Category: Surface Command

Uncovering and Protecting Sensitive Data Across Cloud Environments with Exposure Command

Modern organizations grapple with the complex task of securing sensitive data in sprawling hybrid and multi-cloud environments. Due to insufficient visibility and governance, data is often misplaced, duplicated, or left exposed. This fragmented environment makes it difficult for teams to accurately assess data exposure risks, comply with stringent privacy regulations, and continuously track sensitive data across locations, owners, and usage.

Without a consistent, holistic view of where sensitive data resides and how it is managed, organizations face significant security, compliance, and operational risks. To solve this challenge and make sense of their data security posture, organizations typically start by discovering and gaining visibility into data stored across their IT estate and work to classify the type of data and associated risk of exposure.

Modern enterprises typically rely on various data classification sources, including CSP-native detection services (such as Amazon Macie, MSFT Defender for Cloud, or GCP Security Command Center), third-party DSPM tools, custom classification policies, or by manually tagging native cloud resources. When discrepancies arise, security teams face a critical question: Which classification should they trust and how can they manage these classifications efficiently at scale? To help solve this persistent challenge, we’re excited to announce sensitive data discovery and data-centric risk prioritization in Exposure Command, empowering teams to implement data-centric risk prioritization as a cornerstone of their security strategy.

Automated Data Classification Leveraging Existing Tagging Frameworks

With this update, Exposure Command offers teams the ability to ingest data classifications and findings from native data security services offered by cloud providers such as AWS Macie, Microsoft Defender for Cloud, and Google Cloud Security Command Center. This enhancement enables organizations to centralize sensitive data insights across their cloud environments, providing a unified view of data risks and exposures. By leveraging these integrations, security teams can automate data classification ingestion, enhance risk assessment, and take proactive remediation steps to secure sensitive information in their cloud infrastructures.

We don’t just stop at support for native services, however, as we also offer the ability to ingest tags directly, whether from the Cloud Service Provider (CSP) or via IaC templates such as Terraform. With automated cloud-native tagging, organizations can establish a single source of truth for data classification, ensuring that security teams can quickly assess and respond to risks tied to sensitive information.

By taking a tag-based classification strategy, organizations can:

  • Standardize classification across cloud resources with custom tag schemas for severity, data type, and compliance requirements.
  • Ensure consistency by automating tag propagation across related resources.
  • Leverage version control to track classification changes over time for audit and compliance purposes.

Infrastructure as Code Integration for Seamless Classification

Exposure Command makes it easy to implement and enforce consistent data classification directly within cloud infrastructure deployment workflows. With native Terraform resource tagging, automated tag inheritance, and customizable classification schemas, security teams can automate classification at scale. Version control ensures auditability and change tracking, helping organizations maintain a dynamic, risk-aware classification framework that evolves with their cloud environment.

Sensitive Data Discovery Meets Risk Prioritization

Exposure Command enables teams to take a data-centric approach to risk prioritization by incorporating insights into sensitive data exposures alongside Layered Context and Attack Path Analysis, ensuring that organizations focus on the risks that could lead to real-world breaches. By layering asset criticality, exploitability, and risk posture with insights into sensitive data exposure, security teams can focus on protecting crown jewel data assets.

Taking a Data-Centric Approach to Risk Prioritization with Layered Context

Layered Context is a multi-dimensional risk prioritization model that moves beyond traditional vulnerability management by integrating sensitive data insights, threat intelligence, and business impact analysis into a unified view of risk. Rather than prioritizing based solely on CVSS scores, this approach ensures security teams focus on the exposures that pose the highest real-world risk, not just those that appear severe on paper.

By layering in sensitive data awareness, Exposure Command allows teams to see not just which systems are vulnerable, but which ones expose high-value data whether it’s customer PII, financial records, intellectual property, or regulated information. This makes it possible to prioritize remediation based on both exploitability and potential business impact.

Uncovering and Protecting Sensitive Data Across Cloud Environments with Exposure Command

Understanding Paths for Lateral Movement and Unwanted Access to Sensitive Data

Attackers don’t just exploit vulnerabilities - they chain weaknesses together to reach high-value data. Exposure Command’s Attack Path Analysis goes beyond simply identifying risky assets; it maps how an attacker could move through the environment to access sensitive data. By visualizing lateral movement opportunities, privilege escalation paths, and gaps in data protection, security teams can preemptively block attack routes before they’re exploited.

Uncovering and Protecting Sensitive Data Across Cloud Environments with Exposure Command

Instead of just highlighting vulnerable systems, it maps how attackers could exploit weaknesses to access sensitive customer information, financial records, or intellectual property. This data-centric approach shifts remediation from a focus on CVSS scores to business impact-driven security, ensuring that teams address the most critical exposures first.

By revealing hidden exploitation paths, Exposure Command identifies chained vulnerabilities, lateral movement risks, and privilege escalation opportunities that could allow attackers to reach high-value data. A misconfiguration on a low-risk asset might seem harmless - until it's linked to a cloud storage bucket containing sensitive data. With attack path visualization, security teams can better understand attack scenarios, block lateral movement, and proactively shut down high-risk pathways before they can be exploited - moving from reactive patching to proactive breach prevention.

Why Data-Centric Risk Prioritization Matters

Traditional risk management often overlooks the nuances of sensitive data exposure, relying on static vulnerability metrics. By embedding sensitive data insights directly into risk prioritization workflows, Rapid7 Exposure Command shifts the paradigm to focus on what matters most: safeguarding critical data assets.

This approach ensures that security efforts are aligned with business priorities, enabling organizations to:

  • Protect customer and proprietary information.
  • Mitigate the risk of data breaches and non-compliance penalties.
  • Enhance collaboration between security, IT, and risk management teams.

Take Command of Your Sensitive Data Risks

With sensitive data discovery now part of Exposure Command, Rapid7 is empowering organizations to bolster their security strategies. Whether you're a financial institution safeguarding customer data or a healthcare provider ensuring patient privacy, this innovation provides the tools you need to protect what matters most.

Ready to elevate your risk management program? Learn how Rapid7 Exposure Command can help you integrate data-centric risk prioritization into your security operations.

