Tag Archives: Exposure Command

Unlocking MSSP Success: Why CTEM is Critical

Post Syndicated from Rapid7 original https://blog.rapid7.com/2025/03/14/unlocking-mssp-success-why-ctem-is-critical/

Co-authored by Thomas Green and Sid Nanda

What is Continuous Threat Exposure Management (CTEM)?

Unlocking MSSP Success: Why CTEM is Critical

Continuous Threat Exposure Management (CTEM) is a five-stage, continuous security program introduced by Gartner in 2022. It proactively assesses an organization’s exposure across networks, systems, cloud infrastructure, IoT devices, applications, and identities. Unlike traditional vulnerability assessments, CTEM prioritizes risk mitigation strategies and iteratively refines security postures through continuous validation and remediation.

By emphasizing offensive security techniques such as continuous red teaming and simulation-based testing, CTEM goes beyond basic vulnerability prioritization to identify and address weaknesses before adversaries can exploit them. The result is an adaptable, intelligence-driven security framework that enables organizations to transition from reactive defenses to proactive resilience.

Why Should Service Providers Care?

The MSSP market is increasingly competitive, and differentiation is critical. Gartner has identified CTEM as a key opportunity for MSSPs in 2024, emphasizing that “product leaders who differentiate their portfolios by offering services that result in prioritized remediation outcomes and measured reduction in exposure stand out in the crowded MSSP market.”

Moreover, the expansion of the attack surface – combined with the inability to patch all vulnerabilities in a timely manner -has made traditional vulnerability management insufficient. MSSPs must demonstrate how their services deliver tangible security benefits to customers. A well-structured CTEM program enables MSSPs to provide a continuous, data-driven security validation framework that reduces risk while aligning stakeholders across IT, security, and leadership teams.

CTEM: A Programmatic Approach

Unlike traditional security programs that rely on static tools, CTEM is an adaptive program that integrates offensive security methodologies, including red teaming, penetration testing, vulnerability management, cloud security posture management, and web application security. This holistic approach ensures alignment with Governance, Risk, and Compliance (GRC) initiatives while delivering continuous security improvements.

The Five Stages of a CTEM Program

1. Scoping: Defining the Attack Surface

Scoping, as defined by Gartner, involves identifying an organization’s complete attack surface. This is where Surface Command, a key component of the Exposure Command suite, provides critical visibility by combining Cyber Asset Attack Surface Management (CAASM) with External Attack Surface Management (EASM). Unlike point-in-time assessments, Surface Command offers continuous monitoring of assets across on-prem, cloud, and SaaS environments, ensuring that no shadow IT or misconfigured exposure goes undetected.

2. Discovery: Mapping Assets, Vulnerabilities, and Risks

Discovery involves identifying both known and hidden assets, vulnerabilities, and misconfigurations. A common pitfall is confusing scoping with discovery—simply identifying a large number of vulnerabilities does not equate to security success.

Rapid7 Exposure Command enhances the discovery phase by integrating InsightVM for vulnerability management, InsightAppSec for dynamic application security testing (DAST), and InsightCloudSec for cloud security posture management (CSPM). These tools work together to provide comprehensive visibility intoexposure across hybrid environments.

3. Prioritization: Focusing on What Matters

Not all security issues require immediate remediation. Effective prioritization should factor in:

  • Business risk and potential impact
  • Urgency and exploitability
  • Availability of compensating controls
  • Tolerance for residual attack surface

Rapid7 Exposure Command’s risk-based prioritization framework goes beyond CVSS scoring by incorporating real-world exploitability data, asset criticality, and threat intelligence. The Command Platform provides a unified view of risks and remediation priorities, enabling MSSPs to help customers focus on the most impactful security improvements.

4. Validation: Proving Security Effectiveness

Validation is the cornerstone of CTEM. Organizations must confirm that vulnerabilities are exploitable, understand potential attack paths, and assess the effectiveness of security controls.

MSSPs can use continuous red teaming, penetration testing, and adversary simulations to validate security postures. Additionally, Security Information and Event Management (SIEM) solutions provide real-time threat correlation, ensuring organizations can detect and respond to threats before they escalate.

5. Mobilization: Operationalizing Security Improvements

The final stage of CTEM is mobilizing findings into actionable security improvements. This involves:

  • Streamlining approval workflows for remediation
  • Automating patch management and configuration changes
  • Ensuring alignment between IT, security, and executive teams

Rapid7 Exposure Command facilitates mobilization by providing automation and orchestration capabilities, reducing friction in vulnerability remediation processes. By integrating with existing IT workflows, MSSPs can ensure that security enhancements are implemented efficiently and effectively.

Achieving a Secure Environment with CTEM

The burden of threat management continues to grow as attack surfaces expand and adversaries evolve. MSSPs must help organizations move beyond traditional vulnerability management to a continuous, risk-driven security approach.

By leveraging ExposureCommand, MSSPs can:

  • Provide continuous visibility into evolving threats and vulnerabilities
  • Enable proactive risk mitigation through prioritized remediation
  • Validate security effectiveness through ongoing testing and adversary simulations
  • Streamline remediation efforts with automation and orchestration

CTEM is not just a security strategy—it’s a key differentiator for MSSPs. By embedding CTEM into their service offerings, MSSPs can deliver measurable risk reduction, enhance customer trust, and solidify their role as strategic security partners.

Learn More about Rapid7’s Exposure Command ▶︎

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Seeing The Whole Picture: A Better Way To Manage Your Attack Surface

Post Syndicated from Michael Chroney original https://blog.rapid7.com/2025/03/10/seeing-the-whole-picture-a-better-way-to-manage-your-attack-surface/

Do you trust your view of your organization’s risk?

Seeing The Whole Picture: A Better Way To Manage Your Attack Surface

With cloud adoption, remote work, shadow IT, and AI, security teams face an overwhelming challenge: scoping their attack surface and continuously discovering all assets and exposures before threats emerge. This aligns with the critical first steps of a Continuous Threat Exposure Management Program (CTEM), which emphasizes the importance of scoping and discovery.

This visibility gap has significant consequences. In 2024, 14% of breaches happened because attackers exploited vulnerabilities to gain initial access — that’s almost triple the amount from 2023 (Verizon DBIR 2024). This isn’t surprising when you consider that only 17% of organizations feel confident that they can find and list at least 95% of their assets, according to Gartner Innovation Insight: Attack Surface Management 2024 research. Without a clear plan for scoping and discovery, organizations can’t effectively secure their assets because they don’t know what they’re trying to protect.

If you don’t have a complete picture of your entire IT estate — inclusive of internal and external facing assets — you’re going to miss vulnerabilities and leave openings that attackers can exploit. That’s why it’s so important to continuously scan and discover your assets so that you always have an accurate, up-to-date view of your attack surface. This is where tools like external attack surface management (EASM) and cyber asset attack surface management (CAASM) come into play because they give you a single view of everything you have and can highlight what’s exposed. Gaining this visibility will help your security teams proactively detect, prioritize, and remediate threats before they are exploited.

Why you need a complete view of your attack surface

Let’s face it, as organizations grow, their potential vulnerabilities grow right along with them. This creates complexity for security teams who are already struggling to keep up. They’ve tried to solve this by adding more and more security tools, but this often backfires and creates a fragmented view that makes it harder to see the whole picture.

To truly reduce risk and strengthen your defenses, you need a unified approach that combines EASM and CAASM.

Even organizations who embrace EASM or CAASM may end up with a disjointed security toolset. Many organizations try to manage their attack surface with either an EASM, a CAASM, or other separate tools, but this often results in an incomplete view of the attack surface, creating blind spots and leading to missed vulnerabilities. This fragmented approach also fails to identify critical control gaps. For example, if an asset is not visible, it might be overlooked that it lacks an endpoint agent or is not protected by a firewall.

Why EASM or CAASM alone fall short

EASM solutions are highly effective for monitoring internet-facing assets, including web applications, cloud services, and third-party integrations. However, they cannot provide visibility into internal environments that are not publicly accessible. This includes non-internet-facing components of on-prem infrastructure, privileged systems, and certain shadow IT assets.

CAASM solutions provide internal visibility, aggregating data from security tools, asset inventories, and IT management systems. They’re great at identifying misconfigurations, vulnerabilities, and security gaps within an organization’s controlled environment. However, CAASM tools can’t account for external exposures, leaving an incomplete picture of how attackers could gain initial access. Additionally, CAASM solutions are completely reliant on 3rd party tools and integrations, meaning that you are adding yet another tool to your tech stack that you have to pay for and manage.

Disparate tools, disjointed defense

To secure growing attack surfaces, many organizations rely on a mix of vulnerability management, cloud security posture management (CSPM), and application scanners. However, these tools often operate independently, leading to fragmented visibility and inefficiencies. Without a single source of truth, security teams struggle to correlate risks, resulting in missed threats, duplicate efforts, and slower response times. Managing multiple tools also increases alert fatigue and operational overhead, while leaving critical gaps in attack surface coverage.

Are you sensing a trend here?

The power of a unified view

A truly effective risk management strategy needs more than a bunch of different tools — it needs those tools to work together seamlessly, giving you a complete picture of all your assets and potential exposures. Security teams need one single source of truth that brings together data from all of their vulnerability management solutions. This will ensure that teams can:

  • Strengthen Security Through Visibility

You have to know and trust what assets you have, where they are, and how they might be exposed. This is key to enforcing proper access controls, patching vulnerabilities, and applying the right security measures to your assets. With a full inventory, teams can be sure that no device, application, or cloud instance is left unprotected.

  • Manage Risk Across Your Entire Attack Surface

A unified approach lets security teams prioritize the most critical risks across all digital environments, greatly reducing blind spots. With a unified view, organizations can detect patterns, understand attack paths, and proactively close security gaps before attackers can exploit them.

By integrating all of your exposure management capabilities into a single, centralized system, your organization can move from reactive security measures to a proactive and holistic approach — giving you the confidence to effectively defend against modern threats.

Take command of your attack surface

The threat landscape is constantly shifting, and it’s more important than ever to have a complete and accurate view of your attack surface. It’s time for security teams to ask some tough questions: Do we really have the insight we need to protect our organization? Are there blind spots that attackers could take advantage of? These questions are at the heart of the scoping and discovery phases within a CTEM program, prompting organizations to continuously evaluate and improve their attack surface visibility.

To get ahead of threats, organizations should simplify their security approach by reducing the number of tools they’re using and find a solution that seamlessly combines EASM and CAASM. A unified view helps security teams find, prioritize, and reduce risks more effectively.

