Rapid7 Insight VM

Service scope

Software add-on or extension: No
Cloud deployment model: Public cloud
Service constraints: N/a
System requirements: Supported operating systems

Supported web browsers

Recommended hardware sizing

Ports for communication between agent, engines, console, and cloud

Detailed system requirements at: https://www.rapid7.com/products/insightvm/system-requirements/

User support

Email or online ticketing support: Email or online ticketing
Support response times: "We have established the following Service Level Objectives (SLOs) that govern our response and communication processes. The following time frames are relative to your time zone.
Severity-1 “Critical”: < 2 Hours initial response, 4 Business Hours update cadence
Severity-2 “High”: < 4 Business Hours initial response, 3 Business Days update cadence
Severity-3 “Medium”: < 12 Business Hours initial response, 5 Business Days update cadence"
User can manage status and priority of support tickets: Yes
Online ticketing support accessibility: None or don’t know
Phone support: Yes
Phone support availability: 24 hours, 7 days a week
Web chat support: No
Onsite support: Yes, at extra cost
Support levels: https://www.rapid7.com/globalassets/_pdfs/whitepaperguide/rapid7-customer-support-guidebook.pdf/
Describes how R7 support works, we have a technical Account Management team and the details can be found here.
https://www.rapid7.com/contentassets/27cecc8df3274f698972f0c2a69e6b40/rapid7-technical-account-management-support-brief.pdf/
Support available to third parties: Yes

Onboarding and offboarding

Getting started: Rapid7 offers online help, free webinars, and formalized, curriculum-based training for Rapid7 products including hands-on technical lab exercises. Rapid7 offers a flexible training model available in virtual open enrollment, virtual dedicated and on-site classroom formats. Custom training is also an option for your organization. We build a class or entire curriculum suited to your specific training objectives. Courses can include introductory or advanced product topics and can cover one or more products.
Service documentation: Yes
Documentation formats: HTML

PDF

Other
Other documentation formats: CSV
End-of-contract data extraction: If you opt to end your engagement with Rapid7, you have the opportunity to collect and transfer any data that is possible to export.
End-of-contract process: At the end of a contract, you will have the opportunity to collect and transfer any data possible to export. If you request that Rapid7 delete all of your data, the request will be processed within 14 days. No additional fees apply.

Using the service

Web browser interface: Yes
Supported browsers: Internet Explorer 11

Microsoft Edge

Firefox

Chrome
Application to install: Yes
Compatible operating systems: Linux or Unix

Windows

Other
Designed for use on mobile devices: No
Service interface: Yes
User support accessibility: None or don’t know
Description of service interface: The Home page of the Security Console includes several informational panels reflecting the assessment of risk in your environment along with your existing configurations. The data you accumulate and settings you configure will populate this space. Default items include:
• Risk and Assets Over Time
• Sites
• Current Scans for All Sites
• Asset Groups
• Asset Tags
Accessibility standards: None or don’t know
Description of accessibility: N/a
Accessibility testing: None
API: Yes
What users can and can't do using the API: InsightVM offers the InsightVM Application Programming Interface (API) Version 3. This API supports the Representation State Transfer (REST) design pattern. Unless noted otherwise, this API accepts and produces the application/json media type. This API uses Hypermedia as the Engine of Application State (HATEOAS) and is hypermedia friendly. All API connections must be made to the security console using HTTPS.
API documentation: Yes
API documentation formats: Open API (also known as Swagger)
API sandbox or test environment: No
Customisation available: Yes
Description of customisation: InsightVM is highly configurable to meet specific customer requirements. Users can customise dashboards, reports, scan schedules, scan templates, configurate and compliance policy templates, alerts, sites, asset groups, role based access controls, and more.

Scaling

Independence of resources: Cloud components are hosted in AWS. Rapid increases in CPU, memory, storage, and networking capacity are performed on demand to meet the scaling and performance needs of enterprise customers.

