Tenable Security Center Reviews

The reporting vulnerability is very helpful when you link it with the people who close it with the admin and support team, giving them the criticality to find how to close each item.  And it's up to date with all the vulnerabilities on the market thanks to prompt updates from the cloud.

In the next release, we would like to see the inclusion of external IPs and simplified reporting that's easier to deal with.

We have been using this solution for about two years.

The solution has been very stable up till now. I would give it nine or 10 out of 10 for scalability

For our size, it's scalable. It covers all the bank infrastructure and all that we have.

Two or three people from the security team manage the solution, but they extract it for the IT team to take action in different areas, including infrastructure and domain support. So 10 or more people assess the reports to fix the issues.

We are happy with the support from the Tenable side. But sometimes the vendor's people move between areas too often, causing occasional shortages on technical issues inside the country. When you raise tickets, the vendor sometimes takes some time to respond, but they are always helpful. 

Positive

Previously we used Rapid7, but we switched after comparing it with the solution because it had some additional features that we needed.

Overall, the initial setup was smooth and easy. Later we had to integrate it with other solutions in the system, but it didn't take long.

We had a consultant for two weeks at the beginning but in the end, we completed it, doing most of the work ourselves and gaining valuable experience. And, of course, we had to set up our systems inside the bank and the structure of the scope of the vulnerability, so that made it about a month.

Four people were involved in the deployment, two from the vendor and two from our team.

We're happy with the licensing cost and find it affordable.

We paid for three years, mostly for the finances and sourcing, but all features are inclusive.

I would rate our licensing cost as eight on a scale of one to ten.

I would give the product an overall rating of nine out of 10.

The product is a very good solution. I would advise potential users to look at other solutions. The product is our second solution, and we are happy that it meets our requirements.

Our primary use case is compliance for our audits, for our customers. We were exposed in that we were not meeting contractual obligations.

We are monitoring our infrastructure: servers, switches, storage, routers, SAN storage, operating systems, and applications to the extent that the tool is able to see into them. We use it to hit the high ones like Adobe or Microsoft Office and the like. Some of the more niche products that we use may not be in their inventory of vulnerabilities.

It helps us prioritize based on risk and it also helps us prioritize manpower, to show we are getting the most value from the limited number of man-hours that all organizations face. We have the same problems: Where do we need to focus? Where do we need to focus money? And where do we need to focus additional expertise that we don't have or didn't think we needed.

Overall, we use it as a third-party — I don't want to say settle arguments — but as an expert opinion as to what is a true vulnerability is, versus what is something that isn't as high of a priority. It takes opinion — if two cybersecurity people are arguing or discussing if this thing is more important than that thing — and, since Tenable is not invested in our company, gives the best practice. It is very valuable in that sense.

In terms of cyber exposure, it allows us to centralize both vulnerability management and visibility. We have one place to look instead of going through: Okay, we're using the Microsoft tool, and now we're going to go use the Cisco tool, and now we're going to go use the Red Hat tool. It allows us to centralize and easily correlate all data together, and then use the prioritization or just understand where the gaps in our security posture lie. That's more valuable than saying, "Okay, here's this report for Microsoft, and now we're going to print out a report from Red Hat, and we're going to print out a report from Cisco, and we're going to print out a report from NetApp, and we're going to put them all together and then we're going to discuss it." Having it in a single view is very valuable to us in that it saves us a lot of time.

Tenable also helps us to focus resources on the vulnerabilities that are most likely to be exploited. And since it is continuously updated, it allows us to reevaluate quickly if there are new vulnerabilities found, versus ones that we're already working off and are already known to us.

And since cybersecurity and IT security are not a fix-it-and-forget-it scenario — it's a continuous process — having a tool like this, especially one that is continuously monitoring our environment, is very valuable. It's not that we're not doing this once a year, we're not doing this once a quarter. We're doing this every day.