How Rapid7 can help

Rapid7 recently announced Exposure Command and Surface Command, the first two solutions launched on the new Command Platform. Surface Command provides complete visibility across internal and external environments by combining EASM and CAASM in a single solution, allowing security teams to view and prioritize high-risk assets across their entire environment. Exposure Command builds on Surface Command’s attack surface visibility, offering proactive exposure mitigation and remediation prioritization across your hybrid environment.

Uncovering and Protecting Sensitive Data Across Cloud Environments with Exposure Command

Post Syndicated from Rapid7 original https://blog.rapid7.com/2025/02/25/uncovering-and-protecting-sensitive-data-across-cloud-environments-with-exposure-command/

Uncovering and Protecting Sensitive Data Across Cloud Environments with Exposure Command

Modern organizations grapple with the complex task of securing sensitive data in sprawling hybrid and multi-cloud environments. Due to insufficient visibility and governance, data is often misplaced, duplicated, or left exposed. This fragmented environment makes it difficult for teams to accurately assess data exposure risks, comply with stringent privacy regulations, and continuously track sensitive data across locations, owners, and usage.

Without a consistent, holistic view of where sensitive data resides and how it is managed, organizations face significant security, compliance, and operational risks. To solve this challenge and make sense of their data security posture, organizations typically start by discovering and gaining visibility into data stored across their IT estate and work to classify the type of data and associated risk of exposure.

Modern enterprises typically rely on various data classification sources, including CSP-native detection services (such as Amazon Macie, MSFT Defender for Cloud, or GCP Security Command Center), third-party DSPM tools, custom classification policies, or by manually tagging native cloud resources. When discrepancies arise, security teams face a critical question: Which classification should they trust and how can they manage these classifications efficiently at scale? To help solve this persistent challenge, we’re excited to announce sensitive data discovery and data-centric risk prioritization in Exposure Command, empowering teams to implement data-centric risk prioritization as a cornerstone of their security strategy.

Automated Data Classification Leveraging Existing Tagging Frameworks

With this update, Exposure Command offers teams the ability to ingest data classifications and findings from native data security services offered by cloud providers such as AWS Macie, Microsoft Defender for Cloud, and Google Cloud Security Command Center. This enhancement enables organizations to centralize sensitive data insights across their cloud environments, providing a unified view of data risks and exposures. By leveraging these integrations, security teams can automate data classification ingestion, enhance risk assessment, and take proactive remediation steps to secure sensitive information in their cloud infrastructures.

We don’t just stop at support for native services, however, as we also offer the ability to ingest tags directly, whether from the Cloud Service Provider (CSP) or via IaC templates such as Terraform. With automated cloud-native tagging, organizations can establish a single source of truth for data classification, ensuring that security teams can quickly assess and respond to risks tied to sensitive information.

By taking a tag-based classification strategy, organizations can:

  • Standardize classification across cloud resources with custom tag schemas for severity, data type, and compliance requirements.
  • Ensure consistency by automating tag propagation across related resources.
  • Leverage version control to track classification changes over time for audit and compliance purposes.

Infrastructure as Code Integration for Seamless Classification

Exposure Command makes it easy to implement and enforce consistent data classification directly within cloud infrastructure deployment workflows. With native Terraform resource tagging, automated tag inheritance, and customizable classification schemas, security teams can automate classification at scale. Version control ensures auditability and change tracking, helping organizations maintain a dynamic, risk-aware classification framework that evolves with their cloud environment.

Sensitive Data Discovery Meets Risk Prioritization

Exposure Command enables teams to take a data-centric approach to risk prioritization by incorporating insights into sensitive data exposures alongside Layered Context and Attack Path Analysis, ensuring that organizations focus on the risks that could lead to real-world breaches. By layering asset criticality, exploitability, and risk posture with insights into sensitive data exposure, security teams can focus on protecting crown jewel data assets.

Taking a Data-Centric Approach to Risk Prioritization with Layered Context

Layered Context is a multi-dimensional risk prioritization model that moves beyond traditional vulnerability management by integrating sensitive data insights, threat intelligence, and business impact analysis into a unified view of risk. Rather than prioritizing based solely on CVSS scores, this approach ensures security teams focus on the exposures that pose the highest real-world risk, not just those that appear severe on paper.

By layering in sensitive data awareness, Exposure Command allows teams to see not just which systems are vulnerable, but which ones expose high-value data whether it’s customer PII, financial records, intellectual property, or regulated information. This makes it possible to prioritize remediation based on both exploitability and potential business impact.

Uncovering and Protecting Sensitive Data Across Cloud Environments with Exposure Command

Understanding Paths for Lateral Movement and Unwanted Access to Sensitive Data

Attackers don’t just exploit vulnerabilities – they chain weaknesses together to reach high-value data. Exposure Command’s Attack Path Analysis goes beyond simply identifying risky assets; it maps how an attacker could move through the environment to access sensitive data. By visualizing lateral movement opportunities, privilege escalation paths, and gaps in data protection, security teams can preemptively block attack routes before they’re exploited.

Uncovering and Protecting Sensitive Data Across Cloud Environments with Exposure Command

Instead of just highlighting vulnerable systems, it maps how attackers could exploit weaknesses to access sensitive customer information, financial records, or intellectual property. This data-centric approach shifts remediation from a focus on CVSS scores to business impact-driven security, ensuring that teams address the most critical exposures first.

By revealing hidden exploitation paths, Exposure Command identifies chained vulnerabilities, lateral movement risks, and privilege escalation opportunities that could allow attackers to reach high-value data. A misconfiguration on a low-risk asset might seem harmless – until it’s linked to a cloud storage bucket containing sensitive data. With attack path visualization, security teams can better understand attack scenarios, block lateral movement, and proactively shut down high-risk pathways before they can be exploited – moving from reactive patching to proactive breach prevention.

Why Data-Centric Risk Prioritization Matters

Traditional risk management often overlooks the nuances of sensitive data exposure, relying on static vulnerability metrics. By embedding sensitive data insights directly into risk prioritization workflows, Rapid7 Exposure Command shifts the paradigm to focus on what matters most: safeguarding critical data assets.

This approach ensures that security efforts are aligned with business priorities, enabling organizations to:

  • Protect customer and proprietary information.
  • Mitigate the risk of data breaches and non-compliance penalties.
  • Enhance collaboration between security, IT, and risk management teams.

Take Command of Your Sensitive Data Risks

With sensitive data discovery now part of Exposure Command, Rapid7 is empowering organizations to bolster their security strategies. Whether you’re a financial institution safeguarding customer data or a healthcare provider ensuring patient privacy, this innovation provides the tools you need to protect what matters most.

Ready to elevate your risk management program? Learn how Rapid7 Exposure Command can help you integrate data-centric risk prioritization into your security operations.

Command Platform Innovations Eliminate Data Blind Spots Through Complete Visibility and Context-Driven Risk Prioritization

Post Syndicated from Rapid7 original https://blog.rapid7.com/2025/02/25/command-platform-innovations-eliminate-data-blind-spots-through-complete-visibility-and-context-driven-risk-prioritization/

Command Platform Innovations Eliminate Data Blind Spots Through Complete Visibility and Context-Driven Risk Prioritization

Rapid7 provides unmatched attack surface visibility through the Command Platform, helping security teams identify, prioritize, and remediate risk across hybrid environments. Surface Command is the only solution available that combines native external and internal scanning into a single unified view of your attack surface, enriched with telemetry from third party security and ITOps tools via more than 120 out-of-the-box connectors.

Exposure Command builds on this foundational attack surface visibility, layering on adversary-aware risk prioritization and integrated remediation workflows that make it easy for security teams to anticipate where attackers are going to target, pinpoint their most pressing exposures and act swiftly and collaboratively to address issues before they can be exploited.

Now, we’re taking this a step further with three key innovations designed to strengthen risk prioritization, streamline remediation, and ensure sensitive data remains protected.

Expanding Already Unmatched Attack Surface Visibility and Context to Sensitive Data

Sensitive data is a prime target for attackers, yet security teams often struggle to track where it resides and how exposed it is. Sensitive Data Discovery in Exposure Command delivers continuous visibility into sensitive data across multicloud environments, ensuring that security teams can proactively protect high-value assets.

With native ingestion from CSP security services like AWS Macie, GCP DLP, and Microsoft Defender, as well as Infrastructure-as-Code (IaC) tagging support, security teams can classify sensitive data from the start, eliminating manual, error-prone processes and improving data hygiene.

These insights feed directly into our risk scoring and prioritization methodology, with sensitive data insights woven directly into Layered Context and Attack Path Analysis, enabling teams to identify and focus on the exposures that put sensitive information at risk.

Improving Program Efficiency and Efficacy with AI-driven Vulnerability Scoring

The exponential growth of vulnerabilities has outpaced the ability of vendors and agencies like NVD to provide timely CVSS scores. This leaves security teams struggling to assess the severity of vulnerabilities, particularly with the volume of CVEs escalating rapidly. To bridge this gap, we’re introducing AI-driven CVSS scoring, a powerful capability that leverages an advanced machine learning model to:

  • Analyze vulnerability data from trusted sources and historical expert assessments
  • Generate accurate, intelligence-driven CVSS scores to fill in vendor and agency gaps
  • Feed into our Active Risk scoring model to help security teams cut through the noise and make informed decisions faster and with confidence

With this innovation, the accuracy of Active Risk scores have improved by 17%, ensuring greater consistency and actionable insights. The model’s predictive capabilities achieve a remarkable 87% accuracy in severity classification, making it an indispensable tool in today’s fast-evolving threat environment.

Streamlined Remediation with Surface Command and Remediation Hub

Security teams don’t just need to find risks. They need to fix them, and fix them fast, but it’s usually not within their purview to actually take the ultimate action to resolve the issue at its root. Security teams often need to communicate with stakeholders across the organization – often on the infrastructure or DevOps teams – to convince them that there is a pressing risk that needs their attention.

Overcoming this burden of proof – because it’s often not a simple task to convince others around the organization to share your sense of urgency – can be challenging to say the least. In order to clear that hurdle, it requires irrefutable evidence with clarifying context to inspire action.

Our newly-expanded Surface Command and Remediation Hub integration ensures that remediation guidance is embedded directly within asset inventory and detail pages, eliminating the need to switch between platforms to gather and share the contextual information needed to address risk fast.

By deepening the integration between Surface Command and Remediation Hub, security teams benefit from:

  • Faster mean-time-to-remediate (MTTR) by bringing prioritized remediation guidance directly into the asset inventory and detail pages within Surface Command
  • Deeper asset context at the time of remediation, including insights from third-party security and ITOps tooling
  • Improved collaboration by providing security teams and stakeholders with enriched context for quicker decision-making

Ready to Take the Next Step?

