Rapid7

Corporate brand

Rapid7 is a cybersecurity company providing vulnerability management, security analytics, detection and response, application security, and penetration-testing technologies.

Last updated October 14, 2026

AI crawler reads

No AI crawler has read this profile since Oct 28, 2026.

Overview

Rapid7 is a United States cybersecurity company headquartered in Boston, Massachusetts. Founded in 2000, the company develops software and services intended to help organizations discover exposure, prioritize cyber risk, detect malicious activity, investigate incidents, and respond to attacks. Its product portfolio spans vulnerability management, security information and event management, managed detection and response, application security, cloud security, and penetration testing. Rapid7 is particularly associated with the Metasploit Framework, an open-source penetration-testing and security research platform used by defenders, consultants, researchers, and students to validate vulnerabilities and test exploit exposure in controlled environments. The company acquired the commercial Metasploit business in 2009 and subsequently incorporated Metasploit-related capabilities into its broader security product strategy. Metasploit remains separately recognizable as a security testing platform rather than simply a conventional enterprise software module. The company’s cloud-based Insight platform organizes several of its commercial offerings. InsightVM focuses on vulnerability risk management and remediation prioritization; InsightIDR provides security analytics, threat detection, investigation, and response capabilities; InsightAppSec is designed to identify and manage application security weaknesses; and related offerings address cloud risk, exposure management, automation, and managed security operations. Rapid7 also offers expert-led services, including managed detection and response, incident response, penetration testing, and advisory work. Rapid7’s market positioning is based on consolidating security visibility and operational response across endpoints, networks, applications, users, and cloud environments. Rather than treating vulnerability scanning, security monitoring, and incident response as entirely separate activities, the company promotes an integrated approach in which exposure data can inform detection and remediation priorities. Its customers include enterprises, public-sector organizations, and other institutions that need to manage security risk across complex technology estates. Rapid7 became a publicly traded company in 2015 under the ticker RPD. Its corporate development has included product expansion and acquisitions intended to broaden capabilities in vulnerability management, security analytics, application security, cloud security, and managed services. The brand is active and operates internationally. Because the supplied reference material is limited, detailed information about the company’s full acquisition history, historical leadership, regional revenue mix, and current product status should be checked against corporate filings and official product documentation before publication.

History

Rapid7 was established in 2000 in the United States as the security industry was developing a more formal market for vulnerability assessment, penetration testing, and security risk management. The company’s early identity was closely associated with helping organizations understand exploitable weaknesses in their systems rather than relying solely on perimeter defenses or compliance checklists. A major stage in Rapid7’s development came through its connection with the Metasploit project. Metasploit had become a widely used framework for security testing and exploit research, and Rapid7 acquired the commercial Metasploit business in 2009. Under Rapid7, Metasploit continued to serve as a platform for controlled penetration testing, vulnerability validation, security education, and research. Its open-source framework and commercial editions gave Rapid7 visibility among security professionals while complementing the company’s enterprise software portfolio. Rapid7 subsequently expanded beyond penetration testing into broader vulnerability management and security operations. The company developed and marketed products for discovering assets, assessing vulnerabilities, prioritizing remediation, monitoring security events, and supporting incident investigations. This expansion reflected a wider change in enterprise security: organizations increasingly needed continuous visibility across on-premises infrastructure, endpoints, applications, identities, and cloud services rather than periodic assessments of isolated systems. The Insight product family became the main organizing structure for many of Rapid7’s cloud-delivered offerings. InsightVM addressed vulnerability risk management and remediation workflows. InsightIDR extended the portfolio into security analytics, threat detection, and investigation. InsightAppSec focused on application security testing and vulnerability management. Rapid7 also added or expanded cloud-risk, automation, managed detection and response, incident response, penetration-testing, and advisory capabilities. Rapid7 entered the public markets in 2015, listing on Nasdaq under the ticker RPD. As a public company, it continued to invest in subscription software, cloud delivery, services, and acquisitions designed to broaden its security operations and exposure-management capabilities. Its business model has increasingly emphasized recurring software revenue supported by professional and managed services. Today, Rapid7 presents itself as an international cybersecurity provider combining technology with human expertise. Its offerings are aimed at security teams that need to reduce the time between finding a weakness, understanding its practical risk, detecting exploitation, and taking corrective action. Metasploit remains the company’s best-known security-testing brand, while the Insight portfolio represents its broader enterprise platform strategy. Detailed historical claims about individual acquisitions, leadership changes, and product retirements require verification against Rapid7’s filings and archived company announcements.

