Rapid7 penetration testing: pricing, retests and three offers

By The PenTest Index

Rapid7 penetration testing is a quote-based, one-time test performed by Rapid7 personnel or permitted subcontractors, with no price on its penetration testing service page. A South Carolina state price list released in January 2025 shows $15,300 for a network test of up to five days. That is a public-sector list figure, not your quote. Vector Command and Metasploit are separate Rapid7 products.

Sources checked October 10, 2026. We read Rapid7's service pages, its service brief, its online agreement, two Vector Command scope documents, its AWS Marketplace listing and a South Carolina state price list. We did not buy or run a Rapid7 test. How we check offers · How we make money

Worth a scoped quote if you need network, wireless, social engineering, device or red team work from one firm, or you already buy from Rapid7 and want one contract.

Probably not your first call if you have one small web app and a tight budget. The 'Small' application test tier on that state list is $15,300; it also lists custom application tests with smaller figures but no defined billing unit. Start with an offer that publishes a lower price.

Watch the product name. Vector Command is a year-long service aimed at your internet-facing systems. It is not a one-time test of your app. If someone asked you for "a pen test report," check with them before you buy it.

What decides it: the total, the exact scope, the retest terms and the report date. Rapid7 publishes none of these for a one-time test.

Already know what needs testing and who needs the report? Ask Rapid7 to quote the named service, the report date and the retest terms.

Request a scoped Rapid7 proposal

Need a price you can see today instead? See offers with published prices.

Which Rapid7 penetration testing offer fits your project?

Ask for Penetration Testing Services when you need one defined test and a report. Look at Vector Command when you want a team attacking your internet-facing systems all year. Use Metasploit when your own staff will do the testing. These are three different purchases, and Rapid7's own solutions page lists them side by side under one heading.

A penetration test is an authorized attempt to find and prove weaknesses an attacker could use. A red team exercise goes further: testers try to reach a goal, such as your customer data, while your defenders try to catch them. Rapid7 calls Vector Command "continuous red teaming," meaning that kind of work runs through the whole contract instead of once.

Service descriptions come from Rapid7's service page, service brief, Vector Command scope, Vector Command Advanced scope and Metasploit page, all checked October 10, 2026. The last row is our reading.

Three rules follow from the table.

• One system and a report due by a date. Ask for the one-time test. Bring the written request from whoever needs the report.
• A web app with logins and user roles. Ask for the one-time web application test. Vector Command's scope documents describe network, phishing and breach work. They do not describe testing an app role by role.
• You want pressure on your defenses all year. Price Vector Command. If you also need a yearly internal test, look at Advanced, and read the scheduling rule further down first.

Think of it this way. A one-time test is a home inspection before you buy the house. Vector Command is a guard who tries your doors every month. Both are useful. Only the inspection gives you the report the bank asked for.

Not sure which kind of test you need at all? See which type of penetration testing service fits.

How much does a Rapid7 penetration test cost?

Rapid7 publishes no price for a one-time test on its website. The best public evidence is a document titled "Rapid7 Public Sector Price List" on South Carolina's procurement site. It lists a network penetration test at $15,300 for up to 5 days, $30,600 for up to 10 days and $45,900 for up to 15 days.

Read that figure for what it is. It comes from a state purchasing list. The file name carries a release date of January 17, 2025 and a state contract number. Its price column is headed "CV Price," and the list does not explain that label. It is not a commercial price, not a quote, and not proof of what anyone paid. It is still the only place we found Rapid7's test sizes next to dollar amounts.

Source: Rapid7 Public Sector Price List, South Carolina, release date January 17, 2025 per the file title, checked October 10, 2026. Every line says the scope is set in a statement of work. The right-hand column is our arithmetic.

Here is what a buyer can take from it.

The network test tiers price effort in five-, ten- and fifteen-day blocks. Each of those tiers divides to the same $3,060 a day. "Up to" matters, though. If a test uses four of its five days, the list does not say you pay less.

"Small," "medium" and "large" are not defined. The application tiers carry the same three amounts as the 5, 10 and 15-day network tests. That suggests the same day blocks, but the list does not say so. Ask Rapid7 what makes an app small.

The retest is its own line. It sits at $3,060, the same as one day on this list. The list does not say how many findings or how much time that buys. More on retests below.

An example, with made-up needs. Say you want an external and an internal network test, each in the smallest size. On this list that is $15,300 + $15,300 = $30,600. A retest and a segmentation test each have a separate $3,060 line, and we cannot tell you how many lines a real job needs. So $30,600 is the sum for those two listed five-day tiers, not a proven minimum for your job. It is not a number to put in a budget without a quote.

Two other figures get mistaken for the price of a Rapid7 test.

• Vendr's contract data. Vendr, a software-buying service, reports a median Rapid7 contract of $36,678 a year across 177 purchases, with a low of $7,134 and a high of $218,264, on a page marked "Last updated: February 2026." The page does not break that down by product, and most of what Rapid7 sells is software. It tells you nothing about a test. Vendr's Rapid7 page
• Metasploit Pro's license. The same state list shows a Metasploit Pro subscription at $12,600 per user. That buys software for your own testers, and the list does not state the term.

