PAGES
← all tools
◆ Attack Surface & Exposure Management

Rapid7 Surface Command

commercial

13 more tools, grouped by what they do.

Attack Surface & Exposure Management

Exploitation & C2

SIEM

Vulnerability Management

CNAPP

Integrated & IT Risk Management

Patch Management

SAST / SCA / Code Security

SOAR

Threat Intelligence
rss ↗ What is a cyber toolchain?

Summary

Rapid7 Surface Command is a commercial exposure-management platform, run as a SaaSSaaSSoftware delivered over the internet and run on the provider's infrastructure, so the buyer pays a subscription instead of installing or operating anything locally. service, that gives security teams a unified view of assets across cloud, on-premises, and endpoint environments. It pulls in telemetry from integrations like ControlUp for device health and connectivity data, and links external attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. findings such as domain registrar details to other tools like DataGuard for deeper investigation. Asset Details views include AI-generated summaries so analysts can orient themselves on an asset without digging through raw data first. It's aimed at SOCSOCA security operations center, the team or function that monitors threats, investigates alerts and coordinates incident response. Its work can be internal, outsourced or shared. analysts and exposure-management teams who need to reconcile scattered asset inventories into one working picture rather than stitching together separate recon and monitoring tools. Launched in 2016, it continues to receive regular feature updates.

Rapid7 Surface Command publishes no documentation we track, so the description above is written from general knowledge rather than the vendor's own words.

How Rapid7 Surface Command helps

Which assets in my environment are missing from the inventories I already trust?

pulls together cloud, on-premises, and endpoint records into one asset list, so an asset seen by one source but absent from another surfaces as a gap

What do I actually know about this asset before I spend time investigating it?

shows an AI-generated summary on the asset's detail view pulling together its most relevant data, so an analyst gets oriented without opening every raw record first

Which of my endpoints are unhealthy or unreachable right now?

shows health scores, hardware details, and connectivity status pulled from ControlUp telemetry alongside the rest of the asset's record

Which remediation work should my team tackle first, and can I explain it quickly to others?

generates a summarized report of remediation activity, ranking top items so priorities can be communicated without manually compiling the underlying findings

Release-note detail over time

See how much detail Rapid7 Surface Command puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Commercials

pricing & packaging history · Rapid7 vendor page

13 readings of Rapid7's pricing page since Oct 2021, with 1 relaunch of its plan lineup and 2 changes to what its plans include — each one dated, compared with the reading before it, and explained for someone buying the tool.

Pricing and packaging history is included with Researcher and Business. See how every vendor we track sells, and how that has changed over time, using data we don't publish anywhere else.

See plans →

Website history

metasploit.com, every change

Rapid7's home page and 4 more pages as they looked each month from August 2021 to October 2026: 37 renders, 0 changes of tagline or palette. Step through them, play them, or put any two months side by side.

Website history is included with Researcher and Business.

See plans →

Releases

Show

8 entries

  1. September 20264
  5. August 20262
  8. July 20262
    Show

    8 entries

    1. docs update Sep 14, 2026 · issue 074
      └──▷ HOW TO FIND IT
      Share a self-explanatory remediation report with asset owners who don't have product access — the AI summary explains what needs fixing and why, with no manual write-up required.
      📍In the Surface Command console, go to Risk › Remediation Hub, open the Top Remediations Report, and select Export in HTML or CSV format to distribute to stakeholders.
    2. docs update Sep 12, 2026 · issue 072

      Remediation Hub gains AI-summarized reports (HTML/CSV) and unified CrowdStrike remediation recommendations.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

      └──▷ HOW TO FIND IT
      Share a self-explanatory remediation report with asset owners without manual write-up — the AI summary travels with the export.
      📍In the product, go to Risk › Remediation Hub, open the Top Remediations Report, review the AI Summary, then export in HTML or CSV format and send to stakeholders.
      Triage CrowdStrike findings alongside all other remediation sources in a single workflow to cut context-switching.
      📍In the product, go to Risk › Remediation Hub and ensure the CrowdStrike connector for Rapid7 Attack Surface Management is active; CrowdStrike remediation recommendations will appear inline with findings from other sources.
      • Adds AI-generated summaries to the Top Remediations Report in Risk > Remediation Hub, exportable in HTML or CSV format, so stakeholders receive the same remediation context (impact, next steps) that teams see in-product.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
      • Surfaces CrowdStrike remediation recommendations directly in Risk > Remediation Hub alongside other sources via the CrowdStrike connector for Rapid7 Attack Surface Management, enabling unified prioritization without tool-switching.
      • Adds AI-generated summaries to the Top Remediations Report in Risk > Remediation Hub, exportable in HTML or CSV format, so stakeholders receive the same remediation context (impact, next steps) that teams see in-product.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

      1 more in Everything

    3. docs update Sep 9, 2026 · issue 069

      Rapid7 Surface Command: Adds Top Remediations Report with AI Summary to Remediation Hub (Risk > Remediation Hub), exportable in HTML or CSV format, surfacing AI-generated remediation context — including potential impact and recommended next steps — directly in stakeholder reports.

