NeXpose is a vulnerability manager, and it is available in free and paid versions. This tool was one of the first headlining products that put its producer, Rapid7, on the map. Rapid7 is also the sponsor of the Metasploit project, enabling Metasploit Framework to be distributed for free while producing the paid tool Metasploit Pro as an income generator. Rapid7 takes the same approach as NeXpose.

What does NeXpose do? 

NeXpose is a vulnerability manager. This category of security tool is an automated penetration testing system. A vulnerability manager works through a list of tricks that hackers try, which is distilled into the necessary conditions for each attack vector to work.

While a penetration tester will attempt each attack and note the results, a vulnerability manager just looks for the system’s weaknesses that would make the attack possible. The active search of the vulnerability manager is known as a vulnerability scanner.

As a vulnerability scanner doesn’t need to spend any time attempting to hack the target system, it is a lot faster than a pen testing exercise. It can whiz through thousands of checks for system security weaknesses, which are also known as “exploits.”

NeXpose is always on. This constant check sweeps a system when it is first launched and then checks new components when they are added. News of a new exploit also provokes action from NeXpose. So, this service gives a constant live list of vulnerabilities.

A nice feature of NeXpose is the ability to connect the system to Metasploit Pro. When this integration is activated, NeXpose marks exploits that can be examined further. This allows the network manager to run the attack that the detected weakness facilitates and confirm whether the system is genuinely vulnerable.

When NeXpose scans a system and spots weaknesses, it lists those exploits in its dashboard and gives each a score from 1 to 1000, with 1000 being the highest priority. This is a much finer-grained scoring system than many vulnerability scanners, which use a categorization system that runs from 1 to 10 or just labels the severity of a problem as Low, Medium, or High.

Clicking on a vulnerability’s entry in the summary list gets a detailed assessment of the weakness. This lists that malware and hacker campaigns that exploit this vulnerability plus details of where to find the error.

Two more important features of NeXpose are its Policy Assessment and Remediation Reporting modules. The Policy Assessment service scans the system and recommends alterations to settings and practices to improve system security. The Remediation Reporting service lists the top 25 actions the IT Department should take to reduce security vulnerabilities. This list changes as the teamwork through the solutions. This provides an excellent task list for technicians to follow.

The development of NeXpose

The base version of NeXpose is the Community Edition, which is free to use. However, rapid7 also produces a paid version, which is just called Nexpose. Rapid7 is a leading cybersecurity system producer. Its ownership of both NeXpose and Metasploit draw comparisons because both have Community versions plus paid versions. However, the journey of Nexpose has been quite different from that of Metasploit.

Metasploit began as an independent private project, which grew into an open-source, community-supported project. Open-source systems are tricky because modern software packages are expensive to develop and maintain, and unfunded projects get out-of-date fast. There are many examples of once ground-breaking free products falling by the wayside through lack of development funding – OpenOffice is an excellent example of this problem. As a result, some open-source projects seek commercial partners who fund the continuing Community Edition while exploiting the brand for their commercial products to combat this problem.

Rapid7s approach to the development of NeXpose was the reverse of the model that is applied to Metasploit. NeXpose began as a commercial product and then branched out to include a free Community Edition. The list of paid editions has altered over the years. At one point, NeXpose was available as Ultimate, Enterprise, Consultant, and Express editions.

Rapid7 seems to be phasing NeXpose out in favor of its InsightVM product. The main difference between these two vulnerability managers lies in their deployment options. NeXpose is an on-premises software package, and InsightVM is a SaaS system. The Insight platform is Rapid7’s core system now, and all of its new products are delivered from this base. The company has created cloud versions of all of its security tools and is gradually removing tools on the Insight platform.

NeXpose Community Edition is tough to find now. It is no longer listed on the Radi7 Free Tools page. Furthermore, it is no longer offered as “forever free.” Instead, it is presented as a 1-year free trial of NeXpose Community. In addition, the Community Edition is limited to scanning 32 targets.

The presentation of the paid NeXpose system also indicates that it is no longer a company’s core product. Every page on the Rapid7 website that promotes NeXpose urges visitors to try InsightVM instead. There is no mention of the on-site NeXpose on the Web pages that promote InsightVM.

How much does NeXpose cost?

Rapid7 doesn’t publish a price list for NeXpose, though it does publish prices for its Insight products. However, rival vulnerability management service Faraday does offer subscriptions to NeXpose, and it publishes its prices. Prices work on bands of several monitored devices. These prices are for a one-year subscription.

  • 128 devices – $3,200
  • 256 devices – $6,400
  • 512 devices – $11,264
  • 768 devices – $15,616
  • 1,024 devices – $19,968
  • 1,536 devices – $27,136
  • 2,048 devices – $34,304
  • 2,560 devices – $39,680

In this scenario, buyers also have to take out a subscription to the Faraday platform alongside a subscription to NeXpose, which makes the proposal very expensive.

Rapid7 offers a 30-day free trial of NeXpose.

NeXpose deployment options

NeXpose is an on-premises package. It is implemented in two parts – the server, the NeXpose Security Console, and the Scan Engines, which are data gathering agents. It is possible to install the Security Console in one location and communicate with Scan Engines on several sites.

The Security Console and the Scan Engines can be installed on the following operating systems:

  • Ubuntu Linux 16.04 LTS, 18.04 LTS , or 20.04 LTS
  • Microsoft Windows Server 2012 R2, 2016, or 2019
  • Microsoft Windows 8.1
  • Red Hat Enterprise Linux Server 6, 7, or 8
  • CentOS 7
  • Oracle Linux 7
  • SUSE Linux Enterprise Server 12

There are also Scan Engine versions available for AWS and Azure cloud platforms.