Rapid7’s approach combines cutting-edge technology and comprehensive data insights to help organizations focus on what truly matters. By addressing high-impact risks and safeguarding critical assets, teams can reduce their exposure to threats while improving operational efficiency.

Rapid7’s enhanced platform capabilities empower organizations to modernize their risk management strategies. By integrating sensitive data insights, leveraging GenAI-driven prioritization, and expanding remediation workflows, we provide the tools you need to stay ahead of threats and proactively eliminate exposures across your entire attack surface.

This strategy also streamlines collaboration, enabling security, IT, and risk management teams to work together seamlessly with shared context and priorities. Ultimately, aligning risk management practices with real-world threats and business objectives ensures greater resilience and security.

Learn how Rapid7 can help you adopt a threat-aware approach to threat and exposure management. It’s time to transform your security strategy and protect what matters most.

Rapid7 Fills Gaps in the CVE Assessment Process with AI-Generated Vulnerability Scoring in Exposure Command

Post Syndicated from Rapid7 original https://blog.rapid7.com/2025/02/19/rapid7-fills-gaps-in-the-cve-assessment-process-with-ai-generated-vulnerability-scoring-in-exposure-command/

Rapid7 Fills Gaps in the CVE Assessment Process with AI-Generated Vulnerability Scoring in Exposure Command

The National Vulnerability Database (NVD) announced in February 2024 that it would no longer provide common vulnerability scoring system (CVSS) scores for all CVEs. Due to resource constraints and an inability to keep up with the volume of newly-disclosed vulnerabilities, NVD shifted its focus to processing vulnerabilities more efficiently by relying on vendor-provided and third-party scores rather than scoring each CVE independently.

Many organizations rely on NVD’s CVSS scores as a consistent, centralized guide to measuring the potential risk of vulnerabilities. This is especially useful for teams that don’t have the resources to conduct their own in-depth vulnerability analysis given the pace at which new CVEs are cropping up.

To address this widening gap in vulnerability scoring and ensure our customers are making informed decisions with the most accurate understanding of their current risk posture we’re excited to announce the release of AI-Generated Risk Scoring in Exposure Command. By integrating an advanced machine learning model, Exposure Command supplements existing CVSS scores by providing AI-Generated Risk Scores for CVEs where NVD does not provide them, ensuring all vulnerabilities are provided an accurate score.

The need to evolve from traditional vulnerability management practices to continuous threat and Exposure Management

Moving beyond simple risk scoring methodologies is critical for modern vulnerability management teams to stay ahead of advanced threats. For many organizations, this means adopting a Risk-Based Vulnerability Management (RBVM) approach.

Put simply, this means incorporating not just a deep and accurate understanding of how risky a given CVE is in a vacuum, but also layering on additional context related to reachability and exploitability, asset criticality, and a real-world understanding of what threat actors are actively targeting in the wild. And how all these inputs relate to the organization’s specific environment.

AI-Generated CVSS scoring in Exposure Command feeds directly into our broader Active Risk scoring methodology. More importantly, it empowers Rapid7 to produce predictive CVSS scores by analyzing vulnerability information and comparing with previous expert vulnerability analysis.

The model generates each vector individually, and once combined to form a score, results in 76% of these generated scores being in the correct severity classification. Combined with Rapid7’s Active Risk calculator, this increases to 87% of scores returning the correct classification. The remaining scores are never more than one classification out.

This insight will feed directly into and improve the overall accuracy of our Active Risk scoring models, as well as, ensure severity scores are assigned and provided to security teams faster than humanly possible, making your entire security program more resilient to external change.

By leveraging AI/ML to generate predictive risk scores, security teams benefit from:

  • Enhanced accuracy: Our expertly designed model trained on historical NVD data accurately provides CVSS scores.
  • Predictive scoring: Get immediate insight into the severity of newly-disclosed CVEs that are left unscored, without the need for manual aggregation and analysis.
  • Improved security posture: Ensuring all CVEs are assigned an accurate severity score, organizations are equipped with the necessary context to effectively prioritize remediation efforts and in turn strengthen their organization’s security posture.

This release represents a major step forward in our mission to provide industry-leading cybersecurity solutions. We expect these enhancements will significantly improve your ability to assess and manage vulnerabilities, giving you the confidence to stay ahead of potential threats.For more detailed information and implementation guidelines, please refer to the release notes. If you’d like to learn more about the Rapid7 AI Engine and how we’re leveraging AI across the platform, download the eBook today!

Introducing the Exposure Management Webinar Series: Commanding Your Attack Surface

Post Syndicated from Emma Burdett original https://blog.rapid7.com/2025/02/04/introducing-the-exposure-management-webinar-series-commanding-your-attack-surface/

Introducing the Exposure Management Webinar Series: Commanding Your Attack Surface

The digital landscape is expanding rapidly, and with it, the complexity of managing an organization’s attack surface. To help cybersecurity professionals navigate this challenge, Rapid7 presents a three-part webinar series, “Commanding Your Attack Surface.” This series dives deep into the evolving exposure management landscape, featuring insights, strategies, and practical demonstrations designed to help teams stay ahead of adversaries.

From foundational concepts to cutting-edge solutions, this series is a must-watch for anyone looking to enhance their organization’s security posture. Whether you’re just beginning to explore exposure management or you’re a seasoned practitioner, these webinars offer valuable knowledge and actionable steps to transform your approach.

Why Watch? Key Learnings from the Series

Webinar 1: Exposure Management 101 – Essential Concepts & Strategies. Discover the basics of exposure management and learn how to identify and mitigate risks across your attack surface. This session explores Gartner’s Continuous Threat Exposure Management (CTEM) framework and outlines how a proactive approach can reduce your organization’s likelihood of a breach by threefold.

Watch the Webinar here

Webinar 2: Take Command of Your Attack Surface with Rapid7 Exposure Command. Dive into Rapid7’s cutting-edge Exposure Command platform, which provides unified attack defense and response capabilities. Learn how to bridge the “security visibility gap” by leveraging real-time data aggregation, advanced correlation, and a vendor-agnostic approach to create a single source of truth for your security team.

Watch the Webinar here

Webinar 3: Meeting the Exposure Management Challenge – Key Use Cases for Success. Hear from industry experts on the most pressing challenges in exposure management today. Gain insights into best practices for unifying visibility, prioritizing risks, and validating controls to maximize the effectiveness of your security investments.

Watch the Webinar here

Each session builds on the last, equipping you with the tools and knowledge to proactively manage and defend your attack surface. Click through to view the webinars and transform your cybersecurity strategy today!

Surface Command and Unified Attack Surface Management

At the heart of successful exposure management lies Surface Command, Rapid7’s solution for a continuous 360° view of your attack surface. Here’s how Surface Command can transform your security operations:

  • Eradicate Blind Spots: Achieve unparalleled visibility by monitoring internal and external assets, uncovering shadow IT, and eliminating coverage gaps.
  • Defend with Full Context: Leverage native and third-party enrichment to identify the exposures adversaries are most likely to exploit.
  • Accelerate Response: Equip teams with actionable context to triage the full blast radius of an attack and respond more effectively.

Surface Command enables teams to detect, prioritize, and remediate security issues across their entire digital estate, empowering organizations to defend proactively against emerging threats.

Ready to take control of your attack surface?
Explore the possibilities with Surface Command here

What’s New in Rapid7 Products & Services: Q4 2024 in Review

Post Syndicated from Margaret Wei original https://blog.rapid7.com/2024/12/18/whats-new-in-rapid7-products-services-q4-2024-in-review/

What’s New in Rapid7 Products & Services: Q4 2024 in Review

This quarter at Rapid7 we continued to make investments across our Command Platform to provide security professionals with a holistic, actionable view of their entire attack surface – from Exposure Management to Detection and Response. Below, we’ve highlighted key releases and updates from the quarter across our products and services, including the new Platform Home Navigation experience, extensibility enhancements to Exposure Command and Surface Command, expanded MXDR support, and 2024 threat landscape trends from Rapid7 Labs.

Accelerate security efficiency and results with Rapid7’s Command Platform

In October, we released our revamped, modernized Command Platform home navigation experience for all users, providing a more cohesive, efficient flow for our users and increased visibility between Rapid7 products and capabilities. Now, viewing security program metrics across your suite of Rapid7 products is easier than ever before—so you can spend less time navigating between products and more time making decisions with easily accessible data.

We’ll be building on this new experience in the coming year to bring iterative updates to the look, feel, and function of the Command Platform—stay tuned for more!

What’s New in Rapid7 Products & Services: Q4 2024 in Review
New Command Platform Home Navigation

Along with the navigation updates, we’ve made improvements to our user management experience. Now, teams are empowered to better safeguard data and systems with more tailored, role- and responsibility-based user access controls. This enables easier collaboration across your organization while ensuring the appropriate access level for each person.

What’s New in Rapid7 Products & Services: Q4 2024 in Review
Revamped user management experience

Achieve complete attack surface visibility and proactively eliminate exposures from endpoint to cloud

Rapid7 co-launches Resource Control Policies with AWS, Adding Support in Exposure Command and InsightCloudSec

Leading up to Re:Invent, AWS announced a powerful new feature to help organizations enforce least privilege access at scale: Resource Control Policies (RCPs). RCPs are an org-level access control policy that can be used to centrally implement and enforce preventative controls across all AWS resources in your environment.

To support this launch, we expanded our existing cloud identity and entitlement management capabilities to include dedicated, out-of-the-box checks for consistent and secure application of RCPs. Today, both Exposure Command and InsightCloudSec include these checks, enabling organizations to apply RCPs consistently and securely. Learn more here.

Shifting Left to Stay Secure with Exposure Command

Developers are at the forefront of modern cloud environments, making “shift-left” strategies essential for effective security. By addressing risks during development rather than after deployment, teams can eliminate vulnerabilities before they become costly issues.

To support our customers in executing stronger shift-left strategies, Exposure Command now offers more robust Infrastructure-as-Code (IaC) scanning and deeper CI/CD integration with Terraform and CloudFormation support across hundreds of resource types. For development teams, integrations like GitLab, GitHub Actions, AWS CloudFormation, and Azure DevOps bring security checks directly into their workflows, helping to secure code without disrupting productivity.

Streamline Vulnerability Management Across Your Entire Application Inventory with Vulnerability Groupings

Triaging scan results can be one of the most arduous and time-consuming parts of vulnerability management, but it’s also one of the most critical. Teams need to quickly synthesize results to validate exposures, prioritize response, and determine next steps for safeguarding their attack surface.

