Rapid7 pricing in 2026 starts at $1.62 per asset per month for InsightVM, with 500 assets as the entry point. That is $19.44 per asset per year, or $9,720 a year for 500 assets (Rapid7, 2026). InsightAppSec starts at $175 per app per month. Rapid7 publishes no price for its SIEM, MDR, or Exposure Command products. You need a quote for those.
This guide shows what each product costs, what the list price leaves out, and how Rapid7 compares with Tenable and Qualys.
Last verified: Nov 14, 2026.
At a glance
InsightVM: from $1.62 per asset per month at 500 assets (about $9,720 per year; Rapid7, 2026)
InsightAppSec: from $175 per app per month, billed annually
InsightCloudSec: from $5,775 per month for up to 500 instances
SIEM, MDR, and Exposure Command: no public price, quote only
You host the InsightVM Security Console yourself, so add server cost
Rapid7's own page and third-party price lists disagree, so ask for a written quote
How much does Rapid7 cost?
Rapid7 cost depends on the product. Vulnerability scanning is the cheapest to price, and managed detection costs the most. Rapid7 lists three starting prices on its pricing page. Everything else needs a sales call (Rapid7, 2026).
Product
What it does
Starting price
InsightVM
Finds and ranks software flaws on your devices
$1.62 per asset per month, 500 assets
InsightAppSec
Tests web apps for flaws
$175 per app per month
InsightCloudSec
Checks cloud accounts for risk
$5,775 per month, up to 500 instances
InsightIDR (SIEM)
Collects logs and flags attacks
Quote only
MDR
Rapid7 staff watch your network for you
Quote only
Exposure Command
Bundles scanning, attack surface, and cloud tools
Quote only
An asset is one device or system that Rapid7 scans, such as a laptop, server, or cloud instance.
Rapid7 pricing model: how Rapid7 charges you
The Rapid7 pricing model is a yearly subscription, counted by assets, apps, or users. Each product uses its own unit. InsightVM counts assets. InsightAppSec counts apps. The SIEM counts users and log data. Exposure Command is usage based, and Rapid7 says you can track billable assets against your plan over time (Rapid7, 2026).
Get more cybersecurity reads in your inbox
One email a day — only posts tagged Cybersecurity. No spam, unsubscribe anytime.
Rapid7 prices in US dollars and says international prices vary. Rapid7 labels InsightAppSec as billed annually. The InsightVM page does not state the billing term, so ask before you sign.
Rapid7 InsightVM pricing and InsightVM cost per asset
InsightVM pricing is $1.62 per asset per month at 500 assets. You multiply that by 12 to get the yearly cost per asset: $19.44. Rapid7 does not publish rates for larger counts (Rapid7, 2026).
The table below uses the $1.62 rate (Rapid7, 2026) for every row. These are estimates, not quotes. Real quotes for larger counts are usually lower per asset.
Assets
Per month at $1.62
Per year
500
$810
$9,720
1,000
$1,620
$19,440
2,000
$3,240
$38,880
5,000
$8,100
$97,200
Some price sites show $1.93 per asset at 500 assets. That is $11,580 a year. Rapid7's own page shows $1.62, so use that figure as your starting point (Rapid7, 2026; Ciphers Security, 2026).
What do buyers really pay at scale?
Benchmark data from 58 or more deployments puts InsightVM much lower than the list rate. It shows $5.50 to $7.80 per asset per year under 1,000 assets. It shows $3.20 to $5.80 per asset per year above 10,000 assets (vendorbenchmark.com, April 2026).
That is far below $19.44. The two sources do not agree, and the benchmark is modeled data, not Rapid7 list prices. Ask for a written quote before you plan a budget. Treat the gap as room to negotiate, not as a promise.
Rapid7 license cost: the extra costs
The Rapid7 license cost is only part of your bill. Servers, services, and renewals add more. The items below come from Ciphers Security and vendorbenchmark.com, and Rapid7 does not list them itself.
True-up: if you go over your asset count by a set margin (often 10 percent), you may pay list price for the overage, back to the start of the year.
Setup help from Rapid7 costs about $5,000 to $15,000 for a mid-size company (Ciphers Security, 2026).
Training runs about $1,000 to $3,000 per analyst (Ciphers Security, 2026).
24/7 premium support is a separate fee, often 15 to 20 percent of the license (Ciphers Security, 2026).
Yearly price rises of 5 to 9 percent apply if you do not negotiate a cap (vendorbenchmark.com, April 2026).
Here is what a rise does to a 1,000-asset plan at the $1.62 rate. Flat pricing costs $58,320 over three years. A 5 percent yearly rise brings that to $61,285. A 9 percent rise brings it to $63,726. Ask for a price cap in your first contract.
The server cost you must add
InsightVM is hybrid, so you host the Security Console yourself. It runs a PostgreSQL database and needs real hardware. Rapid7's guide lists these console sizes (Rapid7 docs, 2026):
Assets
CPU cores
Memory
Storage
5,000
4
16 GB
1 TB
20,000
12
64 GB
2 TB
150,000
12
128 GB
4 TB
400,000
12
256 GB
8 TB
A Scan Engine needs at least 4 cores, 16 GB of memory, and 200 GB of storage. The console must also reach the Insight Platform over outbound port 443. Cloud-only tools such as Qualys skip this cost.