Finally, the solution has reduced the number of critical and high vulnerabilities we need to patch first.

The continuous monitoring piece has been very valuable to us. 

The vulnerability priority setting in the software has been very useful to us as it allows us to focus on what's most important. We use it as a piece of our holistic look into our security stance.

The predictive prioritization features are pretty good. They do a lot of research and we trust the research that they do internally. They have knowledge of what's going on with many companies, where we only get a view into what's going on here. So the ability to get best practices out of them as part of this solution, is valuable to us.

The Vulnerability Priority Rating is also pretty good. It's a much more holistic view, instead of being very binary, which we tend to see. It lets us focus on what's most important to us, especially because it goes across many products that we have. It's good in that we see how each of these stacks up and where our priorities should be. Should they be in Cisco, should they be in Microsoft, should they be in Linux? That's very useful to us as well. We'd love to do all the work right now, but we have to pick some type of priority in terms of what we're going to focus on, before we focus on the less vulnerable items.

Using the product — especially very early on — even though we have things like prioritization, it can be a little verbose in that there's a lot of information being streamed out of the reports. What would be nice, and maybe we just haven't found it, would be more of an executive-type view. We still expect it to collect all this information, but we would like a feature that would allow us to show it to an executive or a director or someone like that and give them some type of high-level overview but not get into the nitty-gritty.

We started using this iteration of it two years ago, but we had been a previous customer of theirs as well.

We haven't had any problems with it. It seems stable. They make changes to it regularly, to both the vulnerability database and the product itself. They seem to be going through with a reasonable update path and they support previous versions for the expected amount of time.

We haven't seen any crashes or spikes.

It scales just fine. We're a Fortune 500 company so, obviously, we have very large networks here. As far as we know, it should scale. We don't think we can outpace the scalability of it. There are best-practices that we need to follow, but will this product be able to meet our needs for future growth. We expect it to be able to handle that.

Usage will be increased. There are two parts to the business. There's the business that is our overall corporate business, which is covered 100 percent by the solution. And then there's the manufacturing and design business. On that side, the solution is still growing. We have two contracts with Tenable for their SC product.

We think technical support is pretty good. We have specific needs as defense contractors and they're able to meet those. We have a good account team. We have a customer success manager, Ryan Zentz, and we have a good account executive, Scott Mahan, and they do as much as they can to head off any issues that we have, instead of putting in a ticket or getting something escalated. They do a good job of helping us.

We previously used their lower version of security management. It was their single-install product, Nessus. We were using the standalone, non-enterprise version.

The solution would be fairly simple, but because of our implementation it was fairly complex and we hired Professional Services to do it. We're not a typical example. As a straightforward install, I think it would be very easy. But because of our size and scope, it was a little tricky.

We have multiple deployments so we hired Professional Services for two weeks to do them. Some installations were done in a few hours and some of them took a few days. But, overall, we hired ten days of Professional Services.

We were focusing on installing first in our non-production environments; getting familiar with the installation, the capabilities, and what the overhead of the product was going to be on the network. From there did some testing and ran that through some discussion and a panel of in-house experts and decided that we would be good to go forward with production. 

We then repeated that, where we would install in a small section of production, run a test to make sure that it didn't break anything or that it didn't cause undue harm. And then we went forward with expanding it out.

Now we have a process in place for installing for any new section of the network that comes up or any new infrastructure that we put together. It's a little easier for us to handle now that we're not tackling the big network. We're just handling delta changes over time.

We used their in-house professional services. Our experience with them was good. They had someone onsite and who was well-versed in the defense industry. He was able to get it installed and answer our questions. We didn't have any problem with him. We liked him so much that we brought him back for another week.

Having Tenable is a requirement. It is a compliance piece which is part of our business. But it is money well-spent in that it focuses us to work on problems that are prioritized and it allows us to cut down on the manual integration of multiple reports from Microsoft and Linux, etc. It does save us considerably in that we can have less staff assigned to it, versus having a Linux team and a Windows team and a NetApp team, etc.

