What you are evaluating
The family spans information technology, cloud, operational technology, identity, and attack-surface modules plus third-party connectors. Entitlements, connector fidelity, and permissions for automated actions are separate from the platform name.
A useful evaluation context
A plausible evaluation context is an estate that already uses Tenable scanning and wants to test whether identity, cloud, operational technology, and external-surface connectors complete the asset picture.
Documented capabilities
The vendor describes these capabilities in the linked sources. Availability depends on the product edition and supported environment.
- Combines vulnerability, web application, identity, cloud, operational technology, and external-surface exposure signals in one exposure view.
- Adds attack-path context so chained conditions can be inspected alongside individual findings.
- Ingests third-party connector data so coverage is not limited to Tenable-origin scans.
Where it fits in the work
- Authorize discovery only against owned assets, then collect authenticated or agent assessments together with any entitled cloud, identity, and external-surface sources.
- Review findings with attack-path context while keeping CVSS, EPSS, KEV, reachability, and business impact visible as separate fields.
- Assign owners, record compensating controls when a patch is deferred, and re-assess after the change window.
APPLY THE IDEA / ILLUSTRATIVE EXERCISE
Make the outcome observable.
In an isolated lab network you own, plant an outdated package on a Linux image, an identity misconfiguration, and a stale public DNS record on a domain you control. Connect only entitled Tenable One sources to that lab.
Evidence to look for
The planted host, identity issue, and authorized external record appear with enough separate severity, exploitation, and reachability evidence to reproduce a human priority decision, and a patch or control plus re-assessment closes the finding.
Use synthetic data and an authorized test environment. Agree the scope and recovery steps before enabling enforcement.
Questions for your evaluation
- Which connectors match the actual configuration database, identity, cloud, and operational-technology sources, and how is mismatch visible?
- What safety controls exist for operational-technology assessment, and who authorizes those scans?
- Can operators explain why an automated action fired and which permissions it required?