Rapid7 Approved by Mastercard as a Security Scanning Vendor for Achieving Compliance With the Payment Card Industry (PCI) Data Security Standard

Market Wire, May, 2006

Rapid7 LLC today announced it has successfully completed the MasterCard Site Data Protection (SDP) Vendor Compliance Testing Program, which certifies the enterprise vulnerability management company to help merchants achieve compliance with the Payment Card Industry (PCI) Data Security Standard. Rapid7 is the provider of NeXpose PCI Compliance, which delivers network vulnerability scanning services and meets the security scanning requirements of the MasterCard SDP program.

By using a MasterCard-approved security scanning vendor such as Rapid7, merchants can proactively protect their businesses and the data in their payment systems against the threat of compromises. Left undetected, vulnerabilities can potentially lead to unauthorized access, but by finding and fixing any exposures, an SDP-compliant solution reduces the risk of intrusion.

To become qualified as an SDP-compliant scanning vendor, Rapid7's NeXpose PCI Compliance demonstrated its effectiveness at proactively locating and reporting vulnerabilities during rigorous evaluation in MasterCard's test environment. MasterCard's testing process addresses how the vendor collects and manages scan requests from customers, the ability of the vendor to identify vulnerabilities and misconfigurations in the network and Web applications, and how the vendor presents the scan results.

A key focus of the MasterCard SDP program is to ensure that merchants and service providers (third party processors and data storage entities) are securely storing credit card account data in accordance with the PCI Data Security Standard. To demonstrate compliance, merchants and service providers must perform onsite security assessments and quarterly network scans. Rapid7 recommends that businesses serious about protecting customer data and avoiding the cost of incidents should do more than the minimum level mandated by the PCI standard.

"The return on investment for deploying a self-auditing solution is easily accomplished," said Alan Matthews, president of Rapid7 LLC. "The financial penalty for failure to provide protected systems for processing credit card data makes vulnerability testing mandatory. Consumers need to be assured that the online transaction systems they are using are secure."

NeXpose PCI Compliance provides scan templates and reporting capabilities that meet or exceed the MasterCard SDP specifications for system security scanning. The PCI Standard compliance report provides pass/fail information at both executive and administrator detail levels. A complete remediation plan is provided that enables security analysts to bring their system devices into full compliance with the PCI Standard.

The PCI Data Security Standard is the global standard adopted by companies in the credit card industry to ensure the protection of customer information. According to the standard, all members, merchants, and service providers that store or process credit cards must meet specific security requirements, which necessitate building a secure network and maintaining a vulnerability management program.

The MasterCard SDP Program provides merchants, service providers and acquirers with easy access to the security vendors that it has recognized as qualified and compliant by maintaining a list on its Website. Rapid7 is on the MasterCard SDP Program's list of approved security scanning vendors at http://sdp.mastercardintl.com/vendors/vendor_list.shtml

About NeXpose

NeXpose enterprise vulnerability management scans devices, systems, software and Web server applications to locate threats, assess their risk to the environment, devise a remediation plan and implement the ticketing process. With its expert system, NeXpose builds a knowledge base of facts on the environment it's exploring and models potential targeted attacks to expose all existing threats. NeXpose provides reporting capabilities that ensure compliance with governmental regulations and corporate security configuration policies.

About Rapid7

Rapid7 was founded in 1999 by a team of software industry veterans who were major contributors to product development and subsequent growth and success at Percussion Software, Bond Technologies and Stride & Associates. Rapid7 launched NeXpose, its enterprise vulnerability management software, in 2001. Since introduced, NeXpose has been sold to over 130 organizations in the U.S. and abroad. Rapid7 sells NeXpose to corporate enterprises, Global 2000 companies, and government entities, and serves the full range of vertical markets.

Rapid7 is headquartered in Boston, MA, with offices in California and the United Kingdom. For more information on the company and its product, NeXpose, visit http://www.rapid7.com .

Contact: Beth Bryant 617-926-3013 Email Contact