Rapid7 unveils upgraded platform with $1M breach cover
Rapid7 has released significant upgrades to its Command Platform, with the introduction of unified threat-informed remediation aimed at helping security teams more effectively identify, prioritise, and resolve critical risks across their digital environments.
The updated platform incorporates artificial intelligence-powered threat detection, integrated vulnerability remediation - including from third-party security tools - and automated incident response through Velociraptor. Together, these features are designed to help organisations strengthen their cybersecurity measures at scale, addressing the hurdles of fragmented toolsets and alert overload that are prevalent in the industry.
Rapid7 is providing an added level of assurance by backing the platform with a Breach Protection Warranty, offering customers financial protection in the event of a security breach. This warranty covers relevant expenses such as forensic investigations, legal counsel, post-incident response, and public relations, with up to USD $1,000,000 included in the package for Managed Threat Complete Ultimate customers. In addition, the warranty includes unlimited incident response, which eliminates extra costs often charged by other providers for such engagements.
Craig Adams, Chief Product Officer at Rapid7, explained, "Security teams are overwhelmed with alerts, they're asking for clarity, prioritisation, and outcomes. It's not enough to simply detect threats; teams need the context to act quickly and the confidence that issues will be resolved. With our latest version of the Command Platform, we're giving customers a cohesive, continuous, and trusted understanding of their entire attack surface, alongside the intelligent automation to prioritise threats and remediate them fast."
The company's enhancements address what it describes as growing complexity in enterprise security environments, where attack surfaces are expanding due to distributed systems and a proliferation of security and IT tools. The upgraded Command Platform aims to automate the prioritisation and remediation of exposures, with a focus on speeding up these processes while improving their accuracy.
Among the platform's most notable changes is the expansion of unified vulnerability management, which now includes support for both Rapid7's own scanning tools and third-party vulnerability management solutions. Security teams can use vendor-agnostic dashboards and workflows to consolidate risk information, prioritise vulnerabilities, and track remediation progress across the entire technology ecosystem.
The platform also introduces expanded automation capabilities. Using Remediation Hub workflows, security teams are able to automate notifications to asset owners and reduce manual task cycles, with the result of lowering administrative workloads and increasing efficiency in communications and resolution activities. Teams have access to unified dashboards to monitor remediation progress within both cloud and on-premises environments.
The update further improves transparency in AI-driven threat detection by presenting security analysts with more detailed reasoning behind AI triage decisions within the InsightIDR platform. The new interface highlights specific data inputs used by Rapid7's AI Engine and offers an "AI Suggested Disposition" field. This function enables users to sort, filter, and batch respond to alerts, potentially accelerating threat investigation and resolution processes.
An additional capability, Active Remediation with Velociraptor, is included to allow the Command Platform to take direct action on behalf of customers. When a threat is detected and contained, Velociraptor can initiatemeasures such as removing malware remnants, restoring system registry settings, and returning affected assets to their baseline secure state. This aims to limit the time a threat remains active and reduce disruption, often acting faster than manual response would allow.
The Breach Protection Warranty is presented as a means to help customers better manage the financial impact of a cyberattack. Rapid7 claims that its service distinguishes itself by integrating unlimited incident response without additional fees, which can reduce the complexity of a customer's breach response strategy compared to rival offerings that require separate charges for such services.
Try Our AI Features
Explore what Daily8 AI can do for you:
Comments
No comments yet...
