What it does
Rapid7 InsightAppSec is a dynamic application security testing product for finding weaknesses in web applications. A team adds an application, configures a scan, runs attacks against selected URLs, and reviews vulnerabilities and reports; the documentation also covers API-driven automation and on-premises scan engines. It is a testing product for application security, not a general monitoring or observability service.
Define the app and scan before testing
InsightAppSec's quick-start guide begins by adding an application, configuring a scan, and choosing the target URLs and attack options. After a scan starts, testers can monitor its progress, review vulnerability details, share reports, and test remediation. The documentation also covers authentication, scan scope, schedules, cloud engines, and local on-premises scan engines. A practical first use is a scoped scan of a development or staging application, followed by review of the reported evidence and retesting after a code fix. This is a documented workflow example, not a scan run for this record.
Teams automating the process can use the documented InsightAppSec API and CI integrations. Its API guide explains importing the OpenAPI specification into Postman, preparing authenticated requests, and sending those requests to the product's regional API endpoint. Do not confuse this product API with the application endpoints being scanned.
Rapid7's documentation includes a free-trial quick-start path, but the pricing and product pages opened did not establish product-specific subscription charges or trial terms. The platform can use a cloud engine or a separately configured on-premises engine, so teams should choose the deployment mode that fits their target environment.
Strengths
- Scan configurations let testers select target URLs and attack options instead of treating a whole domain as an undifferentiated test.
- The documented workflow includes vulnerability review, reports, remediation checks, and integrations with development tools.
- A documented API and on-premises scan-engine option support automation and controlled network environments.
Watch out for
- InsightAppSec sends active scan attacks to selected application URLs, so targets and scope must be deliberately configured; it is not passive monitoring.
Best for
- Application-security teams running DAST against websites and web applications they control
- Teams that need to review and retest vulnerabilities after remediation
- Security engineers automating application scans through an API or CI integration
Sources
- InsightAppSec: Dynamic Application Security Testing (DAST) (Oct 26, 2026)
- Objective: Set the stage | Application Security Documentation (Oct 26, 2026)
- Objective: Identify Risks | Application Security Documentation (Oct 26, 2026)
- Getting Started with the Application Security (InsightAppSec) API | Application Security Documentation (Oct 26, 2026)
- Welcome to Application Security (InsightAppSec) | Application Security Documentation (Oct 26, 2026)
- Rapid7 Product Pricing (Oct 26, 2026)