# Rapid7: how AI models rank it, November 2026

Gane Index, November 2026 Edition. Named in 36 judge labels across 8 categories by 12 of 14 models. Page: https://www.gane.ai/index/it/vendors/rapid7

## Standing by category

| Category | Share | Rank | Negative rate | Labels |
|---|---|---|---|---|
| [Penetration testing as a service](https://www.gane.ai/index/it/security/penetration-testing-as-a-service/index.md) | 0% | 14 | 9% | 22 |
| [Breach and attack simulation](https://www.gane.ai/index/it/security/breach-and-attack-simulation/index.md) | 0% | 23 | 0% | 4 |
| [Attack surface management](https://www.gane.ai/index/it/security/attack-surface-management/index.md) | 0% | 36 | 0% | 3 |
| [Application security posture management](https://www.gane.ai/index/it/developer/application-security-posture-management/index.md) | 0% | 45 | 0% | 2 |
| [Identity threat detection and response](https://www.gane.ai/index/it/identity/identity-threat-detection-and-response/index.md) | 0% | 74 | 0% | 2 |
| [Cloud security posture management](https://www.gane.ai/index/it/cloud/cloud-security-posture-management/index.md) | 0% | 65 | 100% | 1 |
| [Endpoint detection and response](https://www.gane.ai/index/it/security/endpoint-detection-and-response/index.md) | 0% | 29 | 0% | 1 |
| [Endpoint protection](https://www.gane.ai/index/it/operations/endpoint-protection/index.md) | 0% | 54 | 0% | 1 |

## What the models said for it

- "Rapid7 provides managed penetration testing through their Penetration Testing as a Service (PTaaS) platform" (Claude Haiku 4.5, PTaaS)
- "Choose Bishop Fox or Rapid7 if you are a primary target for nation-state actors." (Claude Haiku 4.5, PTaaS)
- "NetSPI / Synack / Rapid7 for regulated and high-assurance environments" (Muse Glimmer 30B, PTaaS)
- "The Best for Enterprise-Lite Capabilities: Rapid7 (InsightVM)" (Qwen 3.7 Flash, ASM)

## And against it

- "Mixed impressions of larger platforms like Rapid7, with one commenter saying "My impression was that they were just average at best."" (Muse Glimmer 30B, PTaaS)
- "older versions of broader security suites (e.g., some from Qualys, Rapid7, or Tenable if not updated)" (Grok 4.20, CSPM)
- "traditional firms like Rapid7 or NetSPI might feel less "as-a-service" for ongoing needs" (Grok 4.20, PTaaS)

## By model

| Model | First choice | Alternative | Mention | Warning | Labels |
|---|---|---|---|---|---|
| Claude Haiku 4.5 | 0 | 2 | 4 | 0 | 6 |
| GPT-5.4 mini | 0 | 0 | 0 | 0 | 0 |
| Gemini 3.5 Flash | 0 | 0 | 0 | 0 | 0 |
| Perplexity Sonar | 0 | 0 | 2 | 0 | 2 |
| Grok 4.20 | 0 | 2 | 0 | 2 | 4 |
| Mistral Small | 0 | 0 | 2 | 0 | 2 |
| DeepSeek V4 Flash | 0 | 1 | 2 | 0 | 3 |
| Llama 4 Maverick | 0 | 0 | 3 | 0 | 3 |
| Qwen 3.7 Flash | 0 | 2 | 1 | 0 | 3 |
| Kimi K2 | 0 | 0 | 1 | 0 | 1 |
| GLM 4.7 FlashX | 0 | 0 | 1 | 0 | 1 |
| MiniMax M2.5 | 0 | 0 | 4 | 0 | 4 |
| GPT-6 Luna | 0 | 0 | 1 | 0 | 1 |
| Muse Glimmer 30B | 0 | 1 | 4 | 1 | 6 |

## Sources returned with these answers

The sites and pages cited by the answers that named Rapid7, from 63 of the 76 answers that named it (only the models that return a source list).