Running with a much smaller team of two people probably saves 80 percent of manpower. I would assume that the team would be ten people or so if we had to mash together multiple reports and spend time doing that.

I don't know our licensing costs but they're in the seven figures. We have an enterprise license, so I believe everything is tied up in that. We do not have any additional cost other than our large enterprise license.

The licensing is a little involved from both sides. That may be due to our specific implementation of it because we are a defense contractor. I feel we rely a lot on their customer service and they rely on us to do a lot of manual labor to get licensing installed or to get licensing. If there were some type of smoother transaction, that would be great.

I would like more self-service in the granting and rescinding of SC licenses, and that way we wouldn't have to be involved with customer service as much or with our account executive.

We did two sets of white papers looking at the competition. We did a white paper in 2015 and another one in 2018. We selected Tenable after the 2018 white paper was written.

Between 2015 and 2018, the market had contracted considerably. Many of the products that we evaluated in 2015 had either been bought out by a competitor or just no longer existed. When we looked at it in 2018, Tenable had the strongest pedigree. They also had the ability to scale the deployment, versus some of the other products. 

We looked at Ivanti, which really wasn't designed for vulnerability management; it was a bolt-on. We looked at Qualys. That was too heavy-handed. It was a good product, but there was too much overhead in managing or maintaining that product.

Tenable was the best fit for our needs. Tenable is also the provider for the ACAS solution for the US government. Since the vast majority of our customers are government customers, and our auditors are government officials, it was seen as an easy way to get past an audit, or at least that we would be looked upon favorably.

We did not test any of the competitors. We had done some tests in 2015, but again, many of those competitors were no longer in business or they had been bought out. The other product that made it as a finalist was Qualys, but there was a significant commitment and infrastructure needed. We felt that if that was the minimum just to get it tested, then it was not going to work for us on an enterprise scale.

Go in with open expectations. Companies don't realize how big their infrastructure really is before they can get a single pane of glass view, which Tenable provides. Don't be disheartened when you run that first scan. It is a process. This is not a sprint, this is a marathon. If you're not willing to invest in this for the long run, then maybe your organization just isn't ready.

I don't know how to assess our vulnerability status compared to that of our peers. The defense industry is fairly secretive about what goes on. But I think we're doing the right things. Having the licensing and the investment that we put in place puts us ahead in the industry. I can only really speak for myself, but I think that we are doing the right things, and investing the right dollar. And if our competitors are doing that, good for them. If not, I wish they would.

Security Center is generally run by either the information security manager or the information security officer. There are a few dozen people who have access to it and their roles would be two-fold: There are the lower-level, cybersecurity folks who are dealing with it on a day-to-day basis. And there are the more managerial types who would be getting reports and making decisions off of it. Lastly, the general IT staff would be using the reports or the remediation recommendations for making changes to their environment.

For deployment and maintenance of the solution we don't need that many. We had Professional Services in and we added a team of four to the Professional Services engineer to help us get it stood up over those two weeks. In terms of ongoing support of the solution, we have one or two people who are tasked with updating the vulnerability database and verifying scans and the like. But it's not overly burdensome. They are information security officers or cybersecurity specialists.

I would rate Security Center at eight out of ten. First, it's a little heavy-handed for us from a licensing perspective and second, there are some features and functionality that we'd like to see in the future which would make it more user-friendly for non-technical or more managerial types. It seems that the product is really written for technologists, especially on the reporting side.

Tenable Security Center is aimed at IT environments. It can receive vulnerability information from Tenable OT and integrate it into a unified report covering both IT and OT environments.

The BPR prioritizes vulnerabilities. The ARCs and compliance reports are very helpful in complying with regulations and standards.

The valauble feature is compliance reporting system.

