Detectify vs Rapid7
Rapid7 offers web app scanning with InsightAppSec inside a wider exposure management platform, while Detectify tests your web apps and APIs with payloads built with ethical hackers.
Last updated 8 October 2026
| Detectify | Rapid7 | |
|---|---|---|
| How tests are built | Payload-based tests, including 1,765+ Crowdsource modules from ethical hackers | 95+ attack types, built as attack modules that send payloads* |
| Attack surface monitoring | Subdomains, IPs and IP ranges, open ports and technologies, plus subdomain takeover checks every 8 hours | Surface Command finds IPs, domains, subdomains, network services and TLS certificates from domain and IP seeds* |
| Web app scanning | Headless Chrome crawler with full SPA support | Crawler can use a browser to run JavaScript. A new Chromium crawling service (engine v7.5) can be enabled* |
| Authenticated scanning | Basic, Recorded Login and Recorded Crawling | Automated login, macros, recorded traffic, Selenium, multi-factor, session cookies, HTTP auth, OAuth 2.0* |
| API scanning | OpenAPI v2, v3, v3.1 and GraphQL. OAuth, Basic and API key | Swagger/OpenAPI (.json), WSDL and GraphQL schemas. Auth options include OAuth 2.0 and HMAC* |
| Internal scanning | Internal Scanning, deployed with Terraform (AWS) or Helm. Outbound-only connection | Optional on-premise engine (64-bit Windows) scans apps cloud engines can’t reach* |
| Cloud configuration checks | Not covered. DNS connectors import assets only | Cloud posture and compliance (CIS) for AWS, Azure, GCP and Kubernetes, in Exposure Command Ultimate* |
| Integrations | Jira (two-way), Slack, Microsoft Teams, PagerDuty, Opsgenie, ServiceNow, Splunk, webhooks, Workato, REST API | Jira (one-way), ServiceNow (two-way status), Slack/Teams and universal webhooks, GitHub Actions, GitLab, Jenkins, Azure DevOps, REST API* |
| Free trial | 2 weeks | Free trials of Surface Command and InsightAppSec. The InsightAppSec trial scans one domain of your own or demo domains* |
Detectify helps 10,000+ users manage their attack surfaces
Which one fits your team
Detectify
Choose Detectify if
- Your biggest risk sits in internet-facing web apps, APIs and subdomains
- You want testing that goes beyond known CVEs
- You want attack surface monitoring and application testing in one platform
Rapid7
Choose Rapid7 if
- You want app scanning, attack surface, vulnerability management and cloud posture in one platform
- You need Selenium, macro or multi-factor login flows for web app scans
- You want app scans in GitHub Actions, GitLab, Jenkins or Azure DevOps pipelines
Why teams choose Detectify
99%
99% of the findings we find have no CVE assigned, based on our own data over the past three years
- Crowdsource ethical hackers submit payloads for vulnerabilities they find in the wild
- 1,765+ modules run against the assets you add
- New tests ship when a vulnerability is disclosed, as with Log4Shell on the same day
- Surface Monitoring finds subdomains, IPs, open ports and technologies
- DNS connectors pull in assets from AWS, Azure, GCP, Cloudflare and more
- Application Scanning and API Scanning test the apps and APIs you choose, with authentication
- Import an OpenAPI spec or GraphQL schema and pick the operations to test
- OAuth, Basic Auth and API key authentication
- Prompt injection tests for AI and LLM endpoints
Crowdsource from submission to test
01
Ethical hacker submits a payloadCrowdsource · path traversal
GET /static/..%2f..%2f..%2fetc/passwd
02
Reviewed, then shipped as a test moduleJoins 1,765+ modules
03
Finding
trade.go-hack-yourself.netPath traversalHigh
Surface Monitoring
Total assets1,199
Monitored assets1,16697% of total
Active assets1,13697% of monitored
DNS connectorsAWSAzureGCPCloudflare
Application Scanning
Scan profile nameLast scan statusOpen vulnerabilities
TRADE GHY + AUTHCompleted2H 3M 1L
INVEST GHYCompleted0H 0M 0L
API Scanning from spec to scan
01
Import your spec, pick the operationsOpenAPI or GraphQL · auth: OAuth
# openapi.json
GET /orders/{id} ✓
POST /orders ✓
POST /assistant/chat ✓
02
Payloads sent to each operationRotated between runs
03
Finding
api.go-hack-yourself.net/assistant/chatPrompt injectionHigh
“If things change, we know right away.”
FAQs
Yes, for teams whose main risk is internet-facing web apps, APIs and subdomains. Detectify monitors your external attack surface and tests applications with payload-based tests. Rapid7 offers web app and API testing through InsightAppSec, as part of its Exposure Command platform.
How the tests are built. Detectify's tests come from its own research and from Crowdsource, a program of ethical hackers who submit payloads for real vulnerabilities. Rapid7 InsightAppSec runs 95+ attack types, built as attack modules.
Yes. API Scanning tests the operations you choose in an OpenAPI v2, v3 or v3.1 spec or a GraphQL schema that you import. It supports OAuth, Basic and API key authentication.
Yes. Internal Scanning runs inside your network and connects outbound only. You deploy it with Terraform on AWS or with Helm.
Yes. Application Scanning supports Basic authentication, Recorded Login and Recorded Crawling.
Pricing depends on the products you use and how many assets you cover. Surface Monitoring is priced by the number of domains in scope, and Internal Scanning by the number of internal apps. Start a 2-week free trial, or talk to sales for a quote.
Yes. They run independently, so you can use Rapid7 for vulnerability and cloud posture management and Detectify for web apps and APIs.
See Detectify on your own domains
Start a free trial, or book a demo to walk through Detectify with our team.