The Total Economic Impact™
Of Rapid7 Threat Command For
Digital Risk Protection And ThreatIntelligence
Cost Savings And Business Benefits
Enabled By Threat Command
January 2023

A FORRESTER TOTAL ECONOMIC IMPACT™ STUDY COMMISSIONED BY RAPID7

Table Of Contents
Executive Summary ................................................. 1

Consulting Team: Rishabh Dua
Tony Lam
Claudia Heaney

The Rapid7 Threat Command Customer Journey 6
Key Challenges ...................................................... 6
Solution Requirements/Investment Objectives ...... 7
Composite Organization ......................................... 7
Analysis Of Benefits ................................................ 9Time Savings For Security Team Members From
Automation ............................................................. 9
Reduced Impact Of Cyberattacks ........................ 11
Remediation Efficiency ......................................... 13
Unquantified Benefits ........................................... 14
Flexibility ............................................................... 14
Analysis Of Costs .................................................. 15
Subscription Costs ............................................... 15
Implementation Effort ........................................... 16
Maintenance Effort ............................................... 17
Financial Summary ................................................ 18
Appendix A: Total Economic Impact ................... 19
Appendix B: Endnotes .......................................... 20

ABOUT FORRESTER CONSULTING
Forrester provides independent and objective research-based consulting to help leaders deliver key transformation
outcomes. Fueled by our customer-obsessed research, Forrester’s seasoned consultants partner with leaders to execute on theirpriorities using a unique engagement model that tailors to diverse needs and ensures lasting impact. For more information, visit
forrester.com/consulting.
© Forrester Research, Inc. All rights reserved. Unauthorized reproduction is strictly prohibited. Information is based on best
available resources. Opinions reflect judgment at the time and are subject to change. Forrester®, Technographics®, Forrester
Wave, and Total Economic Impact are trademarks of Forrester Research, Inc. All other trademarks are the property of theirrespective companies. For additional information, go to forrester.com.

THE TOTAL ECONOMIC IMPACT™ OF RAPID7 THREAT COMMAND

Executive Summary
With an increasingly complex threat landscape, security teams require technology solutions andinternal processes to manage threat intelligence and effectively protect their security
environments. Rapid7 Threat Command is an external threat intelligence solution that helps
security teams gain process efficiencies across the entire threat lifecycle, from detection andinvestigation to remediation. With Rapid7’s underlying technology platform and security
expertise, Threat Command enhances an organization’s security posture.

With the increasing volume of cyberthreats,increasing complexity of digital environments, andKEY STATISTICS

expanding attack surfaces for organizations,companies need to enhance their cyberdefenses.1 In
fact, according to Forrester research, 63% oforganizations globally were breached in 2021, andsecurity decision-makers were more concerned about
external attacks than any other attack vector. 2
These cyberthreats and compromised data, such as

Return on investment (ROI)

Net present value (NPV)311%$1.42M

information on end users floating around on the dark
web, are pushing organizations to find an external
threat intelligence solution that can provide precise

demand and full-service remediation to quickly

visibility into the threats most relevant to theirremove threats impacting it.

organization and industry and assist in them in

Rapid7 commissioned Forrester Consulting tostaying one step ahead of potential issues. Security

conduct a Total Economic Impact™ (TEI) study andteams struggle with the necessary resources,

examine the potential return on investment (ROI)

systems, headcount, internal processes for detection

enterprises may realize by deploying Threat

and remediation, and data visibility across their

Command.3 The purpose of this study is to provide

security landscape to effectively manage external

readers with a framework to evaluate the potential

threats. With external threat intelligence solutions,financial impact of Threat Command on theirsecurity teams gain greater visibility into threatorganizations.

intelligence data and swifter, automated remediationthat substantially lower the risk organizations face

To better understand the benefits, costs, and risks

from cyberattacks.

associated with this investment, Forrester interviewed
four representatives with experience using Threat

Threat Command is a threat intelligence and digitalrisk protection solution that reduces an organization’s

Command. For the purposes of this study, Forrester
aggregated the interviewees’ experiences andrisk exposure from external threats. Threat Command

combined the results into a single global composite

pairs AI and machine learning detections with humanorganization with 7,500 employees and revenue ofintelligence to prioritize alerts relevant for immediate$5.7 billion per year.

action. Threat Command acts as an extension of anorganization’s security team, providing expertise on

THE TOTAL ECONOMIC IMPACT™ OF RAPID7 THREAT COMMAND FOR DIGITAL RISK PROTECTION AND THREAT INTELLIGENCE

1EXECUTIVE SUMMARY

Prior to using Threat Command, interviewees noted

composite organization’s security team members

their legacy external threat intelligence solutions were

gain efficiencies across those activities, allowing

unable to provide them with data relevant to their

them to reprioritize more productive and valuableorganization and lacked visibility across all assets.

work.

