Exposure Command FAQs |
| Managed service | Rapid7 MDR is priced on endpoints, servers and networks protected, and not on data volume or incident count | Rapid7 MDR pricing page |
Bring your asset inventory, split by type, to the first sales call. With the definitions above, you can check whether the quoted asset count matches what you actually run.
Rapid7 vs UnderDefense: Pricing at a Glance
If you are pricing Rapid7’s managed service against an alternative, the main differences are what you pay for and which SIEM the service runs on. The table compares Rapid7 MDR with UnderDefense Agentic AI SOC using each company’s own published information.
| Rapid7 MDR (Managed Threat Complete) | UnderDefense Agentic AI SOC | |
|---|---|---|
| Published price | Quote only | From $11 per device per month, an indicative price for organizations with up to 100 employees |
| Pricing unit | Endpoints, servers and networks protected | Device |
| SIEM | Delivered on Rapid7’s SIEM, with telemetry from 190+ integrations | Works on top of the SIEM you already run, such as Splunk, Microsoft Sentinel, QRadar, Elastic or Google SecOps, across 250+ integrations |
| Log data | Unlimited log ingestion, 13 months of retention in the Essentials package | No data restrictions, according to UnderDefense |
| Incident response | Unlimited incident response, according to Rapid7 | Incident response retainer included, 40 hours in the Standard tier |
Which column fits depends mostly on whether you want to keep the SIEM you already run, the question UnderDefense’s Rapid7 comparison works through in detail.
How UnderDefense Works on Top of Rapid7
Incident Command and Exposure Command produce alerts and risk scores, and your team still owns the investigation, the user follow-up and the response at 2 a.m. UnderDefense Agentic AI SOC runs on top of Rapid7 without replacing it: AI agents investigate each alert, and UnderDefense analysts decide and act around the clock.
| Where Rapid7 leaves off | What UnderDefense Agentic AI SOC adds | Result for your team |
|---|---|---|
| Incident Command alerts from many log sources | AI agents correlate each alert across SIEM, identity, endpoint and cloud data, cutting noise by about 99% | Analyst time goes to alerts that carry real risk |
| User behavior analytics flagging an unusual login | ChatOps confirms the activity with the user over Slack, Microsoft Teams, email or SMS | A suspicious login is confirmed or escalated in one exchange |
| Customer support from 8 a.m. to 6 p.m. regionally | Analysts on shift 24/7, with a 20-minute SLA response for critical alerts | A 2 a.m. alert gets a decision before morning |
| Rapid7 alongside other tools you own | Investigation across 250+ integrations, with Rapid7 kept as your system of record | No migration and no second console to learn |
| SOAR playbooks in every package | Every agent and analyst action logged and auditable | An evidence trail for auditors and incident reviews |
Running Incident Command without a night shift? Get a 24/7 triage demo
Frequently Asked Questions
1. How much does Rapid7 InsightVM cost?
Rapid7’s general pricing page still lists InsightVM from $1.62 per asset per month at 500 assets, about $9,720 a year. InsightVM is now sold inside Exposure Command Essentials, which is quote-only, billed per asset on an annual subscription, with volume discounts for larger asset counts.
2. What is the price of Rapid7 InsightIDR?
InsightIDR, now Incident Command, has no published price. It is an annual SaaS subscription priced per asset, with the per-asset price falling at higher tiers. G2 still shows a vendor-supplied InsightIDR price of $2,156 per month with a 500-asset minimum, last updated in October 2024.
3. Is there a free trial for Rapid7 products?
Yes for several products. Rapid7 offers an InsightVM trial for hands-on vulnerability management, a trial button on the Exposure Command pricing page, and G2 lists a free trial for its SIEM. Rapid7 does not publish trial lengths on the pricing pages reviewed.
4. How is Rapid7 InsightCloudSec priced?
InsightCloudSec starts at $5,775 per month for up to 500 instances, or $69,300 a year, according to its pricing page. The same cloud security capabilities are also part of Exposure Command Ultimate, which is priced by quote.
5. Does Incident Command pricing include managed detection and response?
No. Incident Command is the SIEM subscription. Rapid7’s managed service, Managed Threat Complete, is priced separately on the number of endpoints, servers and networks protected, in Essentials, Advanced and Ultimate packages.