It does not natively support industrial protocols needed for OT environments. The reporting system is very powerful, though it could be more user-friendly for creating custom reports.

I have been using Tenable Security Center as a partner for five years.

It's very stable.

I rate the solution's stability an eight out of ten.

We cater the solution to medium and enterprise. We haven't seen issues with scalability.

I rate the solution's scalability an eight out of ten.

Deployment takes probably a couple of days. it can either be done for one person.

It requires the installation of its tools and console server, which can be either virtual or physical. You need to activate the licenses and update the tool for the latest plugins. Typical deployments may involve multiple scanners linked to the main console, depending on the customer's network. Additionally, customers might need to deploy agents which require a separate Center manager machine. While, there is a lot to set up, it can be done within a couple of days.

I rate the initial setup an eight out of ten.

It's very affordable.

Continuous monitoring is essential because new vulnerabilities are discovered every day, and even existing vulnerabilities can evolve. As new malware emerges, a vulnerability that seemed minor today might become critical tomorrow. The malware, and malicious activities are constantly changing. 

We cannot rely solely on the hardware or servers required to run Tenable Security Center because it is an on-premise solution.

It provides essential tools for vulnerability management and operates on-premises. This allows customers with requirements or audio restrictions to run Security Center on their premises. Additionally, the reporting system is highly advanced, and the compliance dashboards are extremely useful for meeting regulatory requirements. For example, banks and financial institutions prefer Security Center due to its robust reporting capabilities and on-premises operation.

I advise them to look into Tenable Security Center instead because it not only provides vulnerability management but also include other modules of Tenable, such as Tenable Identity, Tenable Cloud, etc. This allows for a single pane of view for the entire company, covering more than vulnerabilities and offering a comprehensive.

Overall, I rate the solution a nine out of ten.

We use the product as a security tool for VMs and web applications.

The product could be user-friendly, and they could enhance the web application's security features.

We have been using Tenable Security Center for a year.

It is a stable product. Our customers utilize just one security center due to the scope of the budget. It doesn't have any adverse effect on the business.

Tenable Security Center on the cloud side is preferred in larger enterprises, but Nexpose might be a suitable option in smaller organizations. The POC implementation for the banking sector is lengthy. I prefer cloud-based scanning for its ease and scalability.

The tickets are passed quickly. Their support manager works proactively in scheduling meetings and solving the issues with the team. They provide the best support care for the customers.

We used Netsparker and Nexpose before. We switched to Tenable SC for better pricing and efficient scanning features. Additionally, it provides features for data security and cloud usage for clients who want to avoid sending information through the cloud.

The initial setup process is simple. If the customers do not have scanners, we can complete it quickly within an hour.

Tenable SC helps us save about 20% of the price compared to Nexpose, which involves buying three different licenses.

The product helps with web application security. I advise others to use Tenable IO and NAS, especially in regions with specific data protection regulations like GDPR and PDPA.

I rate it a nine out of ten.

I use the solution in my company for vulnerability risk assessment, and we are quite happy with it.

The tool's initial configuration is not so easy. The hardware requirements related to the tool need to be better because we need a lot of memory to achieve speed in the solution. If our company needs to react at times, we need to upgrade more memory in the hardware. In general, Tenable Security Center is a very good solution according to me.

I have been using Tenable Security Center for six months. My company works in partnership with Tenable Security Center.

Stability-wise, I rate the solution an eight out of ten.

Scalability-wise, I rate the solution an eight out of ten.

I use the solution for quite a huge amount of computers in my company, and I see that its scalability is quite nice since it offers an unlimited number of scanners, so I think it's ready for big enterprises.

In the Czech Republic, the tool is mostly used by medium and enterprise-sized businesses consisting of 1,000 to 15,000 users.

I rate the technical support a nine out of ten.

Positive

I have previous experience with Tenable Security Center's competitive solutions, and now I see why Tenable is okay.

I rate the setup phase a six on a scale of one to ten, where one is difficult and ten is easy.

