Rapid7 InsightAppSec review
Broad DAST coverage with strong automation, but the starting price is high per app.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Rapid7 InsightAppSec is a dynamic application security testing product for security and application teams. It scans modern web applications, APIs, and internal applications for vulnerabilities through configurable scan engines, attack types, authentication methods, and crawling options. Its platform coverage includes web applications, APIs, and a Chrome extension, making it suited to teams that need broad attack coverage across externally hosted and internally hosted applications.
The standout strength is testing depth. InsightAppSec provides click-and-scan web application security testing, Universal Translator for application discovery and attack, and more than 95 attack types. Attack Replay helps validate vulnerabilities and fixes, while authenticated scanning supports automated login, browser authentication, Selenium files, session cookies, and certificate authentication. Swagger/OpenAPI and WSDL-based API scanning extend coverage beyond browser-based applications. Reporting, compliance workflows, and remediation features help teams organize findings after scans.
For development and IT operations, the product offers a REST API for managing applications, scan configurations, scans, and vulnerabilities. Jenkins integration adds build pass/fail rules for CI/CD workflows, while integrations with Jira, ServiceNow ITSM, Azure, and Chrome support adjacent processes. Cloud and on-premises scan engines provide a hybrid deployment model. Rapid7 lists pricing starting at $175 per app per month, billed annually. That per-app starting price makes InsightAppSec a stronger fit for teams prioritizing broad coverage, authentication flexibility, and deployment choice than for buyers focused primarily on minimizing testing cost. Teams should choose it when those capabilities justify the subscription structure.
Rapid7 InsightAppSec pros and cons
- Where it wins
- 95+ attack types with configurable crawling and attack replay
- Authenticated scanning supports multiple login and credential methods
- Cloud and on-premises engines plus Jenkins CI/CD automation
- Where it doesn't
- Starts at $175 per app per month with annual billing
- Per-app pricing can become costly across larger application portfolios
- API scanning is centered on Swagger/OpenAPI and WSDL formats
Rapid7 InsightAppSec fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update