With the recent addition of Application Vulnerability Grouping, InsightAppSec customers can now visualize attacks and assess single applications or their entire application inventory at once, allowing teams to:

  • Visualize exposures with pre-triaged vulnerabilities by app and attack type
  • Identify and focus on threats in key functional areas to simplify vulnerability remediation
  • Manage application-layer risks at scale by updating the status or severity and adding comments to entire groups of vulnerabilities at once
What’s New in Rapid7 Products & Services: Q4 2024 in Review

Explore Exposure Management Use Cases via Guided Product Tours

We’re excited to introduce a new way for you to engage hands-on with core use cases across the Command Platform with our new guided product tours. These tours provide a first-hand, in-depth look at new products and features.

Today, you’ll see tours showcasing how Surface Command can help you map your entire attack surface and identify coverage gaps across your security ecosystem. You’ll also learn how you can prioritize remediation efforts and mobilize teams across your organization with Remediation Hub. Check out the available tours here, and we’ll continue to add more covering use cases across the Command Platform in the future.

Gain Insights from Products Across Your Environment Faster with Self-Service Surface Command Connector

Surface Command customers can now install connectors at their own convenience via the Rapid7 Extensions Library, making it faster and easier to gain visibility into cyber asset insights across your security and IT management tools. Customers can choose from over 100 out-of-the-box connectors to ingest and enrich asset data within Surface Command, consolidating insights from across your entire security ecosystem into one place.

What’s New in Rapid7 Products & Services: Q4 2024 in Review
Surface Command connectors in Rapid7 Extensions Library

Pinpoint critical signals and act confidently against threats with cloud-ready detection and response

A Growing Ecosystem of Cloud Event Sources in InsightIDR and MDR

At Rapid7, we understand that organizations are tasked with collecting and correlating vast amounts of data across their unique ecosystems. To tackle this, teams need faster, more dynamic mechanisms to ingest cloud data directly into their SIEM tool. We addressed this earlier this year with cloud event sources, providing a native cloud collection framework that can receive log data from cloud platforms directly – without requiring installation of collector software in their cloud and on-premise environments.

This quarter, we further expanded our list of cloud event sources by adding support for Microsoft products, including: Defender for Endpoint, Defender for Cloud, Defender for Identity, Defender for Cloud Apps, Defender O365, Defender for Vulnerability Management, and Entra ID.

MXDR: Expanded Support for Microsoft & AWS

In our Q3 “What’s New” blog, we announced the launch of Rapid7 MDR for the Extended Ecosystem (MXDR), which expands our MDR service to triage, investigate, and respond to alerts from third-party tools within customer organizations. Now, we’re excited to announce that we have updated our MXDR to support an expanded subset of detections across AWS GuardDuty and Microsoft security tools, bringing more protection to customer environments across a broader group of security tools.

Furthering our commitment to keep organizations safe and ahead of adversaries in today’s complex threat landscape, this update includes:

  • Deepened existing support for Microsoft security tools like Defender for Endpoint, Defender for Cloud, and AWS GuardDuty
  • Expanded support (via aforementioned cloud event sources) to critical alerts across Defender for Identity, Microsoft O365, Defender for Vulnerability Management, and Microsoft Entra
What’s New in Rapid7 Products & Services: Q4 2024 in Review
Example Microsoft Defender for Endpoint alert

Expanded Coverage for Next-Gen Antivirus: MacOS and Linux

We’ve extended operating system coverage for Next-Gen AV (NGAV) support beyond Windows OS to now include protection capabilities for MacOS and Linux. Now, customers utilizing NGAV don’t have to utilize multiple point systems across the operating systems within their detection surface to stop breaches as early as possible in the kill chain.

The latest research and intelligence from Rapid7 Labs

2024 Threat Landscape Statistics

This year, Rapid7’s global Managed Services team and Rapid7 Labs researchers responded to hundreds of major incidents, significant vulnerabilities, and ransomware threats—delivering emergent threat guidance, research reports, and other vulnerability and threat content for customers. See the roundup of key statistics and trends from our Rapid7 Labs team in our recent blog post, here.

What’s New in Rapid7 Products & Services: Q4 2024 in Review
Example of findings presented in the 2024 Threat Landscape Statistics: Ransomware Activity, Vulnerability Exploits, and Attack Trends from Rapid7 Labs

Emergent Threat Response: Real-time Guidance for Critical Threats

Rapid7’s Emergent Threat Response (ETR) program from Rapid7 Labs delivers fast, expert analysis and first-rate security content for the highest-priority security threats to help both Rapid7 customers and the greater security community understand their exposure and act quickly to defend their networks against rising threats.

In Q4, Rapid7’s ETR team provided expert analysis, InsightIDR and InsightVM content, and mitigation guidance for multiple critical, actively exploited vulnerabilities and widespread attacks, including:

Follow along here to receive the latest emergent threat guidance from our team.

Stay tuned for more!

As always, we’re continuing to work on exciting product enhancements and releases throughout the year. Keep an eye on our blog and release notes as we continue to highlight the latest in product and service investments at Rapid7.

Rapid7 Extends Cloud Security Capabilities with Updates to Exposure Command

Post Syndicated from Ryan Blanchard original https://blog.rapid7.com/2024/12/06/rapid7-extends-cloud-security-capabilities-with-updates-to-exposure-command/

Rapid7 Extends Cloud Security Capabilities with Updates to Exposure Command

The cloud has become the backbone of modern innovation, powering everything from AI to remote work. But as organizations embrace the cloud, they also face an ever-expanding and increasingly complex attack surface. With purpose-built harvesting technology providing real-time visibility into everything running across multi-cloud environments, Exposure Command from Rapid7 ensures teams have an up-to-date inventory, mapping their cloud attack surface and enriching asset data with risk and business context.

To ensure teams can keep up with the torrid pace of innovation and overcome increased complexity, Rapid7 remains dedicated to investing in advancing the cloud security capabilities available within Exposure Command. To that end, we’ve made a few significant updates across AI resource coverage, third-party CNAPP enrichment and more. Let’s dive right in.

Extending coverage for securing AI/ML development in the cloud

AI and machine learning (ML) are transforming industries, but the speed of adoption can often leave organizations vulnerable. AI/ML workloads often process sensitive or proprietary data, requiring robust protections to ensure compliance with ever-evolving regulations. Safeguarding these environments isn’t just about securing the infrastructure; it’s about understanding the unique workflows and ensuring compliance at every step.

These workloads also introduce unique risks, such as model poisoning attacks or vulnerabilities in APIs, creating new vectors for data exfiltration and service disruption. Additionally, the dynamic nature of cloud-hosted AI services presents challenges in maintaining secure configurations as resources scale elastically, potentially exposing sensitive endpoints or misconfigured setups.

To that end, Exposure Command has expanded support for critical AI services like Amazon Comprehend and Polly, AWS’s natural language processing and text-to-speech services.This provides comprehensive visibility across an organization’s attack surface, aligning AI-specific risks with broader enterprise priorities.

Shifting left and securing the software supply chain

Developers are at the forefront of modern cloud environments, making “shift-left” strategies essential for effective security. By addressing risks during development rather than after deployment, teams can eliminate vulnerabilities before they become costly issues.

Exposure Command now offers more robust Infrastructure-as-Code (IaC) scanning and deeper CI/CD integration, with Terraform and CloudFormation support across hundreds of resource types. For development teams, integrations like GitLab, GitHub Actions, AWS CloudFormation, and Azure DevOps bring security checks directly into their workflows. Whether it’s identifying misconfigurations in AWS Glue Catalogs or assessing risks in SES configurations, these tools help teams secure their code without breaking their stride.

Bridging the hybrid cloud gap with native and third-party CNAPP connectors

For many organizations, the challenge isn’t just securing the cloud – it’s securing everything holistically. Hybrid environments that span on-prem systems and multiple cloud providers can create silos, leading to gaps in visibility and risk management. To tackle this, we’ve integrated InsightCloudSec data directly into Surface Command, empowering security teams with a unified view of their entire attack surface in one place.

But we didn’t stop at consolidating our own native CNAPP capabilities. Teams now get out-of-the-box integrations with popular cloud security tools like Wiz and Orca as well as CSP-native services like AWS Inspector, all making it easier than ever to identify risks across cloud-native and hybrid environments. Everything can now be seen in one place – from endpoint vulnerabilities to cloud misconfigurations and overly permissive roles – allowing for faster action with clarity and precision.

Tackling virtual desktop risks with custom registry keys

With the rise of remote work, virtual desktop infrastructures (VDIs) like AWS Workspaces have become essential. Yet, their dynamic nature makes tracking vulnerabilities a challenge. Exposure Command addresses this with features like custom registry keys for golden images, ensuring you can trace a risk back to its source and effectively prioritize remediation.

Commanding the cloud attack surface

The challenges of securing modern environments aren’t going away. Attack surfaces will continue to expand, threats will grow more sophisticated, and organizations will face increasing pressure to innovate securely.

Keep an eye out for more updates coming soon as we continue to invest in helping organizations effectively manage exposures from endpoint to cloud.

Rapid7 Extends AWS Support to Include Coverage for Newly-Launched Resource Control Policies (RCPs)

Post Syndicated from Ryan Blanchard original https://blog.rapid7.com/2024/11/20/rapid7-extends-aws-support-to-include-coverage-for-newly-launched-resource-control-policies-rcps/

Rapid7 Extends AWS Support to Include Coverage for Newly-Launched Resource Control Policies (RCPs)

In today’s cloud-first world, security and innovation go hand-in-hand. Rapid7 is excited to announce our support for Amazon Web Services’ (AWS) new Resource Control Policies (RCPs), a powerful tool designed to bolster security controls for organizations using AWS infrastructure. As a launch partner for this feature, Rapid7’s Exposure Command now extends its capabilities even further, helping organizations set precise, scalable guardrails within their AWS environments.

The need for strong guardrails in the Ciscloud

Cloud platforms like AWS have transformed business agility by enabling rapid development, fast deployments, and real-time scalability. Yet, as organizations increase their reliance on cloud infrastructure, they face a heightened risk landscape. Rapid development cycles and AI-driven cloud services often result in more identities, permissions, and resources—all of which can lead to excessive access and increased risk.

The need for stringent guardrails has never been more urgent. Without them, organizations risk unintentionally exposing data or resources as they rapidly scale operations.

AWS addresses this challenge with two main types of policies:

  • Service Control Policies (SCPs): Manage access at the principal level (such as IAM users and roles), setting maximum permissions across the organization.
  • Resource Control Policies (RCPs): Limit access directly at the resource level, with special utility for restricting external access across the AWS environment.

Building on broad and deep AWS coverage with support for RCPs

Exposure Command supports AWS RCPs through features that enhance security posture and operational insight by providing a centralized view of RCP use within the organization, enabling teams to monitor usage and governance of these policies. Cloud and Security teams can easily search, inspect, and understand RCP impacts on cloud resources, allowing for proactive adjustments with best practice recommendations that guide users through best practices in adopting RCPs.

