How much does Rapid7 InsightVM cost per asset in 2026?

Rapid7 InsightVM is priced from $1.62 per asset per month at 500 assets, which works out to about $19.44 per asset per year. Per-asset pricing decreases as volume rises: 1,000 assets roughly $1.85 per asset per month, 5,000 assets $1.74, 15,000 assets $1.68, and 50,000+ assets $1.62. Rapid7 does not publish a public price; quotes require a sales conversation (Ciphers Security, September 2026).

How much does Rapid7 InsightIDR cost?

Rapid7 InsightIDR (SIEM/XDR) is priced per user for endpoint coverage plus per GB for log ingestion. Reported enterprise pricing for 1TB daily log ingestion is $85,000 to $140,000 per year at list, dropping to $65,000 to $110,000 with strong negotiation leverage. InsightIDR is the natural pairing with InsightVM for organizations that want vulnerability management plus SIEM in a single Insight Platform bundle (vendorbenchmark.com, 2026).

What infrastructure does Rapid7 InsightVM require?

Rapid7 InsightVM is hybrid, not SaaS. You host a Security Console running a PostgreSQL database, and Rapid7's sizing guidance calls for 12 CPU cores, 64 GB of RAM, and 2 TB of storage at 20,000 assets, rising to 256 GB and 8 TB at 400,000 assets. You also host Scan Engines across your network segments. This is real capital and operational cost sitting on the buyer's side of the line, and is the single most common omission when comparing InsightVM to cloud-native Qualys (TechBag, 2026).

How does Rapid7 InsightVM pricing compare to Tenable and Qualys?

At mid-market scale Rapid7 InsightVM sits between Tenable and Qualys: 100 assets runs about $2,300 to $2,700 per year for Rapid7 versus $2,600 to $3,800 for Tenable and $1,700 to $3,300 for Qualys. The price difference over Qualys reflects InsightVM's stronger remediation workflow tooling and tighter Insight Platform SIEM integration. Documented competitive quotes from all three vendors typically drop the final price 15 to 30 percent below list (cipherssecurity.com, September 2026).

Rapid7 Pricing 2026: InsightVM Cost per Asset Breakdown

Q: What is the minimum asset count for Rapid7 InsightVM?

The minimum asset count for Rapid7 InsightVM is 250 to 500 assets; Rapid7 does not quote smaller deployments. Teams below that threshold are directed to Nexpose Express (on-premises perpetual license) or Nexpose Community Edition (free, supports up to 32 IPs). For teams already running Nexpose on-premises, migration to the InsightVM cloud console is included in standard support contracts (Rapid7, September 2026).

Q: What is the median Rapid7 InsightVM contract?

The median Rapid7 annual contract across InsightVM standalone deployments is approximately $25,000 to $48,000 per year at negotiated pricing for 5,000-asset deployments. The median Fortune 1000 Rapid7 subscription is approximately $385,000 annually across two to three products. Strategic enterprise deployments (100,000+ assets) routinely exceed $2.2M per year before custom services (vendorbenchmark.com, 2026).

Quick Answer

Rapid7 InsightVM pricing in 2026 runs from $1.62 per asset per month at 500 assets ($19.44 per asset per year), with list examples of $11,580 per year for 500 assets, $22,200 for 1,000, $104,400 for 5,000, and $972,000+ for 50,000+ assets. InsightVM is hybrid (you host the Security Console and PostgreSQL) rather than SaaS. The minimum asset count is 250 to 500 (Rapid7 + Ciphers Security, September 2026).

Rapid7's published per-asset pricing is one of the few public rates in the enterprise vulnerability management category, which makes procurement-side comparisons straightforward against Tenable and Qualys.

Last verified: Sep 15, 2026.

