Rapid7 is one vendor. Your stack isn’t.
InsightVM now ships inside Rapid7 Exposure Command, priced per asset and built around Rapid7’s own scanners.
DefectDojo Pro pulls findings from Rapid7 and 500+ other tools into one deduplicated, prioritized queue, in the cloud, on-premises, or air-gapped.
A scanner’s platform vs. a system of action
Exposure Command is Rapid7’s exposure management platform, built on InsightVM scanning. DefectDojo Pro manages findings from whatever scanners you run, Rapid7’s included. Rapid7 details from rapid7.com, checked October 30, 2026.
| Capability | Rapid7 Exposure CommandInsightVM · Essentials and Ultimate | DefectDojo ProScanner-independent · System of action |
|---|---|---|
| Primary role | Exposure management built on Rapid7’s own vulnerability scanning and attack surface discovery | Scanner-independent unified vulnerability management and ASPM |
| Where findings come from | Rapid7 agents and network scanning, with integrations to security and IT tools | 500+ integrations, Rapid7 included, plus the Universal Parser for any JSON, CSV or XML |
| Deduplication | Consolidates Rapid7 asset, vulnerability, cloud and app findings into one risk model | Cross-tool matching and Dedupe Pools turn repeat reports from different scanners into one finding |
| Prioritization | Threat-aware active risk score; attack path analysis in Ultimate | Priority and Risk weigh EPSS, CISA KEV, reachability, exposure and business criticality |
| Remediation | Remediation Hub, workflows, SLAs and reporting | Two-way Jira, ServiceNow, Azure DevOps, GitHub, GitLab. Sensei opens fix pull requests |
| Deployment | Rapid7 Command Platform (cloud), with an on-premises Security Console for scanning | SaaS, or self-hosted on Docker Compose or Kubernetes, including air-gapped |
| Pricing model | Per asset, by asset type and package in scope | Based on findings volume, not asset count. Community Edition stays free |
Keep the scanner. Change what runs it.
InsightVM is good at finding host and network vulnerabilities. Your SAST, SCA, DAST, cloud and pen test findings still need somewhere to land, and that place shouldn’t belong to one scanner vendor.
Every scanner in one queue
InsightVM next to Snyk, Burp Suite, Wiz, Checkmarx and the rest of your 500+ supported tools, in one asset hierarchy.
One finding, not three
When InsightVM and another scanner report the same issue, cross-tool deduplication keeps one finding and one owner.
A ranking you can defend
EPSS, CISA KEV, reachability and business criticality decide the order, across every tool, not just Rapid7’s.
Fixes, not more tickets
Route findings to Jira or ServiceNow with SLAs. Add Sensei to open fix pull requests on GitHub, GitLab, Bitbucket and Azure DevOps.
Run it next to Rapid7 first.
Nothing gets ripped out on day one. Connect Rapid7, compare the queues, then decide what stays.
Connect Rapid7
Use the InsightVM connector for an on-premises Security Console, or the cloud connector for the Insight platform. Add InsightAppSec and InsightCloudSec if you run them.
Add the rest of your stack
Connect your SAST, SCA, DAST and cloud tools. Anything without a parser comes in through the Universal Parser.
Rebuild routing and SLAs
Recreate ticket routing and remediation SLAs per asset or organization, with Triage Engine rules doing the sorting.
Decide what stays
Keep InsightVM as one scanner among many, or replace it. Your findings and workflows stay in DefectDojo either way.
Straight answers
Does DefectDojo replace Rapid7?
It replaces the management layer. You can keep InsightVM scanning and send its findings to DefectDojo Pro, where they are deduplicated and prioritized alongside every other tool’s output.
Can DefectDojo import Rapid7 data?
Yes. DefectDojo Pro has connectors for InsightVM (on-premises Security Console and Insight cloud), InsightAppSec and InsightCloudSec. Every edition, Community Edition included, imports Nexpose XML 2.0 reports.
Is InsightVM still available?
Rapid7 now sells InsightVM as part of Exposure Command, in the Essentials and Ultimate packages. Existing customers are directed to their Rapid7 account team for contract and timeline changes.
Can we self-host DefectDojo?
Yes. DefectDojo Pro runs as SaaS or self-hosted with Docker Compose or Kubernetes, including air-gapped installs. Community Edition is free and self-hosted under the BSD-3-Clause license.
How is DefectDojo Pro priced?
On the volume of findings you process, not the number of assets you scan. Get a quote on the pricing page.