This RCP support further extends the robust identity analysis capabilities offered by Exposure Command and InsightCloudSec, enabling organizations to automatically refine permissions organization-wide, uncovering and addressing overly permissive roles or unused access. By doing so, security teams are able to implement and effectively scale LPA adherence across AWS resources, enhancing security without compromising agility.

Exposure Command and InsightCloudSec support broad AWS coverage that extends well beyond RCPs and SCPs, encompassing a suite of tools to secure AWS cloud resources:

  • Real-Time Visibility into AWS accounts, services, and resources.
  • Vulnerability Management for proactive scanning, identification, and remediation across cloud assets.
  • Context-Driven Risk Prioritization to address the highest-impact vulnerabilities based on risk, exploitability, and blast radius.
  • Automated Remediation for rapid policy updates and resource configurations.
  • Extensive and rapidly-expanding support for foundational AI/ML services from AWS to securely configure and track AI services usage with support for services including AWS Bedrock, SageMaker, Kendra, Comprehend, Polly and more.

Ready to Take Command of your AWS security?

As organizations embrace the cloud’s full potential, maintaining robust security while supporting rapid growth is critical. Rapid7’s Exposure Command, now with AWS RCP support, empowers security teams to adopt a zero-trust approach while maintaining the agility and flexibility that cloud environments demand. Together with AWS, we’re committed to helping organizations reduce risk, ensure compliance, and innovate confidently in the cloud.

Interested in learning more about RCPs and our expanded AWS support? Be sure to swing by booth #697 at AWS Re:Invent to chat and see the Command Platform in action!

Accelerate Mean Time to Exposure Remediation Across Hybrid Environments with Remediation Hub

Post Syndicated from Pauline Logan original https://blog.rapid7.com/2024/11/19/accelerate-mean-time-to-exposure-remediation-across-hybrid-environments-with-remediation-hub/

Accelerate Mean Time to Exposure Remediation Across Hybrid Environments with Remediation Hub

As organizations continue to scale their digital infrastructure, the volume of vulnerabilities and exposures grows at an overwhelming pace. Security teams often find themselves inundated with alerts and risk signals, unable to remediate every issue within their environment. They often struggle to keep pace with the dynamic nature of threats, and existing tools were not built to address the complexity of modern IT environments.

With limited time and resources, trying to address every potential vulnerability is not feasible. This reality has driven the need for prioritization—teams must focus on the vulnerabilities that present the highest risks to their organization, based on factors like attacker behaviors, real-world threat intelligence, and exploitability.

Meet Remediation Hub, Your New Home for Exposure Prioritization and Remediation

Accelerate Mean Time to Exposure Remediation Across Hybrid Environments with Remediation Hub

Rapid7’s Remediation Hub, our newest addition to the Exposure Command platform, is designed to address this exact challenge. Remediation Hub automatically prioritizes various risk signals across your hybrid environment and suggests the actions your team can take that would have the largest impact on reducing your overall risk posture.

The solution leverages foundational visibility from Surface Command, which presents a comprehensive view of your attack surface, combining both external scanning and cyber asset management to provide a dynamic inventory and topology map of every asset across your environment. Underpinned by a powerful graph database, the platform allows teams to visualize the entire attack surface and understand the interconnected relationships between assets, ensuring that teams are guided to take action on the risks that are not only likely to be exploited but could also have the broadest blast radius.

Accelerate Mean Time to Exposure Remediation Across Hybrid Environments with Remediation Hub

Remediation Hub considers factors like public accessibility, reachability, and the presence of downstream controls (like a firewall, for instance) when prioritizing vulnerabilities. The platform’s Active Risk incorporates real-world threat intelligence from Rapid7 Labs and our open source community to provide clarity into what CVEs are being actively exploited in the wild, which could provide insight into which exposures across your environment attackers are likely to target.

Along with insight into the impacted assets, teams are also provided step-by-step guidance on how to implement the suggested fix, with many actions available as native automation workflows.

Accelerate Mean Time to Exposure Remediation Across Hybrid Environments with Remediation Hub

Proactive Exposure Management: Moving from Reactive to Proactive

By taking a more targeted, intelligence-driven approach to remediation, security teams can move from reactive to proactive exposure management, ultimately making their organizations more resilient to attacks and accelerating the time it takes to both detect and remediate exposures that pop up across their environments.

To learn more and experience a self-guided Product Tour, click here.

What’s coming next?

In the next post, we’ll walk you through how users can leverage Remediation Hub when responding to an Emergent Threat, including gathering available information about a zero-day, building an understanding of your exposure, along with step-by-step remediation guidance.

We’ll also, of course, continue to bring additional enhancements to Remediation Hub geared toward making it easier for teams to more effectively collaborate with stakeholders across the organization to prioritize and remediate exposures across their hybrid environments. So be sure to stay tuned here for more posts with those updates. As always, we welcome customer feedback and would love to hear from you! Your input helps us tailor our product roadmap, based on your priorities and business needs.

Modernizing Your VM Program with Rapid7 Exposure Command: A Path to Effective Continuous Threat Exposure Management

Post Syndicated from Ryan Blanchard original https://blog.rapid7.com/2024/10/03/modernizing-your-vm-program-with-rapid7-exposure-command-a-path-to-effective-continuous-threat-exposure-management/

Modernizing Your VM Program with Rapid7 Exposure Command: A Path to Effective Continuous Threat Exposure Management

In today’s threat landscape, where cyber-attacks are increasingly sophisticated and pervasive, organizations face the daunting challenge of securing a constantly expanding attack surface. Traditional vulnerability management (VM) programs, while necessary, are no longer sufficient on their own. They often struggle to keep pace with the dynamic nature of threats and the complexity of modern IT environments.

This is where continuous threat exposure management (CTEM) comes into play – an approach that shifts the focus from merely identifying vulnerabilities to understanding and mitigating exposures across the entire attack surface.

Implementing a continuous threat and exposure management process

CTEM is a term originally coined by Gartner, who defined it as, “a five-stage approach that continuously exposes an organization’s networks, systems, and assets to simulated attacks to identify vulnerabilities and weaknesses.”

The five stages of CTEM as defined by Gartner are:

Modernizing Your VM Program with Rapid7 Exposure Command: A Path to Effective Continuous Threat Exposure Management
  • Scoping: This involves understanding the full threat landscape by incorporating tools like external attack surface management (EASM) and network scanning. However, it emphasizes the need to think in terms of business context, focusing on crown jewels, critical applications, and understanding what matters most to the organization.
  • Discovery: This stage focuses on discovering assets and profiling the associated risks. It requires visibility into both cloud and on-premises environments and extends beyond identifying vulnerabilities to include coverage gaps, misconfigurations, and other security risks.
  • Prioritization: Since not all risks can be addressed simultaneously, this phase involves prioritizing issues based on a combination of factors like severity, exploitability, and potential business impact, to determine what should be tackled first.
  • Validation: This stage emphasizes investing in tools that help validate security controls and map potential attack paths. It includes the use of breach and attack simulation (BAS) tools, continuous assessment services, controls monitoring, and attack path mapping to test the effectiveness of existing defenses.
  • Mobilization: The final stage is about taking action. It includes both automation of responses and fostering cross-organizational alignment to ensure that remediation efforts are executed effectively and in sync with business priorities.

This framework helps organizations continuously manage and reduce their exposure to threats in a way that is strategic and aligned to the business.

The role of exposure assessment platforms (EAPs) in CTEM

Exposure assessment platforms (EAPs) are essential to a successful CTEM program. They continuously identify and prioritize exposures, such as vulnerabilities and misconfigurations, across a broad range of asset classes. By consolidating and contextualizing data from various sources, EAPs provide a more comprehensive view of an organization’s risk landscape. This enables security teams to prioritize remediation efforts based on factors such as asset criticality, business impact, and the likelihood of exploitation.

Gartner’s insights into EAPs underscore their importance in modern cybersecurity strategies. By delivering a centralized view of high-risk exposures, EAPs empower organizations to take decisive actions to prevent breaches. They also enhance operational efficiency by offering a unified dashboard that tracks the lifecycle of vulnerabilities and other exposures.

How Rapid7 Exposure Command supports modern vulnerability management programs

Exposure Command is designed to bridge the security-visibility gap many organizations face. By integrating the capabilities of an EAP into a comprehensive security platform, Exposure Command enables organizations to modernize their VM programs and align them with the principles of CTEM.

Exposure Command can help organizations achieve this transformation in a few ways:

  • Consolidated view of exposures from the inside out and outside in: Exposure Command provides a single, consolidated view of all assets and identified exposures from an internal and external perspective, including vulnerabilities, misconfigurations, and other risk signals. This unified view reduces the overhead associated with managing multiple tools and platforms, enabling security teams to focus on what matters most: mitigating the most critical threats.
  • Vendor-agnostic approach: As organizations adopt a CTEM approach, they require tools that can evaluate a wide range of exposure telemetry, including security control configurations. Exposure Command excels in this area by leveraging data from existing endpoint and network investments to create a more accurate, situational picture of the organization’s risk landscape. This holistic view is crucial for making informed decisions about where to focus remediation efforts.
  • Contextualized risk prioritization: Traditional VM programs often rely on CVSS scores to prioritize vulnerabilities, which can lead to misaligned efforts. Exposure Command, however, incorporates threat intelligence, asset criticality, and business impact into its risk-prioritization algorithms. This results in a more accurate and actionable understanding of which exposures pose the greatest risk to the organization.
  • Identify exploitability and potential for lateral movement: Exposure Command provides the contextual asset enrichment that enables effective threat detection, investigation, and response. The platform showcases how an attacker might exploit vulnerabilities and provides guidance on how to prevent such incidents.
  • Automated response workflows and deep ecosystem integration: One of the key benefits of Exposure Command is its ability to automate and streamline workflows. By integrating with existing security tools and platforms, Exposure Command can automatically ingest and analyze exposure data, reducing the manual effort required to maintain a VM program. This automation not only improves efficiency but also ensures security teams have access to the most up-to-date information. More and more we’re running into non-patchable systems too, and this deep integration and ability to provide bi-directional workflows enables more effective mobilization across teams, giving actionable feedback to those around the organization who have the ability to execute the necessary remediation actions.

While the benefits of Exposure Command are clear, it’s important to recognize that its effectiveness is tied to the maturity of the organization’s CTEM processes. If these processes are broken or immature, the value of Exposure Command may be limited. However, by adopting an outcome-driven approach that scopes the most critical aspects of the business and correlates asset context with dynamic risk ratings, organizations can maximize the benefits of Exposure Command.

