What Is Metasploit? A Defender's Guide for Businesses

Written by Ruben Selby, founder and penetration tester at Wolfcore. Last reviewed 8 November 2026.

In one sentence: Metasploit is a toolkit that packages known attack methods into reusable modules, so a security tester can show whether a weakness is really exploitable and an attacker can do the same thing without permission.

Part of our Security tools library.

This page explains what the tool is and what it means for your business. It is not a how-to and it contains no attack steps.

What it is

Rapid7’s documentation describes the Metasploit Framework as a Ruby-based, modular penetration testing platform that lets you write, test and run exploit code. It is also described as an open source pen testing and development platform. Rapid7 sells a commercial edition, Metasploit Pro, which adds features that are not in the Framework: a web interface, task chains, social engineering campaigns, vulnerability validation and integration with its vulnerability scanner.

Like most security tools, it is neutral. A tester working under a written agreement uses it. A criminal could use the same Framework. That is why defenders should know what it does.

How it works

Rapid7’s documentation explains that every task is defined in a module. Module types include:

Exploit: code that targets a specific vulnerability to give access to a system.
Auxiliary: modules that do not deliver a payload, such as scanners and fuzzers.
Post-exploitation: modules that gather more information or extend access after a system is compromised.
Payload: the code that runs after an exploit works.
Encoder and NOP generator: helpers that shape how a payload is delivered.

A typical authorised workflow, as the documentation outlines for Metasploit Pro, is to discover which hosts and services exist, match them against known weaknesses, validate that a weakness is real and report the result. The documentation also lists Metasploitable 2, a deliberately vulnerable practice target, and a feature to skip fragile devices during testing. That second feature matters in factories and hospitals, where an old device can fall over if probed.

What it does not do: it does not find unknown bugs on its own, and it does not replace a person who understands your business. A tool works with what is already known. This is why Wolfcore treats tools as support for a tester, not the test.

Who it affects and how badly

Sole trader to 10 staff: unlikely to be targeted by a specific tester, but old unpatched software is easy for anyone to try. Worst case: one unpatched device and a ransomware infection.
10 to 50 staff (accountancy, legal, trades, estate agents): most often meets the tool through a client’s security test or an annual pen test. Worst case: an exploited missing update on a server.
50 to 250 and 250 plus (manufacturing, healthcare, schools, councils, fintech and insurance): more systems, more old devices. Worst case: a known weakness on one device becomes a route to a wider network, with downtime and a personal data breach.

The same exposure applies in the UK, EU, US and Armenia.

Real examples

This entry names no organisation, because Metasploit is a tool, not an incident. For real incidents where published weaknesses were used against organisations, see cisa-kev and zero-day. Rapid7’s own documentation shows how scanners, exploits and post-exploitation steps are packaged for reuse, which is why a weakness that is published and fixable is easy for anyone to try.

The UK angle

The NCSC defines penetration testing as a method for gaining assurance in the security of an IT system by attempting to breach some or all of it, using the same tools and techniques as an adversary might. Its guidance adds three points that matter to a buyer. First, the quality of a test is closely linked to the abilities of the testers, so a tool-only test is a poor substitute. Second, a test can only confirm that systems are not vulnerable to known issues on the day of the test. Third, the NCSC recommends that HMG organisations use testers and companies within the CHECK scheme. That recommendation is aimed at government bodies, so private buyers should ask what accreditation and experience a supplier can show.

The ICO’s guide to data security says the UK GDPR requires you to test and evaluate your security measures regularly, lists penetration testing as an example, and says you should document the results and act on them.

How the framework is used in a test

Worked example (an illustration, not a real client)

A 60-person manufacturer has its annual pen test. A scanner reports that an old server “may be vulnerable”. That is a guess. The tester validates it inside the agreed scope, using a framework module, and shows the weakness is real and reachable from the office network. The report then says what an attacker could reach and what to fix. The same test skips a fragile production controller, as the scope says. The cost of fixing is a patch window. The cost of ignoring is the same weakness found by someone else, with the production line stopped.

How to detect it

Keep logs from firewalls and servers and review unusual outbound connections from servers, especially to unfamiliar addresses.
Use endpoint protection with behaviour monitoring, not signature-only scanning. Rapid7’s documentation itself lists features aimed at evading detection, so signatures alone are not enough.
Alert on new services, new admin accounts and unexpected remote sessions.
Watch for repeated failed sign-ins from one internal host, a sign of password guessing.
Know when an authorised test is scheduled, so you can tell it from a real attack.

How to fix or prevent it

Patch promptly, starting with internet-facing systems and anything on a published exploited list.
Remove services you do not need, and close ports you do not use.
Segment the network so one device does not reach everything.
Use multi-factor authentication on remote access and admin accounts.
Run endpoint detection with alerts that someone reads.
Commission a scoped test with a written agreement, and act on the report.
Re-test after fixes.

Frequently asked questions

Is Metasploit illegal to own? Rapid7 describes it as an open source penetration testing platform. The problem is using any such tool against systems without written permission.

Does Metasploit find new vulnerabilities? No. It packages known weaknesses into modules, and the NCSC notes a test only shows you are not vulnerable to known issues on the day.

Is a test run only with a tool good enough? The NCSC says the quality of a penetration test is closely linked to the abilities of the testers.

Back to the Security tools hub.

Sources

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. Start with the free web vulnerability scan at https://wolfcore.co.uk/free-web-vulnerability-scan/ and read about penetration testing at https://wolfcore.co.uk/services/penetration-testing/.

What is Metasploit? A defender’s guide to the penetration testing framework