Command Platform Innovations Eliminate Data Blind Spots Through Complete Visibility and Context-Driven Risk Prioritization

Rapid7 provides unmatched attack surface visibility through the Command Platform, helping security teams identify, prioritize, and remediate risk across hybrid environments. Surface Command is the only solution available that combines native external and internal scanning into a single unified view of your attack surface, enriched with telemetry from third party security and ITOps tools via more than 120 out-of-the-box connectors.

Exposure Command builds on this foundational attack surface visibility, layering on adversary-aware risk prioritization and integrated remediation workflows that make it easy for security teams to anticipate where attackers are going to target, pinpoint their most pressing exposures and act swiftly and collaboratively to address issues before they can be exploited.

Now, we’re taking this a step further with three key innovations designed to strengthen risk prioritization, streamline remediation, and ensure sensitive data remains protected.

Expanding Already Unmatched Attack Surface Visibility and Context to Sensitive Data

Sensitive data is a prime target for attackers, yet security teams often struggle to track where it resides and how exposed it is. Sensitive Data Discovery in Exposure Command delivers continuous visibility into sensitive data across multicloud environments, ensuring that security teams can proactively protect high-value assets.

With native ingestion from CSP security services like AWS Macie, GCP DLP, and Microsoft Defender, as well as Infrastructure-as-Code (IaC) tagging support, security teams can classify sensitive data from the start, eliminating manual, error-prone processes and improving data hygiene.

These insights feed directly into our risk scoring and prioritization methodology, with sensitive data insights woven directly into Layered Context and Attack Path Analysis, enabling teams to identify and focus on the exposures that put sensitive information at risk.

Improving Program Efficiency and Efficacy with AI-driven Vulnerability Scoring

The exponential growth of vulnerabilities has outpaced the ability of vendors and agencies like NVD to provide timely CVSS scores. This leaves security teams struggling to assess the severity of vulnerabilities, particularly with the volume of CVEs escalating rapidly. To bridge this gap, we’re introducing AI-driven CVSS scoring, a powerful capability that leverages an advanced machine learning model to:

  • Analyze vulnerability data from trusted sources and historical expert assessments
  • Generate accurate, intelligence-driven CVSS scores to fill in vendor and agency gaps
  • Feed into our Active Risk scoring model to help security teams cut through the noise and make informed decisions faster and with confidence

With this innovation, the accuracy of Active Risk scores have improved by 17%, ensuring greater consistency and actionable insights. The model’s predictive capabilities achieve a remarkable 87% accuracy in severity classification, making it an indispensable tool in today’s fast-evolving threat environment.

Streamlined Remediation with Surface Command and Remediation Hub

Security teams don’t just need to find risks. They need to fix them, and fix them fast, but it's usually not within their purview to actually take the ultimate action to resolve the issue at its root. Security teams often need to communicate with stakeholders across the organization - often on the infrastructure or DevOps teams - to convince them that there is a pressing risk that needs their attention.

Overcoming this burden of proof - because it’s often not a simple task to convince others around the organization to share your sense of urgency - can be challenging to say the least. In order to clear that hurdle, it requires irrefutable evidence with clarifying context to inspire action.

Our newly-expanded Surface Command and Remediation Hub integration ensures that remediation guidance is embedded directly within asset inventory and detail pages, eliminating the need to switch between platforms to gather and share the contextual information needed to address risk fast.

By deepening the integration between Surface Command and Remediation Hub, security teams benefit from:

  • Faster mean-time-to-remediate (MTTR) by bringing prioritized remediation guidance directly into the asset inventory and detail pages within Surface Command
  • Deeper asset context at the time of remediation, including insights from third-party security and ITOps tooling
  • Improved collaboration by providing security teams and stakeholders with enriched context for quicker decision-making

Ready to Take the Next Step?

Rapid7’s approach combines cutting-edge technology and comprehensive data insights to help organizations focus on what truly matters. By addressing high-impact risks and safeguarding critical assets, teams can reduce their exposure to threats while improving operational efficiency.

Rapid7’s enhanced platform capabilities empower organizations to modernize their risk management strategies. By integrating sensitive data insights, leveraging GenAI-driven prioritization, and expanding remediation workflows, we provide the tools you need to stay ahead of threats and proactively eliminate exposures across your entire attack surface.

This strategy also streamlines collaboration, enabling security, IT, and risk management teams to work together seamlessly with shared context and priorities. Ultimately, aligning risk management practices with real-world threats and business objectives ensures greater resilience and security.

Learn how Rapid7 can help you adopt a threat-aware approach to threat and exposure management. It’s time to transform your security strategy and protect what matters most.

Introducing the Exposure Management Webinar Series: Commanding Your Attack Surface

The digital landscape is expanding rapidly, and with it, the complexity of managing an organization's attack surface. To help cybersecurity professionals navigate this challenge, Rapid7 presents a three-part webinar series, "Commanding Your Attack Surface." This series dives deep into the evolving exposure management landscape, featuring insights, strategies, and practical demonstrations designed to help teams stay ahead of adversaries.

From foundational concepts to cutting-edge solutions, this series is a must-watch for anyone looking to enhance their organization's security posture. Whether you're just beginning to explore exposure management or you're a seasoned practitioner, these webinars offer valuable knowledge and actionable steps to transform your approach.

Why Watch? Key Learnings from the Series

Webinar 1: Exposure Management 101 – Essential Concepts & Strategies. Discover the basics of exposure management and learn how to identify and mitigate risks across your attack surface. This session explores Gartner’s Continuous Threat Exposure Management (CTEM) framework and outlines how a proactive approach can reduce your organization’s likelihood of a breach by threefold.

Watch the Webinar here

Webinar 2: Take Command of Your Attack Surface with Rapid7 Exposure Command. Dive into Rapid7’s cutting-edge Exposure Command platform, which provides unified attack defense and response capabilities. Learn how to bridge the "security visibility gap" by leveraging real-time data aggregation, advanced correlation, and a vendor-agnostic approach to create a single source of truth for your security team.

Watch the Webinar here

Webinar 3: Meeting the Exposure Management Challenge – Key Use Cases for Success. Hear from industry experts on the most pressing challenges in exposure management today. Gain insights into best practices for unifying visibility, prioritizing risks, and validating controls to maximize the effectiveness of your security investments.

