Rapid7 InsightAppSec Reviews

We use the solution for testing before deployment on customers and looking for some issues when customers need to verify the problem with using that product. Basically, it's for testing before deployment. 

AppSec is a Software as a Service. So we don't need to upgrade it.

It is easy to use and deploy to the customer.

The recorder for the login sequence to the customer application is great.

The solution is stable.

It is very easy to scale. Users can expand it if they need to.

We'd like to see integrations with WAF solutions. That could be improved. 

Rapid7 has a new solution to test a secure application and integrate with the secure application, however, sometimes, our customer has a Web Application Firewall externally.

I've been using the solution for three years. I've used it for a while now. 

The stability has been very good. I would rate it five out of five in terms of reliability. It doesn't crash or freeze. There are no bugs or glitches. The performance is good. 

It's quite simple to scale the product. You just have to define a new application, and that's all. I'd rate it five out of five in terms of ease of deployment. 

Three of us are using the solution right now. 

Technical support has been very helpful and responsive. We are satisfied with their level of support.

Positive

The initial setup is very straightforward and simple. It's not a complex process. 

We only need three people to deploy the solution.

The process only takes a few days. It depends on the number of secured applications of the customer. When the customer has a small setup, it's faster.  

We only need one or maybe two people to maintain the solution. 

We provide deployments for customers. We can handle implementations. 

I'm on the technical side and therefore do not directly deal with costs or licensing. I'm not sure how much we pay or what the licensing agreement is.

We're a partner. 

We support our customers with products from Rapid7 and Tenable. We provide support to our clients.

I'd rate the solution nine out of ten. 

We use Rapid7 for application security. We use it ourselves and we also provide services for our customers. The primary use is for checking security assessments of web applications. If you need code scanning or API integration, then AppSec provides these options.

This product is easy to use.

It uses a signature-based method to check for problems with your code and will provide an alert if anything is found. It will also give recommendations as to how to fix the issues.

The performance can be improved.

I would like a facility to monitor applications after they have been scanned. For example, when new programming is done, an application should be scanned again because sometimes they add a lot of pages and can affect it. The application should be monitored to protect you from future attacks or mistakes made by the developer team.

In the future, if they can have integration with a lot of ticketing systems then it would be amazing. This would mean that if you're using any ticketing system, then because the application is already integrated with it, and if there's an issue with the web application, it will automatically open a support ticket for the development team.

I have been working with Rapid7 InsightAppSec for two years.

I have not had any trouble with bugs or glitches.

The scalability is good.

The technical support is amazing. I have been in contact with the local office in Dubai, and they are very good.

It is a cloud-based solution so the initial setup is very simple.

You have an account, so you add the website to the application, and you should add your own website so that it has the authorization to scan your whole application.

The price of this product is very cheap. A trial version is available for 60 days, where the reports and problem fixes are available for free.

This is a product that I recommend and my advice for anybody who is interested in trying it, there is a free 60-day trial period where they will fix your problems without any payment. That will give you the opportunity to experiment with and gain experience scanning web applications.

I would rate this solution a ten out of ten.

We primarily used the solution to help us with analysis on our customer website. We also used it for our internal website in order to check security.

The way the solution arranged the web scanning was the most valuable aspect for us.

The reporting is definitely an aspect of the solution that's in need of some work. We found that we'd try to use widgets, but often getting them to work for us wasn't very clear. They need to be more user friendly or offer better instructions. 

The solution needs to have a softcore scan or scan that integrates better with the content.

In total, I've used the solution for about one year.

The solution is stable. It's good in terms of stability. That's not really any cause for concern. For users, if the internet connection becomes an issue, they will run into problems. If the internet is interrupted, they will have to re-scan. For us, we had some issues and had to reconfigure part of the scan. I'm not sure if the bandwidth of the internet was an issue on our side (in the office) or if something was happening with Rapid7. 

It's quite easy to scale up for businesses that need to grow out the product. Users can just buy more licenses. It's quite easy, but of course, it will cost more. That would be the only prohibitive factor for some people or companies.

We would sometimes need to reach out to technical support. This was only in instances when the product would crash or come down. Overall, I can say they were pretty good. We didn't have any issues with them and always found them helpful.

We haven't used a similar product to Rapid7. This was our first time using this type of technology, so we have nothing to compare it to.

The initial setup for us was easy enough. We didn't face too many issues. Deployment took maybe 30 minutes. It's quite quick and doesn't cause too much trouble at the outset.

One or two people handled the deployment process. You don't need too many people or too many work hours to get everything up and running.

We didn't need any outside help. Our company is quite technical and we have an IT engineer as part of the team. We have the knowledge in-house to handle implementations in general.

We had a yearly license for a team of five or six people. I'm not sure what the cost was for Rapid7 overall as I don't handle the finances in my company.

I'm not sure of what version of the solution we had been using at our organization previously. As of right now, the license has expired on Rapid7. We haven't been using it for about one month. It hasn't been too long since we stopped with regular usage.

We used Rapid7's cloud when we were running the program.

We had a team of about five or six people that had access to the product when we were using it.

If a company needs an effective product for web scanning, I can recommend this product. It's a great product. We found it to be quite effective in that regard. However, it did not help us to understand the web availability. This was something it lacked.

I would rate the solution eight out of ten.

The primary use case is vulnerability scanning and discovering.

• Visibility
• Realization of how my systems are developed.
• An identification of vulnerabilities.

How it integrates with the rest of my systems. I like how they have done some scanning which is reaching into my environment.

I would like more details of what the product can do.

For the new vulnerabilities and information which comes out, I would like to see them do some specific in-house application testing for companies who do their own application development.

The technical support is very helpful. I have used them in the last month.

Our previous solution was not as robust, so we needed this solution in order to achieve our goals and objectives.

I think the initial setup was straightforward.

We did it ourselves.

We have seen measurable decrease in the mean time to respond to threats by 20 percent.

We have seen staff productivity increase by approximately one team member.

We were kind of adopted into this because a sister company of ours also had this solution. Therefore, we just integrated and adopted it instead of looking for others.

Give it a try. It exceeds my expectations, and I'm curious to see what else they can release.

To scan our Web applications.

Opportunity to find vulnerabilities and procedures of remediation for our web applications,

The most common attack templates are easy to access and apply. For example, the OWASP 2017 template contains up to 64 opponent techniques that we can evaluate in our applications.

I find the AppSec interface for defining scans and targets a bit confusing at first, but with practice the logic of the operation flow is understood.

I have been using this solution for about four to six months.

We haven't had any issues about this.

Because is a cloud solution, scalability is not an issue.

We have not yet had experience with Insight AppSec support cases.

The initial setup is very easy and straightforward.