Tenable Vulnerability Management Reviews

I use Tenable Vulnerability Management to scan the network, including servers and endpoints, to identify risks in our environment and provide mitigation and solutions. I also use it to assess our security posture through asset discovery and risk identification.

Tenable is user-friendly and excels in reporting. It allows me to easily fetch and schedule reports. The software's discovery feature aids in strengthening our security posture. The single-sensor installation process on various operating systems is smooth, unlike Rapid7, which requires different versions for separate systems. Furthermore, Tenable enables vulnerability management through potential AI integration that consolidates efforts and resolves multiple vulnerabilities simultaneously.

Before, we built the assets on Tenable.sc and scanned them for asset discovery. Now, we are deploying Nessus Agent into all the machines. We have written the script, which is automatically deployed on the VM or the cloud. Previously, we could not identify the workstations that were offline for a certain period. With Nessus Agent, we don't have that problem. It increases our efficiency.

Nessus Agent is the best feature. When we scan the environment, the vulnerabilities are discovered. The integration of Tenable into our security ecosystem was very good. There were no complications. We integrated it with different tools like ServiceNow and SharePoint.

We don't have a specific use case. My primary purpose for using Tenable is to conduct survivability tests, mainly to determine whether the system crashes, particularly when subjected to DOS attacks. I do not use it for more than that because, for other aspects, we have manual VAPT procedures in place.

Currently, I have only used Tenable for DOS attack-related purposes and thus, I am not fully acquainted with its other features. However, it provides survivability benefits. It helps me understand if the system is capable of withstanding certain levels of stress. Though it's not core technical security testing, it provides us with survivability insights.

We help clients with their overall cybersecurity assessment. Many start with free tools like Nessus, but eventually require more comprehensive solutions. We use Nessus and Tenable.io (formerly Nessus Professional) to scan environments and then convince clients of the value of a full Tenable.

Integrating Tenable into the workflow has improved our client's response times to critical vulnerabilities.

The notification system, including email and SMS alerts, is helpful. However, the actual response time depends on how closely clients monitor their Tenable systems. If they actively review alerts and notifications, it definitely helps their IT teams act quickly.

Considering regular use cases of the solution, we wanted to cover two things, external vulnerabilities and the ability to identify misconfigurations on the perimeter, like, let's say, if someone is open, something vulnerable to outside, we monitor it. The use case was monitoring the external parameter addresses with Tenable.io and seeing changes there. If something changes or if something becomes vulnerable, as it's seen from the outside, without actual credentials to scan, you know, like, we can have several layers of scans. So, Tenable.io, we used as seen outside without providing any credentials, So it

gives you the true picture of how and what the attackers can use. It might be that if we use it with the credentials, we won't find additional vulnerabilities, but we don't cover that because it's not important because external attackers will not see it, actually. So, it's the first use case, and generally, Tenable.io is used for identifying vulnerabilities in the company infrastructure, servers, endpoints, and additional hardware and software, like routers, switches, and whatever has an IP address. Let's say, not for IoT, just for IT infrastructure and development infrastructure, and that was the use case of Tenable.io.

It improved basic things in resiliency, like cyber resiliency in the company, so as to not be attacked, not to be breached, or not be successfully attacked by hackers. So, it's basically a non-vulnerable state. This provided us with visibility of our actual status of where all the infrastructure is and helped to prioritize the vulnerability mitigation. It also indicates what to tackle first because you have a lot of stuff there, but you need to prioritize it. The main point here is to know how to prioritize since we never have enough time and resources to deal with fixing everything. You need to understand what to do first, and Tenable.io actually helps with that because they have additional intelligent sources to not just give you, like, CVSS because all the vulnerabilities have CVSS scores from zero to ten. So it gives you not just to always work by the score number because it just represents the vulnerability and how it can be hacked. But just take into account when you prioritize if it's a public-facing asset or computer or server or if not, or if this is now a trendy vulnerability to use and to exploit or not. Also, they have an additional score represented only in the system in addition to the CVSS score that helps you prioritize the mitigations.

We can scan manual stuff through Tenable.io. 

We have a great view to create desktops also in Tenable.io.

Regarding vulnerability management, the web application scanning is okay. The assist agents are bringing more value to the product by getting the vulnerabilities addressed early with real-time response. This is better, rather than waiting for the scans to run or something like that.

The initial setup is not complex. 

It's a stable product. 

We can scale the solution.

I use it to scan assets to evaluate vulnerabilities, define the risk, and create a resolution process for vulnerability management.

It has greatly impacted us by providing asset visibility, allowing us to know which assets have higher vulnerabilities and to calculate the risk for them. 

The return on investments is adequate since we need this vulnerability management, and without Tenable, visibility was not possible. It saved us time and improved our security.

We actually needed clarity on the vulnerabilities in our infrastructure. We used the solution to scan and make a report for us on what is vulnerable in our infrastructure and what is not, what we can improve and update, and what is good as it is.

It is a very, very user-friendly tool. To make some sense, you just need to put in your domain and click a button to scan and give you a piece of customized information about your infrastructure. It is very easy to use to schedule a scan, and it can consume a lot of CPU resources. So, you can schedule a scan between 1 AM to 3 AM, and it works very well for us.