Security team members dealt with information
overload and inadequate resources to handle the•

Up to 70% reduction in the likelihood of amajor security breach. By implementing Threat

workload. The security team members manually

Command, the composite organization gains

gathered information across a variety of sources withgreater efficiency to detect, investigate, respondtime-consuming investigations across digital locations

to, and remediate cyberattacks. For thesuch as the dark web. Moreover, the remediation

composite organization, having Threat Commandprocess for actionable alerts was slow and inefficient.

as a part of its security environment has theAfter the investment in Threat Command,

effect of lowering the likelihood of successfulinterviewees had an efficient solution that monitored

breaches by up to 70% over the course of threeand defended against external threats. It provided

years and decreasing the impact of cyberattacks.

organizationally relevant data displayed in a single

This results in up to $1.1 million (PV) in savings

location, saved security analysts’ valuable time, andover three years.

created more efficient processes from investigation to
remediation. This strengthened the organizations’•Remediation efficiency for the security team.
By implementing Threat Command, thesecurity posture for detecting and responding tocomposite organization gains a fastercyberthreats.

remediation process for actionable alerts due tothe automation and access to Rapid7’s internal
intelligence team. The composite organization

Reduction in time forinvestigation, threat
hunting, and analysis withThreat Command

75%

avoids the cost of adding one additional security
analyst. This results in $302,200 (PV) in savings
over three years.
Unquantified benefits. Benefits that provide value
for the composite organization but are not quantified
in this study include:•

Proactive processes for external threat
intelligence and remediations. The composite

KEY FINDINGS

organization gains more efficient security

Quantified benefits. Three-year, risk-adjusted

processes from contextualized and relevant

present value (PV) quantified benefits for thealerts on potential threats and the ability to takecomposite organization include:

down malicious accounts and domains before•

Security-team productivity gains fromautomation of $496,700 over three years. Prior
to implementing Threat Command, the composite
organization has an inefficient process forinvestigation, threat hunting, analysis, and reportthey become larger problems. Implementing
Threat Command helps the composite
organization become more proactive in dealing
with new adverse activity that previously would
have gone undetected.

creation. By leveraging Threat Command, theTHE TOTAL ECONOMIC IMPACT™ OF RAPID7 THREAT COMMAND FOR DIGITAL RISK PROTECTION AND THREAT INTELLIGENCE

2

EXECUTIVE SUMMARY•

Reduction in number of false positive alerts.
By implementing Threat Command, thecomposite organization realizes a decrease in thenumber of false positives since the systemprovides customized, contextualized, andrelevant alerts.

Costs. Three-year, risk-adjusted PV costs for thecomposite organization include:•

Threat Command subscription andremediations fees. Rapid7 charges thecomposite organization an annual subscription
based on number of assets covered and a
supplementary charge for additional
remediations, adding up to over $410,300 overthree years.

•

Implementation and ongoing costs.
Implementation and ongoing tasks add up to$25,700 over three years.

The representative interviews and financial analysis
found that a composite organization experiences
benefits of $1.88 million over three years versus
costs of $457,000, adding up to a net present value(NPV) of $1.42 million and an ROI of 311%.

THE TOTAL ECONOMIC IMPACT™ OF RAPID7 THREAT COMMAND FOR DIGITAL RISK PROTECTION AND THREAT INTELLIGENCE

3

EXECUTIVE SUMMARYROI

BENEFITS PV

NPV

311%

$1.88M$1.42M“Everything was a little bit easier,to navigate and search, and thealerts and the reports that we got
on a daily basis were much more
fruitful.”— CIO, airlines
THE TOTAL ECONOMIC IMPACT™ OF RAPID7 THREAT COMMAND FOR DIGITAL RISK PROTECTION AND THREAT INTELLIGENCE

4

EXECUTIVE SUMMARYTEI FRAMEWORK AND METHODOLOGY
From the information provided in the interviews,
Forrester constructed a Total Economic Impact™
framework for those organizations considering an

DUE DILIGENCE
Interviewed Rapid7 stakeholders and Forrester
analysts to gather data relative to Threat

investment in Threat Command.

Command.

The objective of the framework is to identify the cost,benefit, flexibility, and risk factors that affect the

INTERVIEWSInterviewed four representatives atinvestment decision. Forrester took a multistep

organizations using Threat Command to obtainapproach to evaluate the impact that Threatdata with respect to costs, benefits, and risks.

Command can have on an organization.
Forrester Consulting conducted an online survey of
351 cybersecurity leaders at global enterprises in the

COMPOSITE ORGANIZATION
Designed a composite organization based on

US, the UK, Canada, Germany, and Australia.

characteristics of the interviewees’

Survey participants included managers, directors,organizations.

