Rapid7 Details Q2 2026 Product Enhancements, Focusing on AI, Detection, and Exposure Management
Rapid7's Q2 2026 product updates introduce bidirectional Microsoft Defender alert sync, Detection as Code, AI-driven AppSec pre-triage, and enhanced exposure management capabilities.
Rapid7 has unveiled a series of significant product and platform enhancements rolled out in the second quarter of 2026, aiming to bolster security teams' speed, context, and confidence in their operations. The updates span detection and response, compliance, exposure management, and application security, with a notable emphasis on leveraging artificial intelligence and streamlining complex security workflows.
In the realm of detection and response, Rapid7 has made bidirectional synchronization and enriched alert context for Microsoft Defender alerts generally available to its SIEM and MDR customers. This integration allows security teams to automatically sync alert statuses between Rapid7's SIEM and the Microsoft Defender console. By incorporating additional context, such as process trees and user identities, analysts can investigate threats more efficiently and reduce manual effort, thereby accelerating response times.
Furthermore, Rapid7 introduced "Detection as Code," a feature designed to enable security teams to build, test, version, and deploy detections using familiar engineering workflows like Terraform. This capability aims to improve the quality and consistency of alerts by providing built-in validation, guardrails, and version control, ultimately helping teams scale their detection engineering efforts more effectively.
For ransomware resilience, the company has integrated "Ransomware Prevention for Incident Command" into its Insight Agent. This new layer of protection is engineered to halt ransomware encryption and endpoint damage proactively, strengthening defenses without introducing additional operational complexity for security teams already managing multiple endpoint security solutions.
In exposure management, Rapid7 has enhanced its Remediation Hub by adding asset-level context to its Top Remediations Report. This includes details on operating systems, IP addresses, cloud provider information, tags, and endpoint protection status, enabling teams to better understand remediation requirements and assign ownership. The updates also provide clearer patch and endpoint coverage signals, reboot status, customizable filters, and scheduled reporting, streamlining the process of tracking risk reduction efforts.
Application security testing also sees an AI-driven boost with the introduction of AI vulnerability pre-triaging for InsightAppSec. This feature automatically filters out false positives during the scanning process, initially focusing on BlindSQL and BlindNoSQL vulnerabilities. By reducing the manual review burden, security teams can concentrate on high-impact vulnerabilities and accelerate remediation.
Rapid7 is also expanding its support for compliance mandates with new solution webpages that map its platform capabilities to requirements for regulations like NIS2, NIST CSF 2.0, DORA, HIPAA, HITRUST, and GovRAMP. Additionally, the company has released an open-source MCP Server and Agent Skill for Bulk Export, facilitating the integration of Rapid7 data into custom AI workflows and tools.
Finally, Rapid7 previewed "Cyber GRC" to select customers, a new offering designed to unify security, risk, compliance, and third-party risk management. This initiative aims to move organizations toward continuous compliance by mapping controls to telemetry, automating evidence collection, and prioritizing risk with live attack surface context, with broader availability expected in late July.