Rapid7 reports more than 11,500 customers worldwide and US$824 million in annual recurring revenue as of Q2 2026, according to its investor relations page. Its SEC Form S-1 states that Rapid7 was "initially incorporated in July 2000 in Delaware", was reincorporated in Delaware in October 2011, and lists principal executive offices at 100 Summer Street, Boston, Massachusetts. Almost none of that scale comes from penetration testing. Rapid7 is a vulnerability management and detection company that also sells consulting-led testing, and that distinction is what sends buyers looking.
This guide ranks eight alternatives and says plainly where Rapid7 is still the right answer. Every claim about Rapid7 below is drawn from Rapid7's own pages or from its filings, and where a figure is not published we write "not published" rather than estimating.
At a Glance: Rapid7 and the Best Alternatives in 2026
Vendor | HQ | Who tests | Published pentest price |
|---|---|---|---|
Rapid7 (benchmark) | Boston, Massachusetts | Rapid7 consultants | Not published |
1. Stingrai | Toronto, with a London office | Two named penetration testers per engagement, CREST-accredited firm; Snipe on web app scopes | US$3,000 or US$6,800 per assessment for one web application and associated APIs |
2. NetSPI | Minneapolis | 350+ in-house experts | Not published |
3. Cobalt | Boston | Cobalt Core, 500+ matched testers | US$3,500 per Autonomous Pentest |
4. BreachLock | New York, Amsterdam | In-house certified team | Not published |
5. Synack | Redwood City | Synack Red Team, 1,500+ researchers | Not published |
6. NCC Group | Global, 2,000+ colleagues | In-house consultants | Not published |
7. Praetorian | Austin, Texas | In-house engineers | Not published |
8. Intruder | London | Platform plus AI pentesting | From US$3,500 per test |
All cells were verified on each vendor's own pages on 5 September 2026. Source links appear in the full comparison table further down.
What Rapid7 Sells in 2026
Rapid7's product surface and its testing surface are two different businesses.
The platform. InsightVM is the vulnerability management technology that, in Rapid7's own words, "powers Exposure Command." Rapid7 describes it as "the vulnerability management you know, now connected with attack surface, cloud, and application risk in one Exposure Command view," and sums the change up as "Same scanner. More context." The packaging sits under Exposure Command, which lists three tiers, Surface Command, Exposure Command Essentials and Exposure Command Ultimate. That page sets out pricing principles ("Pay for what you use", "Grow without re-buying", "See usage clearly") but publishes no figures.
The services. The penetration testing services page covers network testing, web application testing, IoT and internet-aware device testing, social engineering, wireless and red team attack simulation. The credibility claims are genuine and specific: testers "provide direct contributions to Rapid7's Metasploit Project, the world's most used penetration testing tool," and consultants "spend up to 20% of bench time focused on attacker research and skill development." Rapid7's wider services line also includes incident response, managed detection and response, continuous red teaming, managed application security and managed vulnerability management.
That combination is the product. Rapid7 sells one vendor relationship across scanning, detection and testing.
Why Buyers Look for Rapid7 Alternatives
None of these are defects. They are consequences of building a platform company that also staffs a consulting practice, and all four are verifiable on Rapid7's own pages.
1. Testing is a service line, not a product. InsightVM has a product page, a package page and a trial. Penetration testing has a contact form. Teams that want a portal, a live findings feed and a retest workflow as part of the testing purchase are buying a different shape of thing.
2. No dollar figure is published anywhere in the path. Neither the Exposure Command pricing page nor the penetration testing services page carries a number. Budget comparison during procurement therefore requires a sales cycle before you can even rank quotes. Buyers working to an audit date routinely shortlist on published pricing first.
3. Scanning coverage is not penetration testing evidence. A vulnerability management deployment tells an auditor what was scanned. It does not demonstrate adversarial testing of authorization logic or multi-step business workflows, which is what a SOC 2 or PCI DSS assessor is looking for in a penetration test report. Buyers who assumed InsightVM covered the requirement discover the gap late.
4. Remediation automation is not published. Rapid7 routes findings into ticketing and remediation workflows. What is not published on its pages is automatic generation of fix pull requests, or a gating check that blocks a vulnerable merge. Engineering-led teams increasingly want the patch proposed in the pull request rather than a finding in a queue.
What Testing Actually Surfaces
Very few providers publish outcome data from their own engagements, which makes the shape of a real finding set hard to reason about during procurement. Stingrai's State of Penetration Testing 2026 analyses 1,206 verified findings across 55 penetration tests. Two numbers matter for this comparison. First, 92.7% of tests surfaced at least one High or Critical finding, which is the practical argument against treating a clean scan as an all-clear. Second, the false-positive rate across those findings was 0.74%, and the median time to fix a Critical was 10.5 days. Verification discipline and fix velocity are the two variables a scanning-first program tends to leave unmeasured.
