HailBytes ASM vs Rapid7 Surface Command
A self-hosted EASM alternative for teams that want active recon ownership without committing to Rapid7’s Exposure Command / InsightPlatform suite.
TL;DR
Rapid7 Surface Command (now part of Exposure Command, building on the IntSights and Noetic acquisitions) bundles external attack surface visibility into the broader Insight platform with InsightVM. HailBytes ASM is a self-hosted alternative that runs the recon pipeline inside your own AWS or Azure account, priced on infrastructure rather than as a Rapid7 module.
- Pick HailBytes ASM if you don’t want a Rapid7 platform commitment, need white-label client deliverables, or want unlimited scans at flat VM cost.
- Stay with Rapid7 if you’re already standardized on InsightVM / InsightIDR and want EASM correlated with vulnerability and SIEM data inside the same console.
Pricing & Cost Model
| Dimension | HailBytes ASM | Rapid7 Surface / Exposure Command |
|---|---|---|
| Pricing axis | Infrastructure ($0.24/vCPU/hour) | Per asset / Insight platform tier |
| Annual cost (small surface) | $5,880 (4 vCPU, ASM’s documented minimum; $8,400 list), all-in $8,520 committed and $11,040 at list, below the ~$15,000 Insight floor on either basis; this band is a price win at the documented minimum, though 8 vCPU is the size we recommend for production | ~$15,000+ (Insight floor) |
| Annual cost (mid surface) | $11,760–$23,520 (8–16 vCPU; $16,800–$33,600 list) | $50,000–$120,000 |
| Standalone purchase | ✅ | 🟡 Often bundled with InsightVM |
| Free trial | 30 days via AWS / Azure Marketplace | 30-day Insight trial |
| Procurement path | Cloud marketplace (counts toward EDP / MACC) | Direct Rapid7 contract |
HailBytes figures are the 1-year commitment price (delivered as an AWS or Azure private offer, not a discount on the published meter) with list alongside, so the comparison sits on the same annual-contract basis as the competitor column. The meter covers software only; the VM, storage, and networking run in your own cloud account and are billed separately at roughly $35/vCPU/month, $220/month at 4 vCPU, $280 at 8, $560 at 16, and $1,120 at 32, so scale that line to the size on the row you are reading.
Our cost steps with the size of the surface rather than scaling per asset, so every comparison on this page is calculated all-in against the rung that fits. 4 vCPU is ASM’s documented minimum and suits a small, stable surface (about $8,520/year all-in on a 1-year commitment, $11,040 at list). 8 vCPU is the size ASM’s own hardening guide names Production (recommended) and covers 10 to 50 scheduled scans a day ($15,120 / $20,160). 16 vCPU covers 50+ scans a day ($30,240 / $40,320). Quote 4 vCPU only where the surface genuinely is small and stable; 8 vCPU is the size we recommend for production. Full pricing.
Sizing above 8 vCPU: ASM sizes its scan worker from the host, so a larger instance scans proportionally faster: a 16 vCPU deployment gives the scan engine twice the cores an 8 vCPU one does. Instances deployed before August 2026 pick this up on the next update, when the installer rewrites the worker limits to match the machine.
Architecture & Control
| Dimension | HailBytes ASM | Rapid7 |
|---|---|---|
| Deployment | Self-hosted in your AWS / Azure account | SaaS (Rapid7-hosted) |
| Source code access | Ships with the deployment; auditable under NDA | Closed source |
| Data residency | Whatever cloud region you pick | Rapid7-controlled regions |
| Custom scan logic / wordlists | ✅ Full control | ❌ |
| Per-tenant isolation | One VM per tenant | Multi-tenant SaaS |
Capability Comparison
| Capability | HailBytes ASM | Rapid7 Surface Command |
|---|---|---|
| Subdomain enumeration | ✅ Multi-source | ✅ |
| Active port & service scanning | ✅ Built-in | ✅ (via InsightVM pivot) |
| CVE matching / vuln depth | 🟡 OSS toolchain | ✅ InsightVM mature engine |
| SIEM correlation | 🟡 Bring your own SIEM | ✅ InsightIDR native |
| Threat-intel pivots (IntSights) | ❌ | ✅ Surface Command differentiator |
| Unlimited scans | ✅ | 🟡 Tier-based |
| Custom wordlists | ✅ Unlimited | ❌ |
| AI-powered analysis | ✅ OpenAI + Ollama (local GPU) | 🟡 AI Engine in Insight |
| MCP server / AI-agent tooling | ✅ Built-in (Claude / Cursor / Windsurf) | ❌ |
| SIEM integration | ✅ Splunk, Sentinel, Elastic, Chronicle | ✅ InsightIDR-first |
| Government cloud (GovCloud / Azure Gov) | ✅ Both | 🟡 Limited |
| White-label for client deliverables | ✅ Built-in | ❌ |
See It in the Product
Surface Command lands inside the Rapid7 platform. These are the same jobs done from a self-hosted console.
Captured from a running instance. See all 48 screens →
When HailBytes ASM Wins
- You don’t want an Insight platform commitment. Surface Command’s value is correlation across InsightVM/IDR; standalone, the math is hard.
- MSSPs and pen-test firms. White-label deliverables and per-instance cost make resold continuous monitoring viable.
- Government and regulated industries. AWS GovCloud and Azure Government deployments, with data never leaving your tenancy.
- AI-agent recon workflows. The built-in MCP server lets Claude, Cursor, and Windsurf drive scans and triage findings.
When Rapid7 Wins
- Heavy InsightVM / InsightIDR shops. Native correlation across vuln management, EDR, and SIEM is a real product moat.
- You value the IntSights threat-intel pivot for adversary infrastructure tracking integrated into the ASM view.
- Existing Rapid7 contract spend that absorbs the Surface Command SKU at marginal cost.
Try HailBytes ASM
30-day free trial through AWS Marketplace and Azure Marketplace, including the underlying VM.
See HailBytes ASM in Action
Skip the slide deck. Watch the product run end-to-end before you book a call.
Try HailBytes ASM Free
Get a free trial deployment on AWS or Azure. Our team walks you through setup and your first steps, whether that’s a single organization or a multi-client rollout.
- ✓ 30-day free trial on AWS or Azure
- ✓ Guided onboarding from our security team
- ✓ No credit card required to start
- ✓ 40+ security tools pre-configured