In all cases, the operating system must be implemented with 64-bit architecture.  The console is accessed through a Web browser, which must be one of:

  • Google Chrome
  • Mozilla Firefox
  • Mozilla Firefox ESR
  • Microsoft Edge

NeXpose pros and cons

NeXpose is a comprehensive vulnerability scanner, and the network administration community has widely acclaimed it. Therefore, many will be disappointed by the suggestion that Rapid7 seems to be deprecating this tool in favor of its InsightVM option. Rapid7 sees InsightVM as the latest version of NeXpose. However, those who like running NeXpose on their hosts won’t be pleased that InsightVM is only available as a cloud SaaS system.

Let’s take a look at the good points and bad points of NeXpose.

Alternatives to NeXpose

No matter how good NeXpose is, it will be shelved one ay, and signals for Rapid7 indicate that day could be soon. So whether you are in the market looking for a vulnerability manager for the first time or considering replacing NeXpose, several perfect substitutes are available.

Pros:

  • Available for installation on Linux, Windows, and Windows Server
  • Performs a system-wide scan very quickly and then instantly scans new assets.
  • This system updates its processes and rescans whenever a new exploit is documented
  • Give network administrators a list of the 25 most urgent problems to fix
  • Creates recommendations on security policy changes

Cons:

  • It needs a lot of RAM
  • It doesn’t have an associated patch manager
  • It looks like it’s on its way out

We have tracked down some great alternatives to NeXpose that we think are better with these selection criteria in mind.

Our methodology for selecting an alternative to NeXpose  

We reviewed the market for vulnerability managers like NeXpose and assessed the options based on the following criteria:

  • An always-on scanner
  • A system that will rescan the entire network whenever new exploits are identified
  • A vulnerability scanner that identifies instances of the OWASP Top 10
  • A service that can use AI to spot logical flaws in code that hackers could exploit
  • Check for database security errors and data leaks
  • A free tool or a free trial for a no-cost assessment
  • Value for money, represented by a good set of features at a suitable price

Here is our list of the five best alternatives to NeXpose:

  • Invicti (ACCESS FREE DEMO) This is a Web application vulnerability manager that assesses systems from an external viewpoint. It can be used for on-demand scans, periodic sweeps, or set to run constantly. Invicti routinely drills through APIs to discover supporting microservices that third parties could host as a specialist Web vulnerability scanner. In addition, the service gives a thorough assessment of code, searching for logical weaknesses that could become zero-day exploits. Deployment options include a SaaS platform or an on-site software package for Windows and Windows Server. Access a demo system to experience Invicti for yourself.

  • Acunetix (ACCESS FREE DEMO) This vulnerability manager is available in three versions and each edition would have a slightly different use. All versions include an external Web application scanner that searches for more than 7,000 vulnerabilities, including the OWASP Top 10. The Standard Edition is an on-demand vulnerability scanner. The Premium Edition can perform scheduled scans, and it adds on a network vulnerability scanner that looks for 50,000 vulnerabilities. The top plan, Enterprise, can be operated continuously. All plans are offered as hosted SaaS packages or for installation on Windows, macOS, or Linux. Access a demo system for assessment.

  • ManageEngine Vulnerability Manager Plus This is a suitable replacement for NeXpose because it is an on-premises package. However, this tool goes one better because it includes a patch manager and a configuration manager, so it can put right many of the weaknesses that it discovers. The package performs a vulnerability scan every 90 minutes by default, but it can lengthen that frequency. ManageEngine provides the system with a threat intelligence feed, which is always aware of the latest exploits. The software installs on Windows Server, and agents scan devices run Windows, macOS, and Linux. Access a 30-day free trial to assess this package. There is also a Free edition to scan up to 25 devices.

  • Rapid7 InsightVM This is the service that Rapid7 would like you to try instead of NeXpose. This service is delivered from the cloud and offers Web application vulnerability scanning. It can also assess systems hosted on other cloud platforms, and it can scour your network for weaknesses with the installation of an on-site agent. In addition, one account can be used to scan multiple sites. InsightVM also includes a risk assessment service that lets you know if partner companies have experienced damaging attacks. Finally, as part of a suite of security tools on the Insight platform, InsightVM can work with those stablemates to produce a complete cyber protection strategy. InsightVM is available for a 30-day free trial.

  • Syxsense Secure This is another vulnerability manager that is delivered from a cloud platform. The package includes a port scanner, a patch manager, and endpoint detection and response modules. The EDR modules install on Windows, macOS, and Linux and act as agents for all of the security functions of the package. The vulnerability scanner can be run on-demand or set to repeat on a schedule at a frequency of your choice. Discovered weaknesses that can be traced to out-of-date software automatically trigger the patch manager, which seeks out the relevant updates and copies over their installers. The SaaS package includes storage space for these patches and the log records that the tool generates for standards compliance auditing. Syxsense Secure is available for a 14-day free trial.

  • Temporal model

  • Weighted model

The temporal model increases the risk score with the passage of time. This is because newly discovered exploits are known by very few people who are unlikely to get around to all of the computers in the world immediately. Older exploits are known by many hackers and so the likelihood that the scanned system will be attacked by this method is much higher.

The weighted model calculates a risk score value that is based on a number of factors but begins with a severity number, which is ranked from 0 to 10.