Rapid7 Managed Threat Complete

My primary use case of Rapid7 MDR is to do 24/7 threat monitoring and managed detection and response. We use it to identify suspicious activity across endpoint, network, and cloud environments and investigate the alerts and reduce false positive alerts through analysis.

One of the examples was we used Rapid7 MDR to detect a suspicious malware activity or PowerShell activity on a user's device. Rapid7 MDR can correlate that endpoint element with network authentication and identification, and it finds if it has suspicious activity and then escalates it with details. The alert had already been validated and with context, we were able to isolate the affected endpoint, investigate the user's activity, and confirm the incident. At the same point, Rapid7 MDR filtered several benign administrative activities such as PowerShell execution, which significantly allowed us to focus on genuine threats.

Overall, Rapid7 MDR helps us to strengthen our security operations by providing continuous monitoring, high quality threat detection, and expert analysis support. The contextual investigation and actionable recommendations have improved our SOC response and allowed the SOC team to focus on high priority activities rather than spending time on false positive alerts.

The best features that Rapid7 MDR offers are 24x7 alert monitoring, expert threat hunting, and high quality alert validation, which significantly reduces false positive alerts. I also appreciate the detailed incident investigations, actionable remediations and recommendations, and the ability to correlate the data from network and cloud environments. The service integrates all the security tools, and Rapid7 MDR analysts provide timely communication and valuable expertise that helps us to respond to attacks more efficiently.

I think the best feature is reducing the false positive alerts so we, instead of reviewing many alerts ourselves, Rapid7 MDR analysts validate the incidents with the relevant context before escalating them. This significantly reduces the alerts and false positives, allowing the SOC team to work on only high priority alerts.

Rapid7 MDR provides capabilities such as robust alert monitoring and investigation, and the Rapid7 MDR analysts already prioritize alerts and help the security analysts focus on high priority alerts only. Because of this, it improved our overall security posture and reduced the workload of the SOC analysts. With continuous monitoring, faster threat detection, and expert analyst support, we have been identifying security issues more quickly. Overall, it has ensured critical security events are detected and handled promptly.

I think Rapid7 MDR already has a strong managed security service, but I believe things can be improved. More customization options for detection rules and other workflows would help organizations to align their services more closely with the specific environment.

Additionally, improving the speed of the communication for the low priority alerts and providing more self-service investigation capabilities could further enhance the overall user experience.

I think the room for improvement is deeper customization and reporting flexibility. Rapid7 MDR is a solid solution overall. I think they can implement more customization options for detection, logging, workflows, and also the integration with other security platforms that would be helpful.

Rapid7 MDR transparency is quite good. It provides useful visibility into detections and investigations with detailed alert information and analyst notes. It shows severity classification and recommended actions. In these investigations, it helps our team to understand the alert, why it was generated, and what would be the next steps that we can take. For example, during a suspicious endpoint activity alert, the Rapid7 MDR team provides context around the process execution, related user activity, and supporting indicators, which help us quickly validate the incident and take appropriate actions. Additionally, more transparency into the detection logic and more customization visibility would further improve the experience.

I have been working in this field since the last two point eight years.

Rapid7 MDR is quite stable according to my experience. The service has provided consistent monitoring and dependable support from the Rapid7 MDR team. We have not experienced availability issues.

I think Rapid7 MDR is scalable. I have studied that it supports growth by allowing my organization to expand its monitoring coverage as the number of users, endpoints, and security data sources increases. The managed service model reduces the need to continuously scale the internal SOC resources while maintaining consistent monitoring and response capabilities. Also, the onboarding of assets and integration is relatively good, which helps to manage the increased volume of findings and investigations.

Customer support is quite good, which is why I think it is quite good.

We are utilizing the AI-assisted risk-aware investigation workflows in Rapid7 MDR. They help us improve our alert triage and prioritization by providing context around the alerts, identifying the risk factors, and helping analysts to focus on more critical security events. Instead of treating every alert with the same priority, the workflow considers factors such as asset criticality, behavior, threat intelligence, and attack patterns to determine the potential impact. This has helped in reducing false positive alerts and overall alert fatigue, and in speeding up the investigation of the real threats.

Rapid7 MDR AI capabilities are good for improving threat detection and alert prioritization and also in the investigation. From the governance and security perspective, I think they have strong controls around data handling, access management, and transparency, which helps in improving data security. Also, the combination of AI-driven analysis and Rapid7 MDR analysts provides a good balance where AI can help identify attack patterns quickly, while human experts validate findings and make the response decisions.

Rapid7 MDR is quite good and I appreciate the responses. I use it on a daily basis. I think it is really reliable as compared to the other platforms which I use, and it helps in reducing the investigation time by providing additional context and highlighting the important points.

