SIDE BY SIDE · FACTS ONLY

JupiterOne vs Rapid7: asset inventory facts side by side

SHORT ANSWER

JupiterOne describes 2 of the five approaches on the pages we read and Rapid7 describes 3; they differ on External attack surface management. On collection, JupiterOne works without new agents and Rapid7 does not describe its collection method on the pages we read. Many estates run two of these approaches together, so the question is often which pair, not which one; we do not score either.

By The Inventory Desk · CAASM Finder · Published 2026-10-11

Desk research from public vendor pages read on 27 September and 11 October 2026. Profiles follow our published method; we did not run the products.

How do their approaches compare?

Top bar: JupiterOne
Lower bar, lighter: Rapid7 Surface Command

Full bar: described on the vendor's pages we read
Hatched bar: described with a condition (another product, a higher tier, or part of the approach)
Stub: not in our sources (it may exist; we did not find it)

The bars show what each vendor's own pages describe, or how your answers weigh the five approaches. They are not a measure of how well a product works.

What are the facts, side by side?

From each vendor's own pages. Differs marks rows where the recorded status or check value differs.
Fact	JupiterOne	Rapid7 Surface Command
Positioning	A cyber asset platform built on a security graph: more than 200 integrations feed assets and their relationships into a graph you can query in plain English or with a pre-built query library.	Rapid7's attack surface product, combining external discovery (EASM) with asset discovery and a unified internal and external inventory (CAASM), part of the Rapid7 Command platform.
Deployment	SaaS with API integrations; useful coverage depends on how many integrations a team configures. Source: JupiterOne platform · Read 27 Sep 2026	Part of the Rapid7 Command platform with Exposure Command, InsightVM and InsightCloudSec. Source: Rapid7 products · Read 27 Sep 2026
CAASM aggregation	Described 200+ pre-built integrations feed a security graph of devices, users, networks, applications, data, code repositories, security controls and owners. Source: JupiterOne platform · Read 27 Sep 2026	Described Asset discovery and a unified inventory (CAASM) including devices, software, identities and controls. Source: Rapid7 Command platform packages and pricing · Read 11 Oct 2026
Agent-based inventory	Not in our sources Not described on the pages we read.	Not in our sources Not described on the pages we read.
External attack surface managementDiffers	Not in our sources Not described on the pages we read.	Described Internal and external attack surface visibility (EASM), including unknown internet-facing assets and shadow IT. Source: Rapid7 Surface Command · Read 27 Sep 2026
CMDB-centred inventory	Not in our sources Not described on the pages we read.	Not in our sources Not described on the pages we read.
Exposure management	With a condition Blast radius views on the graph; Unified Vulnerability Management, announced in May 2026, deduplicates findings across tools. Source: GlobeNewswire: JupiterOne AI system mapping and Unified Vulnerability Management · Read 27 Sep 2026	With a condition Includes an Exposure Management dashboard and remediation hub; vulnerability scanning sits in the Exposure Command Essentials tier above it. Source: Rapid7 Command platform packages and pricing · Read 11 Oct 2026
Servers and network devices	Partly Networks are a listed asset class; network devices are not called out. Source: JupiterOne platform · Read 27 Sep 2026	Partly Internal attack surface visibility is described; network devices are not called out. Source: Rapid7 Surface Command · Read 27 Sep 2026
Cloud workloads	Partly Covered through integrations; cloud workloads are not named as a class on the platform page. Source: JupiterOne platform · Read 27 Sep 2026	Partly InsightCloudSec sits in the same platform. Source: Rapid7 products · Read 27 Sep 2026
SaaS applicationsDiffers	Partly Applications are a listed asset class. Source: JupiterOne platform · Read 27 Sep 2026	Not in our sources
Identities as assets	Matches Users are a listed asset class. Source: JupiterOne platform · Read 27 Sep 2026	Matches Identities are part of the unified inventory. Source: Rapid7 Command platform packages and pricing · Read 11 Oct 2026
Off-network laptopsDiffers	Partly Devices are a listed asset class, through the endpoint tools you integrate. Source: JupiterOne platform · Read 27 Sep 2026	Not in our sources
OT and IoT devices	Not in our sources	Not in our sources
Internet-facing discoveryDiffers	Not in our sources	Matches External attack surface visibility (EASM). Source: Rapid7 Surface Command · Read 27 Sep 2026
Offers its own agent	Not in our sources	Not in our sources
Works without new agentsDiffers	Matches Builds its graph from API integrations. Source: JupiterOne platform · Read 27 Sep 2026	Not in our sources
Merges records from several sourcesDiffers	Partly The graph maps relationships between assets; how duplicate records merge depends on the data each integration supplies. Source: JupiterOne platform · Read 27 Sep 2026	Matches A unified asset inventory (CAASM). Source: Rapid7 Surface Command · Read 27 Sep 2026
Feeds or updates a CMDB	Not in our sources	Not in our sources
Cross-source queries and reportsDiffers	Matches Graph queries in plain English, a pre-built query library and compliance insights. Source: JupiterOne platform · Read 27 Sep 2026	Partly Asset graph and blast radius views. Source: Rapid7 Command platform packages and pricing · Read 11 Oct 2026
Workflows, tickets or actionsDiffers	Partly Alerts are documented; write-back actions into other systems are not. Source: JupiterOne platform · Read 27 Sep 2026	Matches Remediation hub and built-in, SOAR-ready automation and integrations in the Surface Command package. Source: Rapid7 Command platform packages and pricing · Read 11 Oct 2026
Price or pricing basis publishedDiffers	Matches Annual list prices of $25,000, $50,000 and $100,000 by tier. Source: JupiterOne pricing · Read 27 Sep 2026	Partly Pricing basis published: asset types and use cases in scope; no amounts. Source: Rapid7 Command platform packages and pricing · Read 11 Oct 2026
Free tier or trialDiffers	Not in our sources	Matches Public trial. Source: Rapid7 Surface Command · Read 27 Sep 2026
Platform it is part of	None	Rapid7: Shares the Command platform with Exposure Command, InsightVM and InsightCloudSec. Source: Rapid7 products · Read 27 Sep 2026
Integrations	200+ pre-built security integrations. Source: JupiterOne platform · Read 27 Sep 2026	SOAR-ready integrations, with Exposure Command, InsightVM and InsightCloudSec in the same platform. Source: Rapid7 Surface Command · Read 27 Sep 2026
Price	Published: Small-Market $25,000 a year; Mid-Market $50,000 for 12 months up to 200,000 data points; Enterprise $100,000 for 12 months up to 400,000 data points; custom above 1 million data points. Priced on data points and term. No free tier or trial mentioned. Source: JupiterOne pricing · Read 27 Sep 2026	No amounts published. Priced on the asset types and use cases in scope; Start Trial offered. Exposure Command Essentials adds vulnerability scanning and Ultimate adds cloud, IaC and DAST. Source: Rapid7 Command platform packages and pricing · Read 11 Oct 2026