VPs, and C-level executives who are responsible forcybersecurity decision-making, operations, andreporting. Questions provided to the participants
sought to evaluate leaders' cybersecurity strategies
and any breaches that have occurred within their

FINANCIAL MODEL FRAMEWORK
Constructed a financial model representative of
the interviews using the TEI methodology andorganizations. Respondents opted into the survey via

risk-adjusted the financial model based ona third-party research panel, which fielded the survey

issues and concerns of the interviewees.

on behalf of Forrester in November 2020.

DISCLOSURESCASE STUDY
Employed four fundamental elements of TEI inmodeling the investment impact: benefits, costs,

Readers should be aware of the following:This study is commissioned by Rapid7 and delivered byForrester Consulting. It is not meant to be used as acompetitive analysis.
Forrester makes no assumptions as to the potential ROI
that other organizations will receive. Forrester strongly
advises that readers use their own estimates within theframework provided in the study to determine theappropriateness of an investment in Threat Command.

flexibility, and risks. Given the increasing
sophistication of ROI analyses related to IT
investments, Forrester’s TEI methodology
provides a complete picture of the total
economic impact of purchase decisions. Please
see Appendix A for additional information on the
TEI methodology.

Rapid7 reviewed and provided feedback to Forrester, but
Forrester maintains editorial control over the study and its
findings and does not accept changes to the study that
contradict Forrester’s findings or obscure the meaning of
the study.
Rapid7 provided the customer names for the interviews
but did not participate in the interviews.

THE TOTAL ECONOMIC IMPACT™ OF RAPID7 THREAT COMMAND FOR DIGITAL RISK PROTECTION AND THREAT INTELLIGENCE

5

The Rapid7 Threat Command Customer Journey
Drivers leading to the Threat Command investment

Interviews
Role

Industry

Region

Revenue

Security Team
Size

Named Assets

Principal threat
intelligence analyst

Financial services

North America$18.9 billion

6 team members

7,500

Cyber security andincident response lead

Materials

North America$1.6 billion

4 team members

500

CISO

Legal

North America$1.5 billion

5 team members

200

CIO

Airlines

North America$700 million

8 team members

500

many were irrelevant. This time-consuming

KEY CHALLENGES

process led to additional work, which could have

Prior to implementing Threat Command,

been more efficiently spent on higher-priority

interviewees’ organizations worked with limited

security tasks.

technology solutions such as open source tools or
antivirus software for threat intelligence and wereinundated with data. The remediation processes were
inefficient. The interviewees noted how their“We were having a lot of trouble
distinguishing relevant threats
from noise. It was a manualapproach of pulling theinformation from these sources… It was very reactive.”organizations struggled with common challenges,
including:•Lack of visibility and unactionable data
gathered across legacy solutions.
Interviewees noted that there was an immense
amount of data to examine with their previous
solutions and systems. This resulted in limited

Principal threat intelligence analyst,
financial services

visibility into the potential security threats to bothinterviewees’ organizations and their customers.
The data the legacy solutions provided was
confusing to navigate. There was no singularaccounting of assets or solution to provide
curated customizable information.
••

Reactive approach to potential cyber

Manual and time-consuming process forincidents. Interviewees noted that their legacy

investigation and analysis. Interviewees statedsystems and internal processes led to a reactivethat security team members using legacy threat

approach for their threat intelligence

intelligence solutions had to spend hours

investigations and security responses. Security

manually searching through different platforms

team members would get alerts from systems or

such as a web-based Git repository or the darkother teams with limited context, which led to

web to investigate all potential threat alerts, and

THE TOTAL ECONOMIC IMPACT™ OF RAPID7 THREAT COMMAND FOR DIGITAL RISK PROTECTION AND THREAT INTELLIGENCE

6

THE RAPID7 THREAT COMMAND CUSTOMER JOURNEY

inefficient triage of larger issues. As a result, theteams sacrificed quality for speed.
SOLUTION REQUIREMENTS/INVESTMENTOBJECTIVES
The interviewees’ organizations searched for a

Reduced likelihood of acyberattack after deploying
Threat Command

solution that could:•

Provide greater data visibility through a single
pane of glass.

•

Up to 70%

Consolidate information and create a centralized
asset list.

•

Provide customizable alerts with greater context
around the threat intelligence.

•

Improve search capabilities across platforms andlocations such as the dark web, application
marketplaces, and social media.

•

Modernize security systems and processes.

COMPOSITE ORGANIZATION
Based on the interviews, Forrester constructed a TEI
framework, a composite company, and an ROI
analysis that illustrates the areas financially affected.
The composite organization is representative of thefour interviewees, and it is used to present theaggregate financial analysis in the next section. The
composite organization has the following
characteristics:“We needed something that gave
us the capability to aggregate
everything into ... one central
platform and bring all of ourthreat intelligence and curatingprocesses together in a way that
it was usable. The solution also
had to have the capability of
being able to talk to all of ourother security technology that
could absorb threat
intelligence.”
CISO, legal

