Rapid7 Launched New Threat Intelligence Engine

The platform aims to shift network defense from reactive monitoring toward proactive threat prevention.

Updated on Oct. 2, 2026 in Cybersecurity

Bold flat-color editorial illustration showing an abstract modular geometric structure, symbolizing cybersecurity threat detection systems. — Rapid7 launched its new intelligence engine, a threat detection platform designed to proactively prevent malware attacks targeting network-edge infrastructure. AI Illustration. Upload story photo >

Live Poll

Do you trust that modern cybersecurity tools are keeping your personal digital data secure?

Rapid7 has officially released its new Rapid7 Intelligence engine, a platform designed to monitor and validate security threats in real time. The launch follows the firm’s identification of a modular Linux malware ecosystem specifically targeting telecom and network-edge devices.

Why it matters

By correlating shared malware behaviors across its network, the platform aims to shift enterprise security postures from reactive monitoring toward proactive prevention. This development addresses the growing complexity of campaigns targeting critical infrastructure.

The engine processes telemetry from Rapid7's 11,500 global customers to identify patterns in malware like BPFDoor variants, BPF Rekoobe, and AVERAT implants. This intelligence identifies campaigns by correlating behavioral data against the company's 13-year threat research legacy.

The players

Rapid7

A Boston-based cybersecurity firm specializing in vulnerability management, incident detection, and threat intelligence for over 11,500 enterprise customers.

Rapid7 Labs

The research division of Rapid7 that maintains a 13-year repository of vulnerability data and malware analysis.

The details

The engine operates by analyzing behavioral patterns rather than relying solely on signature matching, which often misses evolved threats. It specifically tracks modular Linux malware targeting network-edge hardware, including BPFDoor — a sophisticated backdoor that uses BPF (Berkeley Packet Filter) to intercept network traffic without alerting standard security logs. By detecting these components together, the engine aims to flag unauthorized network edge access attempts before they fully compromise the device.

Q2 2026: Rapid7 tracked 8,539 critical vulnerabilities.
October 2, 2026: The Rapid7 Intelligence engine was officially launched.

The Tech Race

This development places Rapid7 in direct competition with automated threat intelligence providers seeking to neutralize modular malware before deployment. The platform follows an industry-wide push to automate the defense of network-edge devices against BPF-based Linux malware tactics.

Enterprises can now leverage this engine to automate the detection of advanced Linux-based threats that previously required manual investigation. The platform integrates into existing defense stacks for current customers to prioritize remediation based on real-time campaign tracking.

The takeaway

The engine highlights a shift toward behavioral correlation as a primary defense against modular malware. Interested organizations should monitor the platform's performance in flagging BPFDoor and AVERAT variants over the next quarter.