PAGES
← all tools
◆ SAST / SCA / Code Security

InsightAppSec

v1 commercial

InsightAppSec is a dynamic application security testingdynamic application security testingDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. platform that identifies vulnerabilities in web and mobile applications during development and testing phases.

rss ↗ What is a cyber toolchain?

Summary

InsightAppSec is a commercial dynamic application security testing (DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces.) tool from Rapid7's security suite, run as a hosted service accessed through a browser at insight.rapid7.com rather than installed locally, with on-premise Engines available for scanning internal apps. It is built for application security teams managing a portfolio of web apps rather than individual developers, organizing everything around an App object that owns its own Scan Configs, Schedules, Scans and Vulnerabilities. Rather than exposing every scan parameter, it ships with Rapid7-defined defaults and a Scan Configuration Wizard, letting teams choose between fast and thorough scans without hand-tuning each run. It sits in the appsec testing space alongside other DAST products, with a REST APIREST APIA web API design style where clients interact with resources over HTTP using standard methods like GET, POST, and DELETE, giving cyber tools a predictable, language-agnostic way to integrate with external services. covering apps, engines, attack templates and vulnerabilities for teams that want to script or integrate scanning. Launched in 2016, it has been part of Rapid7's commercial lineup for years.

InsightAppSec is a dynamic application security testing platform that identifies vulnerabilities in web and mobile applications during development and testing phases.

How InsightAppSec helps

Which of my web apps currently carry vulnerabilities a breach could use?

the Apps screen rolls up every Scan run against an App and surfaces its open Vulnerabilities, so a portfolio of external and internal apps can be checked from one screen instead of app by app

Which parts of my app did a scan actually attack, and how?

each Scan runs against the Attack Template attached to its Scan Config, and the template records which modules and attacks were executed, so a finding can be traced back to the specific attack that produced it

Can my on-premise apps be scanned without exposing them to a hosted service?

an Engine installed on an internal host runs the scan locally and reports state back, and Engines can be organized into Engine Groups so scans are assigned to the group responsible for a given part of the network

What did we already know about a vulnerability before this latest scan found it again?

Vulnerability Comments and Vulnerability History attached to the resource keep prior findings and notes across scans, so a recurring issue is not evaluated as if it were new

Which scans were skipped because they landed during a blackout window?

Blackouts are checked against Schedules before a Scan runs, so a scan blocked by a blackout period shows up against that window rather than as a silent no-run

all 8 features, with the evidence for each →

Features

8 capabilities across 5 areas · 8 backed by code, an API document or a real run

Built from InsightAppSec's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

What InsightAppSec offers you

Scanning 3 capabilities InsightAppSec is built around the ability to configure, schedule, and run application scans. These capabilities cover everything needed to define what gets scanned, when, and how.
Scan configuration verified Defines and stores all the parameters that control how a scan of an application is carried out. 1 release · 10 other sources · first seen Aug 2026

release

  • Scan Configs (9 endpoints) — A Scan Config defines all the necessary information required to perform a Scan of an App. v1 · Aug 2026 · source · release history

docs

  • Open the scan configuration screen by navigating to Assets & Identities > Applications and selecting the app you want to configure. Go to the tab and select the scan configuration that you want to edit. Click > and use the toggle to Navigate to Assets & Identities > Applications and select your app. seen Sep 2026 · source

api 9 total

  • PUT /scan-configs/{scan-config-id} · source
  • GET /scan-configs/{scan-config-id}/options · source
  • PUT /scan-configs/{scan-config-id}/options · source
  • DELETE /scan-configs/{scan-config-id} · source
  • GET /scan-configs/{scan-config-id} · source
  • POST /scan-configs · source
Scan execution verified Launches and manages individual scan runs, allowing the user to start, stop, and inspect scan progress and results. 1 release · 10 other sources · first seen Aug 2026

release

  • Scans (9 endpoints) — A Scan encapsulates all the information for a single execution of the criteria defined in the provided Scan Config. v1 · Aug 2026 · source · release history

docs

  • This field is used with UseEncryptedData. If it is set to 1, this will contain an encrypted value to be passed during the authentication sequence. seen Sep 2026 · source

api 9 total

  • PUT /scans/{scan-id}/action · source
  • GET /scans/{scan-id}/execution-details · source
  • GET /scans/{scan-id} · source
  • GET /scans/{scan-id}/action · source
  • GET /scans · source
  • DELETE /scans/{scan-id} · source
Scan scheduling and blackouts verified Sets up recurring scan schedules and blocks out time windows during which scanning will not occur. 1 release · 10 other sources · first seen Aug 2026

