Rapid7 InsightVM
2026-11-02-d392cbe7 commercialThe section your link pointed to isn't on Rapid7 InsightVM's page any more, so we've brought you to the top.
Rapid7 InsightVM is a vulnerability management platform that scans networks and assets to identify, prioritize, and help remediate security weaknesses.
Summary
Rapid7 InsightVM is a commercial vulnerability-management platform that scans an organization's assets to find, prioritize, and track security weaknesses over time. It runs as a service, with a Security Console that schedules scans and integrates collected data, and it is built for vulnerability-management and SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. teams responsible for maintaining an inventory of what is running across their environment and patching accordingly. Its fingerprinting reaches beyond generic asset discovery into specific software: it identifies AI tools installed on scanned assets, Microsoft Intune-managed applications, Splunk deployments, and Oracle Database installations down to version and patch level, giving those teams more precise data to act on rather than broad guesses. Launched in 2016, it continues to receive regular updates, including recent scheduler reliability improvements.
Rapid7 InsightVM is a vulnerability management platform that scans networks and assets to identify, prioritize, and help remediate security weaknesses.
Rapid7 InsightVM publishes no documentation we track, so the description above is written from general knowledge rather than the vendor's own words.
How Rapid7 InsightVM helps
Which unpatched software is putting this environment at risk right now?
scans assets and cross-references installed versions against known vulnerabilities, tracking which weaknesses persist across repeated scans over time
Are any AI tools running on machines that security never approved?
fingerprints installed software specifically enough to recognize AI tools on scanned assets, adding them to inventory alongside traditional applications
Which endpoints managed through Intune actually have vulnerable applications on them?
fingerprints Microsoft Intune-managed applications during scans, tying managed-endpoint inventory to the same vulnerability data as everything else
What version and patch level is this Oracle database actually running?
authenticates to the database and reads its version and applied patches directly, rather than inferring them from network-visible banners
Do these Amazon Linux 2023 hosts meet the current federal security baseline?
assesses scanned assets against the DISA STIG Amazon Linux 2023 benchmark and reports where configurations fall short
Which ports on a hardened host are actually listening, when network scans keep missing them?
authenticates over SSH, Scan Assistant, or a direct Windows connection to pull the host's own authoritative port list, falling back to a network scan only when no credential works
Score card
-
Shipping velocity releases a month, last 12 months
-
Documentation quality release-notes rubric, 0–100
-
Breaking-change discipline how rarely a release breaks users, and notice given
-
Maintenance risk quiet time against its own cadence, maintainers
-
Innovation & surface new capabilities, API and MCP surface
Five scores for Rapid7 InsightVM, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.
Score cards are part of every paid plan.
See plans → Already subscribed? Sign in →Trajectory
Blank means never measured; nothing here is a filled-in zero.
Peer standings are included with Researcher and Business. See how this tool ranks against its competitors, using data we don't publish anywhere else.
See plans →Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.
How this is scored
- Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
- Documentation quality — the release-notes rubric published on the analytics page, unchanged.
- Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
- Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
- Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
- Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
- Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
- Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.
Release-note detail over time
See how much detail Rapid7 InsightVM puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.
Checking release-note history…
Commercials
pricing & packaging history · Rapid7 vendor page13 readings of Rapid7's pricing page since Oct 2021, with 1 relaunch of its plan lineup and 2 changes to what its plans include — each one dated, compared with the reading before it, and explained for someone buying the tool.
Pricing and packaging history is included with Researcher and Business. See how every vendor we track sells, and how that has changed over time, using data we don't publish anywhere else.
See plans → Already subscribed? Sign in →Plans by offering
Each offering on the pricing page links to its own page of plans, read at its latest capture.
Plan relaunches
Plans, prices and descriptions are quoted from the vendor's own pricing page as we read it on each date. A plan missing from a later reading is shown as no longer listed on the page — a statement about the page, not the product. Readings that failed to show any plans are left out rather than read as a change.
Website history
metasploit.com, every changeRapid7's home page and 4 more pages as they looked each month from August 2021 to October 2026: 37 renders, 0 changes of tagline or palette. Step through them, play them, or put any two months side by side.
Website history is included with Researcher and Business.
See plans → Already subscribed? Sign in →← → or h l a month · Shift a year · [ ] previous / next change · Space play · 1 2 3 page · T whole page · C compare · F full size
← → or h l the right month · Shift the left · S swap · W wipe · T whole page · Esc back
Rebranding timeline
Dates bound when a change appeared between captures. Possible rebrands are AI suggestions; a redesign alone does not establish a rebrand.
Coverage
Missing something? Tell us
What Rapid7 InsightVM connects to, runs on and detects, read from its release notes and docs. So far: 3 updated supported platforms, 3 new supported platforms, 2 new compliance frameworks, 1 updated vulnerability check, 1 updated compliance framework.
10 changes, tracked since Sep 29, 2026.
-
Nov 22026
new CIS macOS 26 Tahoe policy content
adds CIS macOS 26 Tahoe policy content
-
Nov 22026
updated Oracle Database detection for symlinked homes
improves Oracle Database detection for symlinked homes
-
Oct 262026
updated Improved PHP detection on Windows assets via authenticated scans
Version 8.65.1 improves detection of PHP through authenticated scans for Windows assets.
