Rapid7 InsightVM Review 2026: Pricing, Pros, Cons and Alternatives

The buying decision on InsightVM is no longer a scanner license, but whether the public rate is the product a salesperson will actually quote.

InsightVM now sits inside Exposure Command, and those package pages do not print a dollar amount, so a renewal can move you onto a package the pricing page never priced.

Methodology: prices and inclusions below were read on October 16, 2026, on Rapid7's pricing page, Exposure Command page, InsightVM pages, and vulnerability-management docs, and on the pricing pages of Tenable, Qualys, Intruder, Microsoft, and Wiz.

No trial was opened. A yearly figure is the published rate times the stated quantity, times 12 when the rate is monthly. Taxes, resellers, and negotiated discounts are left out.

Toolradar data: as of October 16, 2026, Toolradar tracks 19 vulnerability scanning tools and had re-checked pricing on 79% of them in the prior 90 days.

Its vulnerability scanning ranking names Tenable, Qualys, and Rapid7 as the infrastructure layer in that set. Nessus drew 149 comparisons there in the last 90 days.

Profiles for the priced rivals are Tenable, Nessus, Qualys, Intruder, and Wiz.

This page turns the published InsightVM rate into a one-year bill at the named quantity, then sets that year beside products that still print a number.

Use the vulnerability scanner ranking for the wider field, and the Tenable review when you are choosing between Nessus and the cloud platform.

Rapid7 is a Boston security company, and its contact page is where the headquarters address is published.

The August 10, 2026 earnings release describes more than 11,500 customers and calls the product line the Command Platform.

That name is the company's description of the suite, not a figure from the financial tables.

InsightVM is the vulnerability scanner inside that platform, and the InsightVM page places it inside Exposure Command, so you are buying the same scanner with a wider view.

Essentials adds attack surface management and Ultimate adds cloud and application security, so you are buying a package.

Surface Command covers discovery without the scan, so skip it if the scan is why you called.

A team that wanted a scanner is now looking at a package, and the attack surface tools guide covers the outside-in half.

Metasploit is a separate Rapid7 product on the penetration testing tools guide.

A deployment still starts with a scan, and Rapid7's agent documentation says the Agent and the Scan Engine complement each other, with the console merging results when both see the same asset.

The agent is local only and does not run scan templates, so laptops still need the engine for policy checks.

An authenticated Scan Engine check covers local, remote, and policy findings, which an agent-only rollout misses.

Scan Assistant covers CIS policy without storing administrative credentials on the console.

Prioritization is Active Risk, on a scale of 0 to 1000.

The risk strategy docs say it uses the latest CVSS score plus exploit feeds, including Metasploit, ExploitDB, AttackerKB, and the CISA known-exploited list, so exploit evidence can outrank a bare critical.

As of January 21, 2026, older strategies, including Real Risk, are deprecated, and you cannot switch back.

Historical data cannot be recalculated, so a trend built on the old score stops the day you switch.

The trial includes remediation guidance, SLA tracking, and Jira and ServiceNow connections. Those connections still have to appear in the quote, because the trial page is not the Exposure Command price list.

Rapid7's pricing page, checked October 16, 2026, prints three starting rates. Vulnerability risk management, the card linked to InsightVM, is the public per-asset rate at the quantity that card names.

Web application security starts at $175/mo per app, and cloud security starts at $5,775/mo for a capped instance count.

Those last two are separate products, not a price for Exposure Command Ultimate, so leave them off the scanner budget.

At the vulnerability rate, that named quantity is $810 a month, or $19.44 per asset across the year.

The page says "starts at" and ties the rate to a stated asset count per asset, without calling it a minimum, a monthly invoice, or the Essentials price.

The Exposure Command pricing page describes usage-based coverage, asks about a discount above 1,000 assets, and prints no dollar amount for Surface Command, Essentials, or Ultimate, so the public rate cannot close a budget alone.

There is no free plan, and the trial page still offers a hands-on InsightVM trial for an on-premises or smaller evaluation, while Exposure Command is a guided demo.

Ask the account team if a renewal lands on Essentials.

Tenable's buy page prints a quantity the package pages never publish. Vulnerability Management is $3,700 for one year at 100 assets, $7,215 for two years, and $10,545 for three years, all at that same count.

At the online cap, one year is $9,250, both one-year prices work out to $37 an asset, and anything above that cap leaves the page for sales.

Extending that online rate to the InsightVM quantity is $18,500 for a year, and that quantity is not an online SKU.

Nessus Professional is $4,790 for one year if you only need a single-user scanner with unlimited assessments.

Scan limits sit in Nessus vs Qualys, and the Qualys floors sit in the Qualys review.

Qualys's VMDR TruRisk trial page starts TruRisk at $2,195, FixIT at $2,995, and ProtectIT at $4,645, with no asset count and no term.

The subscriptions page prices by apps, IPs, web applications, and user licenses, and prints no dollar amount past the small-business floors.

Community Edition is free, and the form's trial lasts 7 days, which is short for agents and a patch cycle.

Intruder's pricing page prices Cloud and Pro as a base plus a per-target fee, and the figures exclude VAT.

At the small published scope, Cloud is $299/mo and Pro is $499/mo, and the annual Cloud bill is $2,870. Internal scanning is Pro and Enterprise only.

At 200 infrastructure targets, or 20 application targets, pricing becomes an enterprise quote, while a free plan remains for weekly external scans.

Microsoft's Defender pricing page lists the vulnerability add-on at $2/user/mo, on an annual commitment after a one-month trial, for Defender for Endpoint Plan 2 and Microsoft 365 E5 customers.

At 100 users that add-on is $2,400 for the year, on top of the suite. Wiz publishes no dollar price, so it does not solve the quote problem, and cloud-only estates should read the cloud security posture guide.

InsightVM fits a team that will run a scan engine, an agent, or both, and that wants a score tied to exploit evidence. Essentials fits when attack-surface context should share the scanner contract, and Ultimate fits when cloud, containers, and application testing belong on the same renewal and you can wait for a quote.

It is a weaker fit when finance needs a package price before the call, since the public rate is not labeled Essentials or Ultimate.

A consultant who wants a scanner license with unlimited assessments is looking at Nessus Professional, not this platform.

A small external estate is an Intruder purchase, because a target price is already printed.

Skip it when endpoints are already on Defender for Endpoint Plan 2 or Microsoft 365 E5, because the vulnerability add-on is a user line on a suite you hold.

Skip it when the assets are cloud accounts and there is no network to scan. Teams that need a no-cost start should use the free vulnerability scanner guide, and subscribe free to Cyberpresso for the next license note when package prices move.