Description of composite. The composite
organization is a $5.7 billion global enterprise, with
7,500 employees headquartered in North America.
The organization has open source tools, antivirus
software, and vendor sources for finishedintelligence. The security team is comprised of fiveteam members working solely on threat intelligence.
The organization has 1000 named assets andmonitors a variety of keywords including domains,login pages, brand and company names, social
media pages, VIP emails, IP addresses,
workstations, and servers. The organization islooking to modernize its threat intelligence andsecurity systems, gain greater data visibility, andcreate more efficient processes across all stages
from threat investigation to remediation. Use caseswith Threat Command include, but are not limited toattack mapping, digital risk, brand and fraud
protection, vulnerability protection, data and

THE TOTAL ECONOMIC IMPACT™ OF RAPID7 THREAT COMMAND FOR DIGITAL RISK PROTECTION AND THREAT INTELLIGENCE

7

THE RAPID7 THREAT COMMAND CUSTOMER JOURNEY

credential leakage, attack surface monitoring, andphishing protection.

Key Assumptions• $5.7 billion in annual
revenue• 7,500 employees• Five threat intelligenceteam members• 1000 named assets

THE TOTAL ECONOMIC IMPACT™ OF RAPID7 THREAT COMMAND FOR DIGITAL RISK PROTECTION AND THREAT INTELLIGENCE

8

Analysis Of Benefits
Quantified benefit data as applied to the composite

Total Benefits
Ref.

BenefitYear 1

Year 2

Year 3

Total

Present
Value

Atr

Time savings for security
team members fromautomation$199,719$199,719$199,719$599,157$496,672

Btr

Reduced impact ofcyberattacks$366,714$440,057$513,399$1,320,170$1,082,784

Ctr

Remediation efficiency$121,500$121,500$121,500$364,500$302,153

Total benefits (risk-adjusted)$687,933$761,276$834,618$2,283,827$1,881,609

TIME SAVINGS FOR SECURITY TEAM MEMBERS
FROM AUTOMATION
Evidence and data. Before implementing Threat
Command, interviewees noted that security teammembers would spend hours searching online on thedark web and investigating potential threats suchleaked credit card numbers, credentials, or accounts.
For security analysts, this was a time-consuming andfraudulent accounts or leaked credentials.
Additionally, with greater data visibility, the time tocreate reports decreased substantially. The
improvements with data context and visibility freed up
analysts at the interviewees’ organizations so they
could conduct higher-priority work within the security
environment.
•

The CIO of an airlines firm estimated the time toextremely manual process, and it limited the time forresearch threats for the two team members

higher-priority security tasks. With Threat Command,

working on threat investigation decreased byanalysts could offload a significant proportion of time

50%. Additionally, they estimated the time to

devoted to investigation of threats in locations like acreate quarterly reports decreased from a few

web-based Git repository and the dark web. Threat

hours to 30 minutes. He said: “It’s all in one

Command scoured through the dark web and otherlocation…making it all a little bit more efficient

sources for information relevant to interviewees’

than me hunting for a couple of hours, looking forcustomers and provided the information in athat information. Whereas now, it’s simply going

consolidated platform. Organizations could use

to a dashboard and I have all the information thatThreat Command’s intuitive console and user

I need.”interface to set up automated blocking rules to take•

immediate action on threats to their environment.

The principal threat intelligence analyst for afinancial services firm estimated that three

Teams would spend hours creating reports by sifting

analysts on the security team saved three to four

through various systems to pull data points. With

hours a day running searches across online

Threat Command, the teams could more easily

locations such as a web-based Git repository

handle a threat when one was identified, which

after implementing Threat Command.

enabled the team to greatly reduce the amount oftime that analysts spent searching the dark web for•

The cyber security and incident response lead at
a materials firm estimated a 50% efficiency gain

THE TOTAL ECONOMIC IMPACT™ OF RAPID7 THREAT COMMAND FOR DIGITAL RISK PROTECTION AND THREAT INTELLIGENCE

9

ANALYSIS OF BENEFITS

for security analysts that researched and created

Results. To account for these risks, Forrester

reports more efficiently after implementing Threat

adjusted this benefit downward by 10%, yielding a

Command. They said: “We used to get reports on

three-year, risk-adjusted total PV (discounted at 10%)a daily basis on the number of alerts that hadof $496,700.

come in. I don’t think we had visibility to that
previously. It was a manual process and it would
probably take a couple of hours weekly for
analysts to go through the reports. Now it’sautomated and everything is fast.”•

The CISO for a legal firm said prior to Threat
Command, analysts could spend up to threehours investigating potential threats. With Threat
Command, they estimated the time to investigate
decreased to 30 minutes. They added that theteam averaged 10 reports a month and each

“I do think Threat Command is aforce multiplier for my team at
the end of the day because you
have one platform to go to.”
CISO, legal

report could take nearly half a day to complete.
With Threat Command, they estimated eachreport now takes less than 30 minutes tocomplete.
Modeling and assumptions. For the composite
organization, Forrester assumes:•

The intelligence team uses five members.

