Tenable Nessus Room for Improvement
Owner at a tech services company with 1-10 employees
The price could be more reasonable. I used the free Nessus version in my lab with which you can only scan 16 IP addresses. If I wanted to put it in the lab in my network at work, and I'm doing a test project that has over 30 nodes in it, I can't use the free version of Nessus to scan it because there are only 16 IP addresses. I can't get an accurate scan. The biggest thing with all the cybersecurity tools out there nowadays, especially in 2020, is that there's a rush to get a lot of skilled cybersecurity analysts out there. Some of these companies need to realize that a lot of us are working from home and doing proof of concepts, and some of them don't even offer trials, or you get a trial and it is only 16 IP addresses. I can't really do anything with it past 16. I'm either guessing or I'm doing double work to do my scans. Let's say there was a license for 50 users or 50 IP addresses. I would spend about 200 bucks for that license to accomplish my job. This is the biggest complaint I have as of right now with all cybersecurity tools, including Rapid7, out there, especially if I'm in a company that is trying to build its cybersecurity program. How am I going to tell my boss, who has no real budget of what he needs to build his cybersecurity program, to go spend over $100,000 for a tool he has never seen, whereas, it would pack the punch if I could say, "Let me spend 200 bucks for a 50 user IP address license of this product, do a proof of concept to scan 50 nodes, and provide the reason for why we need it." I've been a director, and now I'm an ISO. When I was a director, I had a budget for an IT department, so I know how budgets work. As an ISO, the only thing that's missing from my C-level is I don't have to deal with employees and budgets, but I have everything else. It's hard for me to build the program and say, "Hey, I need these tools." If I can't get a trial, I would scratch that off the list and find something else.
I'm trying to set up Tenable.io to do external PCI scans. The documentation says to put in your IP addresses or your external IP addresses. However, if the IP address is not routable, then it says that you have to use an internal agent to scan. This means that you set up a Nessus agent internally and scan, which makes sense. However, it doesn't work because when you use the plugin and tell it that it is a PCI external, it says, "You cannot use an internal agent to scan external." The documentation needs to be a little bit more clear about that. It needs to say if you're using the PCI external plugin, all IP addresses must be external and routable. It should tell the person who's setting it up, "Wait a minute. If you have an MPLS network and you're in a multi-tenant environment and the people who hold the network schema only provide you with the IP addresses just for your tenant, then you are not going to know what the actual true IP address that Tenable needs to do a PCI scan."
I've been working on Tenable.io to set up PCI scans for the last ten days. I have been going back and forth to the network thinking I need this or that only to find out that I'm teaching their team, "Hey, you know what, guys? I need you to look past your MPLS network. I need you to go to the edge's edge. Here's who you need to ask to give me the whitelist to allow here." I had the blurb that says the plugin for external PCI must be reachable, and you cannot use an internal agent. I could have cut a few days because I thought I had it, but then when I ran it, it said that you can't run it this way. I wasted a few hours in a day.
In terms of new features, it doesn't require new features. It is a tool that has been out there for years. It is used in the cybersecurity community. It has got the CV database in it, and there are other plugins that you could pass through. It has got APIs you can attach to it. They can just improve the database and continue adding to the database and the plugins to make sure those don't have false positives. If you're a restaurant and you focus on fried chicken, you have no business doing hamburgers.View full review »
- Add the possibility to customize attributes that define the assets critical level based on the company's "business sense".
- Improve integration and tests for OT platforms, OT application, OT hardware, and non-Ethernet protocols.
- Improve the exchange of info/insights/attributes with RM (Risk Management) domain.
- Offer a more flexible strategic and high-level dashboards based on previous comments (minus technical and more business-oriented)
- Model OS costs (and its segregation schema for individual modules).
Some of our customers are operating on the cloud as well as on-premises.
We would like to have the option of using the solution for the cloud as well as on-premises with the same license at the same time. That would be very helpful.View full review »
VP - Risks, Audits & InfoSec at a tech services company with 501-1,000 employees
In terms of what could be improved, I would say its reporting portion.
Additionally, we have the on-prem version, but sometimes we want to have an on-cloud deployment as well for certain projects, although not so many. The people who used it on cloud didn't find it as good as the version they were using on-prem. Overall, the cloud version could be improved.View full review »
Vulnerability Management Analyst at a financial services firm with 10,001+ employees
It wasn't very clear how the scripts are running the scans. There's information about the script but it's not straightforward. The script information for each of the plugins should be available, but it doesn't give us straightforward direct information about how it was executed. That needs to be more clear.
We find that the solution causes several issues due to the fact that it runs even before it calculates, the asset in prevention.
I can't think of any features that are lacking.View full review »
IT Security Operations Analyst at a manufacturing company with 10,001+ employees
The only thing that I don't like is KBs information. For example, if we scan our workstation and you go to the results report that Nessus provides, we are going to see a lot of KBs as remediation. But in most cases, the KBs are always superseded.
Also, we are not able to apply those because Microsoft has already released a new TB.
Nessus is not doing a good job in updating its remediation section of the reports.
Remediation needs improvement. They are providing a lot of superseded KBs as remediation.
For example, when you share that with several team members or with one individual, and you ask them to work on this, they reply with Microsoft already has something new.View full review »
The solution should have a more in-depth level of scanning, with features to meet the developers. Other points that should be addressed involve the understanding of issues by the users and the need for improvising the reporting structure. The reports should also be more attractive and user-friendly.
This is how Tenable Nessus occasionally works when drawing up something on the field.
Additional features I wish to see addressed in the next release include customer support and ease of understanding of vulnerabilities and how they can be fixed.
