Rapid7 InsightVM

InsightVM is Rapid7's vulnerability management product, sitting within its Command Platform alongside exposure management, attack surface management, cloud-native application protection, application security, next-generation SIEM and threat intelligence. Its relevance to PCI is the same as any scanner: the standard requires regular vulnerability testing, and this is what generates and tracks those findings.

The platform framing is the reason to consider it over a standalone scanner. Findings feed the same console as detection and response, so a vulnerability, an exposed asset and an alert about it are not spread across three tools. Rapid7 also sells managed detection and response, including a variant specifically for Microsoft environments, for organisations that want the monitoring run for them. A free trial is offered. As with any scanner, PCI validation itself still needs ASV scanning and, at higher merchant levels, a QSA.