Rapid7

Last updated: Aug 12, 2026

How does Fluid Attacks' solution compare to Rapid7's?

The following comparison table enables you to discern the performance of both providers across various attributes essential for meeting your company's cybersecurity needs. To better understand each attribute, read their descriptions in the dedicated page.

Organization

Attribute	Essential	Advanced	Rapid7
Focus	Native ASPM with in-house scanners	AI-powered PTaaS on top of native ASPM with in-house scanners	Exposure management and managed detection and response (MDR)
Extras	None	None	Application security testing (DAST), attack surface management (ASM), cloud-native application protection platform (CNAPP), penetration testing and threat intelligence
Headcount	157	Same	3728
Headcount distribution	Engineering 40%, IT 14%, sales 15%, marketing 2%, operations 4% and others 25%	Same	Engineering 25%, IT 17%, sales 14%, operations 6% and others 38%
Headcount growth	+14%, +15%, -1%	Same	-2%, +4%, +13%
Headquarters	CO and US	Same	AE, AU, CZ, DE, GB, IE, IL, IN, JP, SG and US
Countries	AR, BO, CA, CL, CO, DO, MX, PA, PE and US	Same	BR, GB and US
Reputation	9.44 from 228 reviews over 8 years on Gartner and Clutch	Same	8.65 from 2,592 reviews over 10 years on Capterra, G2, Gartner, PeerSpot and TrustRadius
Followers	22K based on the following: Facebook, Instagram, LinkedIn, X and YouTube	Same	387K based on the following: Facebook, Instagram, LinkedIn, X and YouTube
Research firms	None	None	Forrester, Frost & Sullivan, Gartner, IDC, Nucleus Research and Omdia
Founded	2001	Same	2000
Funding	Bootstrapped	Same	$350.5M USD in 8 rounds from 5 investors
Acquisitions	None	None	Acquired 0 times and made 14 acquisitions
Revenue	10M to 15M	Same	800M to 900M
Third-Party CVEs Discovered	289 CVEs reported to MITRE, ranked in the top 10 CVE labs worldwide	Same	48 CVEs reported to MITRE
Compliance	GDPR, ISO/IEC 27001:2022, ISO/IEC 27017:2015, ISO/IEC 27018:2019, ISO/IEC 27701:2019, PCI DSS, SOC 2 Type II and SOC 3	Same	Cyber Essentials Plus, EU-US DPF, FedRAMP Authorized, GDPR, GovRAMP, ISO/IEC 27001 and SOC 2 Type II
Bug bounty	Yes	Yes	No
Visits	64K per month. Top 3: 18% CO, 9% US, 5% BR. Others 68%	Same	775K per month. Top 3: 30% US, 7% IN, 7% GB. Others 56%
Authority	33 out of 100	Same	50 out of 100
Public vulnerability DB	Discovered and third-party	Same	Discovered and third-party
Content	Blog, documentation, e-books, glossary, reports, success stories, videos, webinars and white papers	Same	Blog, documentation, e-books, glossary, infographics, podcasts, reports, success stories, videos, webinars and white papers
Comprehensive documentation	13 documentation sections	Same	11 documentation sections, 8 in common and 3 additional
Community	Forum	Same	Forum
Sync training	1 workshop	Same	2 live product use courses (paid)
Async training	3 product use courses, all free	Same	Security education platform (subscription-based)
Distribution	Direct or with any of its 14 partners	Same	Direct or with any of its partners
Marketplaces	AWS	Same	AWS, Azure and GitHub
Freemium	No	No	No
Free trial	21-day free trial	PoV	30-day free trial
Demo	Yes	Yes	Yes
Open demo	No	No	No
Pricing	Contact sales and marketplace	Contact sales	Contact sales, marketplace and public web
Pricing tiers	1 plan	1 plan	3 plans (Essentials, Advanced and Ultimate). None transparent.
Minimum term	Monthly	Monthly	Annually
Minimum payment period	Monthly	Monthly	Annually
Minimum capabilities	ASPM, binary SAST, containers, CSPM, DAST, IaC, SAST, SCA and secrets	Same plus: AI SAST, API security testing, MAST, PTaaS, RE and SCR	ASM
Minimum scope	1 author	Same	1 asset or app
Pricing drivers	Authors	Same	Apps, assets or instances
Free implementation	Yes	Yes	No information available
Free support	Yes	Yes	Yes