The inclusion of the forensics and incident response capabilities has improved our investigations by providing deeper analysis and helping us to understand the scope of the threat and the impact of that on the environment. The forensic analysis also helps us identify the root cause, the affected systems, attackers' activities, and required remediation steps.

Rapid7 MDR has a few features that I think are very valuable because it goes beyond simple alert generation and focuses on the actual risk and potential impact of that risk in our organization. By considering factors such as important assets and user behavior, threat indicators, and the context of the attack, we can better assess our security posture.

I have used the multi-vector telemetry capabilities in Rapid7 MDR. It has helped me in improving investigation accuracy by correlating the data across different endpoints, user activity, and network activity. Having visibility across different telemetry sources provides better context for the alerts and helps us differentiate between legitimate and potential threats.

Cybersecurity advisor helps us make decisions by providing expert guidance and helping us focus on the risks and threats that matter the most to our business. They help us understand our security gaps, identify additional improvements, and also align our security strategy with the business requirements. This also ensures that our resources are used effectively and that security supports the organization's overall goals.

Currently, we are not using the integrated Rapid7 MDR for Microsoft environments feature. I think our team will be enabling that in the upcoming time.

My advice is that Rapid7 MDR is a good fit for organizations that want to use it for 24/7 security monitoring and expert investigation support. It also helps in reducing the workload of the internal SOC teams. With the help of this, SOC teams can mostly focus on the high priority alerts instead of wasting time on the false positives. I think this is a really good tool to have. I would give Rapid7 MDR a rating of eight out of ten because of its 24x7 monitoring capability and valuable analyst expertise that improves our security operations.

I use Rapid7 MDR for security monitoring and easy onboarding and deployment. We primarily use Rapid7 MDR for threat detection and incident response, where it helps us to investigate deeply into those incidents.

One of the best features of Rapid7 MDR is 24/7 security monitoring, expert-led threat detection and response, AI-accelerated investigations, multi-vector visibility, informed defense, and incident response support. The full visibility of SIM, SIEM, and threat hunting is one of the features of Rapid7 MDR, and it has a strong customer partnership.

AI processes a large volume of security telemetry and helps us to speed up the triage and investigation, allowing human analysts to validate findings before action is taken. AI-accelerated investigation helps us significantly.

I particularly like the incident response support, as Rapid7 analysts assist with the investigation, containment, and remediation parts. The detailed incident reports and forensic analysis are very helpful and aid organizations in recovering from security events.

Rapid7 MDR has improved many policies in our organization and enhanced our ability to detect threats early before they become major incidents. It has increased our visibility across our environment, including servers, cloud resources, and user activities. Rapid7 MDR integration reduces the risk of security breaches through constant monitoring and proactive threat hunting, and it reduces filtering out false positives by focusing only on actionable threats. It saves valuable time for our internal security team because Rapid7 analysts perform initial investigations and triage, resulting in faster incident response due to timely detection.

The overall impact increases confidence in our security posture, enabling the security team to focus on strategic initiatives instead of spending excessive time reviewing alerts. It improves compliance readiness through detailed reporting and incident investigations and reduces our operational overhead by leveraging a team of security experts without needing to expand internal staffing.

Rapid7 MDR has helped our team to save approximately 10 to 15 hours per week by reducing the time spent on alert triage and initial investigation. It allows our security team to focus on remediation efforts and strategic security initiatives, whereas before implementing Rapid7 MDR, our security analysts used to spend significant time reviewing security alerts and triaging potential threats, which we estimate was nearly 30 to 40% of their time.

The biggest benefit has been operational efficiency. Instead of dedicating resources for around-the-clock monitoring, Rapid7 MDR acts as an extension of our security team, saving man-hours each month while improving detection and response capabilities. It has significantly reduced the time required for threat monitoring, alert validation, and incident investigation. The platform and analyst support help focus only on verified and actionable security incidents, which has improved efficiency and saved a considerable amount of our security operations team's time.

There are still a couple of areas where Rapid7 MDR can be improved. The visibility of the dashboard should be improved, and faster threat detection can also be enhanced. The dashboard visibility can be improved further, and the threat detection time also needs to be reduced to some extent.

I have been using Rapid7 MDR for three years in my current organization.

This is a good return on investment, as Rapid7 MDR has saved a lot of money for this project.

I feel the pricing cost of Rapid7 MDR is reasonable.

Rapid7 MDR provides valuable visibility into security events, vulnerabilities, and risks, which relates to governance and security. The reporting and logging capabilities support all our readiness, help demonstrate security controls, and efficiently manage processes in our organization. The combination of AI-driven insights and expert analyst validation provides a well-balanced approach where automation improves speed while human expertise ensures accuracy. I particularly appreciate the Rapid7 analyst detections and investigations, which reduce alert fatigue, improve threat visibility, and speed up our security operations. Rapid7 MDR is a primary detection response service that makes it safer to say that our organization is well-protected.

