ASM TOOL PROFILE · RANK 8 OF 9
Rapid7 Surface Command review: external and internal attack surface in one inventory
THE SHORT ANSWER
Rapid7 Surface Command ranks 8 of 10 at 5.25 out of 10. It pairs external attack surface visibility with a unified internal and external inventory and offers a public trial. It does not document exploitability testing, and remediation workflows sit in higher tiers.
Rank 8 of 10 on default weights
Company: Rapid7
Deployment: SaaS, part of the Rapid7 Command platform.
Best for: Rapid7 customers who want external and internal inventory in one product
Gartner Peer Insights (context, not scored): Not among the cards read. Context only; not a score input.
Which steps does Rapid7 Surface Command document?
- FOUNDDocumented
External and internal asset discovery.
- OWNEDNot documented
Ownership attribution method not described.
- PROVENNot documented
No active validation documented for Surface Command.
- CONTAINEDPartial
SOAR-ready automation, higher tiers.
- ROUTEDPartial
Remediation workflows and SLAs at higher tiers.
- RECHECKEDNot documented
Retest after a fix not described.
How does Rapid7 Surface Command score on each criterion?
| Criterion | Weight | Score | Why | Source |
|---|---|---|---|---|
| Finds the unlisted estate | 15% | 6 / 10Lowest in set | Combines external visibility (EASM) with a unified internal and external inventory (CAASM). | |
| Routes to an owner | 10% | 6 / 10 | Builds a unified asset inventory; how ownership is attributed is not described. | |
| Proves exploitability | 20% | 5 / 10 | No active validation is documented for Surface Command; runtime validation was announced for Exposure Command's cloud scope. | |
| Contains before the patch | 20% | 4 / 10 | SOAR-ready automation is listed; no compensating control at the edge is described. | |
| Closes the loop | 15% | 5 / 10 | Remediation workflows, SLAs and reporting are listed for higher tiers; no retest described. | |
| Fits the enterprise stack | 10% | 8 / 10 | Part of the Rapid7 Command platform beside Exposure Command, InsightVM and InsightCloudSec. | |
| Buying transparency | 10% | 4 / 10 | A trial is offered; no price is published. |
What does Rapid7 Surface Command do, by its own account?
Combines external attack surface visibility (EASM) with a unified internal and external asset inventory (CAASM) inside the Rapid7 Command platform.
- Scope
- "Internal + external attack surface visibility (EASM)" and "Asset discovery & unified inventory (CAASM)".
- Automation
- SOAR-ready automation; remediation workflows, SLAs and reporting listed at higher tiers (Exposure Command Essentials and Ultimate).
- Platform
- Sits beside Exposure Command, InsightVM and InsightCloudSec.
- Recent news
- 19 March 2026: Rapid7 announced runtime validation and Data Security Posture Management for Exposure Command, aimed at showing which cloud vulnerabilities are exploitable.
What does Rapid7 Surface Command claim?
No vendor performance figure was collected for this page.
What does Rapid7 Surface Command cost, and what do you need to start?
Not published
A trial is offered. Price not published.
To start: Public trial offered.
Where is it strong, and what should you check?
Strengths
- External and internal inventory in one product.
- A public trial.
Check before you buy
- No exploitability testing documented for Surface Command.
- Remediation workflows sit in higher tiers.
Who should choose Rapid7 Surface Command?
Choose Rapid7 Surface Command if you need one inventory across internal and external assets, especially inside the Rapid7 Command platform. Look elsewhere if proof and containment are the gap.
How does Rapid7 Surface Command compare head to head?
| Opponent | Higher overall | Rapid7 Surface Command scores higher on | Opponent scores higher on |
|---|---|---|---|
| IONIX | IONIX | Fits the enterprise stack | Finds the unlisted estate, Routes to an owner, Proves exploitability, Contains before the patch, Closes the loop and Buying transparency |
| watchTowr | watchTowr | Fits the enterprise stack and Buying transparency | Finds the unlisted estate, Routes to an owner, Proves exploitability, Contains before the patch and Closes the loop |
| CyCognito | CyCognito | Contains before the patch and Fits the enterprise stack | Finds the unlisted estate, Routes to an owner, Proves exploitability, Closes the loop and Buying transparency |
| Hadrian | Hadrian | Contains before the patch and Fits the enterprise stack | Finds the unlisted estate, Routes to an owner, Proves exploitability, Closes the loop and Buying transparency |
| Cortex Xpanse | Cortex Xpanse | Buying transparency | Finds the unlisted estate, Routes to an owner, Contains before the patch, Closes the loop and Fits the enterprise stack |
| CrowdStrike EASM | CrowdStrike EASM | Routes to an owner and Buying transparency | Finds the unlisted estate, Contains before the patch and Closes the loop |
| Tenable ASM | Tenable ASM | Buying transparency | Finds the unlisted estate and Fits the enterprise stack |
| Censys ASM | Rapid7 Surface Command | Contains before the patch | Finds the unlisted estate and Closes the loop |
| Microsoft Defender EASM | Rapid7 Surface Command | Proves exploitability, Contains before the patch and Closes the loop | Finds the unlisted estate, Routes to an owner and Buying transparency |
Frequently asked questions
Is Rapid7 Surface Command EASM or CAASM?
Both, per Rapid7: internal and external attack surface visibility (EASM) and asset discovery with a unified inventory (CAASM).
Can I try Rapid7 Surface Command?
Yes. Rapid7 offers a trial. No price is published.
Does Rapid7 validate exploitability?
Not for Surface Command on the pages reviewed. In March 2026 Rapid7 announced runtime validation for cloud vulnerabilities in Exposure Command, a separate product.
Read next
- Beyond Rapid7 Surface Command: alternatives
Eight alternatives ranked on our weights
- Line Rapid7 Surface Command up against others
Every score side by side
- Exposure triage calculator
Set your own weights and must-haves
- How we weigh
Criteria, weights and limits
- Related lesson: A discovery-to-fix proof of concept
A scorecard by step, not by asset count.