### Domains cited

- stingrai.io: 19
- g2.com: 17
- cloudsecuritypartners.com: 14
- techrepublic.com: 14
- clutch.co: 13
- cybri.com: 12
- hackernoon.com: 12
- softwaretestinghelp.com: 12
- netragard.com: 11
- reddit.com: 11

### Pages cited

- https://cloudsecuritypartners.com/blog/best-penetration-testing-companies: 14
- https://clutch.co/it-services/cybersecurity/penetration-testing: 13
- https://techrepublic.com/article/best-penetration-testing-companies: 13
- https://hackernoon.com/penetration-testing-companies-comparing-the-top-5-vendors: 12
- https://cybri.com/blog/best-network-penetration-testing-companies: 10
- https://msppentesting.com/blog-posts/best-penetration-testing-companies: 9
- https://echeloncyber.com/2026-guide-best-penetration-testing-companies-in-us: 8
- https://netragard.com/blog/best-penetration-testing-companies: 8

## In its own words

What Rapid7's own pages state, read 2026-09-28. Stated by the vendor, not checked by the index.

- Positioning: Managed cybersecurity: Outpace Attackers. The only endpoint to cloud, unified cybersecurity platform. (https://rapid7.com/)
- For: security teams (https://www.rapid7.com/platform)
- Price stated: Pick your product or solution - explore pricing - contact us - confirm your plan. (https://www.rapid7.com/pricing)
- Starting price: $1.62/mo for 500 assets, per asset (https://www.rapid7.com/pricing)
- Free plan or trial: Attack Surface Management Free Trial; InsightVM Free Trial (https://rapid7.com/)
- Customers named: Arcadis, EVRi, AAA Northeast, Chemung Canal Trust Company, Lake City Bank, Venbrook Group, British Land, SO Energy

## What it publishes

Every page rapid7.com exposes, read 2026-09-29: 31916 addresses. By kind, pages and the last 90 days:

- blog: 2030 pages, 20 in the last 90 days, latest 2026-09-28
- case study: 83 pages, 0 in the last 90 days, latest 2025-01-01
- webinar or virtual event: 11 pages, 0 in the last 90 days, latest 2025-02-01
- conference or event: 58 pages, 0 in the last 90 days, latest 2025-05-01
- report or ebook: 28 pages, 0 in the last 90 days, latest 2018-09-01
- comparison: 31 pages, 0 in the last 90 days, latest 2025-04-01
- template or tool: 1 pages, 0 in the last 90 days, latest 2022-06-01
- glossary or explainer: 281 pages, 0 in the last 90 days, latest 2017-05-01
- podcast or video: 2 pages, 0 in the last 90 days, latest 2019-10-01
- news or press: 296 pages, 0 in the last 90 days, latest 2018-06-01
- Recent: 2026-09-28 blog: Etr zero day exploitation of citrix netscaler adc and gateway cve 2026 88771 and cve 2026 88772 https://www.rapid7.com/blog/post/etr-zero-day-exploitation-of-citrix-netscaler-adc-and-gateway-cve-2026-88771-and-cve-2026-88772
- Recent: 2026-09-25 blog: Pt metasploit wrap up belgian waffles chocolates and modules frites https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-belgian-waffles-chocolates-and-modules-frites
- Recent: 2026-09-24 blog: Ve business email compromise rewriting reality zimbra cve https://www.rapid7.com/blog/post/ve-business-email-compromise-rewriting-reality-zimbra-cve
- Recent: 2026-09-23 blog: Em dynamic application security testing dast validates risk at runtime idc marketscape https://www.rapid7.com/blog/post/em-dynamic-application-security-testing-dast-validates-risk-at-runtime-idc-marketscape
- Recent: 2026-09-23 blog: Etr cve 2026 94127 critical unauthenticated rce in f5 big ip apm https://www.rapid7.com/blog/post/etr-cve-2026-94127-critical-unauthenticated-rce-in-f5-big-ip-apm
- Recent: 2026-09-15 blog: Etr cve 2026 76461 critical cisco secure email gateway vulnerability exploited in the wild https://www.rapid7.com/blog/post/etr-cve-2026-76461-critical-cisco-secure-email-gateway-vulnerability-exploited-in-the-wild

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, November 2026 Edition, www.gane.ai/index/it.