Tenable Security Center Reviews

In our organization, we only use Nessus for vulnerability assessment. We are using Tenable.sc and Nessus as threat scanners.

The most valuable feature of this solution is the vulnerability assessment. Also, the scanning and reporting are very straightforward.

The solution needs to improve the vulnerability assessment because we have experienced some challenges with accuracy.

Tenable.sc would benefit from a more user-friendly interface for the hands-on users of the configuration assessment. It is difficult to modify the policies because they require significant expertise that regular users do not have. 

I have been using Tenable.sc for more than five years.

We have a team of four people that manage Tenable.sc on a daily basis.

Customer service and support with Tenable is good. They are knowledgeable and responsive. I would rate their service a four and a half out of five. 

Positive

The initial setup of Tenable.sc is very easy. I would rate the implementation a five out of five for ease of setup.

We implemented the solution through our in-house team.

For anyone considering implementing Tenable.sc into their organization, I would recommend that they have the proper design of the solution and the proper placement of the scanners before implementing the solution. 

Tenable is a good product, I have no concerns with it as a solution.

I rate this product a nine out of ten overall.

We use Tenable SC for internal vulnerability scans with agents, and agentless scanning in the cloud. For example, we're scanning the AMI in the cloud and making it part of the base image.

The most valuable features of Tenable SC are scanning, reporting, dashboards, and automation.

Tenable SC can improve by adding more integrations with HCI-type tools and more accurate vulnerability detection.

I have been using Tenable SC for approximately three years.

Tenable SC is stable.

The scalability of Tenable SC is scalable.

We have more than 10,000 people using this solution. We are using the solution extensively.

The support from Tenable SC is good.

I rate the support from Tenable SC a four out of five.

We previously used Qualys.

The implementation of Tenable SC is straightforward. It took us approximately two to three months to complete.

I rate the initial setup of Tenable SC a four out of five.

We did the implementation of Tenable SC in-house. We used five or six staff members for the process and we did most of it through automation. We have engineers, managers, administrators, and product managers assisting.

I would recommend this solution to others.

I rate Tenable SC an eight out of ten.

Vulnerability assessment and compliance auditing are our primary use cases. That includes baseline configuration scanning. We use it to protect everything in the enterprise environment: servers, workstations, pretty much all operating systems, networking gear. We are doing cloud and we are doing some IOT. We are not using their web application scanning tool.

The ability to view the plug-ins, the way that the plug-in library works, is really good. It's not an individual list of 80 million different CVEs. We can actually just say, "Hey, here's a plug-in," and it really helps us to boil things down. Instead of having a million CVEs, here's the specific plug-ins that are actually tying the CVE families together. That helps our platform owners, if there is an issue, to see what it is and understand better how to fix it.

Also, the fact that they display the very specific plug-in output in their details area helps our platform owners know, if there's an issue, specifically what was checked and what versions it was on at the time of the test. That's just huge. It increases the trust in the information from the tool. It cuts down on accusations of false-positives and it helps people do their job better.

It helps us to understand our cyber-exposure. At the end of the day, if you don't know what you have, then you cannot defend against it. Understanding what services, what technologies, and all those components will also give us an idea about how to predict what kinds of attacks are the things that we need to guard against in the future.

It also helps us focus resources on the vulnerabilities that are most likely to be exploited. Looking at what actually has an exploit available along with consideration of other things such as network proximity times and information about the threat - either VPR or CVSS - pulling all that together does allow us to identify pretty quickly what are the high-priority targets that we should work on.

One of the most valuable features is their distributed scan model for allotting engines to work together as a pool and handle multiple scans at once, across multiple environments. Automatic scanning distribution is a distinguishing feature of their toolset.

Also, the ability to trend data back as far back as we have disk space for, is helpful.

Finally, the ability to write custom audit files is a really helpful and useful feature. That's something that not a lot of assessment companies have gotten right. There's room for improvement, but literally being able to take the text file, open it up, and adjust the changes, write your own regex and write your own checks, is huge.

It's good at creating information, it's good creating dashboards, it's good at creating reports, but if you want to take that reporting metadata and put it into another tool, that is a little bit lacking. It does great for things for the API. For instance, if we say, "What vulnerabilities do we have?" or "How many things have we scanned?" those things are great. But if we want to know more trending stuff over time, it can create a chart, but that's in a format which is really difficult to get into another program. Integration into other reporting platforms, or providing more specific scanning program metadata, would be an opportunity.