Watch the Webinar here

Each session builds on the last, equipping you with the tools and knowledge to proactively manage and defend your attack surface. Click through to view the webinars and transform your cybersecurity strategy today!

Surface Command and Unified Attack Surface Management

At the heart of successful exposure management lies Surface Command, Rapid7's solution for a continuous 360° view of your attack surface. Here’s how Surface Command can transform your security operations:

  • Eradicate Blind Spots: Achieve unparalleled visibility by monitoring internal and external assets, uncovering shadow IT, and eliminating coverage gaps.
  • Defend with Full Context: Leverage native and third-party enrichment to identify the exposures adversaries are most likely to exploit.
  • Accelerate Response: Equip teams with actionable context to triage the full blast radius of an attack and respond more effectively.

Surface Command enables teams to detect, prioritize, and remediate security issues across their entire digital estate, empowering organizations to defend proactively against emerging threats.

Ready to take control of your attack surface?
Explore the possibilities with Surface Command here

Key Takeaways: Mastering Risk Prioritization with Rapid7 Surface Command

Managing risk in today’s sprawling IT environments demands precision and adaptability. Security teams face a constant influx of data from various tools, each offering fragmented insights. Rapid7’s Surface Command takes control of this chaos, consolidating data and delivering actionable insights through custom risk management strategies.

In our recent webinar, Chaney Edwards, Senior Security Solutions Engineer at Rapid7, shares actionable techniques to cut through noise, prioritize effectively, and command your attack surface. Here’s what you’ll gain.

Key Takeaways from the Webinar

1. Start with Tailored Risk Scoring
Effective risk prioritization starts with understanding what matters most to your business. During the webinar, Edwards highlights strategies to move away from generic scoring systems, such as identifying which tools provide the most accurate data for specific asset types and aligning risk scores with your operational priorities.

2. Bridge Data Silos for a Clearer View
A key takeaway from the webinar is the importance of integrating data from across your environment. Teams often lose valuable time reconciling conflicting metrics from different tools. Edwards discusses the advantages of using a unified framework to correlate insights from multiple sources, ensuring consistent decision-making.

3. Use Queries to Uncover Insights Quickly
Advanced queries don’t just save time; they also uncover patterns you might otherwise miss. Edwards demonstrates how to build queries that reveal key risks, such as identifying assets with outdated configurations, unpatched vulnerabilities, or public-facing endpoints.

Why Watch the Webinar?

This webinar offers more than a product overview—it’s packed with actionable advice for improving your risk management strategy. Whether it’s learning to build custom risk scores, integrating data sources, or designing better queries, you’ll come away with tools and strategies to elevate your approach to risk prioritization.

Watch the webinar here.

What’s New in Rapid7 Products & Services: Q4 2024 in Review

This quarter at Rapid7 we continued to make investments across our Command Platform to provide security professionals with a holistic, actionable view of their entire attack surface - from Exposure Management to Detection and Response. Below, we’ve highlighted key releases and updates from the quarter across our products and services, including the new Platform Home Navigation experience, extensibility enhancements to Exposure Command and Surface Command, expanded MXDR support, and 2024 threat landscape trends from Rapid7 Labs.

Accelerate security efficiency and results with Rapid7’s Command Platform

In October, we released our revamped, modernized Command Platform home navigation experience for all users, providing a more cohesive, efficient flow for our users and increased visibility between Rapid7 products and capabilities. Now, viewing security program metrics across your suite of Rapid7 products is easier than ever before—so you can spend less time navigating between products and more time making decisions with easily accessible data.

We’ll be building on this new experience in the coming year to bring iterative updates to the look, feel, and function of the Command Platform—stay tuned for more!

What’s New in Rapid7 Products & Services: Q4 2024 in Review
New Command Platform Home Navigation

Along with the navigation updates, we’ve made improvements to our user management experience. Now, teams are empowered to better safeguard data and systems with more tailored, role- and responsibility-based user access controls. This enables easier collaboration across your organization while ensuring the appropriate access level for each person.

What’s New in Rapid7 Products & Services: Q4 2024 in Review
Revamped user management experience

Achieve complete attack surface visibility and proactively eliminate exposures from endpoint to cloud

Rapid7 co-launches Resource Control Policies with AWS, Adding Support in Exposure Command and InsightCloudSec

Leading up to Re:Invent, AWS announced a powerful new feature to help organizations enforce least privilege access at scale: Resource Control Policies (RCPs). RCPs are an org-level access control policy that can be used to centrally implement and enforce preventative controls across all AWS resources in your environment.

To support this launch, we expanded our existing cloud identity and entitlement management capabilities to include dedicated, out-of-the-box checks for consistent and secure application of RCPs. Today, both Exposure Command and InsightCloudSec include these checks, enabling organizations to apply RCPs consistently and securely. Learn more here.

Shifting Left to Stay Secure with Exposure Command

Developers are at the forefront of modern cloud environments, making “shift-left” strategies essential for effective security. By addressing risks during development rather than after deployment, teams can eliminate vulnerabilities before they become costly issues.

To support our customers in executing stronger shift-left strategies, Exposure Command now offers more robust Infrastructure-as-Code (IaC) scanning and deeper CI/CD integration with Terraform and CloudFormation support across hundreds of resource types. For development teams, integrations like GitLab, GitHub Actions, AWS CloudFormation, and Azure DevOps bring security checks directly into their workflows, helping to secure code without disrupting productivity.

Streamline Vulnerability Management Across Your Entire Application Inventory with Vulnerability Groupings

Triaging scan results can be one of the most arduous and time-consuming parts of vulnerability management, but it’s also one of the most critical. Teams need to quickly synthesize results to validate exposures, prioritize response, and determine next steps for safeguarding their attack surface.

