Rapid7 Exposure Command Essentials — base package
The Essentials package lists Surface Command, integrations, risk-based prioritization, policy/configuration assessment, and remediation workflows. Attack-path analysis, cloud identity/access risk, and application testing belong to Ultimate and earn no Essentials credit.
Documented focus
Exposure Command Essentials combines asset visibility and integrations with vulnerability prioritization, configuration assessment, and remediation workflows. Ultimate-only capabilities are excluded.
Trade-offs and boundaries to verify
The Essentials package lists Surface Command, integrations, risk-based prioritization, policy/configuration assessment, and remediation workflows. Attack-path analysis, cloud identity/access risk, and application testing belong to Ultimate and earn no Essentials credit.
The Essentials package lists Surface Command, integrations, risk-based prioritization, policy/configuration assessment, and remediation workflows. Attack-path analysis, cloud identity/access risk, and application testing belong to Ultimate and earn no Essentials credit.
Confirm the named offering against your required workflow. A documented feature is evidence of product functionality, not a guarantee of your subscription entitlement or a measured result in your environment.
Product evidence at a glance
Verified consolidates established base inclusion and documented product capability. Package evidence is reported separately. Module / integration / activation, Outside assessed base, and Not established preserve the boundaries. Missing evidence is not a finding that a product lacks the capability.
| Research area | Evidence | Source |
|---|---|---|
| Asset visibility | Verified | Official source ↗ |
| Existing-tool data | Verified | Official source ↗ |
| Risk prioritization | Verified | Official source ↗ |
| Attack paths | Outside assessed base | The assessed baseline is Exposure Command Essentials. Attack-path analysis, cloud identity/access risk, and application testing described in Ultimate are outside that baseline. Official source ↗ |
| Attack validation | Outside assessed base | The assessed baseline is Exposure Command Essentials. Attack-path analysis, cloud identity/access risk, and application testing described in Ultimate are outside that baseline. Official source ↗ |
| Control gaps | Verified | Official source ↗ |
| Remediation workflow | Verified | Official source ↗ |
| Person-level identity risk | Outside assessed base | The assessed baseline is Exposure Command Essentials. Attack-path analysis, cloud identity/access risk, and application testing described in Ultimate are outside that baseline. Official source ↗ |
What to ask in a demonstration
- Which capabilities and integrations are included in the exact package being quoted?
- Demonstrate the workflow using representative data from our own environment.
- Who owns implementation, day-to-day operation, and each action during the pilot?
Package and implementation boundaries
The Essentials package lists Surface Command, integrations, risk-based prioritization, policy/configuration assessment, and remediation workflows. Attack-path analysis, cloud identity/access risk, and application testing belong to Ultimate and earn no Essentials credit.
Research date and scope
The underlying source record was checked October 27, 2026 (retained package research); eligibility checked October 28, 2026. This summary was published October 30, 2026. Source-check dates above identify retained research and any new checks separately. The publication date is not a new verification of every vendor claim. This is documentation-based buying research, not a hands-on review.
Read our research approach · Understand product and package evidence