Elastic Security vs Rapid7 InsightIDR (2026): which should you pick?

Pick Elastic Security if

• Fits if you have a security team that wants SIEM and endpoint data in one place
• Works for teams that want detection rules published openly on GitHub

Look elsewhere if

• Not for you if you want a flat price per device, because the bill follows GB ingested and retained
• Pricey if you send a lot of data, since ingest and retention charges still apply
• Skip it if you want a simple antivirus: this is a platform to run
• Tight if you need response actions or Device Control, which are Complete tier only
• Watch out: AI triage comes with the higher Complete tier and the trial length is not stated

Pick Rapid7 InsightIDR if

• Fits if you have a security team that wants a SIEM for detection
• Works for companies already buying other Rapid7 products

Look elsewhere if

• Not for you if you want a virus scanner, since it is a SIEM
• Not for you if you want a published price, as the page offers a demo and a Compare Packages view
• Watch out: the page read calls it Incident Command Next-Gen SIEM, not InsightIDR
• Too light for a free try: no trial or free plan is on record

Elastic Security

• Serverless pricing has two tiers, Essentials and Complete, billed per GB ingested and retained; the page says as low as $0.09 and $0.11 per GB ingested, with no plan price to list.
• Per-endpoint fees no longer apply as of March 23, 2026; ingest and retention charges still do.
• Advanced endpoint features such as response actions, tamper protection and Device Control are in the Complete tier only.
• This is a platform for a security team, not a consumer antivirus; the cost follows how much data is sent in.

Rapid7 InsightIDR

• The page read does not use the name InsightIDR; the product appears there as Incident Command Next-Gen SIEM.
• No SIEM package prices are published; the page offers a demo and a Compare Packages view.
• Rapid7 publishes starting prices only for other products, such as InsightVM at $1.62 per asset per month.
• It is a SIEM and detection platform rather than a consumer antivirus.

Elastic Security

Endpoint protection with Elastic Defend

The agent applies behavioral protections on Linux, macOS and Windows, and the vendor says they work offline. Ransomware, memory and behavior prevention are in the entry tier.

SIEM and detection rules

Prebuilt detection rules, triage, investigation and hunting. Elastic Security Labs writes the rules and publishes them openly on GitHub.

AI-assisted triage

Attack Discovery correlates alerts into attack chains, and an AI Assistant helps analysts; both come with the higher Complete tier.

Workflow automation

Scripted automation and AI agents run together in Elastic Workflows, so a playbook can call an agent when a step needs judgment.

Long-term data retention

Data is kept in a searchable store billed per gigabyte retained, so older logs can be queried without restoring an archive first.

Rapid7 InsightIDR

Next-gen SIEM

Combines logs, telemetry and asset context from cloud, SaaS, endpoints and hybrid environments in one view.

AI alert triage

AI-driven behavioral detections and triage, with natural-language search across large volumes of records.

Endpoint detection and response

The Ultimate package adds XDR capabilities and embedded digital forensics in one agent, per the vendor.

Deception technology

The Advanced package adds deception technology and deeper threat intelligence.

Response automation

SOAR playbooks and actions such as isolating machines, revoking credentials and killing processes.

Elastic Security

Pricing could not be confirmed. See elastic.co.

Rapid7 InsightIDR

Pricing could not be confirmed. See rapid7.com.