The solution is deployed on the cloud and on an on-premises model, but our company mainly relies on the latter.

The solution can be deployed in a few hours since you need to download the tool's initial package, which is quite big, but once it is done, the deployment process becomes really fast and can be done in 20 to 30 minutes.

I rate the solution's price as seven on a scale of one to ten, where one is cheap and ten is expensive. The tool is quite expensive.

I don't use the product for compliance support.

In terms of the product's valuable feature for threat detection, I would say that the solution's reporting overview in the dashboard is nice. The prioritization of vulnerabilities in the tool is very nice.

The real-time monitoring capabilities of the product are very useful for our company, as they help us to be more in control and interact more actively.

The tool's dashboard and reporting capabilities match our company's needs since we are able to modify the basic view to create a new dashboard, and it works out very well for our needs.

Speaking about how Tenable Security Center's integration capabilities with other tools have affected our company's security operations, I would say that I have very little experience with the integration part, but from what I can see in the product's documentation and description, it can be really well-integrated with a lot of systems, like service desk in ServiceNow and other security vendors, which is good for our company. I can say that the integration capabilities of the product are good.

I would definitely recommend the product to those who plan to use it.

I rate the tool a nine out of ten.

The product is useful for vulnerability management. The Auto-Remediate feature is good. The tool enables centralized vulnerability management.

The product should provide risk-based vulnerability management. It is a popular feature. Large environments can have a lot of vulnerabilities. We need to prioritize them for remediation. So, risk-based vulnerability management is useful for large enterprises.

I have been using the solution for almost ten years.

We don't face many challenges with the product’s stability. We have two or three issues in a year.

The tool is easy to scale. Almost 1,800 users are using the tool in our organization.

The technical support is good. When we raise the issues to Tenable’s support persons, they respond well.

The initial setup was easy. One engineer is required to deploy the solution in two hours. We do not face challenges in maintaining the product.

The tool provides competitive pricing. We pay a yearly license fee. There are no additional costs associated with the tool.

We explored other products, but Tenable was more user-friendly. Tenable has better accuracy, too.

We are satisfied with the solution. Overall, I rate the product a nine out of ten.

Our customers use the product for scanning their network for vulnerabilities.

Tenable is the leading product for vulnerability scanning. Most of the customers use Tenable in our region. The customers are happy with the product.

People do not prefer the solution for web applications. They prefer Acunetix or Netsparker over Tenable for web applications. The solution should provide better web application features and support. It could provide some add-ons to customers.

I have been using the solution for the past six months.

I rate the tool’s stability a ten out of ten.

We have 15 to 25 customers who use the solution. I rate the tool’s scalability a nine out of ten.

The support team was helpful. Usually, we don't contact the support team because our engineers do the installation. It's not so complicated.

Positive

The initial setup is easy. We have certified engineers of the product.

Two engineers are needed to maintain the solution. The time taken for deployment depends on the prerequisites of the customers. If the customers provide all details to us at the proper time, we can deploy the solution in two to three days.

The annual licensing fee of the product is $25,000. The pricing depends upon the number of IPs. There are no additional fees associated with the solution.

I am dealing with the latest version of the solution. It's a very good product to use. Overall, I rate the product a nine out of ten.

We use the solution for creating passwords and security scanning purposes.

The solution has been beneficial for our organization.

The solution serves as a good tool and is very user-friendly as well. It has many features. We are able to identify vulnerabilities in our systems, and ways to fix them with the solution’s help.

The solution is expensive. They should work on its pricing. 

We have been using the solution for six months.

It is a stable solution.

It is a scalable solution. We have eleven users using the solution in our company that include Associates and Engineers. I rate the solution’s scalability as a ten.

The solution’s tech support team is very helpful.

Positive

We have an in-house team for installation.

I recommend the solution as it is a very good and user-friendly product. I rate it as a nine.