Rapid7 Unveils AI-Powered Platform for Proactive Zero-Day Defense
Rapid7 is previewing new features that leverage AI and continuous software visibility to enable preemptive security against zero-day threats, allowing organizations to identify risks before exploitation.
The cybersecurity landscape is increasingly defined by the rapid collapse of the window between vulnerability disclosure and active exploitation. As adversaries integrate artificial intelligence into their attack methodologies, defenders must operate at machine speed to stay ahead. In response, Rapid7 is previewing a suite of new features designed to transform zero-day threat response from a frantic fire drill into a proactive, AI-accelerated defense strategy.
At the core of this new approach is the principle of continuous software visibility. Rapid7 emphasizes that organizations cannot secure what they cannot see, especially in complex, AI-enabled environments. The new platform aims to provide a complete and continuous view of emerging risks. When a zero-day vulnerability is disclosed, the system, through an Emerging Threat Response (ETR) process, should already be tracking it. The critical next step is correlating this threat with an organization's specific environment, a capability enhanced by Rapid7's in-preview Software Visibility feature.
This Software Visibility tool allows security teams to move beyond disruptive network scans. Instead, they can drill directly into the ETR to identify relevant assets and software versions in real-time. For instance, if a zero-day impacts specific versions of a popular browser, the platform can instantly map this criteria against the entire technology stack, revealing whether the vulnerability exists within the organization's environment and shifting the posture from reactive investigation to proactive defense.
Beyond simply identifying vulnerable instances, the platform addresses the crucial question of "how exposed are we?" This requires breaking down traditional data silos. Rapid7's Exposure Command accelerates this by unifying internal and external telemetry and enabling natural language queries. Instead of complex syntax, security analysts can ask plain-English questions like "Show me all assets running Safari earlier than version 18." This unified view not only reveals the total footprint of vulnerable assets but also uncovers "toxic combinations"—highlighting not just vulnerable software but also associated users and potential privilege escalation paths.
By illuminating these connections, security teams can prioritize their response based on actual business risk rather than generic CVSS scores. This unified view is crucial for bridging the gap between Security Operations (SecOps) and IT Operations (ITOps). The platform aims to streamline the handoff between these teams by providing actionable remediation guidance.
When a patch is unavailable, Rapid7 Exposure Command can offer interim mitigation advice using existing security controls. Once a patch is released or a CVE is assigned, the challenge shifts to rapid, safe deployment. Rapid7's AI-Generated Remediation Summaries, now available, provide tailored, environment-specific guidance. These summaries contextualize vulnerability findings based on existing controls, asset ownership, and the unique attack surface, translating raw data into clear narratives for ITOps.
These new features, previewed at Black Hat USA 2026, represent a significant step towards preemptive security. By leveraging AI for accelerated discovery, continuous visibility, and intelligent correlation, Rapid7 aims to equip organizations with the tools needed to identify and close attack paths before adversaries can exploit them, effectively rewriting the zero-day playbook.