Also counts toward: Scheduled jobs

release

  • 9 more areas: Blackouts, Schedules, Tags, Targets, Vulnerability Comments, Reports, Variances Documentation, Search, Vulnerability History v1 · Aug 2026 · source · release history

api 10 total

  • POST /schedules · source
  • DELETE /schedules/{schedule-id} · source
  • PUT /blackouts/{blackout-id} · source
  • GET /blackouts · source
  • PUT /schedules/{schedule-id} · source
  • GET /blackouts/{blackout-id} · source
Attack Configuration 1 capability InsightAppSec controls which attack techniques are used during a scan through Attack Templates. Users can tailor the scope and method of attacks to match the application and testing requirements.
Attack template management verified Creates and configures the attack templates and individual attack modules that determine what vulnerabilities a scan will test for. 1 release · 14 other sources · first seen Aug 2026

Also counts toward: REST API

release

  • Attack Templates (10 endpoints) — An Attack Template describes if and how Attacks should be executed during the execution of a Scan. v1 · Aug 2026 · source · release history

api 14 total

  • POST /attack-templates/{attack-template-id}/modules · source
  • GET /modules/{module-id}/attacks/{attack-id} · source
  • GET /attack-templates/{attack-template-id}/modules · source
  • PUT /attack-templates/{attack-template-id}/modules/{attack-module-id} · source
  • DELETE /attack-templates/{attack-template-id}/modules/{attack-module-id} · source
  • GET /attack-templates/module-configs · source
Vulnerability Management 1 capability Discovered vulnerabilities are tracked, annotated, and reviewed within InsightAppSec across scan history. Users can follow the lifecycle of each finding from discovery through resolution.
Vulnerability management verified Displays and tracks vulnerabilities found during scans, including their history, status changes, and any comments added by reviewers. 1 release · 13 other sources · first seen Aug 2026

Also counts toward: REST API

release

  • Vulnerabilities (9 endpoints) — A Vulnerability is a resource that encapsulates any information found by any Scan over the lifetime of an App, that may identify where and how an App could be exploited. v1 · Aug 2026 · source · release history

api 13 total

  • GET /vulnerabilities/{vuln-id}/comments · source
  • POST /vulnerabilities/{vuln-id}/comments · source
  • GET /vulnerabilities/{vuln-id}/history · source
  • GET /vulnerabilities · source
  • GET /vulnerabilities/{vuln-id}/discoveries · source
  • GET /vulnerabilities/{vuln-id}/variances/{variance-id}/documentation · source
Application and Asset Management 2 capabilities InsightAppSec organises scan targets as Apps, which act as containers grouping all related configuration, scan history, and findings. Supporting files needed for scanning are also managed at this level.
App management verified Creates and manages Apps, the top-level objects that group scan configurations, schedules, scans, and vulnerabilities for a single target application. 1 release · 11 other sources · first seen Aug 2026

Also counts toward: REST API

release

  • Apps (11 endpoints) — An App owns Scan Configs, Schedules, Scans and Vulnerabilities; you must create an App in order to create any of these other resources. v1 · Aug 2026 · source · release history

api 11 total

  • DELETE /apps/{app-id}/users/{user-id} · source
  • DELETE /apps/{app-id} · source
  • GET /apps/{app-id} · source
  • DELETE /apps/{app-id}/tags/{tag-id} · source
  • GET /apps/{app-id}/tags · source
  • POST /apps/{app-id}/tags · source
File management verified Uploads and manages files associated with an application that a scan may need in order to complete successfully. 1 release · 7 other sources · first seen Aug 2026