Related Articles
Techday NZ
3 days ago
- Techday NZ
Rapid7 Q1 2025 incident response findings
Rapid7's Q1 2025 incident response data highlights several key initial access vector (IAV) trends, shares salient examples of incidents investigated by the Rapid7 Incident Response (IR) team, and digs into threat data by industry as well as some of the more commonly seen pieces of malware appearing in incident logs. Is having no MFA solution in place still one of the most appealing vulnerabilities for threat actors? Will you see the same assortment of malware regardless of whether you work in business services or media and communications? And how big a problem could one search engine query possibly be, anyway? The answer to that last question is "very," as it turns out. As for the rest… Initial access vectors Below, we highlight the key movers and shakers for IAVs across cases investigated by Rapid7's IR team. While you'll notice a fairly even split among several vectors such as exposed remote desktop protocol (RDP) services and SEO poisoning, one in particular is clearly the leader of the pack where compromising organisations is concerned: stolen credentials to valid/active accounts with no multi-factor authentication (MFA) enabled. Valid account credentials — with no MFA in place to protect the organisation should they be misused — are still far and away the biggest stumbling block for organisations investigated by the Rapid7 IR team, occurring in 56% of all incidents this first quarter. Exposed RDP services accounted for 6% of incidents as the IAV, yet they were abused by attackers more generally in 44% of incidents. This tells us that third parties remain an important consideration in an organisation's security hygiene. Valid accounts / no MFA: Top of the class Rapid7 regularly bangs the drum for tighter controls where valid accounts and MFA are concerned. As per the key findings, 56% of all incidents in Q1 2025 involved valid accounts / no MFA as the initial access vector. In fact, there's been very little change since Q3 2024, and as good as no difference between the last two quarters: Vulnerability exploitation: Cracks in the armour Rapid7's IR services team observed several vulnerabilities used, or likely to have been used, as an IAV in Q1 2025. CVE-2024-55591 for example, the IAV for an incident in manufacturing, is a websocket-based race condition authentication bypass affecting Fortinet's FortiOS and FortiProxy flagship appliances. Successful exploitation results in the ability to execute arbitrary CLI console commands as the super_admin user. The CVE-2024-55591 advisory was published at the beginning of 2025, and it saw widespread exploitation in the wild. One investigation revealed attackers using the above flaw to exploit vulnerable firewall devices and create local and administrator accounts with legitimate-looking names (e.g., references to "Admin", "I.T.", "Support"). This allowed access to firewall dashboards, which may have contained useful information about the devices' users, configurations, and network traffic. Policies were created which allowed for leveraging of remote VPN services, and the almost month-long dwell time observed in similar incidents may suggest initial access broker (IAB) activity, or a possible intended progression to data exfiltration and ransomware. Exposed RMM tooling: A path to ransomware As noted above, 6% of IAV incidents were a result of exposed remote monitoring and management (RMM) tooling. RMMs, used to remotely manage and access devices, are often used to gain initial access, or form part of the attack chain leading to ransomware. One investigation revealed a version of SimpleHelp vulnerable to several critical privilege escalation and remote code execution vulnerabilities, which included CVE-2024-57726, CVE-2024-57727, and CVE-2024-57728. These CVEs target the SimpleHelp remote access solution. Exploiting CVE-2024-57727 permits an unauthenticated attacker to leak SimpleHelp "technician" password hashes. If one is cracked, the attacker can log-in as a remote-access technician. Lastly, the attacker can exploit CVE-2024-57726 and CVE-2024-57728 to elevate to SimpleHelp administrator and trigger remote code execution, respectively. CVE-2024-57727 was added to CISA KEV in February 2025. The vulnerable RMM solution was used to gain initial access and threat actors used PowerShell to create Windows Defender exclusions, with the ultimate goal of deploying INC Ransomware on target systems. SEO poisoning: When a quick search leads to disaster SEO poisoning, once the scourge of search engines everywhere, may not be high on your list of priorities. However, it still has the potential to wreak havoc on a network. Here, the issue isn't so much rogue entries in regular search results, but instead the paid sponsored ads directly above typical searches. Note how many sponsored results sit above the genuine site related to this incident: Multiple sponsored searches above the official (and desired) search result This investigation revealed a tale of two search results, where one led to a genuine download of a tool designed to monitor virtual environments, and the other led to malware. When faced with both options, a split-second decision went