For compliance support, Rapid7 MDR provides good visibility into vulnerabilities, threats, and security. When suspicious login activity is detected by Rapid7 MDR, the MDR team provides detailed information, including the affected user account, source IP address, and timeline of events, which helps us validate the event. The transparency is very good for Rapid7 MDR.

Rapid7 MDR follows a structured risk detection process that combines automated analysis and threat intelligence. It collects data, logs, and telemetry from endpoints, servers, and cloud environments, then enriches the data against multiple data sources and analyst validation.

The multi-vector feature is one of the best features, as it analyzes and correlates data across multiple attack vectors such as endpoints, identity, cloud environments, network, email systems, and other security tools. For example, an attacker may compromise a user account through phishing email, log in from an unusual location, and then try to access sensitive cloud resources. Individually, these events might appear harmless, but Rapid7 MDR correlates and analyzes data from email, identity, and cloud environments to recognize this attack chain and generate a high-fidelity alert. The benefits of multi-vector detection include better visibility across the attack, detection of complex attack chains, reduction of blind spots, improved threat detection accuracy, faster incident investigation, and providing better context for analysts.

The ecosystem is supported through endpoint telemetry, processing, and file activity, which has a significant positive impact on our security program. Rapid7 MDR is integrated with Microsoft and our other security tools. We are using AI-assisted risk workflows, including data ingestion, AI-based analysis, risk scoring and prioritization, analyst validation, investigation, and containment. The ecosystem supports endpoint telemetry, processing, file activity, and user behavior.

My overall review rating for Rapid7 MDR is 7 out of 10.

Our main use case for Rapid7 MDR is that they serve as our SOC.

Rapid7 MDR is an IDR that does what it is supposed to do. The vulnerability management helps us keep our products and systems up to date.

I am satisfied with the risk-aware detection feature in Rapid7 MDR and have no issues with it.

We use the AI-assisted feature in Rapid7 sometimes, mainly to understand the logs from systems that we are not familiar with.

The main benefits that Rapid7 MDR provides for me as an end-user are the security and that they are available 24 hours a day, always. This gives me reassurance because I do not have to be an expert on the cybersecurity part because they are. We are a quite small firm, so we do not have that in-house expertise, which is why we rely on them.

Regarding points for improvement in Rapid7 MDR, I do not have to do anything with them unless I have a problem. The less I hear from them, the better, because they contact us when there is a problem. We have our monthly meeting, and that is fine by me. That is pretty much it; I get what I want, and I do not want anything else.

The price of Rapid7 MDR could definitely be lower, as these are expensive systems, especially if you have the MDR. They could work on the price.

I have been working with Rapid7 MDR for about two years.

I would rate Rapid7 MDR as a 10 for stability; it has always been there and has never been down.

The ability to scale Rapid7 MDR is really super easy, so I would rate it a 10 as well.

I would rate Rapid7 technical support as definitely a 10, because whenever we have had any problems, it is really fast and sensitive to our knowledge. I get the help I really need, and it is fast, so it is really good.

I have only worked with Rapid7 when it comes to MDR; I have no experience with other products.

Based on my experience, it is really easy to start working with Rapid7 MDR; you are up and running in a day or two.

The initial setup process for Rapid7 MDR is really easy; it was really easy for us.

We did the setup processes in-house for Rapid7 MDR ourselves.

The main competitor for Rapid7 MDR would be CrowdStrike, in my opinion.

I have not looked into CrowdStrike; I do not know the specifics of what they call it, but they have the big offerings as well.

I would definitely recommend Rapid7 MDR to other users. I would rate this review a 10.

Rapid7 MDR is our managed service that serves as our SOC and represents our starting point in utilizing a solution for cybersecurity. Rapid7 MDR is the primary use case for our company's SOC.

The consulting and monthly consulting and reporting are very useful features that we find most valuable.

Having a dedicated cybersecurity advisor through Rapid7 MDR helps us align our cybersecurity strategy to the up-to-date measurements and controls that we can take, which impacts how we align our security program with business needs.

With a very small IT operations team, we have experienced a positive impact from Rapid7 MDR. In the past, we had much effort to handle incidents, and now with the SOC on our side, the process is more streamlined, and we are much faster than before.

My impression of the Risk-Aware Detection features is positive; they work well for us.

We are starting to get into the AI solutions from Rapid7 MDR for our SIEM, but we are in the very beginning stages, focusing on AI-assisted Risk-Aware Investigation workflows.

We are using the integrated MDR for Microsoft environments feature. Up to now, it works well regarding its detection and response capabilities for Microsoft-centric environments.

Now we have a clear view of what has happened in our tenant, which has impacted our incident recovery process positively; before, we did not have this view. We have many signals, so we can control them and check if we are on the right path or if it is just a false incident, and it works very well. In the last several months, we have seen more than we have seen in the previous two years.