•

A 75% reduction in time for investigation, threat
hunting, and analysis attributable to Threat
Command.

•

The team completes 84 reports annually.

•

An 87.5% reduction in time spent on report
creation attributable to Threat Command.

Risks. The magnitude of this benefit may vary basedon:•

The number of security operations professionals,
which may vary by organization size.

•

Security analysts’ salaries, which may vary bygeographic region.

•

Number of reports created annually.

•

The increase in efficiency and speed, which mayvary based on the overall security posture of theorganization.

THE TOTAL ECONOMIC IMPACT™ OF RAPID7 THREAT COMMAND FOR DIGITAL RISK PROTECTION AND THREAT INTELLIGENCE

10

ANALYSIS OF BENEFITSTime Savings For Security Team Members From Automation
Ref.

MetricSourceYear 1

Year 2

Year 3

A1

Number of security team members

Composite

5

5

5

A2

Percent of team members working on
investigation, threat hunting, and analysis

Composite

80%

80%

80%

A3

Time spent for investigation, threat
hunting and analysis prior to Threat
Command (hours)

Interview

1,040

1,040

1,040

A4

Reduction in time for investigation, threat
hunting, and analysis attributable toThreat Command

Interview

75%

75%

75%

A5

Subtotal: Time savings for investigation,
threat hunting, and analysis

A1*A2*A3*A4

3120

3120

3120

A6

Number of reports

Interview

84

84

84

A7

Percent of team members working onreports

Composite

20%

20%

20%

A8

Time spent per report prior to Threat
Command

Interview

4

4

4

A9

Reduction in time for reporting
attributable to Threat Command

Interview

87.5%

87.5%

87.5%

A10

Subtotal: Time savings for reporting

A6*A7*A1*A8*A9

294

294

294

A11

Hourly fully loaded salary per security
team member

TEI standard

$65

$65

$65

At

Time savings for security team members
from automation(A5+A10)*A11$221,910$221,910$221,910

Risk adjustment↓10%$199,719$199,719$199,719

AtrTime savings for security team members
from automation (risk-adjusted)
Three-year total: $599,157

Three-year present value: $496,672

REDUCED IMPACT OF CYBERATTACKS

comprehensive security solution with an intuitive user

Evidence and data. The interviewees’ organizations

interface to proactively identify and remediate threatsneeded to defend themselves and their customers
against increased volume of threats, expanded attack
surfaces, and expanded locations for attacker tools
and exploit code. Limited analyst capacity, disparate
data sets across security solutions, and a lack ofsearch accuracy left these organizations vulnerable
and more reactive to cyberattacks. With Threat
Command, interviewees noted improved security
posture for their organizations. Threat Commandprovided representatives’ organizations a more

before they turned into larger problems. Threat
Command provided improved coverage withcustomizable alerts and dynamic, accurate searches
for queries. The user interface presented information
in a dashboard that prioritized alerts and lowered thesignal-to-noise ratio. This was further enhanced by
the ability for organizations to query Rapid7’s threat
team for more in-depth information on particularalerts/threats with a click of a button within the
console. Faster remediation through automated

THE TOTAL ECONOMIC IMPACT™ OF RAPID7 THREAT COMMAND FOR DIGITAL RISK PROTECTION AND THREAT INTELLIGENCE

11

ANALYSIS OF BENEFITS

processes provided a more active response that

Modeling and assumptions. For the composite

helped cover more of a security environment.

organization, Forrester assumes:

Interviewees’ organizations could identify potential
threats and investigate and remediate potential
threats within the Threat Command console, all of•

An average of 2.5 cyberattacks per year.4•

The average cost per security breach is$654,846.

which lowered the impact of cyberattacks.
•

There’s a 56% degree of coverage from total loss
vectors, which includes internal incidents andexternal cyberattacks.

“We’re able to see thevulnerabilities and threats thatare coming in with Threat
Command, so we can blockwithin our firewall and use email
security tools. One lessmalicious link is one less ability
for someone to breach thesystem.”•With an improving security posture, the reduced
likelihood of cyberattacks may decrease by 50%
in Year 1 to 70% in Year 3.

Risks. The magnitude of this benefit may vary basedon:•

The baseline security posture of the organization.

•

The strength and number of cyberattacks andtype of exposure.

•

The organization’s industry and size, because
these factors relate to the likelihood of a

CIO, airlines

cyberattack and the potential for losses.
Results. To account for these risks, Forrester
adjusted this benefit downward by 20%, yielding athree-year, risk-adjusted total PV of $1.1 million.

Reduced Impact Of Cyberattacks
Ref.