In contrast to Tenable Nessus, we have found Veracode to be more user-friendly, with a greater in-depth understanding of the details and how things can be fixed. Other points in its favor include study cases, customer support, training and e-learning.
The solution is sort of down the mid range, so we are more happy with Veracode.
Cybersecurity Manager at a manufacturing company with 10,001+ employees
I think there's still some things that need to be ironed out to ensure that we can have a one-stop shop to do both ACAS, SCAP automated assessments in. We've been trying to do that and they say you can, the capability is integrated into the system. But in most instances, especially when you're dealing with some systems that are standalone or a network that we built ourselves, we find that some devices aren't pinged and the scans aren't done properly. That also comes down to the hardening of the systems where the password or the privileges weren't taken, so therefore it didn't do the scan properly.View full review »
Senior Consultant at a tech services company with 11-50 employees
We'd like to see more integration potential within the solution.
They tend to do a new release every quarter, and will ultimately continue to add more features.View full review »
The price could be improved. They need more flexible pricing.
If they had a very creative idea, maybe they could add a special feature. Even extending functions, or exploring new areas. If they were able to integrate it with the existing solution, that would be fine.
I would like to see more integrations, more ideas or services, and functions offered.
It's about wider functionality and not a question of integration. It's more a question of, creativity. If they have other ideas such as what could be added to the vulnerability management.View full review »
Chief Hacking Officer at a security firm with 1-10 employees
The reporting interface is in need of improvement. The reports are okay, but the interface is a bit difficult to navigate in some cases.
Nessus is not very good at identifying web application vulnerabilities, which means that we need to buy another product like Acunetix or EMC Networker to handle that part. This is an area that could be enhanced because we would prefer to have these capabilities in one application.View full review »
Manager Information Security at a financial services firm with 51-200 employees
In terms of what could be improved, I would say that the reporting feature needs to be improved.
Additionally, although it has the features, the enterprise edition is very limited. They need to add multiple reporting features in the enterprise edition.View full review »
CSSP Manager at a tech services company with 51-200 employees
The reporting is a bit cumbersome.
A lot of times you have got to, if you want to test things, go in and then back all the way out, and then try something else, and that just becomes cumbersome.
The testing functionality could be better.
The way they had set up the scan sometimes is difficult as well. It's partly due to how it's set up where I am. It's not necessarily a Tenable thing, however, the user, how they assign users and roles, is strange. Sometimes if a coworker sets up a scan, I can't start it or stop it. That's just something that may be an issue on our set-up and not a Tenable issue.View full review »
While Tenable Nessus is a good enterprise solution, the high price would likely make it prohibitive to smaller organizations.
We feel the licensing cost to be too high for our customers and us.
EQA's and dashboards should be addressed in the next release.
Deputy Manager at a consultancy with 501-1,000 employees
While Nessus produces good software, I would like it to allow me to better utilize my homepage. The report structures should be more gradual and effective. Also, other components, such as certain vulnerabilities and Malware detection, should better reflect on the console or dashboard. Nessus does not make this available as there is no centralized dashboard. So too, I require a cloud-based Tenable product, not the one available, which is on-premises.
We have already entered an agreement with Nessus for Tenable.io., following contact I established with South Boston.
Once a person takes part in the demo offered by Tenable.io, we are talking about, more or less, VAS software. The VAS feature is absolutely nice. We have already addressed the coming roadmap with Nessus and it will not include these features. Consequently, perhaps Tenable.io will be the next step. Users such as ourselves will definitely be looking at a different application.
While the solution is great for scanning servers, its features are limited when it comes to scanning network devices for vulnerabilities.View full review »
I have found it is sometimes difficult to control the Zoom meeting sessions. For example, it is difficult to know who is talking and when trying to mute everyone but the speaker you end up muting everyone. When using multiple screens it is laborious to find the control buttons, such as to start a session. Additionally, when a recording is done I have found it difficult to find them, there should be an easier way to retrieve them.
In a future release, the recordings should be able to be enhanced. I am not fully sure if it is the speed of the network or what the challenge is but we record our Zoom meetings and then I edit them to make them into a presentation. There are times when people are grainy, or their sound is not the best. Zoom should have an optimization option for those wanting to do recordings to allow them to receive the best experience. Alternatively, they could give tips on the best configuration settings for the highest recording output quality. For example, Is the user using the most current version of Zoom, or have they blocked out the background noise.View full review »
Currently, they don't have all of the features that I am looking for. I am looking for a technology that installs agents into the machines to perform complicated scanning. That's a good feature that I'm looking for.
Our issues are not all due to Tenable Nessus; we have more than one console that we administrate.View full review »
Director at a tech services company with 11-50 employees
The price could be reduced.View full review »
The solution could improve by having better integration with different vendors' IPS solutions. The ACLs and IPS policies signatures should be enabled based on the results of Tenable Nessus automatically, we currently have to do it manually which is very time-consuming. It has done a good job integrating with Fortinet but we would like it to be better integrated with other solutions that we have. Additionally, After Tenable Nessus was able to recognize the vulnerability it would be great to have it virtually batch the systems if you are not able to update the different systems.View full review »
Information Technology Security Specialist at a tech services company with 201-500 employees
Some things in the user interface could be better. The user interface could allow more adjustments to plugins. The price could also be better.View full review »
Founder & CEO at a tech services company with 1-10 employees
I'd like to see a dashboard for this product because the report for counters is too simple. There needs to be something better for the client.View full review »
Cyber Security Engineer at a manufacturing company with 5,001-10,000 employees
Unfortunately, the solution consumes more system resources when it's being run and I'd like that to be reduced.
The solution should be able to support more devices.View full review »