Analytics

Service usage metrics: Yes
Metrics types: Platform availability is provided at https://status.rapid7.com
Reporting types: Real-time dashboards

Resellers

Supplier type: Reseller providing extra support
Organisation whose services are being resold: Rapid7

Staff security

Staff security clearance: Other security clearance
Government security clearance: None

Asset protection

Knowledge of data storage and processing locations: Yes
Data storage and processing locations: Other locations
User control over data storage and processing locations: Yes
Datacentre security standards: Managed by a third party
Penetration testing frequency: At least once a year
Penetration testing approach: In-house
Protecting data at rest: Other
Other data at rest protection approach: Details available on request
Data sanitisation process: Yes
Data sanitisation type: Explicit overwriting of storage before reallocation
Equipment disposal approach: A third-party destruction service

Data importing and exporting

Data export approach: N/a
Data export formats: CSV
Data import formats: CSV

Data-in-transit protection

Data protection between buyer and supplier networks: TLS (version 1.2 or above)
Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

Guaranteed availability: During the term of Customer’s subscription, the Service will perform in accordance with and subject to the Service Level Agreement (“SLA”) documented at https://www.rapid7.com/legal/sla/. Rapid7’s target is 100% System Availability. If the System Availability during a given month is less than 99.95%, Customer may be eligible for a credit as detailed below (“Service Credit”), which is the sole and exclusive remedy for any failure to meet the SLA.
Approach to resilience: "Rapid7 maintains a Business Continuity Plan for the Insight platform. The primary goal of this plan is to ensure organizational stability, as well as coordinate recovery of critical business functions in managing and supporting business recovery in the event of disruption or disaster. Thus, the plan accomplishes the following:
Ensures critical functions can continue during and after a disaster with minimal interruption;
Identifies and decreases potential threats and exposures; and
Promotes awareness of critical interdependencies.
We can share a high-level overview of our Business Continuity Plan for the Insight platform upon request."
Outage reporting: Service status is available at status.rapid7.com. Users may elect to subscribe to notifications from this site.

Identity and authentication

User authentication needed: Yes
User authentication: 2-factor authentication
Access restrictions in management interfaces and support channels: "The Insight Platform provides an internal authentication mechanism as well as integration with external authentication sources for authentication, minimizing user management overhead. Authorized permissions are determined by a user’s assigned role-based access control (RBAC).
The application provides single-sign-on authentication with the following sources:
• LDAP (including Microsoft Active Directory)
• Kerberos
• SAML 2.0 via external identity provider (IdP-initiated login only)
The application also continues to support its two internal user account stores:
• XML file lists default “built-in” accounts.
• Datastore lists standard user accounts, which are created by a global administrator."
Access restriction testing frequency: At least once a year
Management access authentication: 2-factor authentication

Username or password

Audit information for users

Access to user activity audit information: You control when users can access audit information
How long user audit data is stored for: User-defined
Access to supplier activity audit information: Users contact the support team to get audit information
How long supplier audit data is stored for: At least 12 months
How long system logs are stored for: At least 12 months

Standards and certifications

ISO/IEC 27001 certification: No
ISO 28000:2007 certification: No
CSA STAR certification: No
PCI certification: No
Cyber essentials: Yes
Cyber essentials plus: Yes
Other security certifications: Yes
Any other security certifications: SOC 2 type 2

Security governance

Named board-level person responsible for service security: Yes
Security governance certified: No
Security governance approach: Details available on request
Information security policies and processes: "The Information Security and Information Technology groups are responsible for monitoring compliance with data security policies and procedures. Users found in violation of information security policies may be subject to disciplinary action, up to and including 1) removal from any access to company or customer assets, data, or systems, 2) termination of employment, and/or 3) legal action. When required, Information Security will work with Legal and People Strategy to address any instance of non-compliance.

We use a SaaS product to manage and control relevant Information Security policies, which includes version control editors and full audit history. Rapid7 employment policies are documented in an internal employee handbook."