MetricSourceYear 1

Year 2

Year 3

B1

Average number of cyberattacks per year

Forrester
research

2.5

2.5

2.5

B2

Reduced likelihood of a cyberattack after
deploying Threat Command

Interview

50%

60%

70%

B3

Average cost of a cyberattack

Forrester
research$654,846$654,846$654,846

B4

Degree of coverage due to Threat
Command from total loss vectors

Forrester
research

56%

56%

56%

Bt

Reduced impact of cyberattacks

B1*B2*B3*B4$458,392$550,071$641,749

Risk adjustment↓20%$366,714$440,057$513,399

Btr

Reduced impact of cyberattacks (riskadjusted)
Three-year total: $1,320,170

Three-year present value: $1,082,784

THE TOTAL ECONOMIC IMPACT™ OF RAPID7 THREAT COMMAND FOR DIGITAL RISK PROTECTION AND THREAT INTELLIGENCE

12

ANALYSIS OF BENEFITSREMEDIATION EFFICIENCY

Risks. The magnitude of this benefit may vary based

Evidence and data. Interviewees stated that prior toon:

Threat Command, their organizations lacked the•

The size of the organization.

•

The level of security coverage required.

•

Security analysts’ salaries, which may vary byrequired headcount to properly investigate alerts andpotential threats. With Threat Command
implemented, interviewees’ organizations did notneed to hire additional headcount. With moregeographic region.

comprehensive detection using the underlying
technology, analytics platform, and access to

Results. To account for these risks, Forrester

Rapid7’s internal SOC and remediation teams,

adjusted this benefit downward by 10%, yielding ainterviewee’s organizations gained a more efficient

three-year, risk-adjusted total PV of $302,200.

process within their security environment.
Interviewees found they did not need to hire
additional staff having implemented Threat
Command.
•

The CISO for a legal firm said, “Threat Command
definitely cut down on a lot of hours of work for
my team in a week. A headcount.”•

The CIO for an airline firm estimated theorganization did not need to hire an additional
security analyst after implementing Threat
Command as a part of its security environment.

Modeling and assumptions. For the composite
organization, Forrester assumes:•“Before Threat Command, if I
needed to do a domain takedown,
I had to dig up where it was
registered. Taking down a fakesocial network profile or domain
is painful, and it can take monthsof communication. Now I upload
it, hit the remediation button, andThreat Command does the hard
work in the background.”
CISO, legal

By implementing Threat Command, thecomposite organization avoids hiring one security
analyst.

•A security analyst’s annual fully loaded salary is$135,000.

Remediation Efficiency
Ref.

MetricSourceYear 1

Year 2

Year 3

C1

Avoided headcountInterview

1

1

1

C2

Average annual fully loaded salary forsecurity analyst

TEI standard$135,000$135,000$135,000

Ct

Remediation efficiency

C1*C2$135,000$135,000$135,000

Risk adjustment↓10%$121,500$121,500$121,500

Ctr

Remediation efficiency (risk-adjusted)
Three-year total: $364,500

Three-year present value: $302,153

THE TOTAL ECONOMIC IMPACT™ OF RAPID7 THREAT COMMAND FOR DIGITAL RISK PROTECTION AND THREAT INTELLIGENCE

13

ANALYSIS OF BENEFITSUNQUANTIFIED BENEFITSFLEXIBILITY

Interviewees mentioned the following additional

The value of flexibility is unique to each customer.

benefits that their organizations experienced but were

There are multiple scenarios in which a customer

not able to quantify:

might implement Threat Command and later realize•

additional uses and business opportunities, including:
Proactive approach to potential threats.
Interviewees described more efficient security•

Continued threat protection. Interviewees

processes. They fine-tuned searches forexpressed continued confidence in Threat

themselves and their customers, gained

Command’s ability to identify and help protect

personalized alerts on potential threats, took

their organizations against future threats utilizing

down accounts and domains off the dark web

the most up-to-date threat intelligence. This may

before they became larger problems, and had aresult in improved business continuity and risk

greater accounting of all their digital assets. With

avoidance.

these new processes, interviewees noted theyFlexibility would also be quantified when evaluated as

moved from a reactive to a proactive approachpart of a specific project (described in more detail inwith threat intelligence and threat remediations.

Appendix A).

One interviewee even reported learning of threats
to the organization’s customer before being
informed by the customer.
▪

The principal threat intelligence analyst
for a financial services firm said: “Threat
Command helped us become moreproactive in a way that we otherwise
couldn’t. By the time somebody is asking
you the question, it’s too late to do all thework to fix a problem.”▪

The CIO of an airline firm said: “We’re
more proactive now based upon some of
the information we see within Threat
Command. So there have been several
instances where we received informationfrom Threat Command before ourcustomer even notified us.”•

Decrease in false positives. Interviewees noted
there was a decrease in the number of false
positives after implementing Threat Command.
Since the systems filters out information and only
provides relevant and customized alerts, teams
were able to focus on alerts that required further
investigation rather than chase down potential
alerts that led nowhere.

THE TOTAL ECONOMIC IMPACT™ OF RAPID7 THREAT COMMAND FOR DIGITAL RISK PROTECTION AND THREAT INTELLIGENCE

14

Analysis Of Costs
Quantified cost data as applied to the composite

Total Costs
Ref.