Service

Attribute	Essential	Advanced	Rapid7
PTaaS	No	Yes	MPT and PTaaS
Reverse engineering	No	Yes	No information available
Secure code review	No	Yes	No information available
Pivoting	No	Yes	Yes
Exploitation	No	Yes	Yes
Manual reattacks	Not applicable	Unlimited reattacks	No information available
Zero-day vulnerabilities	Scanner-based zero-day vulnerability detection	Continuous zero-day vulnerability research	Continuous zero-day vulnerability research
SLA	Availability	Accuracy, availability and response	Availability
Minimum availability	99.95% per year	Same	99.95% per month
After-sale guarantees	No	Yes	Yes
Accreditations	CNA, Penetration Testing by CREST and OpenSSF Gold Badge	Same	AWS Security Competency and CNA
Pentester certifications	Not applicable	202 from 59 different types	No information available
Type of contract	Employee	Same	Employee
Endpoint control	No	Total	No information available
Channel control	No	Total	No information available
Standards	Some requirements from 67 standards	All requirements from the same standards	31 standards, 19 in common and 12 additional
Detection method	Automated tools	AI, automated tools and human intelligence	AI, automated tools and human intelligence
Remediation	5	Same, plus 1	4, 3 in common and 1 additional
Output	5	Same, plus 2	6, 2 in common and 4 additional

Product

Attribute	Essential	Advanced	Rapid7
ASPM	Yes	Yes	No
API	GraphQL with JSON	Same	REST with JSON
IDE	5 functionalities	Same, plus 1 functionality	No
CLI	Yes	Yes	Yes
CI/CD	Breaks the build	Same	Breaks the build
Vulnerability sources	18 sources, 5 in common and 13 additional	Same	7 sources, 5 in common and 2 additional
Threat model alignment	Yes	Yes	No
Priority criteria	CVSS v4.0, CVSSF, EPSS and KEV	Same	CVSS and KEV
Custom prioritization	Priority score	Same	Risk score
Scanner origin	In-house	In-house	In-house
SCA	19 package managers	Same	No
AI security	No	Yes	Yes
Reachability	12 languages	Same	No
Reachability type	Deterministic	Same	Not applicable
SBOM	22 package managers	Same	No
Malware detection	Yes	Yes	No
Autofix on components	No	No	No
Containers	4 distributions, 3 in common and 1 additional	Same	12 distributions, 3 in common and 9 additional
Source SAST (languages)	12	Same	No
Source SAST (frameworks)	23	Same	No
Custom rules	No	No	Custom attack modules
IaC	6, 2 in common and 4 additional	2, all in common	2, all in common
Binary SAST	1 type of binary	Same, plus 2 types of binaries	No
DAST	7 attack surface types	Same	Yes. No information available
API security testing	No	4 types of APIs, 3 in common and 1 additional	3 types of APIs, all in common
MAST	No	Yes	No
IAST	No	No	No
CSPM	Yes	Yes	Yes
Secrets	171 secrets types	Same, plus verify other attack vectors and secrets exploitability	No
AI	4 functions, 1 in common and 3 additional	Same, plus 1 function	4 functions, 1 in common and 3 additional
AI SAST	No	Yes	No
MCP	Yes	Yes	Yes
Open-source	No	No	BSD 3-Clause license
Deployment	SaaS (multi-tenant)	Same	SaaS (multi-tenant) + on-premises (no tenancy information)
Regions	US	AP, AU, CA, EU, ME and US
Status	Yes	Yes	Yes
Incidents	3 per year	Same	1.8 per year

Integrations

Attribute	Essential	Advanced	Rapid7
SCM	6, 4 in common and 2 additional	Same	4, all in common
Binary repositories	None	None	1
Ticketing	3, 1 in common and 2 additional	Same	2, 1 in common and 1 additional
ChatOps	None	None	2
IDE	3	Same	None
CI/CD	21, 6 in common and 15 additional	Same	6, all in common
SCA	Native	Same	None
Container	Native	Same	Native
SAST	Native	Same	None
DAST	Native	Same	Native
MAST	None	Native	None
IAST	None	None	None
Cloud	1 in common	Same	3, 1 in common and 2 additional
CSPM	Native	Same	Native
Secrets	Native	Same	Native powered by GitGuardian
Remediation	None	None	4
Bug bounty	None	None	None
Vulnerability management	None	None	13
Compliance	None	None	None

The latest update to this comparison was on 2026-08-11. The primary sources of information were rapid7.com and docs.rapid7.com, which were supplemented by specialized information-gathering sites, social media, and other sources.

More like Rapid7

Free trial — Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your 21-day free trial and discover the benefits of the Continuous Hacking Essential plan. If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' hacking team, fill out this contact form.