-
Oct 262026
updated Expanded CIS policy coverage and enhanced compliance assessment accuracy
Version 8.65.0 strengthens Security Console security, improves session management and On-Demand Agent scan reliability, expands CIS policy coverage, and enhances compliance assessment accuracy.
-
Oct 202026
new CIS Ubuntu 26.04 Benchmark v1.0.0 policy content
New policy content: CIS Ubuntu 26.04 Benchmark v1.0.0: Built-in policy content for CIS Ubuntu 26.04 v1.0.0 is now available. You can assess Ubuntu 26.04 systems against the latest CIS hardening guidance.
-
Sep 292026
new Microsoft 365 Copilot for Desktop fingerprinting
Add fingerprinting support for Microsoft 365 Copilot for Desktop. InsightVM now detects and inventories Microsoft 365 Copilot for Desktop as installed software, ensuring this application is visible in your asset data and included in vulnerability assessments.
-
Sep 292026
new Microsoft Office LTSC 2024 fingerprinting
Fingerprinting support for Microsoft Office LTSC 2024 added. InsightVM now correctly identifies Microsoft Office LTSC 2024 as a distinct product, enabling vulnerability findings to be accurately reported for this Office edition and ensuring customers running LTSC deployments receive complete coverage.
-
Sep 292026
updated Microsoft Edge Stable and Extended Stable channel fingerprinting
Updated fingerprinting to ensure detection of both the Stable and Extended Stable release channels of Microsoft Edge, providing more accurate software inventory and ensuring vulnerability assessments reflect the specific Edge variant deployed in your environment.
-
Sep 292026
new Microsoft Teams fingerprinting
Added fingerprinting support for Microsoft Teams, enabling the application to be accurately identified during scans and assessed for known vulnerabilities.
-
Sep 292026
updated Microsoft .NET Framework 1.1 fingerprinting
With Microsoft .NET Framework version 1.1
Updated fingerprinting to correctly detect Microsoft .NET Framework version 1.1 as installed software on
Chat & assistant apps 1
Chat & collaboration 1
Databases & data platforms 1
Browsers & mobile 1
Languages & runtimes 1
Other 3
Nothing first seen in this window. That doesn't mean Rapid7 InsightVM shipped nothing, only that we found no record of it.
How we count
Read from 4 of 11 release notes and docs updates we hold for Rapid7 InsightVM. "First seen" is the earliest note that names something; "last" is the latest. Our history may start partway through Rapid7 InsightVM's life, so an old integration can show a recent first-seen date.
Each change counts once: "added 40 checks" is one line, so the numbers measure how often coverage moves, not how big the catalogue is or how well it detects.
Releases
11 entries
No entries match these filters.
- November 20261
- October 20264
- September 20263
- August 20262
- July 20261
Integrates with
Explore documented product relationships, workflows and source coverage. Documentary evidence does not confirm current support or your installation's fit.
- Rapid7 InsightVM · Rapid7
| Provider product | Target product | Workflow | Evidence |
|---|---|---|---|
| Qualys Enterprise TruRisk Management (ETM) · Product without a Toolchain page | Rapid7 InsightVM | Import host assets, Import vulnerability findings Data flows into the provider · Availability unknown |
Source 1 not confirmed |
| Rapid7 InsightVM | Amazon EC2 · Product without a Toolchain page | Discover EC2 instances, Import EC2 tags Data flows into the provider · Availability unknown |
Source 1 not confirmed |
| Rapid7 InsightVM | Atlassian Jira Cloud · Product without a Toolchain page | Create remediation tickets, Synchronize issue status Both directions · Availability unknown |
Source 1 not confirmed |
| Rapid7 InsightVM | CyberArk Application Identity Manager · Product without a Toolchain page | Retrieve privileged credentials for authenticated scanning Data flows into the provider · Availability unknown |
Source 1 not confirmed |
| Rapid7 InsightVM | ServiceNow Vulnerability Response · Product without a Toolchain page | Import vulnerabilities and asset context, Map vulnerabilities to configuration items, Synchronize remediation records Data flows out to the target · Availability unknown |
Source 1 not confirmed |
| Rapid7 InsightVM | Splunk Cloud · Product without a Toolchain page | Export asset data, Export vulnerability findings and remediation status Data flows out to the target · Availability unknown |
Source 1 not confirmed |
| Rapid7 InsightVM | Splunk Enterprise | Export asset data, Export vulnerability findings and remediation status Data flows out to the target · Availability unknown |
Source 1 not confirmed |
| Rapid7 InsightVM | VMware ESXi · Product without a Toolchain page | Discover virtual-machine inventory Data flows into the provider · Availability unknown |
Source 1 not confirmed |
| Rapid7 InsightVM | VMware vCenter Server · Product without a Toolchain page | Discover virtual-machine inventory Data flows into the provider · Availability unknown |
Source 1 not confirmed |
Add the badge to your README
Maintain this project? The badge links readers straight to this page, so they can follow every release here.
Choose a badge style and copy the code →