We used Qualys before. Rapid7 is better than Qualys.

I have used Fortify on Demand and other solutions. Each solution, whether it is Fortify, Qualys, or Veracode, has its own pros and cons. 

Qualys has a wider integration scale, and also from the cloud perspective, when you want to install the Qualys agents on any of your ECS or VMs, it is usually easy to integrate. Rapid7 is also easy, but it doesn't offer anything to scan everything from end to end. It is still improving. I recently attended one of their sessions, and I know they are coming up with new features, but they need to fasten up based on what the current market is and what other products offer. 

We have been using it only from the AppSec perspective, and it has been working well for us. If I go with Rapid7 for extensive use, including vulnerability management and infrastructure, it would become a little challenging for us because it doesn't offer so many features compared to Qualys or any other products.

I've used HCL AppScan. AppScan does a lot more. It looks at static analysis. It looks at the code when it's not being executed and when it's executing. It also looks at interactivity. The only problem with AppScan is that it's a bit expensive because, for each scan, you need to pay. You need to get a license for each scan. So, every time I scan, it becomes a bit more expensive. That's the only reason why we went with InsightAppSec.

We haven't used a similar product to Rapid7. This was our first time using this type of technology, so we have nothing to compare it to.

Our previous solution was not as robust, so we needed this solution in order to achieve our goals and objectives.