The 8 Best Rapid7 Alternatives in 2026
1. Stingrai
A testing specialist, not a service line inside a platform company.
Stingrai is a global CREST-accredited penetration testing services company founded in Toronto, Canada in 2021, trusted by companies from startups to enterprises to meet audit requirements for SOC 2, ISO 27001, CMMC, PCI DSS and HIPAA. OSCE³, OSWE, OSEP, CREST CRT certified pentesters, who are also world-class security researchers and bug bounty hunters. Choose from fully human-led or hybrid (AI agents plus human penetration testers) engagements across web, API, mobile, AI and LLM, cloud, network, Active Directory and social engineering penetration tests and red team engagements.
Testing is the entire business rather than a consulting line beside a scanner. Two named penetration testers run each engagement, reviewed by the team lead and an engagement partner, with 18 published CVEs, Hall of Fame credit at Apple, Google, the US Department of Defense and the US Federal Reserve, and a founding member of Uber's offensive security team on the bench. Scope runs from authenticated web and API testing across every user role to mobile, AI and LLM systems, AWS, Azure with Entra ID and Google Cloud, internal and external network with segmentation testing, Active Directory, Wi-Fi, phishing and vishing, and red and purple teaming. Findings reach the PTaaS portal as they are confirmed, with live chat to the assigned testers, Jira and Slack push, retesting and an attestation letter and verified badge with every human-led and hybrid report. Explore the PTaaS platform.
The gap a Rapid7 buyer is usually trying to close is the one between a scan and an attack. Stingrai's penetration testers log in as each user role and chain what they find, so broken authorization, IDOR and business logic abuse show up next to the infrastructure findings, each with a working proof of concept and prioritized remediation guidance. Network testing covers the external perimeter, internal lateral movement and privilege escalation, and segmentation testing where a PCI DSS scope boundary has to hold, and Active Directory work follows ACL abuse, Kerberos and delegation paths up to domain admin.
Stingrai sells a one-time annual engagement when an audit date drives the purchase and a continuous program that tests every release, so replacing a consulting line does not mean changing buying models.
Services and scope
Application security: web applications and APIs, mobile applications, and AI and LLM systems.
Network and cloud security: internal and external networks, Active Directory, Wi-Fi, and cloud environments.
Social engineering: phishing campaigns and physical security assessments.
Adversary simulation: red teaming and purple teaming.
Delivery and evidence
Findings are posted to the portal as they are confirmed rather than held for a report, with live chat to the assigned penetration testers during the test and a push into Jira or Slack. Reports are redactable PDFs with a unified dashboard and analytics for executives, retesting of remediated findings is included, and every human-led and hybrid report ships with an attestation letter and a verified badge, which is what a SOC 2, ISO 27001 or PCI DSS 4.0 assessor asks to see and a scan export does not provide. CREST accreditation applies to Stingrai Inc. as a penetration testing service provider at firm level; it is separate from the CREST CRT certifications individual testers hold.
Where Snipe fits
Snipe is Stingrai's autonomous agent for web applications and their APIs only. A swarm of specialized agents covers recon, authentication, access control, business logic, injection and remote code execution, trained on more than 6,000 HackerOne Hacktivity disclosures and Stingrai's own testers' methodology, and it runs black-box, authenticated grey-box and white-box source review, raises AutoFix pull requests and can gate merges, the fix automation Rapid7 does not publish. The Autonomous tier is Snipe alone; on Hybrid, penetration testers test alongside it throughout the engagement. Mobile, AI and LLM, cloud, network, Active Directory, Wi-Fi, social engineering and red and purple team work is human-led.
Pricing and fit: US$3,000 Autonomous and US$6,800 Hybrid on the pricing page, each covering one web application and associated APIs, with network, cloud, Active Directory and red team scopes quoted through the Get a Quote form. Best for: teams that want a testing specialist with a published starting price and named testers rather than a consulting engagement scoped by contact form, bought one-time or continuously.
2. NetSPI
Minneapolis, Minnesota, US. Founded 2001. Penetration Testing as a Service across application, network, cloud, AI, mainframe, hardware and IoT, plus red team operations, detective controls testing, attack surface visibility and secure code review, delivered by "350+ experts" across "50+ pentesting services". On 2 September 2026 NetSPI and Synack announced a definitive agreement to merge, forming a combined company with well over US$200 million in revenue and an expected close in October 2026. If you are shortlisting either firm this quarter, ask how the combined roadmap affects your account.