It does have a fully-bolstered API which is available online that you can look at, but it is more aimed at getting more vulnerability information out instead of reporting information out.

We've had more problems with the underlying stuff that is running the operating system, as opposed to actually running Tenable. Tenable SecurityCenter has been pretty stable. We've only had one or two smaller technical issues. There have been other issues, but they've not been Tenable's fault.

It does have an upper limit. You can go on their website and see what their upper IP limit is.

We have seen that more and more teams want to get access to the data and get access to their vulnerability information, and it really has helped us grow our program.

Their tier-one, initial tech support is pretty bad. Their premium support is excellent. Whether premium support comes at an extra fee depends on how your negotiations go.

We migrated from Nexpose. We switched because Nexpose is not a scalable product for an enterprise. Also, in most instances, SecurityCenter is less false-positive prone and the detection seems to be better in most instances.

The initial setup was very straightforward. In fact, for some of our teams, we've actually done - "capture the flag" is a bad word for it - but effectively that type of an activity, and they pretty much go from naked box to Tenable scanning instances within a couple of hours. It's very easy to set up.

I can safely say that it can be deployed with one person. And it doesn't require a lot of maintenance. It depends on how much you use it for, but it's mostly just set-it-and-forget-it. Then there is just the mechanical stuff of patching the box and applying system updates, but it actually does a pretty good job most of the time.

We've seen return on investment through visibility, scan stability, ensuring that we're able to assess our environment. Also, ensuring that we are able to have good confidence in the data, and that we're able to do out-of-the-box reporting and various other dashboards that really help us drive our program and help sell our case.

We evaluated Qualys. It depends on whether you want to do on-prem or in the cloud. Qualys really is a black box. You literally put this thing on your network, you can't touch it, and if you want to do something like troubleshoot, it is just not very friendly from an "if things go wrong" perspective.

Make sure that your sizing is done correctly, in terms of the hardware size. When you do buy Tenable, a lot of times you'll use Professional Services to help you implement the tool. Whatever advice Tenable has, listen to it very specifically and also talk to them specifically about what your goals are. Instead of talking tactics, talk about goals. What's going to happen is that they may say "Hey, we're going to do things slightly differently than how you used to do it," but in a lot of instances, they're going to be right.

In terms of features that we're looking forward to, VPR is one that we're going to start using more. And they also recently had a SAML integration for single sign-on. That was a new feature in 5.9.

Overall, Tenable is easily a nine out of ten. It's not a ten because there is no perfect tool out there, and Tenable SecurityCenter does have its limitations.

The primary use case is to perform vulnerability assessments across the entire network.

This solution has given us visibility of the vulnerability in our network. It also shows what needs to be done to negate the vulnerabilities by providing links to the solution for those issues. Generally, we are now able to manage our vulnerabilities better. We can identify them, prioritize them, and then negate them. It has improved our security posture.

The most valuable feature is its ability to scan for vulnerabilities in our important systems, networks devices, and so on.

The web application scanning area can be improved.

A feature that I would like to see is the ability to integrate with exploit tools. 

It's a really stable solution. So far, I have not had any issues. Once it was installed it was very stable, very few bugs. It has topped expectations.

It's easily scalable. If you are required to scan more assets then you just request for it to be expanded, such as from two thousand to five thousand. Scalability is not an issue.

The system is used by around thirty-five users including system admins, who ensure that the system is up, and the application admins who are responsible for fixing the issues that are picked up with the solution.

We use it across our entire network so we cannot expand its use any further.

Their technical support is quite good, and they're very responsive. If there is any issue they perform quite quickly. Also, the local partner is well versed in the solution so they give us the support we need.

We did not use a solution prior to this one.

The initial setup, including the GUI, is very straightforward.

The implementation took about three months, and then the maturation took about six months.

We have about two people for maintenance.

We were working with a local partner for the deployment.

We have seen ROI for this solution. It has reduced our security vulnerabilities. Even during the national audit, one of the findings is that this solution is helping us be more productive. We're able to find these issues before somebody else finds them. We can fix them before they are discovered by others.

The licensing costs for this solution are approximately $100,000 US, and I think that covers everything.

Before choosing this solution we evaluated Qualys Labs and Rapid7.

This is a good solution for evaluating vulnerability in the network. It gives wide coverage, and it is able to scan most platforms on the network.

I would rate this product an eight out of ten.

Basically it reviews our threat landscape vulnerability. So, we just want to be sure that we check compliance in terms of our configuration and compliance to our policies. But, the key is to make sure that we are not exposed to vulnerabilities that can be exploited. So, it's more of just securing our threat landscape.