Ask Rapid7 to itemize the quote: each test, the days of effort, the retest, any travel, and the payment schedule. For prices other providers publish, see penetration testing cost.

Can you buy one Rapid7 test, or is a contract required?

You can buy one. Rapid7 describes its testing as point-in-time assessments, and the state list prices each test as a single line. Vector Command is different: AWS lists it only as a 12-month contract.

What does Vector Command cost, and is it a penetration test?

Vector Command is the one Rapid7 testing offer with a public commercial price: $85,000 for 12 months if you have up to 256 assets, on AWS Marketplace. It is a continuous red team service. Whether it counts as your penetration test depends on who is asking for one.

Prices are from the AWS Marketplace listing "Vector Command," sold by Rapid7, checked October 10, 2026. They are list prices for a 12-month contract, and a private offer can differ. The listing also says additional AWS infrastructure costs may apply. The monthly figures are annual prices divided by twelve, not a confirmed billing schedule. The listing does not name Vector Command Advanced, so we do not know if Advanced costs the same. The three right-hand columns are our arithmetic.

Count your assets before the sales call. Going from 512 assets to 513 adds $45,000 a year. Going from 1,024 to 1,025 adds $100,000. Passing 2,048 at least doubles the price.

Ask what an asset is. Rapid7's scope document says the service targets internet-facing systems that you approve. An automatically generated summary box on the AWS page says assets include internal systems too. Those two do not agree. Send this: "Which assets count toward the tier: only the external addresses and domains we approve, or internal systems as well?"

Know what the reports leave out. Rapid7's scope document says its red team "will only report vulnerabilities that they were able to successfully exploit." That keeps the noise down. It also means the report is not a full list of weaknesses. If your auditor or customer expects every finding from a test, show them that sentence before you buy.

The South Carolina list also shows a Vector Command line at $166.02, with no unit. We cannot tell what that buys, so we do not use it.

Does Rapid7 include retesting?

For a one-time test, nothing on Rapid7's website says. For Vector Command Advanced, Rapid7's scope document includes one proportionally sized remediation validation for the internal and segmentation tests. So get the retest terms in writing either way.

A retest means the testers check specific findings again after you fix them. Rapid7 calls it remediation validation.

All checked October 10, 2026.

Send this question as written:

Is a retest included in this price? How many findings does it cover and how much time? What is the last date we can ask for it? What does an extra retest cost? Do we get an updated report afterward?

Here is why the date matters. Say your team needs 60 days to fix what the test finds. If Rapid7's answer is "one retest, used within 30 days of the report," you need a longer window in writing before you sign. If the answer is "a separate fee, any time within 12 months," the timing works and the fee goes in your total.

How long does Rapid7 take to schedule and report?

Rapid7 publishes no lead time for a one-time test. For the internal test inside Vector Command Advanced, it does: no sooner than 8 weeks after you order, with the final report up to ten business days after testing ends.

The Advanced scope document sets out the steps.

1. The internal test is scheduled "no sooner than 8 weeks from order placement date."
2. Testing is remote, 8:30 AM to 5:00 PM local time, Monday to Friday. The number of test days is set in your order.
3. The final report arrives "within ten (10) business days from the completion of services."
4. A call to walk through the findings follows about two to three weeks after the test.

Add it up: order date, plus 8 weeks, plus the test days, plus up to 2 weeks. With a one-week test, that is about 11 weeks from signing to holding the report. If your audit is less than two months away, Advanced cannot get you there on its published terms.

These are stated terms, not a promise that a slot is open. For any Rapid7 test, get five dates in writing: when your access and scope are due, when testing starts, when it ends, when the final report arrives, and when the retest report arrives.

Is Rapid7 a fit? A worked example

For a mid-size company that needs its networks tested by people on a deadline, a one-time Rapid7 test is worth a quote, and Vector Command Advanced is not. The 8-week scheduling rule rules Advanced out before price comes into it.

We reach that with what we call a Purchase Check. We take one buyer's requirements and check each against what the provider has published. Each one is marked Supported, Mismatch or Unresolved. "Supported" means that one condition is backed by the source shown. It is not a grade for the company.

The example buyer is made up. Say you are the IT manager at a 300-person manufacturer. You already use Rapid7's vulnerability scanner. Your insurer and one large customer want a yearly external and internal network test done by people. You take card payments, so you also want your network segmentation tested. You need the report in six weeks. Your team will need about 60 days to fix things, then a retest. Finance wants the full number first. A short letter you can hand the customer would help.

The findings are our reading of Rapid7's pages and documents, checked October 10, 2026. Rapid7 has not quoted for this made-up buyer.

What to do. Ask Rapid7 for a one-time external, internal and segmentation test, and put the six-week date in the first line of the request. One question decides it: "Can you deliver the final report by this date?" If Rapid7 puts a date in writing, keep going and settle the retest and the total. If it cannot, price another firm, because a must-have you cannot meet takes the offer off the list no matter how good the rest looks.

