Surface Command Overview

Surface Command breaks down data silos by combining comprehensive attack surface visibility across hybrid environments to build a dynamic 360-degree view of your entire attack surface in one place. External scans provide an adversary’s perspective on the attack surface, detecting and validating exposures while highlighting areas attackers are most likely to target.

Surface Command combines these external scans with a detailed inventory of your internal assets, no matter the security or IT tool used to scan them. This process delivers complete visibility into your attack surface without the risk of blind spots, unprotected assets, and ungoverned access. Understanding how assets are configured assists in quickly identify and address misconfigurations, shadow IT, and compliance issues. This integrated approach gives you a holistic view of your digital landscape, enabling proactive risk mitigation, threat prevention, and rapid response.

Data flow

Surface Command pulls data from the various connectors to provide a complete picture of your environment. Surface Command also monitors the data for changes, and optionally, takes action using workflows. There are several parts to this process:

1. Ingestion - Surface Command pulls data using Connectors. Connectors' ingestion can be scheduled to run at the time and frequency that is most appropriate for your environment (typically daily).
2. Correlation - As data comes in from Connectors, Surface Command correlates the data that refers to the same object and provides a unified view of that object. Each unified view of an object is represented as an asset in the system. Each of the records that are determined to be referring to the same object are linked to that unified asset. Correlation also tracks relationships between data. If an information source indicates a relationship between two objects (for example, a Machine has a specific IP address or owner), those relationships are inherited by the unified object they are correlated with.
3. Unified property fulfillment - Each unified asset has a list of properties that are common for that type of asset. The most appropriate value for each of those properties is determined by evaluating the related properties of the correlated information source records and choosing the best value to include in the property of the unified asset. When you run queries for unified assets and look at their details, you are presented with these fulfilled unified properties, but you can also display all of the information source properties that were considered.

Surface Command features

Rapid7 currently offers the following product options containing Surface Command:

• Surface Command is for teams looking to consolidate their attack surface into a unified, single-pane-of-glass view.
• Exposure Command is for teams looking for a holistic view of their attack surface (Surface Command) as well as some cloud and on-premise monitoring, including attack path analysis, risk prioritization, and vulnerability management.
• Exposure Command Advanced is for teams looking for a holistic view of their attack surface (Surface Command) as well as extensive cloud and on-premise monitoring, compliance alignment, infrastructure as code (IaC) scanning, automation capabilities, least privileged access management, and threat detection.

Feature comparison

The following table lists key differences between the products at a feature-level.

Attack Surface management

Exposure management

Onboarding experiences

The following table lists the different experiences and onboarding timelines for each of the CRC offerings.