VENDOR NOTES · RAPID7
Rapid7 Surface Command: ASM and exposure management facts (2026)
SHORT ANSWER
Rapid7 Surface Command combines external discovery with an internal and external asset inventory (EASM plus CAASM) inside the Rapid7 Command platform, next to InsightVM and InsightCloudSec, and offers a public trial. Active exploit validation is not described for Surface Command, remediation workflows sit in higher tiers and no price is published.
By The Exposure Desk · Exposure Management Finder · Published 2026-10-11
Desk research from public vendor pages read in September 2026, updated 2026-10-11. Profiles follow our published method; we did not run the products.
Which tool types does Rapid7 describe?
- Outer point: described on the vendor's pages we read
- Inner point: not in our sources (it may exist; we did not find it)
| Type | Status | What the pages say | Source |
|---|---|---|---|
| EASM discovery | Described | Internal and external attack surface visibility, including unknown internet-facing assets and shadow IT. | Source: Rapid7 Surface Command · Read 27 Sep 2026 |
| Exposure validation | Described | Rapid7 announced runtime validation for Exposure Command in March 2026, aimed at cloud vulnerabilities; active validation is not described for Surface Command. | Source: Rapid7 press release: runtime validation and DSPM for Exposure Command · Read 27 Sep 2026 |
| Exposure management platforms | Described | Sits in the Rapid7 Command platform next to Exposure Command, InsightVM and InsightCloudSec. | Source: Rapid7 products · Read 27 Sep 2026 |
| CTEM programme support | Described | Remediation workflows, SLAs and reporting are listed for higher tiers. | Source: Rapid7 Surface Command · Read 27 Sep 2026 |
| WAF posture | Not in our sources | Not described on the pages we read. | None |
How does Rapid7 prove an exposure is real?
| Exploitability checked | Partly Runtime validation for cloud vulnerabilities in Exposure Command, announced March 2026. Source: Rapid7 press release: runtime validation and DSPM for Exposure Command · Read 27 Sep 2026 |
|---|---|
| Attack-style testing | Not in our sources |
| Retests after a fix | Not in our sources |
What does Rapid7 do with a finding?
| Subsidiary and owner attribution | Not in our sources |
|---|---|
| Routes findings to owners and tickets | Partly Remediation workflows and SLAs at higher tiers; SOAR-ready integrations. Source: Rapid7 Surface Command · Read 27 Sep 2026 |
| Applies a compensating control | Partly SOAR-ready automation; remediation workflows at higher tiers. Source: Rapid7 Surface Command · Read 27 Sep 2026 |
| Works through your WAF or edge | Not in our sources |
| WAF coverage across several vendors | Not in our sources |
| Integrations | SOAR-ready integrations, with Exposure Command, InsightVM and InsightCloudSec in the same platform. Source: Rapid7 Surface Command · Read 27 Sep 2026 |
Where does Rapid7 run, and what does it connect to?
| Deployment | Part of the Rapid7 Command platform with Exposure Command, InsightVM and InsightCloudSec. Source: Rapid7 products · Read 27 Sep 2026 |
|---|---|
| Internal as well as external assets | Matches Combines external visibility (EASM) with a unified asset inventory (CAASM). Source: Rapid7 Surface Command · Read 27 Sep 2026 |
| Cloud connections named | Matches InsightCloudSec sits in the same platform. Source: Rapid7 products · Read 27 Sep 2026 |
| Platform it extends | Shares the Command platform with Exposure Command and InsightVM. Source: Rapid7 products · Read 27 Sep 2026 |
| Platforms it connects to | None in our sources |
What does Rapid7 cost?
Trial available. Price not published. Exposure Command comes in Essentials and Ultimate tiers.
Source: Rapid7 Surface Command · Read 27 Sep 2026
Trial or self-serve start: Matches Public self-serve trial.
Source: Rapid7 Surface Command · Read 27 Sep 2026
Where is Rapid7 strong, and where are its limits?
Strengths and limits come from the vendor's own pages and our sources; a limit can be something we did not find.
Strengths
- Internal plus external assets in one inventory (EASM plus CAASM).
- Sits next to InsightVM and InsightCloudSec in the Command platform.
- A public trial.
Limits
- No active exploit validation is described for Surface Command itself.
- Remediation workflows and SLAs sit in higher tiers, and no price is published.
What does Rapid7 say about itself?
No vendor figures are quoted in these notes.
What do peer reviews say?
Context only. Ratings come from Gartner Peer Insights' External Attack Surface Management market page read on 11 October 2026. They are not used in the finder and we have not verified them.
Not among the product cards we read on the Gartner Peer Insights market page.
What has Rapid7 announced recently?
- 2026-03-19
Announced runtime validation and data security posture management for Exposure Command, aimed at showing which cloud vulnerabilities are exploitable and which sensitive data they expose.
Source: Rapid7 press release: runtime validation and DSPM for Exposure Command · Read 27 Sep 2026
Who should shortlist Rapid7?
Consider Rapid7 if you already run InsightVM or another Rapid7 product, or if you need internal and external assets in one inventory.
In our example finder profiles, Rapid7 is in the first group for: On-premises Rapid7 shop.
Run the finder with your answersHow does Rapid7 compare with each other vendor?
Questions readers ask
Does Rapid7 prove exploitability?
Partly. Runtime validation for cloud vulnerabilities in Exposure Command, announced March 2026. Attack-style testing: Not in our sources.
Does Rapid7 work with WAFs?
Not in our sources. Not described on the pages we read.
Does Rapid7 publish its prices?
Trial available. Price not published. Exposure Command comes in Essentials and Ultimate tiers.