Exposure Command

I use the product on and off as we are Trillium, a Rapid7 distributor. For pre-sales purposes and to study the features, we maintain contact with Rapid7 Exposure Command.

I find two to three features of Rapid7 Exposure Command most valuable. First, the attack surface management is exceptional. Rapid7 is fundamentally a vulnerability management product, and this represents their unique strength. When they perform attack surface management through scanning of public IPs, DNS reputation, and public domains of a customer, they excel at finding vulnerabilities and relating them to relevant CVEs and CVSS scoring systems, providing appropriate risk ratings. This attack surface management feature is quite strong.

Another valuable feature is dark web exposure monitoring. They scan and crawl dark web channels such as Telegram and other dark web forums and leak forums to check whether particulars linked with a customer's domain, credentials, or other IPs are for sale on the dark web or if data has leaked elsewhere. They report these findings comprehensively.

Rapid7 Exposure Command provides me with satisfaction knowing that my external attack surface and digital risk are being monitored. Every organization is exposed to the internet world, and Rapid7 Exposure Command provides visibility into how much we are exposed to the internet and whether our critical data or critical vulnerabilities are exposed to the public. If they are exposed publicly, both good actors and malicious actors operate online, and the malicious actors will leverage such exposure. This visibility is necessary and is being provided effectively by Rapid7 Exposure Command.

I believe there are two to three areas where Rapid7 Exposure Command can be improved. First, cloud integrations and the ability to assess cloud posture are essential components of an organization's external attack surface nowadays. Rapid7 Exposure Command has the cloud posture assessment feature, but in my opinion, it should be linked with cloud compliance requirements being introduced locally and internationally.

Secondly, regarding data criticality, Rapid7 Exposure Command integrates the DSPM feature, which stands for Data Security Posture Management. I believe this feature is present, but it requires enhancement with global data protection regulations such as GDPR.

I am learning about more features in products such as Rapid7 Exposure Command. I mentioned cloud posture assessment across Oracle Cloud, Azure Cloud, and AWS Cloud. Features specific to these cloud offerings would be beneficial. With AWS having separate cloud offerings, Rapid7 Exposure Command must cover all available AWS offerings and relevant services. To be honest, this is an area where I am still learning, so I cannot provide a precisely detailed answer.

I first worked on Rapid7 Exposure Command around one and a half years ago.

Rapid7 has very good technical support staff, and I would rate their job at nine out of ten.

Intelligent automation plays a very crucial role in refining my risk prioritization process because, in recent years, security researchers and leaders have realized that security tools alone are insufficient to deal with security threats. We must stay ahead of attackers, and achieving this requires very effective threat intelligence automation operations, which are directly linked with countermeasures to threats. The term threat hunting emphasizes the need for proactiveness in our daily conversations. Cybersecurity is not simply about a reactive approach; we must be proactive, and to effectively address cyber threats, threat intelligence is a key requirement.

I use two to three metrics to measure the effectiveness of Rapid7 Exposure Command's real-time reporting capabilities. I assess how good the reports are, how concise they are, and whether the information is relevant. There is a possibility of many false positives when dealing with attack surface management and internet crawling, including deep and dark web crawling. Therefore, report quality depends on how effectively false positives are being filtered, and a very concise, actionable, and to-the-point report is a key metric for determining a good product.

Rapid7's user-friendly interface has helped my security team make informed decisions. I have been working with Rapid7 products for seven to eight years. One of their very good features is that their products are user-friendly, and I require around three to four days maximum to become familiar with their products. If a new product is released, I need only three to four days to become accustomed to the interface. The interface is very user-friendly, and there are informational texts where further details are helpful; hovering over them provides very good explanations as well as definitions of technical terms.

In the Pakistani market, Rapid7 Exposure Command's pricing is on the expensive side, and that represents one of the challenges we are facing.

I have not checked the simulation feature in Rapid7 Exposure Command, but I believe it was not included in the first release of the product.

My overall rating for this product is seven point five out of ten.

I am specifically providing feedback on Rapid7 Exposure Command. We are using Rapid7 Exposure Command mostly for vulnerability detection and scanning.

The role of intelligent automation in this product is good, and we received feedback on actively exploited CVEs and vulnerabilities, so I would consider it around seven to eight. We usually measure the effectiveness of real-time reporting by using the latest available dump or when we share the vulnerabilities with governance teams or remediation teams. How quickly and easily we are able to filter the data and pass it on to remediation teams for their planning is one of the KPIs we set, so it is good, not that great, but it is good.

Rapid7 Exposure Command is not as easy to deploy compared to Qualys, and the detection rates are lower than Qualys. Rapid7 Exposure Command is not exactly complex, but it is medium complex when I compare it to Qualys, where the deployment procedure is quite straightforward.

Detection needs more depth in Rapid7 Exposure Command, and when I compare it with Qualys, the output of vulnerabilities can be improved at a depth level. That is one of the major pieces of feedback I have. The detection rate of vulnerabilities is not up to par, and that is one of the most important things that every firm looks for.

I have been working with this solution for a couple of years.

Since we are basically a reseller for Rapid7, we have prioritized technical SPOCs who are assigned to our organization, and we get a response on an immediate basis when we report a challenge. Usually within three to four hours, we receive a remote response, and through troubleshooting, they get the issue fixed.

For me and my team, the deployment is quite simple in terms of setup.

The deployment is done by different folks in the account, and I am mostly managing support and other areas. For one of the accounts, two folks were deployed, and they completed the implementation within two to three weeks.

Currently, I have multiple accounts where Rapid7 is actually used less, but Wiz tool is gaining traction, so more focus and attention is happening currently than Rapid7, which has only a couple of accounts where it is deployed.

Compared to Tenable or Qualys, Rapid7 Exposure Command is definitely affordable for small-sized or mid-sized engagements, although there are some challenges with detection. These challenges are in line with what the vulnerability management framework is expected to do and the vulnerability detection required to be done, matching the expectations of a client about eighty to ninety percent.

With Qualys or others, the APIs are open, but I have not seen much integration in my project, so I am not sure about that. It is mostly referencing excels and the data dumps. I would rate the user-friendly interface between eight and nine.

The licensing cost for Rapid7 Exposure Command is lower compared to Qualys, so it is not a challenge for the customer. Teams and organizations that use Rapid7 Exposure Command do get a comparatively cost benefit. I would rate this product overall as an eight.