      └──▷ HOW TO FIND IT
      Share a self-explanatory AI-summarized remediation report with asset owners without manual annotation.
      📍In the console, go to Risk › Remediation Hub, open the Top Remediations Report with AI Summary, then export in HTML or CSV format and send to stakeholders.
      • Surfaces CrowdStrike remediation recommendations inside Remediation Hub for a unified view of remediation activity across environments.

      1 more in Everything

    4. docs update Sep 9, 2026 · issue 069

      Remediation Hub gains AI-summarized reports and CrowdStrike remediation recommendations, plus new Intune group and CrowdStrike host-group filtering.

      └──▷ HOW TO FIND IT
      Limit a noisy CrowdStrike Falcon connector to only pull devices (and associated Alerts, Vulnerabilities, and Software) that belong to specific managed host groups.
      📍In the Extension Library, open the CrowdStrike Falcon connector configuration and set the Host Groups field to a comma-separated list of group names (e.g. prod-servers,cloud-workloads), then save. Ensure the connected service account has the Host Groups: Read permission in CrowdStrike.
      Share a self-contained remediation brief with asset owners that includes AI-generated context, impact, and next steps without manual annotation.
      📍In Surface Command, navigate to Risk › Remediation Hub, open the Top Remediations Report, review the AI Summary, then export in HTML (for email/web) or CSV (for ticketing systems) using the Export control.
      • Adds a Host Groups setting to the CrowdStrike Falcon connector to restrict device imports (and their Alerts, Vulnerabilities, and Software) to comma-separated host groups; requires the Host Groups: Read permission.
      • Adds a Group Type(s) setting to the Microsoft Intune connector to import MicrosoftIntuneGroup objects; requires Group.Read.All and GroupMember.Read.All permissions.
      • Remediation Hub (Risk > Remediation Hub) now surfaces CrowdStrike remediation recommendations alongside data from other sources, giving a unified view of remediation activity without switching tools.
      • Remediation Hub now includes a Top Remediations Report with AI Summary, exportable in HTML or CSV format, so stakeholders receive the same AI-generated remediation context seen in-product.
      • Microsoft Intune connector now collects software installations via a single whole-tenant report export instead of a per-app device fan-out, completing in under 40 minutes on tenants with ~39 000 applications and ~1.6 million installations.
      • Remediation Hub now includes a Top Remediations Report with AI Summary, exportable in HTML or CSV format, so stakeholders receive the same AI-generated remediation context seen in-product.

      4 more in Everything

    5. docs update Aug 18, 2026 · issue 049

      Surface Command adds ControlUp DEX and CyCognito connectors for unified endpoint and external attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. visibility.

      • New ControlUp DEX connector imports device inventory and platform user data from ControlUp for Desktops into Surface Command, including health scores, hardware details, OS information, and connectivity status.
      • New CyCognito connector imports IP addresses, domains, certificates, web applications, IP ranges, and security issues from the CyCognito API into Surface Command for external attack surface visibility.

      2 details in Everything

    6. docs update Aug 4, 2026 · issue 035

      Surface Command adds Azure Blob Storage, HCL AppScan, Microsoft AD CS, and UpGuard connectors plus DataGuard and EAS enrichments

      • New Azure Blob Storage connector reads JSON blobs from Azure Blob Storage and imports them into the Rapid7 Platform as Surface Command records, with the type configured at runtime.
      • New HCL AppScan on Cloud connector imports application inventory, DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces./SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment./SCASCASoftware composition analysis, identifying third-party dependencies and checking them for known vulnerabilities and license issues. It covers software a team uses rather than writes itself./IAST scan results, and security findings into Surface Command for application security posture visibility.
      • New Microsoft AD Certificate Services connector queries the CA database via WinRMWinRMA Windows-native remote management protocol from Microsoft, implementing the WS-Management standard, that lets tools execute commands and access data on remote Windows hosts over HTTP or HTTPS. to retrieve all certificates — issued, revoked, pending, denied, and failed — with full lifecycle, expiration, template, and PKIPKIA framework of policies, roles, and cryptographic standards for issuing and managing digital certificates that bind public keys to identities, letting tools verify authenticity and encrypt communications without pre-shared secrets. inventory detail.
      • New UpGuard connector integrates domains, IP addresses, vulnerabilities, and vendor risk assessments with the Rapid7 Platform.
      • DataGuard integration now surfaces a prominent Open in DataGuard action on canonical source links.
      +1 more show less
      • External Attack Surface domains now expose registrar and registered properties.

