On Tuesday, Boston-based Rapid7 announced that they have introduced the means to increase vulnerability management efficiency by offering tighter integration between Nexpose and Metasploit.
The tie-in of the two products enables security teams to locate issues, prove they are exploitable and prioritize them, mitigate them, and then track the effectiveness of the mitigation itself. This process is important, Rapid7 explains, because while a given vulnerability may be a large problem for an organization, the same vulnerability could be no problem at all to a different organization; even if they are in the same market space.
According to the release notes, the latest integrations between Nexpose and Metasploit Pro offer security teams the ability to import vulnerability scans; automatically validate the exploitability of a given high-risk vulnerability; spot-check individual vulnerabilities; push granular exploit results back to Nexpose via Vulnerability Exceptions; push device classifications back to Nexpose Asset Groups via Metasploit Tags; and monitor all of this with enhanced reports that are augmented with Nexpose data.
“Security professionals face a huge and complex challenge and they need to know that they are focusing their efforts on the highest risk vulnerabilities,” said HD Moore, CSO of Rapid7 and chief architect of the Metasploit Project.
“With Metasploit and Nexpose, security professionals can identify which of the numerous potential vulnerabilities are real in-roads for an attacker and prioritize these for remediation, making a more meaningful improvement to the organization’s security posture,” he added.
Metasploit version 4.4 is available now.