Published pricing: not published. Best for: large enterprise programs consolidating many asset classes under one testing vendor. Source: netspi.com
3. Cobalt
San Francisco, US. Founded 2013. PTaaS across web, API, network, cloud and AI targets plus secure code review, delivered by the Cobalt Core, a community of more than 500 vetted testers matched to your stack by the platform. Engagements start in 3, 2 or 1 business days across the Standard, Premium and Enterprise tiers. One Cobalt Credit represents "the equivalent of 8 hours of offensive security testing", and Cobalt states that credits "do not roll over into the next contract."
Published pricing: one figure, US$3,500 per test for Cobalt Autonomous Pentest, described as a limited-time promotional offer. Tier pricing is quoted. Best for: the fastest route from scoping to an active test. Source: cobalt.io/pricing
4. BreachLock
New York, US, with a European office in Amsterdam. PTaaS, attack surface management, adversarial exposure validation and red team as a service on one platform, delivered by a team BreachLock describes as "Certified In-House, CREST, OSCP, OSCE and more". It advertises that you can "scope, schedule, and launch CREST-certified pentests in just 24 to 48 hours with unlimited retesting and audit-ready reporting", and publishes scale figures including 1,200+ organizations served across 20+ countries, 40,000 penetration test engagements and 100,000+ APIs tested.
Published pricing: not published. The Standard, Extended and Extensive tiers include 1, 2 and a custom number of free manual retests respectively. Best for: an audit-ready report from an in-house team, scoped fast. Source: breachlock.com/pricing
5. Synack
Redwood City, California, US. Positions as "AI Finds More. Humans Prove What Matters." Testing is delivered by the Synack Red Team, "over 1,500 of the world's most skilled and trusted security researchers", with Sara AI Pentesting, the Synack Autonomous Red Agent, layered on top. Published outcome claims include 32% lower pentesting costs, 22 days saved per pentest, 47% faster vulnerability remediation and a 99.98% noise filtration rate. Its federal track record is the deepest on this list. The pending NetSPI merger applies here too.
Published pricing: not published. Best for: federal, defense and public-sector programs where the platform's authorization posture is a procurement requirement. Source: synack.com
6. NCC Group
Global consultancy with "over 2,000 colleagues". Its penetration testing services span application security, network testing, cloud, hardware, blockchain, cryptographic services and continuous testing, and its accreditation set includes NCSC CHECK, CREST, UKAS and Cyber Scheme. It publishes "1000+ days dedicated to research annually".
Published pricing: not published. Best for: regulated UK and European programs where CHECK or CREST scheme membership is written into the requirement. Source: nccgroup.com
7. Praetorian
Austin, Texas, US. Offensive security engineering across application, cloud, network, AI and machine learning, IoT and hardware, and automotive targets including in-vehicle networks and V2X communications, delivered on what the company calls "our proprietary offensive security platform". Its published claims are "Zero False Positives, every finding verified by an expert", "70% Faster MTTR" and "100% Compliance Coverage, FDA, GLBA, HIPAA, NERC, PCI-DSS & more".
Published pricing: not published. Best for: deep engineering-grade testing of unusual targets, particularly embedded, automotive and machine learning systems. Source: praetorian.com
8. Intruder
London, UK. Founded 2015. Describes itself as "a single platform for AI pentesting, attack surface monitoring, cloud security and vulnerability management", covering continuous external scanning, cloud and container checks, internal scanning by agent and emerging threat scans. This is the closest like-for-like replacement for the InsightVM half of a Rapid7 stack, with an on-demand test attached.
Published pricing: AI-powered web application pentests "Starting from $3,500 / test". Platform tier prices are not shown on the pricing page. Best for: lean teams replacing a heavyweight vulnerability management deployment with always-on scanning. Source: intruder.io/pricing
How It Compares: Rapid7 Side by Side
Rapid7 is compared here rather than ranked, because the post is about alternatives to it and a self-referential rank would be meaningless. Every cell below was read from the linked page on 5 September 2026.