Also counts toward: REST API

release

  • Files (6 endpoints) — Files are used primarily to manage content that can be required to successfully scan an App. v1 · Aug 2026 · source · release history

docs

  • Rapid7 AppSec Plugin for Chrome . Using the proxy tool, you can record the interactions (for example, HTTP GET POST requests) between the front end application and the back end server in a Traffic File. Application Security can replay these interactions to authenticate into your application. seen Sep 2026 · source

api

  • POST /apps/{app-id}/files · source
  • POST /apps/{app-id}/files/{file-id} · source
  • GET /apps/{app-id}/files/{file-id} · source
  • DELETE /apps/{app-id}/files/{file-id} · source
  • GET /apps/{app-id}/files · source
  • PUT /apps/{app-id}/files/{file-id} · source
Engine Management 1 capability On-premise scan engines can be registered and managed within InsightAppSec to support environments where cloud-based scanning is not suitable. Engines can be grouped and kept up to date from within the cyber tool.
Engine management verified Registers, configures, and upgrades on-premise scan engines and organises them into groups for flexible deployment. 2 releases · 17 other sources · first seen Aug 2026

Also counts toward: REST API, Self-hosted deployment

release

  • Engine Groups (6 endpoints) — An Engine Group is a resource which defines a container for a logical grouping of Engines and therefore the purpose of assigning Scans to one of those Engines. v1 · Aug 2026 · source · release history
  • Engines (9 endpoints) — An Engine encapsulates the state and high-level attributes of the components which may be installed and running on a specific On-Premise host. v1 · Aug 2026 · source · release history

docs

  • Application Security (InsightAppSec) Control Panel > Programs and Features Navigate to Administration > Application Security Settings > Manage on-premises engines button. seen Sep 2026 · source
  • and go to Administration > Application Security Settings > Manage on-premises engines Select the Engine Groups tab. button in the first row of the Engine Groups table. Add a name and description that would let you easily identify the purpose of this engine group and press Enter. seen Sep 2026 · source
  • To find out if you are running a legacy version of the engine, go to Administration > Application Security Settings > Manage on-premises engines . In the On-Premises Engines table, find the scan engine you wish to upgrade. seen Sep 2026 · source

api 14 total

  • POST /engines/{engine-id}/upgrade · source
  • PUT /engines/{engine-id} · source
  • GET /engine-groups/{engine-group-id}/engines · source
  • POST /engine-groups · source
  • GET /engines · source
  • GET /engines/{engine-id} · source

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Release-note detail over time

See how much detail InsightAppSec puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

1 entry

  1. August 20261

    1 entry

    1. v1 Aug 2, 2026 · issue 033

      InsightAppSec now publishes an API — 102 endpoints across 17 areas: Apps, Attack Templates, Engines, …

      • Apps (11 endpoints) — An App owns Scan Configs, Schedules, Scans and Vulnerabilities; you must create an App in order to create any of these other resources.
      • Attack Templates (10 endpoints) — An Attack Template describes if and how Attacks should be executed during the execution of a Scan.
      • Engines (9 endpoints) — An Engine encapsulates the state and high-level attributes of the components which may be installed and running on a specific On-Premise host.
      • Scan Configs (9 endpoints) — A Scan Config defines all the necessary information required to perform a Scan of an App.
      • Scans (9 endpoints) — A Scan encapsulates all the information for a single execution of the criteria defined in the provided Scan Config.
      +4 more show less
      • Vulnerabilities (9 endpoints) — A Vulnerability is a resource that encapsulates any information found by any Scan over the lifetime of an App, that may identify where and how an App could be exploited.
      • Engine Groups (6 endpoints) — An Engine Group is a resource which defines a container for a logical grouping of Engines and therefore the purpose of assigning Scans to one of those Engines.
      • Files (6 endpoints) — Files are used primarily to manage content that can be required to successfully scan an App.
      • 9 more areas: Blackouts, Schedules, Tags, Targets, Vulnerability Comments, Reports, Variances Documentation, Search, Vulnerability History

      9 details in Everything

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    compare.md

      Free the public facts, no sign-in Any paid plan all other sections Researcher & Business pricing history and category rank

      my-toolchain — 0 tools

        Betas, release candidates and previews. Turn it off to see final releases only. It also applies to changes you ask for over MCP when you're signed in.
        browse all tools → score card for your toolchain →
        cyber-toolchain / feedback

        Send us feedback