With the recent addition of Application Vulnerability Grouping, InsightAppSec customers can now visualize attacks and assess single applications or their entire application inventory at once, allowing teams to:

  • Visualize exposures with pre-triaged vulnerabilities by app and attack type
  • Identify and focus on threats in key functional areas to simplify vulnerability remediation
  • Manage application-layer risks at scale by updating the status or severity and adding comments to entire groups of vulnerabilities at once
What’s New in Rapid7 Products & Services: Q4 2024 in Review

Explore Exposure Management Use Cases via Guided Product Tours

We’re excited to introduce a new way for you to engage hands-on with core use cases across the Command Platform with our new guided product tours. These tours provide a first-hand, in-depth look at new products and features.

Today, you’ll see tours showcasing how Surface Command can help you map your entire attack surface and identify coverage gaps across your security ecosystem. You’ll also learn how you can prioritize remediation efforts and mobilize teams across your organization with Remediation Hub. Check out the available tours here, and we’ll continue to add more covering use cases across the Command Platform in the future.

Gain Insights from Products Across Your Environment Faster with Self-Service Surface Command Connector

Surface Command customers can now install connectors at their own convenience via the Rapid7 Extensions Library, making it faster and easier to gain visibility into cyber asset insights across your security and IT management tools. Customers can choose from over 100 out-of-the-box connectors to ingest and enrich asset data within Surface Command, consolidating insights from across your entire security ecosystem into one place.

What’s New in Rapid7 Products & Services: Q4 2024 in Review
Surface Command connectors in Rapid7 Extensions Library

Pinpoint critical signals and act confidently against threats with cloud-ready detection and response

A Growing Ecosystem of Cloud Event Sources in InsightIDR and MDR

At Rapid7, we understand that organizations are tasked with collecting and correlating vast amounts of data across their unique ecosystems. To tackle this, teams need faster, more dynamic mechanisms to ingest cloud data directly into their SIEM tool. We addressed this earlier this year with cloud event sources, providing a native cloud collection framework that can receive log data from cloud platforms directly - without requiring installation of collector software in their cloud and on-premise environments.

This quarter, we further expanded our list of cloud event sources by adding support for Microsoft products, including: Defender for Endpoint, Defender for Cloud, Defender for Identity, Defender for Cloud Apps, Defender O365, Defender for Vulnerability Management, and Entra ID.

MXDR: Expanded Support for Microsoft & AWS

In our Q3 “What’s New” blog, we announced the launch of Rapid7 MDR for the Extended Ecosystem (MXDR), which expands our MDR service to triage, investigate, and respond to alerts from third-party tools within customer organizations. Now, we’re excited to announce that we have updated our MXDR to support an expanded subset of detections across AWS GuardDuty and Microsoft security tools, bringing more protection to customer environments across a broader group of security tools.

Furthering our commitment to keep organizations safe and ahead of adversaries in today’s complex threat landscape, this update includes:

  • Deepened existing support for Microsoft security tools like Defender for Endpoint, Defender for Cloud, and AWS GuardDuty
  • Expanded support (via aforementioned cloud event sources) to critical alerts across Defender for Identity, Microsoft O365, Defender for Vulnerability Management, and Microsoft Entra
What’s New in Rapid7 Products & Services: Q4 2024 in Review
Example Microsoft Defender for Endpoint alert

Expanded Coverage for Next-Gen Antivirus: MacOS and Linux

We’ve extended operating system coverage for Next-Gen AV (NGAV) support beyond Windows OS to now include protection capabilities for MacOS and Linux. Now, customers utilizing NGAV don’t have to utilize multiple point systems across the operating systems within their detection surface to stop breaches as early as possible in the kill chain.

The latest research and intelligence from Rapid7 Labs

2024 Threat Landscape Statistics

This year, Rapid7’s global Managed Services team and Rapid7 Labs researchers responded to hundreds of major incidents, significant vulnerabilities, and ransomware threats—delivering emergent threat guidance, research reports, and other vulnerability and threat content for customers. See the roundup of key statistics and trends from our Rapid7 Labs team in our recent blog post, here.

What’s New in Rapid7 Products & Services: Q4 2024 in Review
Example of findings presented in the 2024 Threat Landscape Statistics: Ransomware Activity, Vulnerability Exploits, and Attack Trends from Rapid7 Labs

Emergent Threat Response: Real-time Guidance for Critical Threats

Rapid7’s Emergent Threat Response (ETR) program from Rapid7 Labs delivers fast, expert analysis and first-rate security content for the highest-priority security threats to help both Rapid7 customers and the greater security community understand their exposure and act quickly to defend their networks against rising threats.

In Q4, Rapid7’s ETR team provided expert analysis, InsightIDR and InsightVM content, and mitigation guidance for multiple critical, actively exploited vulnerabilities and widespread attacks, including:

Follow along here to receive the latest emergent threat guidance from our team.

Stay tuned for more!

As always, we’re continuing to work on exciting product enhancements and releases throughout the year. Keep an eye on our blog and release notes as we continue to highlight the latest in product and service investments at Rapid7.

Accelerate Mean Time to Exposure Remediation Across Hybrid Environments with Remediation Hub

As organizations continue to scale their digital infrastructure, the volume of vulnerabilities and exposures grows at an overwhelming pace. Security teams often find themselves inundated with alerts and risk signals, unable to remediate every issue within their environment. They often struggle to keep pace with the dynamic nature of threats, and existing tools were not built to address the complexity of modern IT environments.

With limited time and resources, trying to address every potential vulnerability is not feasible. This reality has driven the need for prioritization—teams must focus on the vulnerabilities that present the highest risks to their organization, based on factors like attacker behaviors, real-world threat intelligence, and exploitability.

Meet Remediation Hub, Your New Home for Exposure Prioritization and Remediation

Accelerate Mean Time to Exposure Remediation Across Hybrid Environments with Remediation Hub

Rapid7’s Remediation Hub, our newest addition to the Exposure Command platform, is designed to address this exact challenge. Remediation Hub automatically prioritizes various risk signals across your hybrid environment and suggests the actions your team can take that would have the largest impact on reducing your overall risk posture.

The solution leverages foundational visibility from Surface Command, which presents a comprehensive view of your attack surface, combining both external scanning and cyber asset management to provide a dynamic inventory and topology map of every asset across your environment. Underpinned by a powerful graph database, the platform allows teams to visualize the entire attack surface and understand the interconnected relationships between assets, ensuring that teams are guided to take action on the risks that are not only likely to be exploited but could also have the broadest blast radius.

