PLATFORM NOTES · RAPID7

Rapid7 Surface Command: CAASM and asset inventory facts (2026)

SHORT ANSWER

Rapid7 Surface Command combines external discovery with an internal and external inventory of devices, software, identities and controls (EASM plus CAASM), with an asset graph, blast radius views and a remediation hub, as the entry package of the Rapid7 Command platform. It offers a trial and prices on the asset types and use cases in scope, without published amounts. Vulnerability scanning sits in the Exposure Command tiers, and SaaS apps and OT are not described on the pages we read.

By The Inventory Desk · CAASM Finder · Published 2026-10-11

Desk research from public vendor pages read on 27 September and 11 October 2026. Profiles follow our published method; we did not run the products.

Visit Rapid7's site

Which approaches does Rapid7 describe?

Full bar: described on the vendor's pages we read
Hatched bar: described with a condition (another product, a higher tier, or part of the approach)
Stub: not in our sources (it may exist; we did not find it)

The bars show what each vendor's own pages describe, or how your answers weigh the five approaches. They are not a measure of how well a product works.

From Rapid7's own pages.
Approach	Status	What the pages say	Source
CAASM aggregation	Described	Asset discovery and a unified inventory (CAASM) including devices, software, identities and controls.	Source: Rapid7 Command platform packages and pricing · Read 11 Oct 2026
Agent-based inventory	Not in our sources	Not described on the pages we read.	None
External attack surface management	Described	Internal and external attack surface visibility (EASM), including unknown internet-facing assets and shadow IT.	Source: Rapid7 Surface Command · Read 27 Sep 2026
CMDB-centred inventory	Not in our sources	Not described on the pages we read.	None
Exposure management	With a condition	Includes an Exposure Management dashboard and remediation hub; vulnerability scanning sits in the Exposure Command Essentials tier above it.	Source: Rapid7 Command platform packages and pricing · Read 11 Oct 2026

Which parts of an estate does Rapid7 cover?

Estate coverage described on Rapid7's pages.
Servers and network devices	Partly Internal attack surface visibility is described; network devices are not called out. Source: Rapid7 Surface Command · Read 27 Sep 2026
Cloud workloads	Partly InsightCloudSec sits in the same platform. Source: Rapid7 products · Read 27 Sep 2026
SaaS applications	Not in our sources
Identities as assets	Matches Identities are part of the unified inventory. Source: Rapid7 Command platform packages and pricing · Read 11 Oct 2026
Off-network laptops	Not in our sources
OT and IoT devices	Not in our sources
Internet-facing discovery	Matches External attack surface visibility (EASM). Source: Rapid7 Surface Command · Read 27 Sep 2026

How does Rapid7 collect and reconcile data?

Collection and reconciliation described on Rapid7's pages.
Deployment	Part of the Rapid7 Command platform with Exposure Command, InsightVM and InsightCloudSec. Source: Rapid7 products · Read 27 Sep 2026
Offers its own agent	Not in our sources
Works without new agents	Not in our sources
Merges records from several sources	Matches A unified asset inventory (CAASM). Source: Rapid7 Surface Command · Read 27 Sep 2026
Integrations	SOAR-ready integrations, with Exposure Command, InsightVM and InsightCloudSec in the same platform. Source: Rapid7 Surface Command · Read 27 Sep 2026

What does Rapid7 do with the inventory?

What Rapid7's pages describe doing with asset data.
Feeds or updates a CMDB	Not in our sources
Cross-source queries and reports	Partly Asset graph and blast radius views. Source: Rapid7 Command platform packages and pricing · Read 11 Oct 2026
Workflows, tickets or actions	Matches Remediation hub and built-in, SOAR-ready automation and integrations in the Surface Command package. Source: Rapid7 Command platform packages and pricing · Read 11 Oct 2026
Platform it is part of	Rapid7: Shares the Command platform with Exposure Command, InsightVM and InsightCloudSec. Source: Rapid7 products · Read 27 Sep 2026
Platforms it connects to	None in our sources

What does Rapid7 cost?

No amounts published. Priced on the asset types and use cases in scope; Start Trial offered. Exposure Command Essentials adds vulnerability scanning and Ultimate adds cloud, IaC and DAST.

Source: Rapid7 Command platform packages and pricing · Read 11 Oct 2026

Free tier or trial Matches Public trial.

Source: Rapid7 Surface Command · Read 27 Sep 2026

Where is Rapid7 strong, and where are its limits?

Strengths and limits come from the vendor's own pages and our sources; a limit can be something we did not find.

Strengths

Internal and external assets in one product (EASM plus CAASM).
Sits next to InsightVM, InsightCloudSec and Exposure Command in the Command platform.
A public trial.

Limits

No price amounts published; pricing depends on the asset types and use cases in scope.
Vulnerability scanning sits in the Exposure Command tiers, and SaaS apps and OT are not described on the pages we read.

What does Rapid7 say about itself?

No vendor figures are quoted in these notes.

What has Rapid7 announced recently?

2026-03-19
Announced runtime validation and data security posture management for Exposure Command, aimed at showing which cloud vulnerabilities are exploitable and which sensitive data they expose.
Source: Rapid7 press release: runtime validation and DSPM for Exposure Command · Read 27 Sep 2026

Who should shortlist Rapid7?

Consider Rapid7 if you already run InsightVM or another Rapid7 product, or if you want internal and external assets in one inventory.

In our example finder profiles, Rapid7 is in the first group for: rapid7 shop with internet-facing systems.

Run the finder with your answers

How does Rapid7 compare with each other vendor?

Questions people ask

Does Rapid7 need an agent?

Own agent: Not in our sources. Works without new agents: Not in our sources. Not in our sources.

Does Rapid7 work with a CMDB?

Not in our sources. Not described on the pages we read.

Does Rapid7 publish its prices?