Furthermore, the platform’s ability to integrate with a wide range of tools ensures it can enhance existing security programs, rather than requiring a complete overhaul. This makes it an ideal solution for organizations looking to modernize their VM programs and adopt a more proactive approach to threat management. As you look to strengthen your organization’s cybersecurity posture, consider how Rapid7 Exposure Command can help you bridge the security visibility gap and take a more proactive approach to managing your threat landscape.

What’s New in Rapid7 Products & Services: Q3 2024 in Review

Post Syndicated from Margaret Wei original https://blog.rapid7.com/2024/10/01/whats-new-in-rapid7-products-services-q3-2024-in-review/

What’s New in Rapid7 Products & Services: Q3 2024 in Review

This was one of the most exciting quarters at Rapid7 as we announced the next chapter in our mission to give customers command of their attack surface: the Rapid7 Command Platform, our unified threat exposure and detection and response platform. With this, we introduced two exciting new products:

  • Surface Command: Unifies asset inventory and attack surface management
  • Exposure Command: Brings together the comprehensive visibility of Surface Command with hybrid vulnerability management for true end-to-end risk management

While building on our legacy as a pioneer in vulnerability management, we’ve also made expansions on the detection and response side of the house – expanding our Managed Detection and Response capabilities with the release of MDR for the Extended Ecosystem. Read on for more details on these exciting launches across Rapid7 products and services.

Achieve complete attack surface visibility and proactively eliminate exposures from endpoint to cloud

As digital infrastructure continues to evolve from traditional on-prem models to hybrid, distributed teams and systems, one thing remains the same – the attack surface continues to grow, creating more risk and a wider visibility gap.

With the August launches of both Surface Command and Exposure Command, Rapid7 is closing the visibility gap and providing your team with the tools to visualize, prioritize, and remediate risk from endpoint to cloud.

Surface Command: Comprehensive visibility you can trust

What’s New in Rapid7 Products & Services: Q3 2024 in Review

Surface Command provides the foundational attack surface visibility that underpins the Command Platform by breaking down security data silos and combining comprehensive external attack surface monitoring with internal asset visibility across hybrid environments. The result? A dynamic 360-degree view of your entire attack surface in one place. With this view, you can:

  • Visualize your entire digital estate from endpoint to cloud
  • Prioritize and mitigate exposures and potential threats with a risk-aware and adversary-driven view of your entire attack surface
  • Identify and address misconfigurations, shadow IT, and compliance issues

Learn more about Surface Command.

Exposure Command: Pinpoint and extinguish critical risks from endpoint to cloud

What’s New in Rapid7 Products & Services: Q3 2024 in Review

Exposure Command extends the power of Surface Command by combining complete attack surface visibility with high-fidelity risk context and insight into your organization’s security posture. Exposure Command aggregates findings from both Rapid7’s native exposure detection capabilities as well as third-party exposure and enrichment sources you’ve already got in place, so you are able to:

  • Extend risk coverage to cloud environments with real-time agentless assessment
  • Zero-in on exposures and vulnerabilities with the threat-aware risk context
  • Continuously assess your attack surface, validate exposures, and receive actionable remediation guidance
  • Efficiently operationalize your exposure management program and automate enforcement of security and compliance policies with native, no-code automation

Learn more about Exposure Command.

Continuous red teaming at your (managed) service with Vector Command

Attackers are relentlessly looking for weak spots and new access points into your organization – you should be too. Leverage Vector Command – our latest continuous red teaming service – to proactively test your external attack surface with ongoing red team exercises and expert guidance from Rapid7’s team of managed services experts.

What’s New in Rapid7 Products & Services: Q3 2024 in Review

With Vector Command, your team will experience:

  • Increased visibility of the external attack surface with persistent, proactive reconnaissance of both known and unknown internet-facing assets
  • Improved prioritization with ongoing, expert-led red team operations to continuously validate your most critical external exposures
  • Same-day reporting of successful exploits with expert-vetted attack paths for multi-vector attack chains and a curated list of “attractive assets” that are likely to be exploited
  • Monthly expert consultation to confidently drive remediation efforts and resiliency planning

Learn more about Vector Command.

Improved scale, reliability and contextualized reporting for cloud and on-prem vulnerability management

The increased scale, rate of change, and complexity associated with cloud and on-prem environments makes managing vulnerabilities a challenge. This quarter we continued to advance our agentless vulnerability assessment capabilities to drive improved scalability and extended reporting to allow teams to quickly identify, prioritize, and remediate vulnerabilities at scale. This includes:

  • In-cloud assessment for Azure hosts drive improved cost efficiency for running vulnerability assessments at scale across all cloud hosts running on Microsoft Azure.
  • Unified cloud vulnerability reporting combines context and insights across discovered CVEs, software and resources with proof data included by default to enable more effective and accelerated vulnerability remediation.
  • Increased granularity for cloud vulnerability first found dates enables teams to quickly understand where an organization is exposed to a given CVE both at an organizational level across their environment globally or on a per-resource basis.Accurately report on MTTR with first found date enhancement for on-prem vulnerabilities with the addition of “First Found” and “Reintroduced” columns, providing deeper visibility into when a vulnerability was first discovered and if it was later reintroduced after patching.

Comprehensive content coverage for policies and critical systems

We strive to provide you with fast and broad coverage for critical policies and systems so you can accurately assess the environment for vulnerability and compliance risks. This past quarter we added a number of new policy coverages and enhancements to InsightVM and Nexpose, including:

  • Arista EOS coverage: Arista is a popular alternative to Cisco, and this expansion provides you with broader coverage of your boundary devices and better insights into critical assets.
  • Released policy coverage for DISA STIG Windows Server 2016 and Windows Server 2019; DISA STIG for Red Hat Enterprise Linux 8 and Red Hat Enterprise Linux 9; and CIS Benchmark for Fortinet Fortigate to ensure continued compliance.
  • Enhanced existing coverages for critical systems like Alpine Linux, Oracle Linux, Windows Server 2022, and Debian Linux.

Pinpoint critical signals and act confidently against threats with cloud-ready detection and response

Introducing MDR for the Extended Ecosystem

In an ever-expanding cybersecurity landscape, organizations are under more pressure than ever to keep pace with the widening attack surface. That’s why we’re so excited to bring extended support and coverage capabilities to our MDR customers with the launch of Rapid7 MDR for the Extended Ecosystem. With this addition, we’re extending our service to include triage, investigation, and response to alerts from third-party tools already in use within customer organizations.

This initial release will bring support for major EPPs such as Microsoft Defender for Endpoint, CrowdStrike Falcon, and SentinelOne, with plans to extend coverage to more third-party tools across cloud, identity, and network in the coming months.

Read this recent blog entry to learn how this extension of MDR sets Rapid7 apart and brings your team coverage, protection, and peace of mind.

Rapid7 named a Leader in IDC MarketScape: Worldwide SIEM for SMB and Enterprise

We’re excited to share we’ve been recognized as a Leader in the IDC MarketScape: Worldwide SIEM for SMB 2024 Vendor Assessment (doc #US52038824, September 2024) and the IDC MarketScape: Worldwide SIEM for Enterprise 2024 Vendor Assessment (doc #US51541324, September 2024). We’re proud that IDC highlights InsightIDR’s superior threat detection content, ease of implementation, and tangible ROI – all areas where we continually invest to provide users with a streamlined, complex-free experience.

To our customers: Thank you. Your partnership, feedback, and trust fuels our dedication to delivering the detection and response functionalities you need to take command of your attack surface and keep your organization safe. Read more about the reports here.

Intuitive log search enhancements to empower practitioners of all levels

Collecting, analyzing, and correlating logs from various sources is table stakes in identifying potential threats, detecting malicious behaviors, and responding to incidents effectively. Within InsightIDR we continue to enhance our Log Search functionality to empower you to go beyond simply correlating logs so you can feel confident securing your organization and enhancing your security posture.

Reformatted Log Search not only optimizes view and streamlines accessibility, but it reduces friction with notable enhancements:

  • Pre-computed queries auto-run in less than half a second and can be leveraged from our OOTB library of queries or built custom using “groupby” or “calculate” commands.
  • Automatic key suggestions are provided to analysts during query building based on the log selection to ensure faster time to investigate (as opposed to recalling and populating individually).
  • Using the select clause, you can leverage new key suggestions to choose those to include in your search results. You can also customize their names and order.

The latest research and intelligence from Rapid7 Labs

Ransomware Radar Report: Findings and insights into the booming ransomware space

According to Rapid7 Labs Ransomware Radar Report, ransomware continues to evolve at a rapid pace. With the first half of 2024 seeing a +67% increase in the average number of ransomware groups actively posting to leak sites each month, it doesn’t appear that things are slowing down.
The report offers analysis and insights to help security practitioners understand and anticipate the latest developments around ransomware attacks. This research is based on data from Rapid7’s Incident Response and Rapid7 Labs teams as well as thousands of publicly reported ransomware incidents observed from January of 2023 through June of 2024.

What’s New in Rapid7 Products & Services: Q3 2024 in Review
Source: Rapid7’s Ransomware Radar Report

Read the Ransomware Radar Report now to learn the key takeaways for keeping your organization safe from ransomware.

Emergent Threat Response: Real-time guidance for critical threats

Rapid7’s Emergent Threat Response (ETR) program from Rapid7 Labs delivers fast, expert analysis and first-rate security content for the highest-priority security threats to help both Rapid7 customers and the greater security community understand their exposure and act quickly to defend their networks against rising threats.

In Q3, Rapid7’s Emergent Threat Response team provided expert analysis, InsightIDR and InsightVM content, and mitigation guidance for multiple critical, actively exploited vulnerabilities and widespread attacks:

Follow along here to receive the latest emergent threat guidance from our team.

Stay tuned for more!

As always, we’re continuing to work on exciting product enhancements and releases throughout the year. Keep an eye on our blog and release notes as we continue to highlight the latest in product and service investments at Rapid7.

Proactively Securing Cloud Workloads in the CI/CD Pipeline with Rapid7 and Azure DevOps

Post Syndicated from Ray Cochrane original https://blog.rapid7.com/2024/09/25/proactively-securing-cloud-workloads-in-the-ci-cd-pipeline-with-rapid7-and-azure-devops/

Proactively Securing Cloud Workloads in the CI/CD Pipeline with Rapid7 and Azure DevOps

As organizations continue to embrace cloud-native development practices, the need for integrated security solutions that seamlessly fit into existing DevOps environments has become more pressing than ever. We recognize this critical need and have added new integration for InsightCloudSec (ICS) and Exposure Command with Azure DevOps for Infrastructure as code (IaC) tooling, empowering organizations to quickly and effectively safeguard their attack surfaces.