Accelerate Mean Time to Exposure Remediation Across Hybrid Environments with Remediation Hub

Remediation Hub considers factors like public accessibility, reachability, and the presence of downstream controls (like a firewall, for instance) when prioritizing vulnerabilities. The platform’s Active Risk incorporates real-world threat intelligence from Rapid7 Labs and our open source community to provide clarity into what CVEs are being actively exploited in the wild, which could provide insight into which exposures across your environment attackers are likely to target.

Along with insight into the impacted assets, teams are also provided step-by-step guidance on how to implement the suggested fix, with many actions available as native automation workflows.

Accelerate Mean Time to Exposure Remediation Across Hybrid Environments with Remediation Hub

Proactive Exposure Management: Moving from Reactive to Proactive

By taking a more targeted, intelligence-driven approach to remediation, security teams can move from reactive to proactive exposure management, ultimately making their organizations more resilient to attacks and accelerating the time it takes to both detect and remediate exposures that pop up across their environments.

To learn more and experience a self-guided Product Tour, click here.

What’s coming next?

In the next post, we’ll walk you through how users can leverage Remediation Hub when responding to an Emergent Threat, including gathering available information about a zero-day, building an understanding of your exposure, along with step-by-step remediation guidance.

We’ll also, of course, continue to bring additional enhancements to Remediation Hub geared toward making it easier for teams to more effectively collaborate with stakeholders across the organization to prioritize and remediate exposures across their hybrid environments. So be sure to stay tuned here for more posts with those updates. As always, we welcome customer feedback and would love to hear from you! Your input helps us tailor our product roadmap, based on your priorities and business needs.

The Importance of Asset Context in Attack Surface Management.

This is the last of the four blogs (Help, I can’t see! A Primer for Attack Surface Management Blog Series, The Main Components of an Attack Surface Management (ASM) Strategy, and Understanding your Attack Surface: Different Approaches to Asset Discovery)  covering the foundational elements of Attack Surface Management (ASM), and this topic covers one of the main drivers for ASM and why companies are investing in it, the context it delivers to inform better security decision making.

ASM goes far beyond traditional IT asset visibility by bringing in the relevant security context that helps teams better prioritize and remediate. In general, the more context that you can make sense of, the more equipped your teams will be to make good decisions and drive toward action.

A clear example of this can be seen in an investigation of a machine under an active threat recorded by your SIEM or XDR solution. You likely have thousands of assets in your environment where the security team is unclear about the machine’s purpose. You now leverage context from your ASM solution to learn that the machine has access to several critical business networks and that it has a high-risk exposure on it related to an ongoing active threat. It’s just a matter of time before compromise and lateral movement. This augmented context during an investigation enables you to immediately make this the number one priority for your team.

Another key example involves identities. By inventorying all the identities across your environment, you can easily determine which ones have MFA disabled, and further filter based on those that have administrative access to a business application. To improve this identity context even further,  you can pull in additional context from tools like KnowBe4 to understand how likely the user is to click on a phishing email based on their phishing training success rate. The marriage of identity data with security controls and business context helps teams better prioritize their most at-risk users for remediation.

Let’s look further at the key types of asset context that we believe are critical for effective ASM.

Business Context-Aware

The first, and arguably most important, is the asset’s business context. This enables teams to understand the business function and risk, as well as the chain of command for contact or remediation. Visibility into the chain of command provides teams with the system owner, primary user, and which department and leader they fall under.

This business context is often pulled from CMDBs such as ServiceNow, Directory Services, HR tools like Workday, and by ingesting tags from CSP and security tool data sources. To effectively leverage business context, organizations need to develop and maintain an information architecture across the environment. Business context also helps identify which assets are a key dependency for business critical applications.

Exposures & Security Controls-Aware

Understanding an asset's vulnerabilities and exposures along with security control, mitigations, and business context is key to giving vulnerability teams the necessary means to make the best prioritization decisions. If a group of 100 machines all contain a Known Exploitable Vulnerability (KEV) that is being used in the wild by a specific piece of malware that is targeting your industry, your team may need to be up all night trying to remediate or mitigate this critical risk. But what if the majority of those same machines also have a security control or configuration in place that effectively causes that piece of malware to fail? Instead, your team can focus on a much smaller number within that group that lacks the required controls and focus on remediating those instead. Being able to harness all the available security context for assets enables teams to prioritize much more effectively.

Threat-Aware

Finally, threat context derived from SIEM, Threat Intelligence Platforms (TIP), and endpoint security tools enables security operations teams to gain insight into active threats and investigations when looking at an asset. It also enables teams to  threat-hunt across all asset data, understand the blast radius from a compromised machine, and use threat insights to prioritize response. If you can identify all machines that have a specific vulnerability and are also seeing TTPs related to it, remediation activities for these  machines can be prioritized.

Data Confidence, Aggregation & Correlation

A key factor in having confidence in security data and the context derived from it is having belief in the accuracy and integrity of the data itself. There are a few ways in which technology can help deliver that confidence. Because ASM is all about having visibility across your data and tooling silos, the final thing to consider is technology features related to an organization’s ability to analyze, troubleshoot, and configure data so that it matches your view of the attack surface. We can break this section into 3 main areas:

Unified Data Ingestion & Correlation

According to research from 451 Group, most security teams rely on between 11 and 30 different security tools to manage and secure their environments. Each of these tools only provides a partial view of the environment, and only from a particular perspective. As an example, Active Directory typically only sees Windows machines that are joined to the Domain Controller, DHCP only sees networked devices that have broadcasted and been given a lease, and CSPM tools only see cloud resources for Cloud Service Providers that have been configured.

Due to these visibility gaps, a holistic ASM solution must be able to see across these data silos and tools by ingesting and correlating data from many different sources, deduplicating it to deliver an accurate, continuously updated view of an organization’s asset landscape.

Data Transparency

Data transparency is all about giving users the ability to understand where their data has come from, how well the data is being ingested, and how the data is populated within the data model. This also enables users to follow & configure correlation logic. It is critical that you trust the data of a solution that is intended to become the ‘single source of truth’ for security data in your organization, so we cannot emphasize enough the importance of having the right visibility into how data is used in an ASM solution.

