Exposure Command
Risk-based visibility has transformed how we prioritize high-risk exposures and streamline remediation
What is our primary use case?
My main use case for Rapid7 Exposure Command is identifying and prioritizing high-risk exposures across our environments. It helps us to focus remediation efforts on the issues that pose the greatest business risk.
What is most valuable?
Rapid7 Exposure Command helps me prioritize high-risk exposures through its risk-based prioritization feature, which I use the most because it helps cut through the noise and quickly identify which exposures need attention first. Teams can focus on the highest-risk issues instead of reviewing everything manually.
Rapid7 Exposure Command offers the best feature of risk-based visibility. It helps bring together data from different sources and makes it easier to identify which exposures should be addressed first.
Risk-based visibility works well for my team as it integrates well with the broader security ecosystem and helps bring together information from multiple sources into a single view. That makes it easier to understand overall risk and prioritize remediation efforts. It also reduces the amount of manual analysis required, which helps teams work more efficiently. Overall, the visibility and prioritization capabilities are the features I find most valuable.
Rapid7 Exposure Command has positively impacted my organization by improving how we prioritize vulnerabilities and helping reduce the time spent analyzing large volumes of findings.
Rapid7 Exposure Command has improved our vulnerability management process by providing better visibility and helping us prioritize high-risk exposures more effectively. We have seen time savings during vulnerability triage and faster prioritization of remediation efforts.
What needs improvement?
I would like to see Rapid7 Exposure Command improved with additional report customizations and more automation options. The automation capabilities could be enhanced to streamline workflows even further.
I rate it a nine because Rapid7 Exposure Command provides strong visibility, risk-based prioritization, and helps simplify vulnerability management in large environments. The reason I did not rate it a ten is that I would still prefer to see more flexibility in reporting, dashboard customizations, and workflow automations. Those improvements would make the experience even better.
For how long have I used the solution?
I have been using Rapid7 Exposure Command for about a year as part of vulnerability management and exposure management activities.
What do I think about the stability of the solution?
Rapid7 Exposure Command is stable in my experience as a reliable platform with no major issues that impact my operations.
What do I think about the scalability of the solution?
Rapid7 Exposure Command's scalability for my organization is highly effective. It handles large environments and growing amounts of security data without any issues.
How are customer service and support?
The customer support from Rapid7 is very good.
I would rate the customer support of Rapid7 Exposure Command a nine on a scale of one to ten.
Which solution did I use previously and why did I switch?
We previously used traditional vulnerability management tools and manual prioritization processes before Rapid7 Exposure Command. Rapid7 Exposure Command helped improve visibility and made it easier to focus on the exposures that mattered most.
What's my experience with pricing, setup cost, and licensing?
From the user perspective, my experience with Rapid7 Exposure Command's pricing, setup cost, and licensing was primarily on the technical side. The setup was smooth and the platform was easy to adopt.
Which other solutions did I evaluate?
We evaluated alternatives such as Tenable and Qualys before choosing Rapid7 Exposure Command, but its exposure management and risk prioritization capabilities were key factors in the decision.
What other advice do I have?
Overall, I believe the governance and security of Rapid7 Exposure Command are solid. The platform provides good visibility and supports responsible risk management and decision-making.
In my experience, Rapid7 Exposure Command's outputs have been accurate and reliable. The insights and prioritization recommendations generally align with what we see in our security operations, which helps build confidence in the platform. We still validate important decisions, but the results have been consistently useful.
I would recommend Rapid7 Exposure Command to organizations that need better visibility into risk and want to improve vulnerability prioritization. It helps reduce noise and focus attention on the exposures that matter most. I rate this product a nine out of ten.
Which deployment model are you using for this solution?
If public cloud, private cloud, or hybrid cloud, which cloud provider do you use?
Automation has improved vulnerability insights and supports timely reporting for remediation teams
What is our primary use case?
I am specifically providing feedback on Rapid7 Exposure Command. We are using Rapid7 Exposure Command mostly for vulnerability detection and scanning.
What is most valuable?
The role of intelligent automation in this product is good, and we received feedback on actively exploited CVEs and vulnerabilities, so I would consider it around seven to eight. We usually measure the effectiveness of real-time reporting by using the latest available dump or when we share the vulnerabilities with governance teams or remediation teams. How quickly and easily we are able to filter the data and pass it on to remediation teams for their planning is one of the KPIs we set, so it is good, not that great, but it is good.
What needs improvement?
Rapid7 Exposure Command is not as easy to deploy compared to Qualys, and the detection rates are lower than Qualys. Rapid7 Exposure Command is not exactly complex, but it is medium complex when I compare it to Qualys, where the deployment procedure is quite straightforward.
Detection needs more depth in Rapid7 Exposure Command, and when I compare it with Qualys, the output of vulnerabilities can be improved at a depth level. That is one of the major pieces of feedback I have. The detection rate of vulnerabilities is not up to par, and that is one of the most important things that every firm looks for.
For how long have I used the solution?
I have been working with this solution for a couple of years.
How are customer service and support?
Since we are basically a reseller for Rapid7, we have prioritized technical SPOCs who are assigned to our organization, and we get a response on an immediate basis when we report a challenge. Usually within three to four hours, we receive a remote response, and through troubleshooting, they get the issue fixed.
How was the initial setup?
For me and my team, the deployment is quite simple in terms of setup.
What about the implementation team?
The deployment is done by different folks in the account, and I am mostly managing support and other areas. For one of the accounts, two folks were deployed, and they completed the implementation within two to three weeks.
Which other solutions did I evaluate?
Currently, I have multiple accounts where Rapid7 is actually used less, but Wiz tool is gaining traction, so more focus and attention is happening currently than Rapid7, which has only a couple of accounts where it is deployed.
What other advice do I have?
Compared to Tenable or Qualys, Rapid7 Exposure Command is definitely affordable for small-sized or mid-sized engagements, although there are some challenges with detection. These challenges are in line with what the vulnerability management framework is expected to do and the vulnerability detection required to be done, matching the expectations of a client about eighty to ninety percent.
With Qualys or others, the APIs are open, but I have not seen much integration in my project, so I am not sure about that. It is mostly referencing excels and the data dumps. I would rate the user-friendly interface between eight and nine.
The licensing cost for Rapid7 Exposure Command is lower compared to Qualys, so it is not a challenge for the customer. Teams and organizations that use Rapid7 Exposure Command do get a comparatively cost benefit. I would rate this product overall as an eight.