2015
Initial public offering
[3]Rapid7 investor relationsrapid7.com
Rapid7 completes its initial public offering and begins trading on Nasdaq under the ticker RPD.
2009
Rapid7 acquires the commercial Metasploit business
[5]Rapid7 press releasesrapid7.com
Rapid7 acquires the commercial business associated with Metasploit, strengthening its position in penetration testing and vulnerability validation.
2000
Rapid7 is founded
[2]Rapid7 company informationrapid7.com
Rapid7 is established in the United States as a cybersecurity company focused on vulnerability and security risk management.

Products and positioning

A cloud-centered cybersecurity provider that combines exposure management, vulnerability prioritization, security analytics, detection and response, application security, penetration testing, and expert-led services.

Penetration testing and security research
Metasploit Framework
Metasploit Framework is an open-source platform used to develop, test, and validate security exploits in authorized environments. Security teams and researchers use it to reproduce vulnerabilities, evaluate defensive controls, support penetration testing, and improve remediation priorities. Its long-standing community presence makes it one of Rapid7’s most recognizable technology assets.
Penetration testing
Metasploit Pro
Metasploit Pro is the commercial edition of Rapid7’s Metasploit technology. It provides workflow, collaboration, reporting, and automation features intended for professional penetration testers and enterprise security teams conducting authorized assessments.
Vulnerability risk management
InsightVM
InsightVM is Rapid7’s vulnerability risk-management product. It is designed to discover assets, identify vulnerabilities, evaluate business and technical context, prioritize remediation, and track corrective work across an organization’s environment.
Security analytics and detection and response
InsightIDR
InsightIDR provides security analytics, threat detection, investigation, and response capabilities. It is intended to help security operations teams collect relevant telemetry, identify suspicious behavior, investigate incidents, and coordinate response activities.
Application security
InsightAppSec
InsightAppSec is Rapid7’s application security testing offering. It helps organizations identify vulnerabilities in web applications and incorporate testing and remediation into development and security workflows.
Managed cybersecurity services
Managed Detection and Response
Rapid7’s managed detection and response services combine security monitoring, threat detection, investigation, and expert assistance. The service is intended for organizations that need continuous operational support but do not want to perform every security operations function internally.

Controversies

2026
Rapid7 discloses Operation Asterix crypto phishing campaign
Cybersecurity firm Rapid7 disclosed a cryptocurrency phishing campaign known as Operation Asterix. The campaign targeted roughly 885,000 phone numbers across several countries, including 316,002 German mobile numbers and directories covering Hong Kong, Bulgaria, the UK, the US and Canadian fintech companies. According to Rapid7, the campaign matched 5,576 accounts to Binance users and 43,066 accounts to crypto exchange users. It used fake emails impersonating Crypto.com and fake apps impersonating Ledger, Trezor and Exodus to steal seed phrases.
Source

2015
Initial public offeringOther
Background
Rapid7 pursued public-market funding and visibility as demand for enterprise cybersecurity software increased.
Action taken
The company completed an initial public offering and listed its shares on Nasdaq under the symbol RPD.
Aftermath
Rapid7 continued operating as a public cybersecurity company and used the public-company structure to support product development, international operations, and corporate expansion.
Source
2009
Acquisition of the commercial Metasploit businessM&A
Background
Metasploit had become a prominent toolset for penetration testing, exploit research, and vulnerability validation. Rapid7 sought to connect that technology with its expanding commercial cybersecurity portfolio.
Action taken
Rapid7 acquired the commercial Metasploit business while the open-source framework continued to be developed and used by the security community.
Aftermath
Metasploit became a central part of Rapid7’s brand identity and helped support the company’s expansion from vulnerability assessment into broader security operations and risk management.
Source

Recent events

2015
Rapid7 becomes a publicly traded company[3]Rapid7 investor relationsrapid7.com
Other
Rapid7 completed its initial public offering and began trading on Nasdaq under the symbol RPD.
Rapid7 promotes an integrated cybersecurity platform[1]Rapid7 official websiterapid7.com
Other
Rapid7’s current corporate messaging presents its Insight platform and managed services as a unified way to identify exposure, detect threats, and respond to incidents across endpoint, cloud, application, and network environments.

Sources18 sources

Cite this profile: Cite the canonical profile. /brand-wiki/rapid7 · Editorial policy · How profiles are compiled