Rapid7 Research

Building a safer world through open sources that go beyond code

Our Philosophy

We believe security is the responsibility of all technology users, manufacturers, and intermediaries and that collaboration is the only way to achieve long-term change. That’s why we’re committed to openly sharing security information, helping our peers to learn, grow, and develop new capabilities, and supporting each other in raising and addressing issues that affect the cybersecurity community.

Project Sonar

Project Sonar is a security research project by Rapid7 that conducts internet-wide scans across different services and protocols to gain insight into global exposure to common vulnerabilities. Like our vulnerability disclosures and exploits, we publish our data for free to encourage scientists, engineers, and anyone else interested in the nature and form of the internet to make their own discoveries.

Learn More

Project Heisenberg

The Heisenberg Cloud is a collection of low-interaction honeypots distributed both geographically and across IP space. The honeypots offer the front end of various services to learn what other scanners are up to (usually no good), and to conduct "passive scanning" to help enhance our understanding of attacker methods.

Learn More

The National Exposure Index

The National Exposure Index is a study conducted annually to better understand the nature of internet exposure—services that either do not offer modern cryptographic protection, or are otherwise unsuitable to offer on the increasingly hostile internet—and how those exposure levels look around the globe. How does your country’s security posture stack up?

Learn More

Quarterly Threat Reports

In our quarterly threat reports, we leverage data from the Rapid7 Insight platform, Managed Detection and Response engagements, Project Sonar, and Project Heisenberg to dive into notable security events, determine key takeaways, and provide helpful information for companies continuing to build out their security programs.

Learn More

Under the Hoodie

In “Under the Hoodie, 2018: Lessons From a Season of Penetration Testing,” we shed light on the “dark art” of penetration testing by revealing not just the processes, techniques, and tools that go into it, but also the real-world experiences of our engineers and investigators gathered over thousands of pen tests.

Learn More
Latest Research
View More Research
Detection Reflection: Analyzing 9 Months of Rapid7 Penetration Testing Engagements
Eric Sun | Aug 02, 2018
The second annual “Under the Hoodie: Lessons from a Season of Penetration Testing” report is out! Our new research shares key findings from 268 Rapid7 penetration testing service engagements conducted between September 2017 and June 2018. In this post, we’ll review interesting detection trends, including...
Read More
The Dynamic Duo: How to Use Projects Heisenberg and Sonar to Investigate Attacker Behavior
Shan Sikdar | Jul 31, 2018
Wading through the chaos and confusion of cybersecurity attacks can sometimes feel reminiscent of old-school detective crime shows. Often, you need more than one viewpoint to successfully crack a case. Just look at Starsky and Hutch—this duo’s problem-solving skills became unmatched when they successfully...
Read More
Under the Hoodie 2018: Lessons from a Season of Penetration Testing
Tod Beardsley | Jul 24, 2018
Today, I’m excited to announce the release of our 2018 edition of Under the Hoodie: Lessons from a Season of Penetration Testing by the Rapid7 Global Services team, along with me, Tod Beardsley and Kwan Lin. In this paper, we collect and analyze the results of a long-running exit survey we give to our...
Read More
Impact Across Industries
Rapid7 researchers constantly work to uncover unknowns as far as technology reaches.
Consumer Technology
It’s hard to imagine our lives without tech glued to our hands. Reality is, security risks are present in even the most unassuming, commonplace devices. Over the years, our researchers have discovered and made public several critical vulnerabilities capable of compromising your personal data and safety in everything from printers, baby monitors, vehicles, and even children’s toys.
Business Technology
It’s no big secret that security has far-reaching impacts on a business—including on its bottom line. The work of our researchers has helped global organizations secure their internal processes, as well as the safety of the customers who rely on them; these improvements can be seen in medical devices, healthcare software, broadcasting equipment, corporate networks, and more.
Public Infrastructure
While most of us don’t spend our days thinking about critical infrastructure, it’s core to the functioning of our world as we know it. Therefore, as the need to innovate it grows, so does our need to secure it. Given our collective dependency on infrastructure, our researchers make it a priority to investigate how to secure emerging tech like smart sensors, while our Public Policy efforts aim to help governments adopt these innovations securely.
The Minds Behind the Research
Meet the Full Team
Tas Giakouminakis
Tas Giakouminakis
Lee Weiner
Lee Weiner
Bob Rudis
Bob Rudis
Derek Abdine
Derek Abdine
Tod Beardsley
Tod Beardsley
Craig Smith
Craig Smith
Deral Heiland
Deral Heiland
Rebekah Brown
Rebekah Brown

Where Research Meets the Roadmap

Explore how Rapid7’s unparalleled understanding of attackers makes our products more powerful.

  • Threat feed dashboard informed by Project Heisenberg honeypots in InsightVM
  • Attacker Based Analytics sourced from Projects Sonar and Heisenberg and threat intelligence in InsightIDR
  • Accelerated discovery and coverage of zero-days and other low-notice exploits in InsightVM
  • Discovery of internet-facing assets in InsightVM using integration with Project Sonar
  • Identification of weak or distrusted certs using research on SSL certificate ecosystem
View All Products

Want to dive deeper into our research data?