What would change the answer. If your deadline were four months away, Advanced would be worth pricing against the one-time test.

If you already buy from Rapid7, ask your account contact what your current agreement includes before you buy anything new.

Ready to ask? Use the quote request below.

What do Rapid7's contract terms say?

Rapid7's online agreement says fees cannot be refunded or cancelled unless your order says otherwise, and that testing time you do not use or schedule within twelve months of ordering is lost. Your signed order and statement of work can change these defaults, so read them against the list below.

The terms come from Rapid7's Master Software and Services Agreement, marked "Last updated October 2025," checked October 10, 2026. Testing falls under its Schedule A, which covers services.

This is a summary of published default terms, not legal advice. If the contract carries real risk for you, have your lawyer read the order and the statement of work.

What does a Rapid7 report include?

Rapid7 publishes the contents of one report: the internal test inside Vector Command Advanced. It has an executive summary, up to five key findings, an explanation of how risk is scored, a step-by-step account of the attack, each finding with fix guidance, and the scope and rules of the test.

Source: Vector Command Advanced scope, checked October 10, 2026.

We found no public sample report for Rapid7's one-time Penetration Testing Services. So ask for a current, cleaned-up sample for the exact service you are buying, and show it to whoever needs the report before you sign. They decide whether to accept it. Rapid7 does not, and neither do we.

One more thing for Vector Command buyers. Rapid7 keeps your report data for up to 90 days after the contract ends. Export everything before then.

What to send Rapid7 before you ask for a quote

Send one written request, then hold the answer up against it. If you price a second firm, send the same request. It works like giving every supplier the same question so the answers line up.

Fill in the brackets.

Quote request

This request is a buying document. It does not give anyone permission to test. Written authorization has to name the real systems and the activities allowed.

When you have filled it in, send it through Rapid7's request form.

Contact Rapid7 about this scope

Stuck on the scope paragraph? Rapid7 cannot quote until you know which networks, apps and sites are in. Our free scope checklist walks through what to settle. You can copy or print it, and it asks for no contact details. It prepares your request. It does not pick a provider for you.

For how to compare the quote you get back, see how to check a penetration testing quote.

What can you check about Rapid7 yourself?

Three things, each at its source.

CREST. CREST is an industry body that accredits testing firms. Rapid7 announced in May 2016 that it had been awarded CREST membership for penetration testing in the UK. That is a ten-year-old company announcement. We could not load a current CREST listing for Rapid7 when we checked on October 10, 2026. If your contract names CREST, look Rapid7 up on CREST's own site and confirm the company, the service and the region you are buying from. Rapid7's 2016 announcement

The age of the brochure. The service brief linked from Rapid7's live testing page is marked ©2019. Its headline figures, "over 1,000 tests per year" and "85% manual, 15% automated," come from that brief. Ask Rapid7 for current numbers and for who would be assigned to your work.

The version of the rules. Both Vector Command scope documents carry a version stamp, and Rapid7 says it can change them by posting a new version, which takes effect on the first day of the next month. Save a copy of the version you sign under.

Which alternatives are worth pricing alongside Rapid7?

Price one other offer against the same written request, and pick it by what Rapid7's answer left you unsure about. If that was the app price, add an offer that publishes one. If you want a second large firm, add one of those.

Listed A to Z. Pentest-Tools.com prices checked October 10, 2026. NetSPI checked October 9, 2026. Bishop Fox checked October 7, 2026.

To see the gap for a small app: two user roles on the grey-box test works out to $3,400 + (2 × $900) = $5,200 as a starting amount, against $15,300 for the 'Small' application-test tier on the 2025 state list for Rapid7. The two are not the same amount of testing, and neither figure is a quote. But if one small app is all you have, start with the published price.

View Bishop Fox application testing

Contact NetSPI

View Pentest-Tools.com managed testing

For more offers, including yearly packages and AI-led tests, compare penetration testing offers.

Quick answers

Is Rapid7 penetration testing the same as Metasploit?

No. Metasploit is software that testers use. Rapid7 owns it, and its own testers use it, but buying a Metasploit license gets you a tool, not a test or a report from an outside firm.

Is a Rapid7 vulnerability scan a penetration test?

No. InsightVM is Rapid7's vulnerability scanner. A scan lists possible weaknesses. A penetration test has people try to use them. If someone asked you for a test, ask them whether a scan report is enough before you send one. See the difference between a scan and a penetration test.

Does Vector Command count as my yearly penetration test?

That is up to whoever asked for the test. Show them two facts from Rapid7's scope document: the base service works on internet-facing systems, and it reports only weaknesses the team exploited. Advanced adds one internal test with a standard findings report.

Does Rapid7 test outside business hours or on site?

The Vector Command Advanced scope says the internal test is remote, 8:30 AM to 5:00 PM local time, Monday to Friday. The 2025 state list shows on-site social engineering as its own line. If you need night or weekend testing, put it in your request.

Sources

All checked October 10, 2026 unless noted. Statements about Rapid7's services are Rapid7's own. We did not buy a test or confirm any term with Rapid7 in writing.