with the latter and what followed was an escalating series of intrusion, data exfiltration and—eventually—ransomware. An imitation website offering malware disguised as genuine software On the same day of initial compromise, the attacker moved laterally using compromised credentials via RDP, installing several RMM tools such as AnyDesk and SplashTop. It is likely that the threat actor searched for insecurely stored password files and targeted password managers. They also attempted to modify and/or disable various security tools in order to evade detection, and create a local account to enable persistence and avoid domain-wide password resets. An unauthorised version of WinSCP was used to exfiltrate a few hundred GB of sensitive company data from several systems, and with this mission accomplished only a few tasks remained. The first: attempting to inhibit system recovery by tampering with the Volume Shadow Copy Service (VSS), clearing event logs, deleting files, and also attempting to target primary backups for data destruction. The second: deployment of Qilin ransomware and a blackmail note instructing the victim to communicate via a TOR link lest the data be published to their leak site. Qilin ranked 7 in our top ransomware groups of Q1 2025 for leak post frequency, racking up 111 posts from January through March. Known for double-extortion attacks across healthcare, manufacturing, and financial sectors, Qilin (who, despite their name, are known not to be Chinese speakers, but rather Russian-speaking) has also recently been seen deployed by North Korean threat actors Moonstone Sleet. Attacker behaviour observations Bunnies everywhere: Tracking a top malware threat BunnyLoader, the Malware as a Service (MaaS) loader possessing a wealth of capabilities including clipboard and credential theft, keylogging, and the ability to deploy additional malware, is one of the most prolific presences Rapid7 has seen this first quarter of 2025. In many cases, it's also daisy-chained to many of the other payloads and tactics which make repeated appearances. To really drive this message home: BunnyLoader is the most observed payload across almost every industry we focused on. Whether we're talking manufacturing, healthcare, business services or finance, it's typically well ahead of the rest of the pack. Here are our findings across the 5 most targeted industries of Q1: BunnyLoader is in pole position not only for the 5 industries shown above, but across 12 of 13 industries overall, with 40% of all incidents observed involving this oft-updated malware. Just over half of that 40% total involved a fake CAPTCHA (commonly used for the purpose of victims executing malicious code), with malicious / compromised sites appearing in a quarter of BunnyLoader cases. Rogue documents, which may be booby-trapped with malware or pave the way for potential phishing attacks, bring up the rear at just 9% of all BunnyLoader appearances recorded. First offered for sale in 2023 for a lifetime-use cost of $250, its continued development and large range of features make it an attractive proposition for rogues operating on a budget. Targeted organisations: The manufacturing magnet Manufacturing organisations were targeted in more than 24% of incidents the Rapid7 IR team observed, by far the most targeted industry in Q1 based on both Rapid7's ransomware analytics and IR team observations. The chart below compares Rapid7's industry-wide data (comprising a wide range of payloads and tactics) with ransomware leak post specific data. In both cases, manufacturing is a fair way ahead of other industries; this reflects its status as one of the most popular targets for ransomware groups over the last couple of years. The manufacturing industry is an attack vector for nation states because it is an important component of global trade. It is also an area that has many legacy and older, operational technologies (OT). Combine unpatched legacy systems with complicated supply chains, and you have a risk that nation state actors will find an attractive target. This is especially the case when considering that many manufacturing organisations have critical contracts with governments, and attacks can cause severe disruption if they're not speedily resolved. Conclusion Q1 2025 resembles a refinement of successful tactics, as opposed to brand new innovations brought to the table. Our Q1 ransomware analytics showed threat actors making streamlined tweaks to a well-oiled machine, and we find many of the same "evolution, not revolution" patterns occurring here. This progression is particularly applicable in the case of initial access via valid accounts with no MFA protection. We expect to see no drop in popularity while businesses continue to leave easy inroads open and available to skilled (and unskilled) attackers. In addition, the risk of severe compromise stemming from seemingly harmless online searches underscores the necessity for organisations to reexamine basic security best practices, alongside deploying robust detection and response capabilities. Businesses addressing these key areas for concern will be better equipped to defend against what should not be an inevitable slide into data exfiltration and malware deployment.