For reference, I’m including several examples of how data transparency is a core capability of Rapid7’s Surface Command.

In the image below, we’re looking at the distribution of raw asset records to uniquely correlated assets in an organization. The system has received over 200,000 raw assets from many different data sources, and is able to narrow it down through its asset correlation algorithm to 63,179 unique assets.

The Importance of Asset Context in Attack Surface Management.

The next example shows correlation effectiveness and property fulfillment (data fields with actual values) for Azure AD’s Device type. This capability is available on a per-connector basis and can be used to see how well the data source in question is correlating with other data sources (i.e., are they seeing the same assets?), and also how much of the data is being fulfilled by the API which can help pinpoint configuration issues that are limiting your view of your attack surface.

The Importance of Asset Context in Attack Surface Management.

The final example is a table view of all the data sources coming into the system and key insights from them. This can be used to assess the quality of your data sources and to debug issues like when duplicate records occur. In that case, correlation rules can be updated to reduce those duplications so users get the best correlation, and thus the best and most accurate view of their attack surface.

The Importance of Asset Context in Attack Surface Management.

This transparency into data ingestion and correlation is also critical when working with other stakeholders in the business, ensuring that everyone is in alignment on the most accurate data.

Data Prioritization

The final key aspect to successful ASM is being able to customize data in the way that an organization wants to see it. Teams rely on some tools more than others, and the weighting of those tools should match the overall preferences of the business. If Active Directory is your source of truth for ‘business owner’ and ‘department’ information over ServiceNow CMDB, then the system should be able to re-correlate the data based on the way an organization sees and utilizes the data.

Below, we show an example of how we are able to configure data prioritization in Rapid7’s Surface Command. Weighting the data can be configured on a per-property basis, so any ingestible and correlatable field can be customized to prioritize which tool should be preferred in the event of a data conflict. This enables teams to select and leverage the tools that they trust the most for specific data and use cases, so the attack surface matches the way they see their environment.

The Importance of Asset Context in Attack Surface Management.
[Example: Where ServiceNow takes priority on the Business Owner of an asset, followed by Azure AD.]

Conclusion: The Value of Context in Attack Surface Management

Over the past four blogs, I have tried to cover some of the key benefits and use cases for ASM. Much of it comes down to the core value that you can only protect what you know about, but in reality, it’s more complex than that.

The context that ASM solutions can provide you about both the external threat, and internal cyber risks, help security teams focus on what is most critical to protecting their organization. With the ever-growing number of vulnerabilities and non-patchable exposures, it just isn’t practical to expect to address everything, so prioritization is key. This is where the real value of ASM lies.

Once we understand our overall security posture, which assets are the most critical to the business, which services are the most exposed to attacks, we have the context needed to drive an effective cybersecurity program. We can take these insights and make them actionable, working with colleagues in DevOps and IT to harden machines and patch the most high-risk vulnerabilities. If we are successful in finding the gaps before the attacker, then we should also reduce the burden downstream on our SOC and IR teams.

I hope you found this blog series valuable. I’d encourage you to explore more information on Rapid7’s market-leading attack surface and exposure management solutions at https://www.rapid7.com/products/command/attack-surface-management-asm/.

Building a Custom Risk Prioritization and Risk Scoring Methodology with Surface Command

Over the 15 years I spent as a practitioner and consultant prior to joining Rapid7, a metric that I found to be ever elusive was a true custom prioritization score. You could get close- with enough time, energy, spreadsheets, and logs. But even then it wasn’t without fault. There were still questions like “what if that data isn’t there?” or “which tool do you trust most”. Ultimately it was a challenge and with every vendor having their own risk scores and priority matrices and scoring models, it was hard to make those predetermined elements fit into your particular environment with all the nuances you cared about.

With our recent launch of the Command Platform, Rapid7 now delivers a more comprehensive view of your attack surface, with transparency that you can trust. Anchored by Surface Command, our new unified asset inventory and attack surface management product, customers can get a more complete, vendor agnostic view of their internal and external attack surface—at a disruptive, all-in value.

Surface Command combines internal and external monitoring to build a 360-degree view of your entire environment, with market-leading Cyber Asset Attack Surface Management (CAASM) and External Attack Surface Management (EASM) capabilities in one unified offering. Surface Command combines external visibility from Rapid7’s native internet scanners with a detailed inventory of all your internal assets, continuously ingested and updated from a wide range of security and IT tools.

Surface Command’s ability to both understand and model your entire attack surface fundamentally changes how Rapid7 can help new and existing customers alike as a security partner. That’s why I’m excited to talk about just some of the features and use cases that really stood out to me.

It all starts with a foundation of complete attack surface visibility

If you want to have a true measure of risk or prioritization within your environment, you first have to be able to consume data from multiple sources, companies, and partners. Most exposure management tools today rely on the data being sourced from that vendor itself. The issue with this approach is it leaves out data competing vendors or solutions may have to bring in as well.

Building a Custom Risk Prioritization and Risk Scoring Methodology with Surface Command

Conversely, Surface Command is wholly vendor agnostic. This allows you to bring in all the data you need from every security tool in your current technology stack, with over 110 connectors available out-of-the-box at time of writing this post and rapidly more being added by the day. You can find and keep up with our growing list of connectors here.

Obviously aggregating all that data means dealing with a substantial amount of information, some of which may be in conflict. So how do we handle this? A powerful, customizable, correlation engine.

Unmatched customizability with a tunable correlation engine

Immediately upon seeing the correlation engine, I knew we had something special. The biggest challenge with large datasets that gather from different tools and vendors is that each tool believes it is correct, as it should. However, in practice, we all know that some tools are great for a lot of the data it provides with some of the other data being… okay. This is very apparent when looking at CMDBs or GRC tools. They struggle to have a clean golden record because attributes are updated by tools with less fidelity than other tools that had already populated that field.