But first, let’s quickly refresh infrastructure as code functionality within ICS to remind us of how important it is and why this new integration will play a key role in your organization’s security posture. Shifting left in code security is more important than ever before and IaC is the impetus for organizations to move cloud security and compliance from being reactive (at runtime) to being preventative (during development). The key is integrating the right controls with the proper guidance directly into the CI/CD pipeline. This integration facilitates delivering secure and compliant cloud infrastructure from the start. Rapid7’s innovative IaC tool allows you to identify key insights and risks during the development process which allow you to protect and secure your attack surface before it’s visible. If you want to learn more about getting started with IaC you can check out this helpful guide.

Why DevSecOps is so important

In today’s fast-paced development environments, security cannot be an afterthought. The ability to integrate security checks directly into DevOps — commonly referred to as DevSecOps —  workflows is crucial for minimizing vulnerabilities and reducing the risk of breaches.

Making security a shared responsibility between development, operations and security teams has a number of key benefits:

  • It enables developers to deliver better, more-secure code faster, and, therefore, cheaper.
  • It makes security a continuous activity, allowing for issues to be caught proactively before they reach production.
  • It stops an all-too-common dynamic where security teams are only being brought in at the end of the project process in a QA role.

Impact of the new integration

With cloud environments being dynamic and complex, it’s vital to have tools that can quickly scan repositories and return actionable insights with minimal disruption to the development process. This is where the integration between InsightCloudSec and Azure DevOps makes a significant impact. By embedding security directly into the CI/CD pipeline, organizations can ensure that their code is secure before it ever reaches production, thus safeguarding their entire attack surface more effectively

The integration of InsightCloudSec with Azure DevOps introduces a suite of new capabilities designed to enhance how organizations assess and respond to potential risks within their cloud environments.

Here’s how it transforms the security landscape:

  • Extend attack surface visibility Into the CI/CD pipeline: The integration is designed to maximize the protection of your cloud environment by continuously monitoring and assessing risks by shifting security controls to the left. By catching issues early, it significantly reduces the likelihood of security threats reaching production, thereby minimizing the potential attack surface.
  • Proactive repository scanning: With this integration, security scans are executed as a seamless part of the CI/CD pipeline. As soon as IaC templates are changed in version control systems, InsightCloudSec can automatically scan repositories, identifying vulnerabilities, misconfigurations, and compliance issues. This seamless execution ensures that security checks do not hinder development velocity, allowing teams to maintain their pace while ensuring security.
  • Frictionless risk assessment and remediation: Rapid7’s integration emphasizes ease of use, ensuring that security assessments and remediation steps are as frictionless as possible. Real-time alerts and detailed insights are provided directly within Azure DevOps, enabling teams to quickly understand and address risks without needing to navigate multiple tools. This streamlined approach not only speeds up the response time but also ensures that remediation efforts are effective and aligned with organizational security policies.
  • Improved collaboration between security and DevOps teams: Driving better integration between security tooling and the CI/CD pipeline helps break down the unfortunately all too common “us vs. them” mentality that can exist between development and security teams. By automating repeatable, time-consuming tasks, such as vulnerability scanning and compliance checks, teams can shift their focus away from manual, often reactive efforts, and towards proactive collaboration. This streamlined approach empowers developers to identify and remediate security issues early in the development process without slowing down delivery, while security professionals gain visibility into code changes in real-time. The result is a more cohesive, efficient workflow where both teams work together to address complex, impactful problems, rather than being bogged down by friction and misaligned priorities.

Integration benefits at-a-glance

The integration between Rapid7’s InsightCloudSec and Azure DevOps will help organizations using the Azure ecosystem of tools easily advance their cloud security programs by shifting left, offering organizations the tools they need to effectively safeguard their attack surfaces without slowing down their development processes. By doing so, organizations can proactively address risks before they become significant threats, leading to a more secure and resilient cloud environment.

Automated scans and seamless alerting within Azure DevOps reduce the time it takes to identify and remediate vulnerabilities, helping organizations maintain a rapid development cycle without sacrificing security. The integration also fosters improved collaboration between security and development teams, ensuring that security is a shared responsibility. With clear and actionable insights provided within the same environment developers use daily, security becomes an integral part of the DevOps workflow.

By delivering seamless, frictionless security assessments and remediation steps directly within the CI/CD pipeline, Rapid7 continues to empower organizations to build, deploy, and maintain secure cloud environments with confidence.

As organizations navigate the complexities of cloud security, this integration will be a vital asset in ensuring that their cloud environments remain secure, compliant, and resilient against ever-evolving threats. Be sure to stay tuned for more updates as we continue to invest in driving more seamless integration between security and development processes.

The Growing Importance of Exposure Management: Our Key Insights from Gartner® Hype Cycle™ for Security Operations, 2024

Post Syndicated from Rapid7 original https://blog.rapid7.com/2024/09/13/the-growing-importance-of-exposure-management-our-key-insights-from-gartner-r-hype-cycle-for-security-operations-2024/

The Growing Importance of Exposure Management: Our Key Insights from Gartner® Hype Cycle™ for Security Operations, 2024

The Gartner® Hype Cycle™ for Security Operations, 2024  was published in late July, and is an interesting look at the dynamic nature of both the threat landscape and the diverse range of technologies that security & risk management (SRM) professionals use to safeguard their organizations.

Understanding the Hype Cycle

Gartner Hype Cycles provide a graphic representation of the maturity and adoption of technologies and applications, and how they are potentially relevant to solving real business problems and exploiting new opportunities. Over 90 Hype Cycles are published per year. Hype Cycles provide a snapshot of the relative market penetration, maturity and benefit of innovations within a certain segment, such as a technology area or business market. This Hype Cycle helps security and risk management leaders strategize and deliver SecOps capability and functions.

What we think are key themes from this year’s Hype Cycle for SecOps

The 2024 Hype Cycle has seen some notable additions and consolidations, particularly around the rapidly-evolving Threat Exposure Management (TEM) market, as existing vulnerability assessment and management approaches mature to support the Continuous Threat Exposure Management (CTEM) framework. In the report Gartner defines CTEM as “a program helping organizations to improve their maturity when they govern and operationalize the five recommended phases of exposure management: scoping, discovery, prioritization, validation and mobilization.’”

Three new profiles reflect this evolution:

  • Threat Exposure Management – This is intended to help organizations answer the question, “ow exposed are we?” It extends traditional approaches to vulnerability management to focus on risk reduction across a much wider potential attack surface, including cloud, SaaS applications and the third-party supply chain.

    Today,many organizations currently have a siloed approach to exposure management across many different domains — external, vulnerability scanning, penetration testing — and are struggling to keep up with the pace of environmental change.

    Gartner rates the potential benefit of Threat Exposure Management as ‘transformational’ and states that organizations should ‘employ proper governance and repeatability to make their threat exposure management programs continuous.’

  • Exposure assessment platforms (EAPs) – This is a new category with a ‘high’ benefit rating from Gartner. In the report, Gartner states that EAPs ‘continuously identify and prioritize exposures, such as vulnerabilities and misconfigurations, across a broad range of asset classes. They natively deliver or integrate with discovery capabilities, such as assessment tools that enumerate exposures like vulnerabilities and configuration issues, to increase visibility.’

    Gartner has removed both vulnerability assessment (VA) and vulnerability prioritization technologies (VPT) from this year’s Hype Cycle, stating that they have been ‘subsumed into exposure assessment platforms.’

    We believe that a potential benefit of EAPs is to provide better insights into high-risk exposures, which could allow organizations to prevent security incidents and breaches. They can also improve operational efficiency by providing centralized visibility of assets and exposures, supporting risk scoring reporting and trend analysis across the organization.

    Rapid7 is named as a Sample Vendor for EAP in this latest report.

  • Adversarial exposure validation – The third new category related to exposure management covers the validation pillar of a CTEM program. As noted in the report, “Adversarial exposure validation technologies offer offensive security technologies simulating threat actor tactics, techniques, and procedures to validate the existence of exploitable exposures and test security control effectiveness. Within this profile, Gartner has consolidated breach attack simulation and autonomous penetration testing and red teaming. “
    Gartner recommends that security and risk leaders should ‘Integrate existing attack simulation and penetration testing scenarios into an adversarial exposure validation roadmap, as part of a shift from vulnerability management to a CTEM program.’

As well as these new categories, we also see movement among some of the existing technologies that can support CTEM initiatives – notably Cyber Asset Attack Surface Management (CAASM), External Attack Surface Management (EASM) and Digital Risk Protection Services (DRPS).

Both EASM and DRPS are in the ‘Trough of Disillusionment’ on this year’s Hype Cycle.  Gartner notes, “SRM leaders are reevaluating the value they’re getting from technologies in the trough, often having to reinforce their justification for budgets. For example:[…] Enterprises were unprepared to consume and operationalize service output (digital risk protection services, external attack surface management, ITDR).

CAASM has moved from ‘Innovation Trigger’ to the ‘Peak of Inflated Expectations’, reflecting the growing demand from enterprises to gain better visibility of their attack surfaces. CAASM helps provide more comprehensive visibility into assets by consolidating asset and exposure information into a holistic view. Noetic Cyber, a recent acquisition of Rapid7, is also a Sample Vendor for CAASM.

Rapid7’s vision for Exposure Management

Rapid7 recently announced the availability of Exposure Command and Surface Command, the first two solutions launched on the new Command Platform. Surface Command provides 360-degree visibility across the internal and external environment by bringing together EASM and CAASM in a single solution, enabling security teams to view and prioritize high-risk assets across their extended environments.

Building on the unparalleled visibility provided by Surface Command, Exposure Command expands traditional vulnerability management programs with insights and context from vulnerability, cloud and application security tools, establishing a single, consolidated platform for exposure management across the organization.

The Growing Importance of Exposure Management: Our Key Insights from Gartner® Hype Cycle™ for Security Operations, 2024

This centralized point of exposure management allows security leaders to prioritize based on the overall risk to the business, understand complex attack paths across the cloud and on-premise environments, and surface the top areas teams need to focus on and while elevating the mitigation activities that would have the largest impact in reducing the overall risk score of your environment.

We believe that these new capabilities align well with the Gartner concept of exposure assessment platforms and the overall requirements of a threat exposure management program. To understand more about Rapid7’s approach to attack surface and exposure management, you can find out more here.

Gartner, Hype Cycle for Security Operations, 2024, July 2024.
GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally, and HYPE CYCLE is a registered trademark of Gartner, Inc. and/or its affiliates and are used herein with permission. All rights reserved.
Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.