Techday NZ
4 days ago
- Techday NZ
LogicMonitor appoints Garth Fort as Chief Product Officer to boost AI
LogicMonitor has appointed Garth Fort as Chief Product Officer, tasking him with overseeing the company's global product strategy and execution, with a focus on further developing the LM Envision platform and driving advancement in AI-powered observability and AIOps through its AI agent, Edwin AI. This appointment follows the company's achievement of exceeding USD $300 million in annual recurring revenue (ARR), a milestone attributed to strong expansion into larger market segments and increased adoption of multiple LogicMonitor products. According to LogicMonitor, customers contributing over USD $100,000 in ARR have grown by more than 25 per cent year-over-year and now account for 80 per cent of the total ARR. The company also noted that Edwin AI, which was launched a year ago, has played a significant role in enhancing revenue growth and broadening platform adoption. Commenting on the appointment, Christina Kosmowski, Chief Executive Officer at LogicMonitor, said, "Garth's appointment represents our continued, strategic investment in product leadership at the intersection of Agentic AIOps and hybrid observability. Garth brings the pedigree and operational excellence to accelerate and execute our roadmap and unlock more value for our customers and partners—our goal is to reduce unplanned downtime by 50 per cent and empower customers with foresight, not hindsight." Garth Fort's previous roles include serving as Senior Vice President and Chief Product Officer at Splunk. During his tenure, he led Splunk's transition to the cloud, which is now a USD $4.2 billion business. The company highlighted his experience in shaping software and cloud services at prominent technology firms, including Amazon Web Services and Microsoft. Fort holds a bachelor's degree from the University of North Carolina, Chapel Hill, where he was recognised as a Morehead Scholar. Garth Fort, Chief Product Officer at LogicMonitor, said, "LogicMonitor is uniquely positioned to lead the next era of AI-driven observability and IT Operations at a time of massive data centre transformation. The increased demands created by rapid adoption of AI are driving unprecedented complexity across hybrid and multi-cloud environments. I'm excited to join LogicMonitor to help build an observability platform that doesn't just monitor across physical and cloud data centres - it foresees and adapts in real time." LogicMonitor stated that its LM Envision platform is designed to enable observability across on-premises and multi-cloud environments, providing IT and business teams with operational visibility and predictability across technologies and applications. The company aims to allow teams to spend less time on troubleshooting and more time on delivering services to employees and customers. The appointment of Fort as Chief Product Officer is intended to further the company's strategy of investing in product development and driving its growth in AI-driven software for IT operations. The company noted that Edwin AI's adoption is contributing to its financial results by supporting platform expansion and accelerating revenue from enterprise customers. LogicMonitor's focus remains on reducing unplanned downtime for its customers, addressing the challenges brought about by increased data centre complexity and the hybrid nature of modern IT environments. The company attributed part of its ongoing growth to the deployment of its AI-powered solutions, which it claims provide clients with improved foresight into IT operations. The company indicated that having experienced leadership, such as Garth Fort, is central to advancing its product roadmap and meeting the evolving demands of customers seeking operational efficiency amid growing technological complexity.
Techday NZ
4 days ago
- Techday NZ
Deel hits USD $1 billion run rate milestone amid rapid growth
Deel has reported surpassing a USD $1 billion run rate in the first quarter of 2025, marking a notable milestone in its growth trajectory. The company, which launched in New Zealand in 2022, announced the achievement less than six years after its founding. It attributes this milestone both to rapid global expansion and a diversified revenue approach, combining subscription and implementation fees for its run rate calculation. Deel's financial overview indicates a sustained pace of growth, with a 75% year-on-year revenue increase from April 2024 to April 2025. The firm reported double-digit EBITDA margin growth in the first quarter of 2025 and stated it has been profitable since the third quarter of 2023. It has not raised additional funds since 2022. The company has also achieved 164% year-on-year growth across its HR and payroll product segments over the past year. Deel now serves more than 35,000 corporate clients and supports approximately 1.25 million workers in over 150 countries. Its customer portfolio includes names such as Klarna, BCG, and Deel's integrated product suite and owned payroll infrastructure are described as having shifted how organisations approach global hiring and employee management. By offering a unified platform as well as white label and unbundled services, Deel aims to address requirements for companies of varying sizes and enable further revenue diversification. As part of its growth strategy, Deel has acquired companies including PaySpace, Hofy, Zavvy, and Assemble. These acquisitions have allowed the company to add new products and extend its payroll infrastructure. Anish Acharya, General Partner at Andreessen Horowitz and Board Member at Deel, commented, "When I first met Deel, there were 10 people with a big idea, and now they're powering global teams at a massive scale. Alex and Shuo continue to execute on their vision, methodically building a platform that reduces the complexity of global hiring and enables companies to onboard talent anywhere in the world with speed and confidence. As a result, Deel has become the default infrastructure for global work. Their product velocity and early bet on AI have unlocked tools that make global work simpler and more accessible for customers everywhere." Alex Bouaziz, Co-founder and Chief Executive Officer of Deel, added, "Reaching a $1 billion run rate is a reflection of the trust our customers have put in us. From day one, we believed the future of work demanded a new kind of infrastructure - one that was global, flexible, and obsessed with quality. We're proud of this milestone, but we're even more excited about what's next. Our work has only just begun." Deel's approach to global HR involves combining payroll, compliance, benefits, performance management, and IT asset equipment management into a single platform. The company has invested in artificial intelligence-powered tools and maintains a fully owned payroll infrastructure to support multiple worker types across its global footprint. Deel supports every worker type in 150+ countries, helping businesses scale smarter, faster, and more compliantly.