Rapid7 | Stingrai | Source | |
|---|---|---|---|
Founded, HQ | "Initially incorporated in July 2000 in Delaware", reincorporated in Delaware October 2011; principal executive offices 100 Summer Street, Boston | 2021, Toronto with a London office | |
Core business | Vulnerability management, exposure management and managed detection | Offensive security only | |
Who tests | Rapid7 consultants, contributors to the Metasploit Project | Certified penetration testers working concurrently with Snipe | |
Testing delivery | Consulting engagement, scoped by contact form | Productized assessment with a published scope of one web application and associated APIs | |
Published pentest price | Not published | US$3,000 Autonomous, US$6,800 Hybrid, or US$650 and US$1,275 per month | |
Published platform price | Not published; Surface Command, Exposure Command Essentials and Ultimate tiers listed without figures | Not applicable | |
White-box source review | Not published as part of the pentest service line | Yes, Snipe scans application source alongside dynamic testing | |
Fix automation | Not published | AutoFix pull requests | |
Merge protection | Not published | Gating check on every pull request | |
Firm-level accreditation | Not published | CREST-accredited penetration testing service provider | |
Adjacent coverage | Incident response, MDR, continuous red teaming, managed application security, managed vulnerability management, IoT consulting | Penetration testing, red teaming and adversary emulation | |
Scale | 11,500+ customers, US$824M ARR as of Q2 2026 | Published vulnerability research, 5.0/5.0 across 20 Clutch reviews |
Where Rapid7 Is the Better Choice
Honest answer, and it is not a small category.
Platform consolidation. If you already run InsightVM, want Exposure Command context across cloud and application risk, and need managed detection and response on the same paper, buying testing from the same vendor removes a procurement cycle, a security review and a set of integrations. One contract, one account team, one renewal date has real value that a specialist cannot match.
Breadth of adjacent services. Incident response retainers, managed vulnerability management and IoT security consulting sit next to the testing practice. Teams that want a single partner across prevention, detection and response are buying the portfolio, not the pentest.
Metasploit lineage. Rapid7 stewards Metasploit and Velociraptor, two of the largest open-source security projects in use. Consultants who contribute upstream to the tooling the rest of the industry uses is a credible signal, and Rapid7 publishes it plainly.
Network and infrastructure heritage. Two and a half decades of vulnerability management gives Rapid7 unusually deep coverage of network and infrastructure assessment, especially in mixed estates where the asset inventory is the hard part.
If your constraint is instead depth on one application's authorization model, a published price you can approve without a sales call, or fixes that arrive as pull requests, the specialists above are built for that.
Buyer Checklist
Run these against every quote, including Rapid7's. Ask for written answers.
Is the price published, quoted, or bundled into a platform subscription? Three different budget conversations.
Who performs the test, and are they employees? Get the staffing model, not just the certification list.
Is source code in scope? Black-box only, or dynamic testing plus white-box review.
What does the AI actually do? Triage and deduplication, or exploitation and chaining. Our AI pentesting tools comparison sets out how to tell.
How do fixes reach engineering? A ticket, or a pull request with a patch and a gate on the next merge.
Are retests included, and for how long? A free retest that expires in 30 days is a different product from retesting included for the engagement.
Which exact control does the report satisfy? Match it to the clause your assessor will cite, whether that is PCI DSS 4.0 Requirement 11.4 or SOC 2 CC4.1.
Is the firm accredited, or are individuals certified? Different claims. Read our guide to verifying CREST accreditation.
Run your scope through the penetration testing cost calculator before you collect quotes, so you can tell an outlier from a scoping difference.
Frequently Asked Questions
What are the best Rapid7 penetration testing alternatives in 2026?
The eight strongest alternatives are Stingrai, NetSPI, Cobalt, BreachLock, Synack, NCC Group, Praetorian and Intruder. Stingrai is a CREST-accredited penetration testing service provider at firm level, founded in 2021 in Toronto with a London office, and testing is the entire business rather than a consulting line beside a scanner. Two named penetration testers run each engagement, reviewed by the team lead and an engagement partner; the team holds OSCE³, OSWE, OSEP, OSCP, CREST CRT and CISSP, has published 18 CVEs and is listed in the bug bounty Halls of Fame of Apple, Google, the US Department of Defense and the US Federal Reserve, and includes a founding member of Uber's offensive security team. Scope runs from authenticated web and API testing across every user role to mobile, AI and LLM systems, AWS, Azure with Entra ID and Google Cloud, internal and external network with segmentation testing, Active Directory, Wi-Fi, phishing and vishing, and red and purple teaming. Findings reach the PTaaS portal as they are confirmed, with live chat to the assigned testers, Jira and Slack push, retesting and an attestation letter and verified badge with every human-led and hybrid report. NetSPI is the pick for large enterprise programs across many asset classes, and Cobalt is the fastest route from scoping to an active test.
How much does Rapid7 penetration testing cost?