It easily detects issues, and alarms the site.

One valuable feature is the Assurance Report Card. with the Assurance Report Card, we are able to give our overview about security posters in just a glance. And with a report to cut this we can quickly, our executives can quickly consume that without going into the difficulties of the vulnerability issue.

In terms of the configuration of the reports, there's some level of flexibility that we are not able to achieve. In terms of configuring the reports to achieve certain percentages and all of that. So, that's really the main thing I've noticed. But, apart from that, I think it's one of the best vulnerability management tools I've used, in terms of giving us the full visibility into the environment.

One to three years.

There were no crashes, or anything of that sort. The solution is stable. At times, we have had the typical bugs, but it's not something I would say is a big deal. It is maybe once in a quarter--insignificant.

I did not have any issues with scalability. This is because once you scope the main control, the Security Center box, you do proper saving on the main box in terms of storage. Initially, when we did the first installation, we did not properly size our storage. So, we quickly entered issues. But, since it was  Linux box, we were able to reconfigure and make development for additional storage. Once we did that, there has not been anything that tested the scalability. So, when the growth becomes a little high, we just add a box and provide a scanner. Then, you define the territory within which you can scan, because each scanner can be assigned to a given territory in terms of sub-nets, and so on.

The tech support was fairly good enough. I would not rate them as top-notch, but it was fairly good enough. I would give it a rating between 70-80%.

I considered Rapid7 Nexpose and Metasploit in the past.

It was pretty straightforward.

It is slightly more expensive than other solutions in the same sphere.

If you are considering a product like this, you must take into account and properly plan, scope, and scan. You need to know how to properly place your scanners and how to schedule automatic scans. You need to properly schedule your scans, so for example you don't need to scan your data center during that day when your business is most active, you can schedule your scans to run in the middle of the night, when your systems are least active.

If you wake up on LAN, then you can even scan clients during the night. You schedule wake up on LAN, your boxes are woken up on LAN, then the scanning is run, and then the boxes are shut down once the scan is over. So that's proper scoping and planning with this solution.

We use Tenable SC for compliance and vulnerability scans. 

We are fully updated in terms of the version, and we have its latest version.

Compliance and vulnerability scans are most valuable. Compliance scan helps in validating how our teams are complying, and vulnerability scan helps in future-proofing. Its vulnerability detection is accurate.

Its reporting can be improved. It is not easy to generate a scan report the way we want. The data is okay, but we can't easily change the template to make it look the way we want.

I have been using this solution for about two years.

It is stable and reliable, but it also depends on the on-premise resources.

It is easy to scale. It is currently being used by a few people in our company.

We sometimes took support from Tenable when we had issues with the scans and we couldn't get the results. They were helpful. It is easy to get support.

It is easy to set up. We need to set it up from the appliance.

We can do it on our own, but we sometimes need help from the vendor.

Its maintenance is done from our side.

It is a bit expensive. Everything is included in the license.

It has been good so far. I would rate it an eight out of 10.

The solution is being used to assess Windows servers and ESXi servers, and VMware ESXi.

The most valuable features of the solution are the dashboards and speed of the test.

Tenable.sc is user-friendly.

The user interface can be improved.

I have been using Tenable.sc for a month.

The solution is stable.

The solution appears to be easily scalable.

Previously to using the solution the organization used Tripwire. The switch was made because Tripwire was not being updated often, the reporting was very bad, and the support was no good.

The initial setup was easy and took only two weeks to deploy.

The implementation was done through a consultant.

For 500 users the licensing fee is roughly $100,000.

I rate Tenable.sc nine out of ten.

The solution is a vulnerability scanner that helps us check if we are covered on the audit and compliance aspect. It provides us with critical alerts in case we encounter any vulnerabilities. The tool also helps us with patching. It also gives us notifications whenever certificates like SSL expire.

The tool provides us insight into the happens of the network and its hosts. It provides me with a list of hosts. 

The product gives us reports whenever we setup a scan. 

The solution needs to improve its support. I would like to see a bird's eye view of my network architecture. I would also like to see the continuous view feature in the tool. 

The tool is pretty stable. I would rate it a ten out of ten. 

I would rate the tool's scalability a nine out of ten. My company has two users for the tool. 

I wasn't part of the tool's initial deployment. However, when we had to install the upgrades, we had to do the deployment all over again. The tool's deployment was easy. 

We have seen ROI with the tool's use. 

I would rate the tool a seven out of ten.