Microsoft Defender for Cloud vs. Rapid7 InsightVM

If you need to proceed with pay as you go service then go ahead with Microsoft Defender for Cloud. This could be expensive in the long run but if the organization usage is slightly less than then this would suite the purpose. Also, it has the latest threat updates, so you're future proof in terms of potential treats.

Incentivized

I think Rapid7 InsightVM is well suited for large enterprise customers with a lot of assets. It integrates well with a number of different ITSM solutions which I think is very good. There are not many CIS benchmarking tools on the market and Rapid7 InsightVM does a very good job at benchmarking. I think where Rapid7 InsightVM falls down a little is on false positive vulnerabilities. Sometime you there a few positive results on vulnerabily discovery. Tuning the settings for scan engines can sometimes be trick as well.

Incentivized

• Automation is crucial to managing sprawl and the additional complexity that comes with it. SOC management workbooks and process automation give significant flexibility.
• The Security posture score and Security Alerts are neatly centralized and offer me crucial information quickly.
• Defender for Cloud avoids the common compromise of simplicity for completeness (former Azure Security Center). The security warnings and advice go into great detail while remaining current and useful.

Incentivized

• The API is also a great tool for us to automate lots of routine procedures like scan and report of asset(s) BY EMAIL.
• Tagging. It helps sort out results and reports for respective assets Owner for remediation without a lengthy report including unnecessary information for that particular team.
• SQL Reporting. It provides advanced reporting and export capabilities that you can not find in the stock report template.

Incentivized

• UI/UX. It can get a little messy when navigating around with all the flyouts in the Azure portal which can be frustrating, particularly when under time pressure.
• The query languages for the queries and workbooks are another language that needs to be learned - it would be nice to have kept it closer to T-SQL or something like that to minimize the need to learn new syntax.
• Adding cost estimations to the security recommendations would really improve the experience.

Incentivized

• Devices found and scanned are never removed. Removal must be done manually with no option for automation.
• The database can be fragile. Ours quietly corrupted and progressively degraded until we had to restore and lose 6 months of data. Still didn't fix it and had to be rebuilt again losing all data.
• Workflow for delegating remediation is supposed to be helpful, but can also become cumbersome.
• Scheduling can become a nightmare if not monitored closely. We found jobs had failed to run because the server had gone offline. When the server came online, it did not try to run missed jobs. Running missed jobs all at once can overload the server, but searching for and launching a large number of missed jobs manually is a pain.

Incentivized

It is a great product that integrates nicely when running an Azure platform and even multi-cloud environment. Not looking for point-solutions but a suite that answers most requirements. It is very comfortable being able to use KQL, workbooks and automation that is native to the azure platform

Compliance mapping capabilities of the software and reporting.

Ease in deployment and implementation.

Seamless integration of the software with cloud and other third party applications.

The software ensures quick incident response and avilability of ready to help customer services providers.

User interface of the product is very friendly.

While I think it is a great tool and platform, I believe it (like all tools and solutions) is always evolving and the needs for clients are changing as the industry evolves and threats are upgraded. Cost is good, and support is helpful. Some things could be more granular and others could be easier to understand

Incentivized

I gave it a seven due to the functionality and general ease of use after the initial setup headaches, but compared to Qualys, Rapid7 Nexpose falls short on features and ease of use. Their support drags this rating down a point as well. I have gone weeks with no update on semi-critical issues and typically have to make call after call to get a semi-coherent response.

Incentivized

I believe Microsoft Defender for Cloud stacks up well against the other tools we looked at. It is native to the Azure platform and provides the same insights as the other tools. We selected Microsoft Defender for Cloud because it integrates well with the Azure resources and gives the needed insight, security alerts and recommendations.

Incentivized

I think Tenable is very comparable and they are both leaders in this space. I evaluated both of them side-by-side and ultimately decided to go with Rapid7. Tenable did have a slight edge on the amount of information I was getting from the machines, but I landed on R7 because I found the features of the InsightVM tool to be more useful. They both get the job done, but I found InsightVM a better experience to use on a day-to-day basis and had better quality of life features that I was looking for.

Incentivized

• Ensuring compliance with data protection regulations can prevent costly fines and legal issues, positively impacting ROI.
• Effective cloud resource protection can optimize cloud spending and resource utilization, ultimately reducing cloud infrastructure costs.
• The subscription costs associated with Defender for Cloud can add to an organization's operational expenses, impacting ROI.
• Smaller organizations may find the feature set and complexity of Defender for Cloud unnecessary, potentially overinvesting in security solutions.

Incentivized

• It certainly has a more positive impact than negative impact while performing the scans. Nexpose can find report vulnerabilities that our other scanner fails to identify during the scan because of its defined scan templates.
• Also, even if the scan is not being performed due to some issues like reachability, whitelisting, etc. it will try to give scan results unlike QualysGuard which just marks the asset as unreachable.

Incentivized