Building a Custom Risk Prioritization and Risk Scoring Methodology with Surface Command

With Surface Command, this is a thing of the past. Each correlated value, such as hostnames, Operating System, Owners, etc. that would normally come from a variety of locations can be individually tuned. Rather than the traditional “last in wins” approach, we have a correlation priority strategy that you get to pick which tool you trust most for that single attribue. This allows for precision when creating your golden record for searching, feeding into your CMDB from a single source now, and also for queries within Surface Command.

Building complex queries with cypher

Surface Command runs on a Graph database and leverages Cypher for the query language. The UI has a very simple and intuitive interface that supports most common query use cases, but you can also select the “advanced query” option to see what that Cypher would look like. I personally used this to teach myself how to build some queries over the course of a week or two. Why? Because I knew what I was after: a custom vendor agnostic prioritization score.

Building a Custom Risk Prioritization and Risk Scoring Methodology with Surface Command

I was able to use the interface above to search through any of the correlations and data points I wanted to filter on. From there I could execute my query, view my results, and then even click the Advanced Query button to move into a Cypher view, as shown below. The ability to move from UI to Query that easily is a perfect way to increase your familiarity with the tool and data.

Building a Custom Risk Prioritization and Risk Scoring Methodology with Surface Command

I started building my query and quickly saw the power of Surface Command. I first looked for mitigations (a searchable attribute) looking for assets without certain controls on them like Antivirus/Antimalware, Vulnerability Scans, etc. Again, this is all vendor agnostic. I didn’t care “which” AV/AM solution, just that it had one. I didn’t care if the vulnerabilities came from Rapid7, Defender, Tanium, Crowdstrike, etc. I just needed to know something was on the host. If not, increase that asset’s prioritization. Or pulling in specific elements like the Crowdstrike Status, something not correlated, but still within the dataset so easy to add. Testing all the IPs that I know from agents running on the asset, what Meraki knew, what AWS/Azure/GCP knew, and seeing if a public IP was on the asset. With each test I created, I assigned a weighing mechanism and score that I determined for my use case. This was it, it was what I had been chasing for so many years.

The Result: A tailored risk score built for YOUR business needs

What you can create is that custom vendor-agnostic prioritization score. You choose which tools you trust most for the attributes in your environment in a single CAASM platform that is vendor agnostic. You decide which data points are priorities to you and your security program. You determine how you want to view those data points and what scores to assign to them. You take control of what a prioritization score should look like, tailored to you and your colleagues at your company taking into account the things you care about most.

As I stated earlier, when I first saw Surface Command and got my hands on it, I knew we had something special. Think about the use case I have here, but let your imagination run. Maybe it’s not just a score you want, maybe it’s dashboards, exports, or feeding back into a CMDB or GRC tool. Maybe it’s taking actions with the data, looking for blindspots where coverage is lacking, or even planning for a budget to see how much of a license you are using or need.

Building a Custom Risk Prioritization and Risk Scoring Methodology with Surface Command

We’d love to show you Surface Command and all that we think it can do, but we’d also love to hear how you would use it! Thanks so much for taking the time to read through this with me today and look forward to speaking with you soon!

What’s New in Rapid7 Products & Services: Q3 2024 in Review

This was one of the most exciting quarters at Rapid7 as we announced the next chapter in our mission to give customers command of their attack surface: the Rapid7 Command Platform, our unified threat exposure and detection and response platform. With this, we introduced two exciting new products:

  • Surface Command: Unifies asset inventory and attack surface management
  • Exposure Command: Brings together the comprehensive visibility of Surface Command with hybrid vulnerability management for true end-to-end risk management

While building on our legacy as a pioneer in vulnerability management, we’ve also made expansions on the detection and response side of the house – expanding our Managed Detection and Response capabilities with the release of MDR for the Extended Ecosystem. Read on for more details on these exciting launches across Rapid7 products and services.

Achieve complete attack surface visibility and proactively eliminate exposures from endpoint to cloud

As digital infrastructure continues to evolve from traditional on-prem models to hybrid, distributed teams and systems, one thing remains the same – the attack surface continues to grow, creating more risk and a wider visibility gap.

With the August launches of both Surface Command and Exposure Command, Rapid7 is closing the visibility gap and providing your team with the tools to visualize, prioritize, and remediate risk from endpoint to cloud.

Surface Command: Comprehensive visibility you can trust

What’s New in Rapid7 Products & Services: Q3 2024 in Review

Surface Command provides the foundational attack surface visibility that underpins the Command Platform by breaking down security data silos and combining comprehensive external attack surface monitoring with internal asset visibility across hybrid environments. The result? A dynamic 360-degree view of your entire attack surface in one place. With this view, you can:

  • Visualize your entire digital estate from endpoint to cloud
  • Prioritize and mitigate exposures and potential threats with a risk-aware and adversary-driven view of your entire attack surface
  • Identify and address misconfigurations, shadow IT, and compliance issues

Learn more about Surface Command.

Exposure Command: Pinpoint and extinguish critical risks from endpoint to cloud

What’s New in Rapid7 Products & Services: Q3 2024 in Review

Exposure Command extends the power of Surface Command by combining complete attack surface visibility with high-fidelity risk context and insight into your organization’s security posture. Exposure Command aggregates findings from both Rapid7’s native exposure detection capabilities as well as third-party exposure and enrichment sources you’ve already got in place, so you are able to:

  • Extend risk coverage to cloud environments with real-time agentless assessment
  • Zero-in on exposures and vulnerabilities with the threat-aware risk context
  • Continuously assess your attack surface, validate exposures, and receive actionable remediation guidance
  • Efficiently operationalize your exposure management program and automate enforcement of security and compliance policies with native, no-code automation

Learn more about Exposure Command.

Continuous red teaming at your (managed) service with Vector Command

Attackers are relentlessly looking for weak spots and new access points into your organization – you should be too. Leverage Vector Command – our latest continuous red teaming service – to proactively test your external attack surface with ongoing red team exercises and expert guidance from Rapid7’s team of managed services experts.

What’s New in Rapid7 Products & Services: Q3 2024 in Review

With Vector Command, your team will experience:

  • Increased visibility of the external attack surface with persistent, proactive reconnaissance of both known and unknown internet-facing assets
  • Improved prioritization with ongoing, expert-led red team operations to continuously validate your most critical external exposures
  • Same-day reporting of successful exploits with expert-vetted attack paths for multi-vector attack chains and a curated list of “attractive assets” that are likely to be exploited
  • Monthly expert consultation to confidently drive remediation efforts and resiliency planning

Learn more about Vector Command.

