Monthly Vulnerability Count

Is there an existing Rapid7 report or dashboard that can provide a single monthly vulnerability count across InsightVM, InsightAppSec, InsightCloudSec, and Application Security? Alternatively, is there a metric that provides an overall vulnerability count across these products?

Ideally, we are looking for a report that provides a consistent monthly snapshot with metrics such as:

Total vulnerabilities identified during the month- this includes vulnerabilities carried over from the previous month that remain unresolved.

The overall total vulnerabilities remediated during the month

We are also seeing some discrepancies that we would like to understand better. For example, in some reporting periods, the number of remediated vulnerabilities is greater than the number of newly discovered vulnerabilities. We would like to understand how these metrics are calculated and whether this is expected when vulnerabilities identified in previous months are remediated during the current month.

For example, this month, the Rapid7 InsightVM Cloud reporting shows that we remediated more than 366.2k vulnerabilities, but we do not currently have a corresponding report that clearly indicates the total number of vulnerabilities in July. It would be very useful to see the number of vulnerabilities discovered and remediated within the same month, while also accounting for vulnerabilities carried over from previous months.

Having these metrics together would make it much easier to measure remediation progress and understand whether our overall vulnerability exposure is increasing or decreasing month over month.

If this type of consolidated monthly report does not currently exist, is this something Rapid7 could provide through an existing report, custom report, dashboard, or another reporting capability?

Our goal is to establish a reliable month-over-month vulnerability metric that can be used for vulnerability management, trend analysis, remediation progress tracking, and audit reporting.

See below as an example (from AI).

1 Like

I just noticed this post. have you looked into the Bulk Export MCP option? If you’re using a locally installed LLM like claude code, you can install the MCP from github, throw in an api key, and ask it to make any reports you want. You could actually give your LLM this exact example and tell it to figure out how to make it and put that into a skill file so that you can request this report anytime you like. - GitHub - rapid7/rapid7-bulk-export-mcp: Rapid7 Bulk Export MCP - AI-powered analysis for Rapid7 Command Platform data using MCP (Model Context Protocol) & AgentSkills. · GitHub

1 Like

Hi Zach,

Thanks for sharing. I will review it.