Cost

Dtr

Subscription costs

Etr

Implementation effort

Ftr

Maintenance effort
Total costs (riskadjusted)

InitialYear 1

Year 2

Year 3

Total

Present
Value$0$165,000$165,000$165,000$495,000$410,331$25,740

$0

$0

$0

$25,740$25,740$0$8,580$8,580$8,580$25,740$21,337$25,740$173,580$173,580$173,580$546,480$457,408

Risks. The pricing will vary based on:

SUBSCRIPTION COSTS
Evidence and data. Interviewees said they paid foran annual subscription fee for Threat Command and•

The number of assets being covered.

•

The number of additional remediations

for a set of additional remediations. The subscription

purchased.

fees were based on the number of named assets andthe remediations pricing was based on number of•Any discounts negotiated with or offered by
Rapid7.

additional remediations purchased.
Modeling and assumptions. For the composite

Results. To account for these risks, Forresterorganization, Forrester assumes:

adjusted this cost upward by 10%, yielding a three-•

year, risk-adjusted total PV (discounted at 10%) of
Subscription fee of $140,000 is for 1,000 named$410,300.

assets.
•Additional remediations for use anytime is$10,000.

Subscription Costs
Ref.

MetricSourceD1

Subscription cost

D2
Dt

Dtr

Year 1

Year 2

Year 3Composite$140,000$140,000$140,000

Additional remediation request costs

Composite$10,000$10,000$10,000

Subscription costs

D1+D2

$0

$150,000$150,000$150,000

Risk adjustment

↑10%
$0

$165,000$165,000$165,000

Subscription costs (risk-adjusted)
Three-year total: $495,000

InitialThree-year present value: $410,331

THE TOTAL ECONOMIC IMPACT™ OF RAPID7 THREAT COMMAND FOR DIGITAL RISK PROTECTION AND THREAT INTELLIGENCE

15

ANALYSIS OF COSTS

IMPLEMENTATION EFFORT

Risks. The costs may vary due to:

Evidence and data. Interviewees described a•straightforward implementation process for Threat
Command. Team members worked to integrate andconnect Threat Command into their security
environment from servers to firewalls. They also

The systems and named assets that need to beconnected and uploaded to Threat Command.

•

Time required to complete implementation.

•

The number of security team members dedicateduploaded lists of named assets such as domains andto the implementation of Threat Command, which

accounts.

may vary by organization size.

Modeling and assumptions. For the composite
organization, Forrester assumes:•

Security team member’s salaries, which may varyby geographic region.

•

The involvement of three security team members.

•

Implementation takes 120 hours to complete.

•

A security team member’s hourly fully loaded

Results. To account for these risks, Forrester
adjusted this cost upward by 10%, yielding a threeyear, risk-adjusted total PV of $25,700.

salary is $65.

Implementation Effort
Ref.

MetricSourceInitialE1

Number of security team members

Composite

3

E2

Time for implementation of Threat
Command (hours)

Interview120

E3

Hourly fully loaded salary

TEI standard

$65

Et

Implementation effort

E1*E2*E3

Risk adjustment

↑10%

Etr

Implementation effort (risk-adjusted)
Three-year total: $25,740

Year 1

Year 2

Year 3$23,400

$0

$0

$0

$25,740

$0

$0

$0

Three-year present value: $25,740

THE TOTAL ECONOMIC IMPACT™ OF RAPID7 THREAT COMMAND FOR DIGITAL RISK PROTECTION AND THREAT INTELLIGENCE

16

ANALYSIS OF COSTS

MAINTENANCE EFFORT

Risks. The cost may vary based on:

Evidence and data. Interviewees described minimal•

efforts to maintain the system. This included tasks

The number of security team members, which
may vary by organization size.

such as updating the asset lists and connecting new
security technologies to Threat Command.
Modeling and assumptions. For the composite•

Time required for maintenance tasks•

Security team member’s salaries, which may varyby geographic region.

organization, Forrester assumes:•

The involvement of two security team members.

•

Maintenance tasks take 5 hours a month to

Results. To account for these risks, Forrester
adjusted this cost upward by 10%, yielding a threeyear, risk-adjusted total PV of $21,300

complete.
A security team member’s hourly fully loaded•salary is $65.

Maintenance Effort
Ref.