Introducing the Rapid7 Command Platform

Post Syndicated from Corey Thomas original https://blog.rapid7.com/2024/08/05/introducing-the-rapid7-command-platform/

Integrated Security Operations for the Next-Generation Attack Surface

Introducing the Rapid7 Command Platform

As cybercrime and attack surfaces have sprawled, Rapid7 has been able to grow with our customers because we are relentlessly focused on relevance. The way we see it, relevance doesn’t mean aligning to market definitions of categories, but rather deeply understanding how critical decisions need to be made and building solutions that provide the right context when and where customers need it.

From our foundations in vulnerability management 24 years ago, we have developed a comprehensive portfolio of security technologies trusted by over 11,000 customers around the globe. We are also home to a team of experts and researchers and the proud curators of one of the most renowned open source security communities – all of which informs our products and services, so customers can have our expertise at their fingertips.

While other vendors launched SIEMs focused on log aggregation and building mounds of data for customers to parse through, we launched our detections-centric next-gen SIEM focused on keeping SOCs ahead of adversaries. As other MDRs became alert-factories pushing the hard work back on the shoulders of their customers, we focused on building high signal-to-noise full environment coverage and end-to-end partnership. And when other exposure management providers stopped at the endpoint, we pushed integrated coverage to the cloud and beyond.

Today, I’m excited to share the next chapter in our mission to give customers command of their attack surface: the introduction of the Rapid7 Command Platform, our unified threat exposure and detection & response platform.

A Relevant View of Your Attack Surface You Can Trust

You cannot deliver what is relevant for customers without listening to customers. Across our industry, we have focused on building purpose-fit products to solve specific customer needs. As a result, even industry-leading products have become high cost, disparate sources of data which must be manually cobbled together for a low-confidence picture of the attack surface.

How can you secure and manage what you cannot see?

Our team has heard this over and over again and we made the commitment to build a better way. With this launch of the Rapid7 Command Platform, we can now deliver a more comprehensive view of your attack surface, with transparency that you can trust.

Anchored by Surface Command, our new unified asset inventory and attack surface management product, customers can get a more complete, vendor agnostic view of their internal and external attack surface—at a disruptive, all-in value.

We begin with a rapidly growing library of over 100 connectors, which collects and unifies data across your security ecosystem. Our AI-charged correlation engine deduplicates and reconciles telemetry across sources to create a cohesive visualization of your environment. While you get an out-of-the-box view, data transparency and detailed metadata drill downs means you can feel confident that you have both a more complete picture and the context you need to accelerate critical security decisions across teams. From the driver’s seat of your attack surface, you can zero-in on controls and policy gaps, discover shadow IT, and gather relevant context that accelerates prioritization and remediation activities. With the total visibility Surface Command provides, you gain total control of your attack surface.

Unified Threat Exposure, Detection, and Response

Reinforced by data silos, security program fundamentals – exposure management and detection & response – have operated in isolation for too long. The Command Platform’s ability to maximize and integrate your security data from endpoint to cloud will finally bring these functions into a single, integrated program that yields better productivity, efficiency, and efficacy for security teams.

Our second new solution on the Command Platform – Exposure Command – brings together the comprehensive visibility of Surface Command with leading vulnerability management and cloud-native application protection to deliver a true end-to-end attack defense. With Exposure Command, InfoSec teams can defend and monitor their risk landscape through the lens of an adversary.

On top of Surface Command’s total visibility, we add the context and clarity of what is actually being exploited in the wild, the items that we know attackers will have in their sights. Understanding what is truly urgent and important transforms endless to-do lists into actionable hit lists. This transparency also gives security leaders the confidence to socialize and articulate potential business impact if these items are not actioned. Married with policy and vulnerability coverage across hybrid environments, unified reporting, and remediation, Exposure Command is your hub for next-generation risk management.

The Command Platform will drive faster and more efficient Detection & Response, with reduced noise and greater conviction around the right actions to take to extinguish threats. We have already made progress towards this vision today with our Threat Complete product, which delivers the enriched context of exposure management alongside leading next-gen SIEM to stay ahead of attackers. The ability to pinpoint and correlate the events, activity, and alerts that actually matter and then know how to respond is the difference of getting breached or not. Whether you’re leveraging our cloud-first technology or partnering with our MDR SOC as an extension of your team, Rapid7 Detection & Response customers can be confident that they have the ecosystem coverage and context they need to be able to respond like an expert every time.

Confidently Take On the Next Era of Security with Rapid7

I’m so grateful to our customers and partners who have been the North Star in guiding us on this mission, and I am proud of the progress that this launch signifies. We are extremely excited to get the Command Platform, Surface Command, and Exposure Command into more hands and continue to improve how we deliver the most relevant security solutions for customers.

Rapid7 is on a path to deliver 100% attack surface visibility and monitoring that customers can afford and rely on, and we have many milestones that are still in front of us. I look forward to sharing more game-changing updates soon.

For those interested in learning more, we’d love to hear from you and share a demo of our new Exposure Command product – sign up here.

Rapid7 Introduces Exposure Command to Eliminate the Security Visibility Gap

Post Syndicated from Rapid7 original https://blog.rapid7.com/2024/08/05/rapid7-introduces-exposure-command-to-eliminate-the-security-visibility-gap/

Exposure Command provides 360-degree visibility and enables security teams to pinpoint and extinguish your most critical risks.

Rapid7 Introduces Exposure Command to Eliminate the Security Visibility Gap

Security and IT teams are experiencing a significant (changed from “seismic” for clarity) shift in operations as they become more distributed. Development and procurement processes have decentralized, and sensitive data now extends far beyond the network edge. This expansion, coupled with growth and innovation outpacing security investments, has led to a significant “security visibility gap.”

Rapid7 Introduces Exposure Command to Eliminate the Security Visibility Gap

Disparate tools widen this gap, creating data silos and inconsistencies, leading to manual efforts and swivel-charing to manually correlate conflicting findings and dashboards. This situation has been exacerbated by broader industry trends. Gartner estimates that through 2026, ‘unpatchable’ attack surfaces will grow from less than 10% to more than half of the enterprise’s total exposure, reducing the effectiveness of traditional vulnerability management programs.

Security teams need to manage and interpret a broad range of different exposure types – cloud misconfigurations, user entitlements, unmanaged machines, vulnerabilities, etc. with conflicting and duplicate data from various different security and IT management tools with varying levels of data fidelity.

The only way to truly solve this problem is to implement a solution that treats third-party data as a first-class citizen, bringing together telemetry from all of your security tools to build a complete picture of your environment, and thereby your attack surface. To that end, Rapid7 announced the launch of two exciting new product offerings designed to unify your attack surface and deliver effective hybrid risk management: Surface Command and Exposure Command.

Unlock complete attack surface visibility to eliminate blind spots and uncover control gaps with Surface Command

Surface Command closes the visibility gap by breaking down data silos, combining internal and external monitoring to build a 360-degree view of your entire environment, combining market leading Cyber Asset Attack Surface Management (CAASM) and External Attack Surface Management (EASM) capabilities into one unified offering.

External scans provide an adversary’s perspective on the attack surface, detecting and validating exposures. Surface Command combines these external scans with a detailed inventory of your internal assets, continuously ingested and updated from a wide range of security and IT tools and automatically correlates the assets to create detailed inventory of your ‘true’ attack surface, highlighting security control gaps.

Rapid7 Introduces Exposure Command to Eliminate the Security Visibility Gap

This process delivers a comprehensive view of your environment that teams across the organization can trust and align on as a ‘single source of truth’ without the risk of blind spots, unprotected assets, and ungoverned access. Understanding how all your interconnected assets are configured enables you to quickly identify and prioritize  high-risk vulnerabilities, shadow IT, and compliance issues. With this more comprehensive visibility serving as the foundation of our Command Platform, security teams have a view of their attack surface they can trust and action across their wider organization.

Rapid7 Introduces Exposure Command to Eliminate the Security Visibility Gap

Automatically prioritize exposures across your hybrid environment with Exposure Command

Exposure Command extends the power of Surface Command even further, combining the same unified attack surface visibility with high-fidelity environment detail and risk context to help teams to zero-in on the exposures and vulnerabilities that attackers have in their sights with the threat-aware risk context needed to prioritize more efficiently and effectively.

With Exposure Command, every asset in your environment is enriched with relevant context from all of Rapid7’s exposure management capabilities, including our industry-leading VM, CNAPP and AppSec solutions, which provides teams an understanding of which assets are most critical to the business and those that suffer from toxic combinations that leave the organization vulnerable to a security incident.

This situational awareness allows teams to more effectively prioritize response efforts by honing in on the vulnerabilities that are either being actively exploited in the wild and/or those that present the most risk should a compromise occur.

Rapid7 Introduces Exposure Command to Eliminate the Security Visibility Gap

Prioritization is critical, especially when you consider the massive volume of risk signals produced by modern cloud-native environments on a daily basis. It’s simply not feasible to expect to address everything, so making sure that teams are spending the time they do have on the actions that will have the greatest impact on reducing their overall risk posture and eliminating critical exposures is key.

When it comes to prioritization, there are three primary vectors that we need to consider: Opportunity, Likelihood and Impact of exploitation.

  • Opportunity – The first step in prioritizing exposures is to understand whether a threat actor could exploit the issue in the first place by analyzing the downstream security controls and mechanisms in place – or not in place for that matter. This includes considering whether or not a resource is publicly accessible, if there are additional mitigating controls like web application or network firewalls, if an at-risk asset has an endpoint protection solution installed, etc.
  • Likelihood – It’s important to understand how likely it is that an attacker would exploit a given exposure. This can be accomplished in a number of ways, including focusing on CVEs on CISA’s Known Exploited Vulnerabilities (KEV) list, but also involves looking at real-world activity via threat intelligence feeds – like those that feed into Rapid7’s Active Risk score –  to get a sense for whether a vulnerability is being exploited elsewhere.
  • Impact – Taking into account the business criticality of the asset, data or system, what would be the relevant impact should a given risk signal be exploited by a threat actor. This is often accomplished by assigning tags that flag whether or not a given resource is associated with a business critical application or is housing sensitive customer data.

To this end, a new feature coming to the Command Platform with Exposure Command, Remediation Hub, automatically surfaces the top areas teams need to focus on and elevates the mitigation activities that would have the largest impact in reducing the overall risk score of your environment along with any relevant contextual information to assist in validation and remediation efforts.

Rapid7 Introduces Exposure Command to Eliminate the Security Visibility Gap

After 24+ years in exposure management, we are excited to partner with customers through the next era of the attack surface and hybrid risk with our new Exposure Command product. This is just the beginning. Stay tuned here for more updates as we continue to grow our Command Platform.

Learn more about Surface Command and Exposure Command

Attending Black Hat? Come see us at booth #2436 to get a one on one tour! If you can’t make it to the event you can also find additional information on the docs page, or give us a bit of information and we’ll have a member of the team reach out directly.