PRESS RELEASE

Boston, MA – September 19, 2011 – Rapid7, the leading provider of security risk intelligence solutions, today announced that the new version of its vulnerability management solution, Rapid7' Nexpose 5.0, will address the complex security challenges presented by the wide scale adoption of virtualization technologies and the rapid increase of malware. For the first time, organizations will be able to ensure that their virtual environments do not represent potential hidden security threats. Rapid7 already provides integrated security risk intelligence to map known exploits against found vulnerabilities, helping organizations prioritize which vulnerabilities to remediate first; increasing user productivity and enhancing the organization’s security posture in a significant way. Nexpose 5.0 will augment this intelligence with the introduction of its patent-pending Real Risk™ technology that leverages Rapid7' Malware Exposure, identifying which vulnerabilities are currently exploited by malware, and making the risk scores used for prioritized remediation even more meaningful and contextual to security teams.

“There is no silver bullet for addressing the issue of security, so it is essential that organizations are armed with real security risk intelligence and innovative solutions to identify, understand, prioritize, and address the specific threats and risks facing them every day. A critical element of this is ensuring that defenders can keep up with the IT deployment paradigms that are shaping the threat landscape,” said Mike Tuchen, president and CEO of Rapid7. “Nexpose 5.0 represents a leap forward in this innovation, delivering practical discovery and scanning options for virtual environments. Combined with the latest malware intelligence, customers can make sensible, prioritized remediation decisions across their virtual and physical environments.”

Vulnerability Management Encompassing Virtualized Environments

According to analyst firm Gartner, “more than 80% of enterprises now have a virtualization program or project”[1], with wide scale adoption being driven by significant proven benefits including lower cost of ownership, accelerated hardware ROI, and a simplified physical infrastructure. However, these new deployment models requires a shift in security paradigms. From 2005 to 2009, the number of annually disclosed virtualization vulnerabilities increased by more than 300%[2], with new classes of vulnerabilities affecting management consoles, management servers, administrative VMs, guest VMs, and hypervisors. As the interest in virtualization has increased, so has the severity of these vulnerabilities, with 40% classified as "high severity".

Rapid7 is proactively addressing this emerging threat with Nexpose 5.0: the first vulnerability management solution to offer organizations patent-pending vScan technology, which enables continuous discovery of virtual machines in their dynamic environments, ensuring they are included in scanning, prioritzation and remediation efforts. Virtualization management metadata is used to discover and track assets in their virtualized infrastructure, giving defenders an up-to-date and accurate view of real risk across their entire physical and virtualized infrastructures. Changes to the status of virtual machines are updated automatically as they are migrated to new hosts or switched on and off. Once discovered, these assets can be classified by the specific factors that are important to security and operational professionals and Nexpose will dynamically update users if any of those key factors change in the assets so they can be appropriately re-classified. These capabilities for virtualization management will initially be available for VMware vCenter™ Server.

Risk Analytics Incorporating Malware Information

Rapid7's approach to security risk intelligence propels vulnerability management beyond the capabilities of other solutions, enabling clearer insight into the real risk of each unique environment it scans, driving more efficient and dramatic reductions to risk exposure. Nexpose 5.0 introduces Nexpose' Real Risk, the industry’s most comprehensive risk intelligence system. Building on the breakthrough Exploit Exposure – the ability to map identified vulnerabilities to known exploits – Nexpose Real Risk adds Malware Exposure, enabling defenders to factor malware kits into risk intelligence. This gives defenders a significant boost in proactively identifying the vulnerabilities that represent the greatest risk and prioritizing their remediation for the greatest productivity and improvement of security posture.

Most vulnerability management solutions do not account for the risk of malware as part of an overall risk assessment. In 2010, 49% of data breaches involved malware[3], though only 13 vulnerabilities[4] were exploited in this way. Proactive identification of those vulnerabilities that can be leveraged by malware enables defenders to prioritize these for treatment, greatly enhancing their security. Nexpose Real Risk is further enhanced by new trending capabilities that enable defenders to dynamically track and report on critical physical and virtual IT assets over time, even if these assets change, come online or are powered off.

“Understanding risk across virtual and physical environments can quickly become a daunting task if a complete view of assets and related exposures most vulnerable to an attack are not readily available," said Andrew Hay, senior analyst, Enterprise Security Practice, The 451 Group. "Companies have long needed a way to make smarter choices when managing their infrastructure and vendors like Rapid7 are helping by providing insight into actual and validated risks.”

Pricing and Availability Nexpose 5.0 will be available in Q4 2011. For information on pricing please contact [email protected]. To learn more or for a free trial, please visit http://www.rapid7.com/products/vulnerability-management.jsp.

About Rapid7

Rapid7 is the leading provider of security risk intelligence solutions. Rapid7's integrated vulnerability management and penetration testing products, Nexpose and Metasploit, empower organizations to obtain accurate, actionable and contextual intelligence into their threat and risk posture. Rapid7's solutions are being used by more than 1,600 enterprises and government agencies in more than 65 countries, while the Company's free products are downloaded more than one million times per year and enhanced further by over 125,000 security community users and contributors. Rapid7 has been recognized as one of the fastest growing security companies worldwide by Inc. Magazine and is backed by Bain Capital Ventures.

For more information about Rapid7, please visit http://www.rapid7.com.

About Rapid7 Nexpose

Nexpose proactively supports the entire vulnerability management lifecycle, including discovery, detection, verification, risk classification, impact analysis, reporting and mitigation. This gives organizations immediate insight into the security posture of their IT environment by conducting over 65,000 vulnerability checks for more than 16,000 vulnerabilities. The solution leverages one of the largest vulnerabilities databases to identify vulnerabilities across networks, operating systems, databases, Web applications and virtual assets. Risk is classified based on real exploit intelligence combined with industry standard metrics such as CVSS, as well as temporal and weighted risk scoring. Nexpose provides a detailed, sequenced remediation roadmap with time estimates for each task. Nexpose is used to help organizations improve their overall risk posture and security readiness as well as to comply with mandatory regulations, including security requirements for PCI, HIPAA, ARRA HITECH ACT, FISMA (including SCAP Compliance), Sarbanes-Oxley (SOX) and NERC CIP.