Operational security

Configuration and change management standard: Supplier-defined controls
Configuration and change management approach: Rapid7 applies a systematic approach to managing change so that changes to services impacting Rapid7 and our customers are reviewed, tested, approved, and well communicated. Separate change management processes are in place for corporate IT systems and Insight platform systems to ensure changes are tailored to the specifics of each environment. The goal of Rapid7’s change management process is to prevent unintended service disruptions and to maintain the integrity of services provided to customers. All changes deployed to production undergo a review, testing, and approval process.
Vulnerability management type: Supplier-defined controls
Vulnerability management approach: The Information Security team is continuously monitoring the Rapid7 network and our product environments in accordance with formally documented vulnerability management processes and procedures. Information Security conducts vulnerability scans on a continuous basis, at least weekly. Rapid7 begins immediate action following the identification of critical vulnerabilities and generally completes the process in well under 48 hours.
Protective monitoring type: Supplier-defined controls
Protective monitoring approach: "We use InsightIDR to monitor for suspicious and malicious behavior across our user endpoints, networks, servers, and cloud services. Our InsightIDR configuration uses a combination of user behavior analytics, attacker behavior analytics in the form of curated threat intelligence, and custom alerts.

We only monitor systems that Rapid7 has implemented in our hosting environments and platform, not systems that customers deploy themselves within their environment."
Incident management type: Supplier-defined controls
Incident management approach: "There is a formal Incident Management process in place and we can provide our Incident Response policy. Incidents are handled by the Information Security team and are escalated to Rapid7's in-house Incident Response team when necessary.

Rapid7 uses InsightIDR to monitor on-premises and cloud environments for security incidents. Information Security partners with the MDR and Incident Response services teams to supplement Rapid7’s incident response program. InsightIDR alerts are regularly reviewed by analysts and escalated via a paging system when indications of potentially malicious activity are detected."

Secure development

Approach to secure software development best practice: Supplier-defined process

Public sector networks

Connection to public sector networks: No

Social Value

Fighting climate change

We take our environmental management and the impact we have on the environment very seriously. We have environmental policies in place and hold the ISO14001 accreditation. Our environmental assessments are conducted annually by an external Lead ESOS Assessor; they are signed-off by the board and compliance reported to the regulator (the Environment Agency). Our environmental policy is published on our website at https://www.bytes.co.uk/company/sustainability/environmental.
Bytes achieved carbon net zero in March 2022 through approved carbon offsetting schemes. We are always seeking to reduce our impact on the environment. We aim to minimise waste, reduce pollutants and use renewable materials. Our offices have recycling facilities for cans, plastic and paper. We aim to reduce our office printing to zero within the next few years.
An Environmental Steering Committee has been established to coordinate environmental activities and drive change.
To drastically reduce our emissions, we have switched to renewable energy. Our Head Office has reached our first milestone of using a specialist 100% renewable electricity provider. We are also exploring options to install solar panels on our Headquarters building.
Other environmental initiatives include installing electric vehicle charging points and encouraging staff to commute to work without the car (setting up a car share network and installing secure cycle parking).
We produce a SECR (Streamlined Energy and Carbon Reporting) report that details the companies energy consumption and carbon emissions. This report is produced annually by an independent assessor.
This report provides details of our emissions in Scope 1, 2 and 3 categories. It details the activities previously taken to reduce emissions and also recommendations for further improvements.
For scope 1,2 and 3 emissions we aim to reduce these by 50% by 2025-2026 from our 2021 baseline.
We aim to be Net Zero by 2040, covering our own operational emissions.

Pricing

Price: £7.38 a unit a year
Discount for educational organisations: Yes
Free trial available: Yes
Description of free trial: We can offer this as a free 30 day trial of the product.

Features

Benefits

Service documents

Framework

Service ID

Contact

Service scope

User support

Onboarding and offboarding

Using the service

Scaling

Analytics

Resellers

Staff security

Asset protection

Data importing and exporting

Data-in-transit protection

Availability and resilience

Identity and authentication

Audit information for users

Standards and certifications

Security governance

Operational security

Secure development

Public sector networks

Pricing

Service documents

Cookies on Digital Marketplace

Rapid7 Insight VM

Features

Benefits

Pricing

Service documents

Framework

Service ID

Contact

Service scope

User support

Onboarding and offboarding

Using the service

Scaling

Analytics

Resellers

Staff security

Asset protection

Data importing and exporting

Data-in-transit protection

Availability and resilience

Identity and authentication

Audit information for users

Standards and certifications

Security governance

Operational security

Secure development

Public sector networks

Social Value

Pricing

Service documents