Integrate Rapid7 InsightVM with Vulnetix. Export vulnerability findings via the InsightVM REST API for centralised tracking.
How Vulnetix compares: better together
Vulnetix does not replace Rapid7 InsightVM. Keep running it. Vulnetix sits on top of Rapid7 InsightVM (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.
Rapid7 InsightVM is strongest at its core category and also carries features in Cloud Security & CSPM, Container & Image Scanning, just as Vulnetix spans categories.
| Capability | Vulnetix | Rapid7 InsightVM |
|---|---|---|
| Security coverage | ||
| SAST (static code analysis) | ✓ Built-in rules + Semgrep augmentation | ✗ |
| SCA / dependencies | ✓ 40+ ecosystems, transitive graph | ✗ |
| DAST (dynamic testing) | ~ Ingests DAST results; no native dynamic engine | ✗ |
| Container & image | ✓ Image CVEs, base image, Dockerfile | ~ Scans container/Kubernetes images in ECR, ACR and Google Artifact Registry |
| IaC / misconfiguration | ✓ Terraform, k8s, CloudFormation | ✗ |
| Secret scanning | ✓ 1,000+ rules, source + binary + git history | ✗ |
| Cloud / CSPM | ✓ Cloud-posture findings, compliance tab | ~ Native cloud configuration assessment across AWS/Azure/GCP resource types |
| Mobile (MAST) | ~ Ingests mobile scanner output; no native mobile engine | ✗ |
| License compliance | ✓ SPDX, copyleft/AGPL/SSPL policy | ✗ |
| SBOM generation | ✓ CycloneDX 1.7 + SPDX 2.3, cosign-signable | ✗ |
| Malware / supply-chain | ✓ De-duplicated corpus + install-time firewall (25+ registries) | ✗ |
| Network / infra vuln | ~ Ingests network scanner output; no native network scanner | ✓ Core: Nexpose engine network scanning + Insight Agent live assessment |
| Fuzzing | ✗ Ingests fuzzing crashes; no native fuzzer | ✗ |
| Pentest / bug bounty | ✗ Ingests pentest/bug-bounty findings; not a testing service | ✗ |
| The Vulnetix orchestration layer | ||
| Cross-scanner dedup & one queue (ASPM) | ✓ Correlates every scanner into one prioritised queue with ownership routing | ~ Aggregates agent/scan/cloud/container findings per asset in one console (single-vendor) |
| Exploit-intel prioritisation | ✓ EPSS, CISA KEV, Coalition ESS, CWSS, Vulnetix LEV | ✓ Active Risk + EPSS + AttackerKB/Metasploit/CISA KEV threat feeds |
| Reachability analysis | ✓ Tree-sitter + CVEAffected; direct/transitive/semantic | ✗ |
| Versioned VEX + audit trail | ✓ Immutable OpenVEX/CycloneDX, cosign-signable | ✗ |
| Safe Harbour autofix | ✓ Resolves + applies the nearest safe version | ~ Remediation Projects and automation workflows drive assignment/tracking of fixes |
| End-of-life policy | ✓ Flags/blocks past-EOL runtimes & packages | ✗ |
| SSVC / risk-based policy | ✓ SSVC v2 + CISA/FedRAMP/Essential-8 presets | ✗ |
✓ full · ~ partial · ✗ not covered
What Rapid7 InsightVM does well
- Mature network + agent (Insight Agent) vulnerability management with live coverage and GraphQL/REST bulk export APIs
- Active Risk scoring (0-1000) fusing CVSS with AttackerKB, Metasploit, ExploitDB, Project Heisenberg/Project Sonar telemetry, CISA KEV and dark-web feeds, plus native EPSS prioritisation
- Native cloud configuration assessment for AWS/Azure/GCP and container/registry image scanning (ECR/ACR/Artifact Registry) without a separate product
- Remediation Projects and automation workflows that assign and track fixes with IT teams
Where Vulnetix adds to it: Vulnetix ingests and orchestrates InsightVM findings. It does not run network scans itself. Vulnetix is a scanner-agnostic ASPM layer that folds InsightVM host and cloud CVEs into one deduplicated queue alongside best-of-breed SAST/SCA/IaC/secrets/malware engines, then layers reachability, immutable versioned VEX + audit, Safe Harbour autofix and SSVC/EOL policy, code-to-cloud coverage beyond InsightVM's infrastructure focus.
No migration, no rip-and-replace. Rapid7 InsightVM keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.
Centralise Rapid7 InsightVM results in Vulnetix
Upload Rapid7 InsightVM JSON output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.