Rapid7 does not publish a price for penetration testing. The penetration testing services page routes to a contact form, and the Exposure Command pricing page lists Surface Command, Exposure Command Essentials and Exposure Command Ultimate without figures. For a published comparison point, Stingrai lists US$3,000 per Autonomous assessment and US$6,800 for Hybrid, Cobalt lists US$3,500 for its Autonomous Pentest, and Intruder lists AI pentesting from US$3,500 per test.
What are the alternatives to InsightVM for penetration testing?
InsightVM is vulnerability management, not penetration testing, so the honest answer is that it has two sets of replacements. For continuous scanning and attack surface coverage, Intruder is the closest like-for-like platform with published tiers. For penetration testing evidence an auditor will accept, you need a scoped engagement with a documented methodology, severity ratings and retested findings, which is what Stingrai, NetSPI, Cobalt, BreachLock and NCC Group sell. Most programs end up buying both.
Rapid7 vs Cobalt for penetration testing: which should I choose?
Cobalt is a productized PTaaS purchase and Rapid7 is a consulting purchase inside a platform relationship. Cobalt publishes tiers with 3, 2 and 1 business day start times, sells annual credit packages where one credit is the equivalent of 8 hours of offensive security testing, and publishes one figure, US$3,500 for its Autonomous Pentest. Rapid7 scopes by contact form and publishes no figure, but brings InsightVM, Exposure Command and managed detection under the same contract. Choose Cobalt for speed to a scoped test, Rapid7 for consolidation.
Is Rapid7 CREST-accredited?
Rapid7 does not publish a firm-level CREST penetration testing accreditation on its own pages, so treat any such claim as unverified until you check the CREST Marketplace directly. Among the alternatives here, Stingrai holds a firm-level CREST accreditation as a penetration testing service provider, NCC Group lists CREST alongside NCSC CHECK and Cyber Scheme, and BreachLock advertises CREST-certified pentests.
Does a vulnerability scan satisfy a SOC 2 or PCI DSS penetration testing requirement?
Generally no. Assessors distinguish between automated vulnerability scanning and penetration testing, and PCI DSS 4.0 in particular separates scanning requirements from the penetration testing requirement in section 11.4. A scan report shows coverage. A penetration test report shows adversarial testing of authorization logic and business workflows, with severity ratings and evidence that findings were retested. Most programs need both, which is why buyers who assumed InsightVM covered the requirement end up adding a testing vendor.
What does Rapid7 do better than a specialist pentest vendor?
Consolidation and adjacency. Rapid7 puts vulnerability management, exposure management, managed detection and response, incident response, continuous red teaming and consulting-led testing on one contract, serving more than 11,500 customers. It also stewards Metasploit and Velociraptor, and states that its consultants "spend up to 20% of bench time focused on attacker research and skill development". For a team that wants one vendor across prevention, detection and response, that is a genuine advantage a specialist cannot replicate.
Which Rapid7 alternative publishes a fixed penetration testing price?
Three do. Stingrai publishes US$3,000 per Autonomous assessment and US$6,800 for Hybrid, each covering exactly one web application and associated APIs, with monthly equivalents of US$650 and US$1,275 on a 12-month engagement. Cobalt publishes US$3,500 per test for its Autonomous Pentest as a limited-time offer. Intruder publishes AI pentesting from US$3,500 per test. NetSPI, BreachLock, Synack, NCC Group, Praetorian and Rapid7 itself all quote every engagement.
Which alternative is best for compliance evidence?
All eight produce reports used as evidence in SOC 2, ISO 27001 and PCI DSS programs. BreachLock is the fastest published route to a CREST-certified report against an audit date. NCC Group is the strongest fit where NCSC CHECK or a UK scheme is written into the requirement. Stingrai's penetration testing supports SOC 2, ISO 27001, HIPAA, PCI DSS 4.0, NIST SP 800-53 and 800-171, DORA and NIS2 programs, whether you buy a single annual engagement or a continuous program, and each human-led and hybrid report comes with named testers, an attestation letter, a verified badge and retesting of remediated findings. Ask every vendor for a redacted sample report and confirm retest evidence is included.
Related Reading
The Bottom Line
Rapid7 earns its position by being the platform a great many security teams already run. If InsightVM and Exposure Command are your inventory of record and managed detection sits on the same contract, buying testing from the same vendor is a defensible decision, and the Metasploit lineage is not marketing.
Buyers keep comparing because penetration testing inside a platform company is a service line, priced by conversation, without published fix automation. For business logic and authorization depth at a published price, with the patch proposed in the pull request and a guarantee on the Autonomous tier, Stingrai is the closest like-for-like upgrade. Compare packages on the Stingrai pricing page, book a free scoping call, or send your scope through the Get a Quote form.