At a glance

From $1.62 per asset per month at 500 assets (~$19.44 per asset per year)
500 assets ~$11,580 per year; 1,000 ~$22,200; 5,000 ~$104,400
15,000 assets ~$302,400 per year; 50,000+ ~$972,000+
Hybrid deployment (customer-hosted Security Console plus PostgreSQL)
Minimum 250 to 500 assets per deployment
Insight Platform bundle unlocks 15 to 25 percent discount versus standalone

Rapid7 InsightVM pricing tiers and what each one includes

Rapid7 InsightVM uses a per-asset sliding scale that drops with volume. Asset means any IP-addressable endpoint the scanner monitors: workstations, servers, network appliances, cloud instances, and containers each count as one. The price per asset falls as the total asset count rises. Rapid7 publishes a starting price on its pricing page ($1.62 per asset per month at 500 assets) but every quote above that line is sales-negotiated (Rapid7, September 2026).

Asset count	Estimated cost per asset per month	Estimated annual total
500	$1.93	$11,580
1,000	~$1.85	~$22,200
5,000	~$1.74	~$104,400
15,000	~$1.68	~$302,400
50,000+	~$1.62	~$972,000+

The starting minimum is typically 250 to 500 assets; Rapid7 does not quote InsightVM for smaller deployments. Teams below that threshold are directed to Nexpose Express (on-premises perpetual license) or Nexpose Community Edition (free, supports up to 32 IPs). For teams already running Nexpose on-premises, migration to the InsightVM cloud console is included in standard support contracts (Ciphers Security, September 2026).

Hybrid deployment and the infrastructure cost that is rarely itemized

InsightVM is hybrid, not SaaS, which is the single most common cost-comparison error. You host a Security Console running a PostgreSQL database, and Rapid7's own sizing guidance calls for 12 CPU cores, 64 GB of RAM, and 2 TB of storage at 20,000 assets, rising to 256 GB of RAM and 8 TB of storage at 400,000 assets. You also host Scan Engines across your network segments. That is real capital and operational cost sitting on the buyer's side of the line, and it is the single most common omission when comparing InsightVM against cloud-native Qualys (TechBag, 2026).

For organizations already running Insight Platform SIEM or other Rapid7 cloud products, the Security Console may already be in place, which removes that capital cost. For greenfield deployments, the infrastructure line needs to be budgeted explicitly. Cloud-native competitors like Qualys do not require any customer-hosted infrastructure, which is why effective TCO comparisons between Rapid7 InsightVM and Qualys VMDR require careful apples-to-apples modeling of infrastructure, not just license (vendorbenchmark.com, 2026).

Rapid7 Insight Platform bundles and the Exposure Command position

Rapid7 now describes InsightVM as the technology powering Exposure Command, and the sales motion leads with the bundle. Exposure Command bundles InsightVM with InsightIDR (SIEM/XDR), InsightCloudSec (CNAPP), and Surface Command (EASM) under one Insight Platform license. Bundle discounts of 15 to 25 percent versus standalone purchases apply when two or more products are committed together with multi-year terms (Rapid7, September 2026).

Buyers who want the standalone InsightVM product (not Exposure Command) must ask for that quote specifically. The standalone license still exists but the sales motion is built around the bundle. The median Fortune 1000 Rapid7 subscription is approximately $385,000 annually across two to three products. Strategic enterprise deployments with the full platform plus custom services commonly reach $2.2M to $3.5M+ per year (vendorbenchmark.com, 2026).

Hidden costs and renewal uplift discipline

Three line items routinely push real first-year cost above the list price. Renewal uplift is the first: Rapid7 states around 3 percent annual uplift while customers commonly report 7 to 10 percent annual escalation. Buyers should fix the uplift contractually at 3 to 5 percent in the original contract. Professional services for initial deployment run 15 to 30 percent of the first-year license, depending on environment complexity. Storage expansion for the customer-hosted Security Console adds disk costs at scale (TechBag, 2026).

Asset scope creep is the second source of year-over-year cost growth. Cloud workloads and ephemeral assets accumulate quickly, and the per-asset count silently grows without a corresponding renewal conversation. The third line item is the additional Insight Platform modules (InsightIDR, InsightCloudSec, Surface Command) that get layered onto the initial contract once vulnerability management is operational. Buyers should negotiate all modules into a single multi-year contract at signing rather than adding them at renewal, where per-asset pricing restarts at the higher list rate (vendorbenchmark.com, 2026).