Rapid7 InsightIDR pricing in 2026: per-asset, bundles, real cost

Rapid7 InsightIDR prices on a per-asset-per-month meter, with log ingestion, EDR (Insight Agent), UEBA, deception, and basic correlation bundled in. The asset definition is broad: physical servers, virtual machines, cloud workloads, network devices, and user endpoints all count. The meter simplicity is the largest structural difference from per-GB SIEMs and the largest reason mid-market SOCs choose Rapid7: budget forecasting becomes a function of headcount and IT estate growth rather than log volume volatility.

The packages now sell under the Incident Command name. The AWS Marketplace list (retrieved 4 August 2026) runs $70.40 per asset per year for Essentials, $96.80 for Advanced, and $123.20 for Ultimate, on a 12-month contract with a 251-asset minimum, so the smallest marketplace contract is $17,670 to $30,923 per year. Essentials is the real floor; Advanced is the mid tier. Rapid7 states that the price per asset decreases across asset-count tiers, but publishes no rates for those higher tiers, so anything beyond the list anchor is a quote. Quarter-end pressure produces real discount outcomes; transactional list-rate purchases leave value on the table.

The asset count is the cost-discipline lever that matters most. Ephemeral cloud workloads count when the Insight Agent is installed; decommissioned-but-not-cleaned-up assets in CMDB count if Rapid7 last scanned them within retention window; shadow-IT cloud accounts count if discovered. Quarterly asset audits routinely remove 20-30 percent of the meter without losing real coverage. The cleanup discipline is the single highest-leverage Rapid7 optimisation and the one most customers do not invest in.

The Insight Platform bundle combines InsightIDR (SIEM/EDR), InsightVM (vulnerability management), and InsightConnect (SOAR/automation) at a negotiated combined discount versus standalone licensing; Rapid7 publishes no bundle rate. For organisations that genuinely run vulnerability management as an active discipline, the bundle math is decisive. For SIEM-only buyers, standalone InsightIDR is the right purchase; the bundle becomes economical only when InsightVM is genuinely used.

Rapid7 MDR is the co-managed upsell path. MDR pricing is quote-only (Rapid7 publishes no MDR list price); the quote typically includes the underlying InsightIDR licence and adds 24/7 SOC coverage with triage, investigation, and response. For organisations without internal SOC capacity or with limited 24/7 coverage, MDR is the genuine path. For organisations with internal SOC capability, MDR scoped to crown-jewel assets (production, payment processing, regulated data) while running self-service InsightIDR on the rest typically delivers better unit economics than full-estate MDR coverage.

The 2026 competitive environment for Rapid7 is unusually favourable. The vendor's historical positioning as a vulnerability management leader has expanded into a credible SIEM/XDR/MDR consolidator, and pricing aggression against Sentinel, Sumo Logic, and CrowdStrike Falcon for SMB and mid-market buyers is producing 20-25 percent discount outcomes on multi-year commits. The Insight Platform bundle pricing is genuinely competitive against Sentinel-plus-Defender and Sumo-plus-Wiz consolidation pitches.

InsightIDR wins decisively for mid-market organisations between 500 and 5,000 assets that want a bundled SIEM-EDR-UEBA stack with predictable per-asset pricing and a credible MDR upsell path. Cloud-native engineering teams, fast-growing technology companies, regional financial services firms, and mid-market healthcare networks all fit the profile cleanly. The Insight Platform bundle (InsightIDR + InsightVM + InsightConnect) is genuinely competitive against Sentinel-plus-Defender or Sumo-plus-Wiz consolidation pitches, particularly when vulnerability management is an active discipline.

InsightIDR loses where the asset-to-log-volume ratio is unfavourable (low asset count with very high log volume from cloud APIs and SaaS audit logs), where deep UEBA is the binding constraint (Exabeam or Securonix maintain depth advantages), or where the customer wants a single per-GB or data-cap meter rather than per-asset (Chronicle wins simplicity). The per-asset meter also rewards organisations with disciplined asset management and punishes those with sprawling, undocumented IT estates.

The 2026 competitive trajectory is favourable. Rapid7's MDR business has matured into a credible alternative to Arctic Wolf, eSentire, and CrowdStrike Falcon Complete for mid-market organisations that want managed augmentation without the full MSSP commitment. For mid-market buyers in 2026 weighing managed security service options, InsightIDR plus Rapid7 MDR is genuinely worth the competitive evaluation against the established MDR vendors.