Rapid7 Explained: InsightVM in Exposure Command, Scan Engines versus the Rapid7 Agent, and Remediation Hub

Rapid7 sells vulnerability management, detection and response, and attack surface management. Its products were renamed between 2024 and 2026. InsightVM, the vulnerability management product many engineers know, now sits inside Exposure Command. Using current names in an interview shows you have used the product recently.

What it is

Rapid7's 2026 product names:

• Exposure Command is the exposure management offering. Its vulnerability management engine is still InsightVM. Its packages add Surface Command (attack surface management) and, at the top tier, cloud and application security.
• Remediation Hub sits inside Exposure Command and prioritises remediation work.
• Incident Command is a SIEM launched in July 2025 on the Command Platform (formerly the Insight Platform). Rapid7 has also continued to describe InsightIDR as its SIEM.
• The Rapid7 Agent (formerly Insight Agent) collects asset data for both vulnerability management and detection.

Wael Mohamed became chief executive on 1 June 2026. Rapid7 has also owned the open-source Metasploit Project since 2009.

How it works

Scan Engines run discovery and vulnerability scans across networks. Unauthenticated scans see the network-facing view; authenticated scans add local, remote and policy checks. The Rapid7 Agent runs local checks only, collects data on its own schedule rather than through scheduled scans, and only reports on the host it is installed on. When both assess the same asset, Rapid7 merges the results and can skip authenticated checks that the agent recently performed.

How to use it

Day one: place engines and agents

Deploy Scan Engines in each network segment, with credentials for authenticated scanning stored in the console, and deploy the agent to laptops, cloud instances and servers where storing credentials is undesirable. Run discovery scans to build the asset list.

Week one: coverage and context

1. Check authentication success on scans; failed logins quietly turn an authenticated scan into a remote-only one.
2. Tag assets with owner, environment and criticality, so Remediation Hub can prioritise by business importance.
3. Connect Surface Command if licensed, and compare what it sees from the internet with what your scans know about.

Every day: work Remediation Hub

Use Remediation Hub to group findings into remediations, meaning the specific update or configuration change that clears many findings at once. Order them by risk, exploitability and asset criticality. Assign them to owners or create tickets. Verify with the next scan or agent collection, and report time to remediate rather than raw counts.

Where it stops

• Agents do not scan networks. Network devices, appliances and exposed services need Scan Engines.
• Naming in transition. Documentation, contracts and the console may use old and new names side by side, which complicates training and procurement.
• Prioritisation needs your context. Untagged assets cannot be weighted by business importance.
• Detection versus exposure. Exposure Command and Incident Command are separate products with separate data; check what your licence includes.

How it comes up in interviews

• "When would you use an agent versus an authenticated network scan?" Roaming hosts and credential handling against network checks and device coverage.
• "How do you know your scanning is complete?" Compare discovery results with the inventory, monitor authentication failures, and look outside-in for assets you did not know about.
• "Remediation by vulnerability or by fix?" Grouping by fix reduces the work a team actually has to do.

Sources

Checked on 13 November 2026: Rapid7 page "InsightVM is now part of Exposure Command"; Rapid7 documentation comparing the Scan Engine and Insight Agent, the Insight Agent overview and Remediation Hub; Rapid7 blog introducing Remediation Hub (19 November 2024); Rapid7 press releases on Incident Command (29 July 2025), the appointment of Wael Mohamed as chief executive, and the Kenzo Security acquisition (26 March 2026).