AI is present, and I think Rapid7 MDR could add good reporting, more reporting, and perhaps more templates in the future to make the product even better.

Since the beginning of the year, we have been using this tool.

Rapid7 MDR works really well; we are completely satisfied with it. It is a nice service and I believe we have everything we need. From my perspective, I have no improvements to suggest. There is much more we have to discover.

I do not think there are scalability issues regarding extending usage in the future.

When ten is the best, I would rate their technical support at a ten.

We have Rapid7 IVM and SIEM, and we are still using them. We have now added Rapid7 MDR as a service, which reflects our previous positive experience with Rapid7 solutions.

I cannot speak to how the initial setup was because we had Rapid7 IVM and SIEM before, and that setup occurred before my time. The setup for Rapid7 MDR was very simple because we already had half of the infrastructure in place.

We evaluated many other solutions for various situations, but ultimately we chose Rapid7 MDR because of the price and the service, which were perfect for us.

I find the pricing reasonable and competitive.

Rapid7 MDR is hybrid regarding whether it is on-premises, cloud-based, or hybrid.

I purchased Rapid7 MDR through our IT supplier.

Five people, at most, are working with the product in our company, indicating the usage is currently pretty limited.

The interface is very handy and user-friendly.

I would say Rapid7 MDR is popular; Rapid7 is a well-known name in my region.

I would rate this product a ten out of ten.

Our primary use cases focus on threat detection and network-related security concerns, with an emphasis on cybersecurity-related areas.

My team is satisfied with the current capabilities, though there are certainly areas for improvement. Rapid7 MDR has not covered all the areas we need, which is why we also utilize Zscaler. For personalized security for developers, testers, and other audiences who are exposing their network to risk, we definitely need very micro-level monitoring of requests and network activity.

All stakeholders claim that Rapid7 MDR is very effective at identifying threats in today's AI era. It is quite difficult for all of us to identify what type of code or requests are coming through. This improvement is very important to the product itself and its realignment. We raised a request, and Rapid7 MDR has made changes to their product by conducting extensive research and development with thorough testing.

There are multiple areas for improvement, especially regarding generative AI-related threats. Secondly, proxy communication happens through agentic AI, making it very difficult to identify whether it is agentic AI, a human, or a hacker. That filtering and identification will need to be improved in Rapid7 MDR. Many products still do not make that effort, but Rapid7 MDR has started to address this; however, this remains a drawback at the moment. We moved our own artificial intelligence product, and our developers and testers are using it, but we still restrict its use to inside our Fujitsu premises. We cannot allow it to go outside because we do not have that level of trust at the moment.

It is quite difficult to specify all areas at the moment, but there are multiple features needed. Based on our transformation with a combination of cloud technology and artificial intelligence, we are using co-pilot and multiple AI models will require many enhancements aligned with new technology trends in the market. I cannot articulate or name all of them, but we are still not confident in asking customers to use AI in their environment. They are reluctant at the moment because of security concerns and other myths around AI. There should definitely be a tool that gives us the confidence that whatever AI model we are using is secured through that tool. That tool should assure customers that there is a 90% or 98% guarantee that their code or utilization of AI technology will meet the mark. Currently, customers are not flexible in beginning to utilize AI, especially for financial institutions, research and development institutes, or places where sensitive business operations occur or large customer volumes exist. No one can risk it at the moment. People are using co-pilot, chatbots, or bot services, but they are still not confident in utilizing them without taking risks. No one can claim that they are 100% secure in providing those services. We are expecting that type of confidence from Rapid7 MDR and other technologies playing a role in the market.

We have been using this solution for more than four years.

Getting responses from any service industry is challenging. We have an SLA, especially those SLAs from which we really need support based on our customer expectations, particularly for our developers. Every machine has Rapid7 MDR installed. We have our own IT department that is enabled with all training. The thing is that we do not directly rely on Rapid7 MDR for support, but we have built up our own competency with Rapid7 MDR. Only for very urgent issues do we get support from Rapid7 MDR, but that also depends upon the contract. We do not have extensive experience where we frequently interact with Rapid7 MDR, but wherever there is a setting, configuration management, or something similar, we are getting support from their technical or non-technical staff. It is about how you build your relationship with them. We are training our employees and providing them with training, and once they are trained, we believe this is a common shared responsibility.

The setup cost is reasonable and not so expensive. It is simple and straightforward.

We are primarily on Microsoft with a platinum contract, so all products we evaluate are in line with Microsoft's technology stack. Rapid7 MDR and Zscaler are both well-equipped and support Microsoft technology. Since Microsoft has its own products like Defender and others, we still use them for our daily work. I would rate my overall experience with customer service as a 3 out of 10.