Rapid7 does not publish InsightIDR pricing or a SIEM price list. Rapid7's pricing page shows no price for it, and the SIEM now appears as Next-Gen SIEM and Incident Command (Rapid7, 2026). A SIEM collects security logs from across your company and flags attacks.
Benchmark data says InsightIDR charges per user for endpoint cover, plus a fee per GB of log data. For 1 TB of logs a day, buyers report $85,000 to $140,000 a year. Strong negotiators report $65,000 to $110,000. Going over your log commitment costs a 15 to 25 percent premium (vendorbenchmark.com, April 2026).
Rapid7 MDR pricing is quote only. MDR means managed detection and response: Rapid7 staff watch your systems all day and act on threats. Rapid7 links to a separate pricing page and shows no price (Rapid7, 2026).
Benchmarks say you pay per user plus a base fee for the security team. Typical yearly spend runs $120,000 to $485,000. With strong negotiation it runs $95,000 to $380,000 (vendorbenchmark.com, April 2026). Small teams should compare that with a tool such as CrowdStrike Falcon before they commit.
Rapid7 InsightAppSec pricing
InsightAppSec pricing starts at $175 per app per month, billed annually. That is $2,100 a year for one app. The plan includes cloud and on-premises scan engines, unlimited scans, and scan schedules (Rapid7, 2026).
Some price sites list $2,000 or $4,500 or more a year with a two-year term. Rapid7's page does not back those figures, so ask for the exact term in writing.
Rapid7 Nexpose pricing
You cannot buy Nexpose from a public price list. Nexpose is the older on-premises name for the scanner. Rapid7 now sells the same scanning as InsightVM and Exposure Command. Rapid7 lists no public Nexpose price in 2026. Older guides mention a free Community edition, but Ciphers Security says Rapid7 no longer lists one (Ciphers Security, 2026).
What is the price of Exposure Command?
Exposure Command has no public price. Rapid7 sells it by demo request. It comes in two packages. Essentials adds vulnerability scanning and fix tracking to Surface Command. Ultimate adds cloud and container security on top (Rapid7, 2026).
Rapid7 now leads with these bundles. If you only want scanning, ask for a standalone InsightVM quote.
Rapid7 vs Tenable
The Rapid7 vs Tenable price gap depends on asset counts, because each vendor publishes a different entry point. Rapid7 lists $19.44 per asset per year at 500 assets. Tenable lists Tenable Vulnerability Management at $3,500 a year for 100 assets in its buy flow. That is $35 per asset per year (Tenable, 2026). The page also shows $3,700 for a one-year card, so check the price at checkout.
Tenable lets you buy online up to 250 assets. Larger counts need sales. The two prices are not a like-for-like match, because the asset counts differ. Our Tenable pricing guide has the full tier list.
Rapid7 vs Nessus
Nessus Professional is a scanner you run yourself. Tenable charges $4,790 for a one-year license, $9,330.95 for two years, and $13,637.54 for three years (Tenable, 2026). The price is per license, not per asset.
If you scan a few hundred assets from one place, Nessus can cost less. Nessus has no cloud console or multi-scanner control (Ciphers Security, 2026). InsightVM fits teams that need dashboards and fix tracking.
Rapid7 vs Tenable vs Qualys
Qualys does not publish a price for VMDR. You must ask for a quote, but it offers a 30-day free trial (Ciphers Security, 2026). Qualys needs no server on your side. See our Qualys pricing guide for the details.
Vendor
Public price
Server you host?
Rapid7 InsightVM
$19.44 per asset per year at 500 assets
Yes, the Security Console
Tenable Vulnerability Management
$3,500 per year for 100 assets
No, cloud console
Tenable Nessus Professional
$4,790 per year per license
You run the scanner
Qualys VMDR
None, quote only
No
Which Rapid7 option should you pick?
Use these rules to narrow the field.
Under 250 assets: look at Nessus Professional or Tenable's online pack first. Rapid7's entry point is 500 assets.
500 to 5,000 assets and a team that can run servers: ask Rapid7 for an InsightVM quote and compare it with Qualys.
No spare server staff: price Qualys or Tenable cloud first, because you skip the console cost.
You also need a SIEM: ask for InsightVM and InsightIDR in one multi-year quote. Do not add the SIEM at renewal.
Whatever you pick, ask two rivals for written quotes. Show them to Rapid7. Document the asset count, the yearly price cap, and the true-up rule in the contract.
Fazlur Rahman is the founder of Tutorsbot, building AI-powered tools for learning and career growth. He writes about applying AI in real products and the practi… Read moreShow less
Fazlur Rahman is the founder of Tutorsbot, building AI-powered tools for learning and career growth. He writes about applying AI in real products and the practical side of building an ed-tech startup.
Fazlur Rahman