Improved scale, reliability and contextualized reporting for cloud and on-prem vulnerability management

The increased scale, rate of change, and complexity associated with cloud and on-prem environments makes managing vulnerabilities a challenge. This quarter we continued to advance our agentless vulnerability assessment capabilities to drive improved scalability and extended reporting to allow teams to quickly identify, prioritize, and remediate vulnerabilities at scale. This includes:

  • In-cloud assessment for Azure hosts drive improved cost efficiency for running vulnerability assessments at scale across all cloud hosts running on Microsoft Azure.
  • Unified cloud vulnerability reporting combines context and insights across discovered CVEs, software and resources with proof data included by default to enable more effective and accelerated vulnerability remediation.
  • Increased granularity for cloud vulnerability first found dates enables teams to quickly understand where an organization is exposed to a given CVE both at an organizational level across their environment globally or on a per-resource basis.Accurately report on MTTR with first found date enhancement for on-prem vulnerabilities with the addition of “First Found” and “Reintroduced” columns, providing deeper visibility into when a vulnerability was first discovered and if it was later reintroduced after patching.

Comprehensive content coverage for policies and critical systems

We strive to provide you with fast and broad coverage for critical policies and systems so you can accurately assess the environment for vulnerability and compliance risks. This past quarter we added a number of new policy coverages and enhancements to InsightVM and Nexpose, including:

  • Arista EOS coverage: Arista is a popular alternative to Cisco, and this expansion provides you with broader coverage of your boundary devices and better insights into critical assets.
  • Released policy coverage for DISA STIG Windows Server 2016 and Windows Server 2019; DISA STIG for Red Hat Enterprise Linux 8 and Red Hat Enterprise Linux 9; and CIS Benchmark for Fortinet Fortigate to ensure continued compliance.
  • Enhanced existing coverages for critical systems like Alpine Linux, Oracle Linux, Windows Server 2022, and Debian Linux.

Pinpoint critical signals and act confidently against threats with cloud-ready detection and response

Introducing MDR for the Extended Ecosystem

In an ever-expanding cybersecurity landscape, organizations are under more pressure than ever to keep pace with the widening attack surface. That’s why we’re so excited to bring extended support and coverage capabilities to our MDR customers with the launch of Rapid7 MDR for the Extended Ecosystem. With this addition, we’re extending our service to include triage, investigation, and response to alerts from third-party tools already in use within customer organizations.

This initial release will bring support for major EPPs such as Microsoft Defender for Endpoint, CrowdStrike Falcon, and SentinelOne, with plans to extend coverage to more third-party tools across cloud, identity, and network in the coming months.

Read this recent blog entry to learn how this extension of MDR sets Rapid7 apart and brings your team coverage, protection, and peace of mind.

Rapid7 named a Leader in IDC MarketScape: Worldwide SIEM for SMB and Enterprise

We’re excited to share we’ve been recognized as a Leader in the IDC MarketScape: Worldwide SIEM for SMB 2024 Vendor Assessment (doc #US52038824, September 2024) and the IDC MarketScape: Worldwide SIEM for Enterprise 2024 Vendor Assessment (doc #US51541324, September 2024). We’re proud that IDC highlights InsightIDR’s superior threat detection content, ease of implementation, and tangible ROI – all areas where we continually invest to provide users with a streamlined, complex-free experience.

To our customers: Thank you. Your partnership, feedback, and trust fuels our dedication to delivering the detection and response functionalities you need to take command of your attack surface and keep your organization safe. Read more about the reports here.

Intuitive log search enhancements to empower practitioners of all levels

Collecting, analyzing, and correlating logs from various sources is table stakes in identifying potential threats, detecting malicious behaviors, and responding to incidents effectively. Within InsightIDR we continue to enhance our Log Search functionality to empower you to go beyond simply correlating logs so you can feel confident securing your organization and enhancing your security posture.

Reformatted Log Search not only optimizes view and streamlines accessibility, but it reduces friction with notable enhancements:

  • Pre-computed queries auto-run in less than half a second and can be leveraged from our OOTB library of queries or built custom using “groupby” or “calculate” commands.
  • Automatic key suggestions are provided to analysts during query building based on the log selection to ensure faster time to investigate (as opposed to recalling and populating individually).
  • Using the select clause, you can leverage new key suggestions to choose those to include in your search results. You can also customize their names and order.

The latest research and intelligence from Rapid7 Labs

Ransomware Radar Report: Findings and insights into the booming ransomware space

According to Rapid7 Labs Ransomware Radar Report, ransomware continues to evolve at a rapid pace. With the first half of 2024 seeing a +67% increase in the average number of ransomware groups actively posting to leak sites each month, it doesn’t appear that things are slowing down.
The report offers analysis and insights to help security practitioners understand and anticipate the latest developments around ransomware attacks. This research is based on data from Rapid7’s Incident Response and Rapid7 Labs teams as well as thousands of publicly reported ransomware incidents observed from January of 2023 through June of 2024.

What’s New in Rapid7 Products & Services: Q3 2024 in Review
Source: Rapid7’s Ransomware Radar Report

Read the Ransomware Radar Report now to learn the key takeaways for keeping your organization safe from ransomware.

Emergent Threat Response: Real-time guidance for critical threats

Rapid7’s Emergent Threat Response (ETR) program from Rapid7 Labs delivers fast, expert analysis and first-rate security content for the highest-priority security threats to help both Rapid7 customers and the greater security community understand their exposure and act quickly to defend their networks against rising threats.

In Q3, Rapid7’s Emergent Threat Response team provided expert analysis, InsightIDR and InsightVM content, and mitigation guidance for multiple critical, actively exploited vulnerabilities and widespread attacks:

Follow along here to receive the latest emergent threat guidance from our team.

Stay tuned for more!

As always, we’re continuing to work on exciting product enhancements and releases throughout the year. Keep an eye on our blog and release notes as we continue to highlight the latest in product and service investments at Rapid7.