MetricSourceF1

Number of security team members

F2

Year 1

Year 2

Year 3Composite22

2

Hours for ongoing work per monthInterview

5

5

5

F3

Hourly fully loaded salary

Forrester
standard

$65

$65

$65

Ft

Maintenance effort

F1*F2*F3*12$0$7,800$7,800$7,800

Risk adjustment

↑10%
$0

$8,580$8,580$8,580

Ftr

Maintenance effort (risk-adjusted)
Three-year total: $25,740

InitialThree-year present value: $21,337

THE TOTAL ECONOMIC IMPACT™ OF RAPID7 THREAT COMMAND FOR DIGITAL RISK PROTECTION AND THREAT INTELLIGENCE

17

Financial Summary
CONSOLIDATED THREE-YEAR RISK-ADJUSTED METRICS

Cash Flow Chart (Risk-Adjusted)
Total costs

Total benefits

Cumulative net benefits

Cash
flows

$2.0 M$1.5 M

The financial results calculated in the
Benefits and Costs sections can beused to determine the ROI and NPV for
the composite organization’s
investment. Forrester assumes ayearly discount rate of 10% for thisanalysis.

$1.0 M

These risk-adjusted ROI and
NPV values are determinedby applying risk-adjustment
factors to the unadjusted
results in each Benefit andCost section.

$0.5 M-$0.5 M
InitialYear 1

Year 2

Year 3

Cash Flow Analysis (Risk-Adjusted Estimates)
InitialYear 1

Year 2

Year 3

Total

Present
Value($25,740)($173,580)($173,580)($173,580)($546,480)($457,408)

Total benefits$0$687,933$761,276$834,618$2,283,827$1,881,609

Net benefits($25,740)$514,353$587,696$661,038$1,737,347$1,424,201

Total costs

ROI

THE TOTAL ECONOMIC IMPACT™ OF RAPID7 THREAT COMMAND FOR DIGITAL RISK PROTECTION AND THREAT INTELLIGENCE

311%

18

Appendix A: Total Economic
ImpactTotal Economic Impact is a methodology developed

PRESENT VALUE (PV)by Forrester Research that enhances a company’s

The present or current value oftechnology decision-making processes and assists(discounted) cost and benefit estimatesvendors in communicating the value proposition of

given at an interest rate (the discounttheir products and services to clients. The TEIrate). The PV of costs and benefits feed

methodology helps companies demonstrate, justify,

into the total NPV of cash flows.

and realize the tangible value of IT initiatives to bothsenior management and other key businessstakeholders.

NET PRESENT VALUE (NPV)TOTAL ECONOMIC IMPACT APPROACH

The present or current value ofBenefits represent the value delivered to the(discounted) future net cash flows given

business by the product. The TEI methodology

an interest rate (the discount rate). A

places equal weight on the measure of benefits andpositive project NPV normally indicatesthe measure of costs, allowing for a full examinationthat the investment should be madeof the effect of the technology on the entire

unless other projects have higher NPVs.

organization.
Costs consider all expenses necessary to deliver the

RETURN ON INVESTMENT (ROI)

proposed value, or benefits, of the product. The cost
category within TEI captures incremental costs overA project’s expected return inthe existing environment for ongoing costs

percentage terms. ROI is calculated byassociated with the solution.

dividing net benefits (benefits less costs)
by costs.

Flexibility represents the strategic value that can beobtained for some future additional investmentbuilding on top of the initial investment already made.

DISCOUNT RATE

Having the ability to capture that benefit has a PV
that can be estimated.

The interest rate used in cash flow
analysis to take into account theRisks measure the uncertainty of benefit and costtime value of money. Organizations

estimates given: 1) the likelihood that estimates will

typically use discount rates between

meet original projections and 2) the likelihood that

8% and 16%.

estimates will be tracked over time. TEI risk factors
are based on “triangular distribution.”
The initial investment column contains costs incurred at “time0” or at the beginning of Year 1 that are not discounted. Allother cash flows are discounted using the discount rate at theend of the year. PV calculations are calculated for each total
cost and benefit estimate. NPV calculations in the summary
tables are the sum of the initial investment and thediscounted cash flows in each year. Sums and present value
calculations of the Total Benefits, Total Costs, and Cash Flowtables may not exactly add up, as some rounding may occur.

THE TOTAL ECONOMIC IMPACT™ OF RAPID7 THREAT COMMAND FOR DIGITAL RISK PROTECTION AND THREAT INTELLIGENCE

19

Appendix B: Endnotes
1 Source: “The 2021 State Of Enterprise Breaches,” Forrester Research, Inc., April 8, 2022.
2 Ibid3 Total Economic Impact is a methodology developed by Forrester Research that enhances a company’s

technology decision-making processes and assists vendors in communicating the value proposition of theirproducts and services to clients. The TEI methodology helps companies demonstrate, justify, and realize thetangible value of IT initiatives to both senior management and other key business stakeholders.
4 Source: “Forrester Consulting Cost Of A Cybersecurity Breach Survey,” Q1 2021.

THE TOTAL ECONOMIC IMPACT™ OF RAPID7 THREAT COMMAND FOR DIGITAL RISK PROTECTION AND THREAT INTELLIGENCE

20

THE TOTAL ECONOMIC IMPACT™ OF RAPID7 THREAT COMMAND FOR DIGITAL RISK PROTECTION AND THREAT INTELLIGENCE

21