Rapid 7 (InsightIDR)

Name: Rapid 7 (InsightIDR)
Brand: Rapid7
Rating: 4.4 (85 reviews)

Rapid7 InsightIDR is a cloud-native security information and event management (SIEM) platform that centralizes log management, applies detections and user and entity behavior analytics (UEBA) for threat detection, and provides investigation and case-management workflows with optional endpoint telemetry and MDR/XDR integrations.

Est 2000|Valuation $1B|Raised $388.2M|36 Ref Customers

LinkedIn 225K|Website|Web traffic 713K|FTEs 2,613|HQ Boston, Massachusetts, US

MarketsSecurity Information and Event Management (SIEM)Endpoint Security (EPP/EDR)

Platform CoversSecurity Orchestration, Automation, and Response (SOAR)IT Asset Management (ITAM)

01Competitive Landscape

Narrative analysis

Where InsightIDR tends to provide value - Reduced operational overhead compared with on-premises SIEMs due to SaaS delivery. - Integrated investigation workflows and a consolidated interface for alerts and evidence. - DFIR-focused endpoint integration can assist incident response without separate DFIR infrastructure in select tiers. - Asset-based pricing presents a different economic model compared with ingest-based SIEMs. Where competitors often outperform InsightIDR - Splunk ES: stronger support for deep customization, large-scale data analytics, and bespoke content for organizations with dedicated Splunk skill sets. - Microsoft Sentinel: stronger positioning for organizations that are heavily invested in Microsoft/Azure and want native signal fusion and cloud-scale ingestion. - Specialist SIEM/UEBA vendors: some competitors offer more advanced UEBA or deeper enterprise-scale SIEM capabilities.

Pricing comparison (high-level)

- InsightIDR: Asset-based pricing can be more predictable for some organizations, but buyers should verify how Rapid7 defines an "asset" (e.g., servers, endpoints, cloud instances). - Sentinel: Ingest-based pricing is transparent per GB but can become expensive at high volumes; commitment tiers can mitigate costs but require forecasting. - Splunk ES: Pricing can be one of the primary barriers; costs can grow substantially with daily ingestion volume and additional features.

Market adoption and analyst signals

Rapid7 has been positioned as a leader in vendor-sponsored analyst evaluations for the SIEM category. Procurement teams should request full analyst reports and examine scoring criteria and trade-offs described in those analyses.

	Rapid7 InsightIDR	Microsoft Sentinel	Splunk Enterprise Security
Starting Price	Older public per-asset pricing examples were published historically; current "Incident Command" packaging may require a quote	Ingest-based billing (per GB) with pay-as-you-go and commitment tiers; pricing varies by region	Pricing is complex and often requires a quote; ingest/workload-based models can lead to high costs at scale
Best For	Organizations seeking a cloud-hosted SIEM with curated detection content, integrated investigations, and predictable asset-based economics	Organizations standardized on the Microsoft/Azure ecosystem seeking native signal integration and cloud-scale ingestion	Large enterprises requiring deep customization, large-scale analytics, and extensive ecosystem integrations, typically with higher administrative overhead
Key Strength	Asset-based pricing model, integrated investigation workflows, UEBA, and optional DFIR integration via Velociraptor in select tiers	Deep integration with Microsoft signals and Azure, flexible cloud scale, and broad connector ecosystem	High configurability, powerful query and correlation capabilities, and a mature marketplace of apps and integrations
Key Weakness	Reported limitations in reporting depth, query experience, noise/false positives, and automation features without InsightConnect; SCIM not supported for the Command Platform	Costs can rise substantially with high ingest volumes and non-Microsoft data sources can add complexity	High cost and operational overhead; requires specialized skills and can be expensive at scale

01Competitive Landscape

Narrative analysis

Where InsightIDR tends to provide value

Reduced operational overhead compared with on-premises SIEMs due to SaaS delivery.
Integrated investigation workflows and a consolidated interface for alerts and evidence.
DFIR-focused endpoint integration can assist incident response without separate DFIR infrastructure in select tiers.
Asset-based pricing presents a different economic model compared with ingest-based SIEMs.

Where competitors often outperform InsightIDR

Splunk ES: stronger support for deep customization, large-scale data analytics, and bespoke content for organizations with dedicated Splunk skill sets.
Microsoft Sentinel: stronger positioning for organizations that are heavily invested in Microsoft/Azure and want native signal fusion and cloud-scale ingestion.
Specialist SIEM/UEBA vendors: some competitors offer more advanced UEBA or deeper enterprise-scale SIEM capabilities.

Pricing comparison (high-level)

InsightIDR: Asset-based pricing can be more predictable for some organizations, but buyers should verify how Rapid7 defines an "asset" (e.g., servers, endpoints, cloud instances).
Sentinel: Ingest-based pricing is transparent per GB but can become expensive at high volumes; commitment tiers can mitigate costs but require forecasting.
Splunk ES: Pricing can be one of the primary barriers; costs can grow substantially with daily ingestion volume and additional features.

Market adoption and analyst signals

	Rapid7 InsightIDR	Microsoft Sentinel	Splunk Enterprise Security
Starting Price	Older public per-asset pricing examples were published historically; current "Incident Command" packaging may require a quote	Ingest-based billing (per GB) with pay-as-you-go and commitment tiers; pricing varies by region	Pricing is complex and often requires a quote; ingest/workload-based models can lead to high costs at scale
Best For	Organizations seeking a cloud-hosted SIEM with curated detection content, integrated investigations, and predictable asset-based economics	Organizations standardized on the Microsoft/Azure ecosystem seeking native signal integration and cloud-scale ingestion	Large enterprises requiring deep customization, large-scale analytics, and extensive ecosystem integrations, typically with higher administrative overhead
Key Strength	Asset-based pricing model, integrated investigation workflows, UEBA, and optional DFIR integration via Velociraptor in select tiers	Deep integration with Microsoft signals and Azure, flexible cloud scale, and broad connector ecosystem	High configurability, powerful query and correlation capabilities, and a mature marketplace of apps and integrations
Key Weakness	Reported limitations in reporting depth, query experience, noise/false positives, and automation features without InsightConnect; SCIM not supported for the Command Platform	Costs can rise substantially with high ingest volumes and non-Microsoft data sources can add complexity	High cost and operational overhead; requires specialized skills and can be expensive at scale