Where do they differ?

External attack surface management: JupiterOne is not in our sources; Rapid7 describes it.
SaaS applications: JupiterOne partly matches; Rapid7 is not in our sources.
Off-network laptops: JupiterOne partly matches; Rapid7 is not in our sources.
Internet-facing discovery: JupiterOne is not in our sources; Rapid7 matches.
Works without new agents: JupiterOne matches; Rapid7 is not in our sources.
Merges records from several sources: JupiterOne partly matches; Rapid7 matches.
Cross-source queries and reports: JupiterOne matches; Rapid7 partly matches.
Workflows, tickets or actions: JupiterOne partly matches; Rapid7 matches.
Price or pricing basis published: JupiterOne matches; Rapid7 partly matches.
Free tier or trial: JupiterOne is not in our sources; Rapid7 matches.

Can they work together?

Neither vendor's pages we read name the other as an integration. That does not mean they cannot work together; ask both vendors.

Choose JupiterOne if

You want to ask relationship questions across assets, users and code
You need a published price before a sales call

Choose Rapid7 if

You already run InsightVM or another Rapid7 product
You want internal and external assets in one inventory

Which limits should you check?

JupiterOne

OT and IoT devices are not listed among its asset classes.
Write-back actions into other systems are not documented, and no free tier or trial is mentioned.

Rapid7

No price amounts published; pricing depends on the asset types and use cases in scope.
Vulnerability scanning sits in the Exposure Command tiers, and SaaS apps and OT are not described on the pages we read.

Put JupiterOne and Rapid7 in the asset census with others Run the finder

Questions people ask

Is JupiterOne or Rapid7 better?

Neither is scored on this site. JupiterOne describes 2 of five approaches and Rapid7 3 on the pages we read, and they differ on 10 recorded facts. Which fits depends on where your assets live, whether you can install agents, your CMDB and your tools; the finder checks those.

Do JupiterOne and Rapid7 work with a CMDB?

JupiterOne: Not in our sources. Rapid7: Not in our sources.

Do JupiterOne or Rapid7 publish prices?

JupiterOne: Published: Small-Market $25,000 a year; Mid-Market $50,000 for 12 months up to 200,000 data points; Enterprise $100,000 for 12 months up to 400,000 data points; custom above 1 million data points. Priced on data points and term. No free tier or trial mentioned. Rapid7: No amounts published. Priced on the asset types and use cases in scope; Start Trial offered. Exposure Command Essentials adds vulnerability scanning and Ultimate adds cloud, IaC and DAST.