      6 details in Everything

    7. docs update Jul 28, 2026 · issue 028

      Surface Command adds AI asset summaries in ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. and three new connectors: Adaptive Security, Avigilon Alta, and Halcyon.

      └──▷ HOW TO FIND IT
      Quickly orient yourself on an unfamiliar asset during an incident — the AI summary surfaces the most relevant properties, exposures, and alerts without manually piecing together data.
      📍In the console, go to Attack Surface Management › Asset Details and select any asset to view the AI-generated summary at the top of the details panel.
      • New AI-generated asset summaries in the Attack Surface Management Asset Details view provide instant overviews of key properties, exposures, and alerts to speed up prioritization and remediation decisions.
      • New Adaptive Security connector imports users and groups from the security awareness training platform into Surface Command.
      • New Avigilon Alta connector integrates Users, Access Groups, ACUs, Readers, and Sites from the cloud-based physical access control solution.
      • New Halcyon connector imports endpoint assets, tenant organizations, deployment groups, and policy groups from the AI-powered anti-ransomware platform.
      • Microsoft SQL connector adds a generic import feed with configurable queries via a new mssql_query_config configuration type.
      +2 more show less
      • CyberArk Endpoint Privilege Manager connector migrates to the new Get Endpoints API, introducing the CyberArkEpmComputer2 type with full unified model fulfillment.
      • Vector Command now requires service agreement acknowledgment before initiating testing.

      7 details in Everything

      └──▷ BREAKING ON UPGRADE
      • !CyberArk Endpoint Privilege Manager connector migrates from the deprecated GetComputers API to the new Get Endpoints API and introduces the CyberArkEpmComputer2 type — existing workflows relying on the old API or type may need to be updated.
    8. docs update Jul 28, 2026 · docs issue 004

      Surface Command adds AI asset summaries in ASMASMAttack Surface Management: the continuous practice of discovering, inventorying, and monitoring an organization's externally exposed assets so that cyber tools can flag unknown or misconfigured entry points before attackers find them. and three new connectors: Adaptive Security, Avigilon Alta, and Halcyon.

      └──▷ HOW TO FIND IT
      Quickly orient yourself on an unfamiliar asset during an incident — the AI summary surfaces the most relevant properties, exposures, and alerts without manually piecing together data.
      📍In the console, go to Attack Surface Management › Asset Details and select any asset to view the AI-generated summary at the top of the details panel.
      • New AI-generated asset summaries in the Attack Surface Management Asset Details view provide instant overviews of key properties, exposures, and alerts to speed up prioritization and remediation decisions.
      • New Adaptive Security connector imports users and groups from the security awareness training platform into Surface Command.
      • New Avigilon Alta connector integrates Users, Access Groups, ACUs, Readers, and Sites from the cloud-based physical access control solution.
      • New Halcyon connector imports endpoint assets, tenant organizations, deployment groups, and policy groups from the AI-powered anti-ransomware platform.
      • Microsoft SQL connector adds a generic import feed with configurable queries via a new mssql_query_config configuration type.
      +2 more show less
      • CyberArk Endpoint Privilege Manager connector migrates to the new Get Endpoints API, introducing the CyberArkEpmComputer2 type with full unified model fulfillment.
      • Vector Command now requires service agreement acknowledgment before initiating testing.

      7 details in Everything

      └──▷ BREAKING ON UPGRADE
      • !CyberArk Endpoint Privilege Manager connector migrates from the deprecated GetComputers API to the new Get Endpoints API and introduces the CyberArkEpmComputer2 type — existing workflows relying on the old API or type may need to be updated.

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    compare.md

      Free the public facts, no sign-in Any paid plan all other sections Researcher & Business pricing history and category rank

      my-toolchain — 0 tools

        Betas, release candidates and previews. Turn it off to see final releases only. It also applies to changes you ask for over MCP when you're signed in.
        browse all tools → score card for your toolchain →
        cyber-toolchain / feedback

        Send us feedback