SECURITY ATLAS / EVALUATION BRIEF
Rapid7 Automation
Research reviewed: 2026-10-18
https://atlasofsecurity.com/landscape/vendors/rapid7-insightconnect/

THE ATLAS TAKE
Rapid7 Automation, historically InsightConnect, builds workflows through plugins and configured connections. Its documentation distinguishes cloud connections from orchestrator connections: they differ in where credentials are held, which actions can run, and how private resources are reached. Atlas analysis: it fits teams willing to map those execution choices to an existing operations environment. A cloud-managed workflow does not mean every step runs in the cloud, and installing an orchestrator does not automatically validate every plugin. Evaluate one end-to-end handoff with actual target credentials and deliberate failure behavior.

SCOPE
No-code workflows connect supported services, while an Insight Orchestrator can execute actions within the customer’s network. This software has a different scope from Rapid7’s managed detection and response service.

WORTH A LOOK WHEN
Teams automating repeatable security tasks across Rapid7 and supported third-party tools, including private-network services.

THINK TWICE WHEN
The design assumes plugin triggers and all actions can run as cloud connections without checking documented support.

IMPLEMENTATION
1. Map execution by step
Identify private resources and decide cloud versus orchestrator connections deliberately.

2. Test narrow credentials
Verify each plugin connection and denied out-of-scope action.

3. Build recovery behavior
Exercise timeouts, duplicate triggers, operator escalation, and target-side verification.

OPERATING REALITY
Plugins, connections, orchestrator health, credentials, and workflow versioning need ownership. Atlas analysis: keep the execution location and target account visible for every consequential step. A connection can be configured yet unusable, so validate credentials and error paths before treating an activated workflow as a production control.

COMMERCIAL CONSIDERATIONS
Quote automation entitlement together with orchestrator infrastructure and implementation required for the intended plugins and workflows.
- Automation and workflow entitlement
- Orchestrator hosting and network access
- Plugin, credential, and workflow maintenance

EVALUATION PLAN / PROPOSED TESTS, NOT COMPLETED RESULTS
1. Verify the connection route
Acceptance evidence: Show where an action executed and which account reached the lab target.
Owner: __________  Pass criterion: __________
Observed result: __________  Evidence location: __________

2. Test an unavailable orchestrator
Acceptance evidence: Confirm triggers or actions fail visibly and recover without duplicate changes.
Owner: __________  Pass criterion: __________
Observed result: __________  Evidence location: __________

3. Replay an input
Acceptance evidence: Demonstrate that repeated events do not create multiple tickets or repeat an approved response.
Owner: __________  Pass criterion: __________
Observed result: __________  Evidence location: __________

QUESTIONS FOR THE VENDOR
- Which actions must run on an Insight Orchestrator because they cannot execute in SaaS?
- Who owns workflow credentials when Rapid7 also delivers a separate MDR service?
- How are workflows exported if Automation is retired while Rapid7 MDR continues, or the reverse, without sharing production orchestrator credentials?

EVIDENCE GAPS
- No independent execution-performance or reliability benchmark was performed.
- Plugin-specific cloud support and current commercial scope need confirmation.

SOURCES
Automation connection types (Documentation)
https://docs.rapid7.com/insightconnect/connections/
Automation plugins (Documentation)
https://docs.rapid7.com/insightconnect/use-plugins
Create and validate a connection (Documentation)
https://docs.rapid7.com/insightconnect/create-a-connection

Use synthetic fixtures in an authorized environment. Agree rollback and acceptance criteria before enforcement.
Documentation research and Atlas analysis. Independent hands-on effectiveness, effort, and complete price remain unassessed.