Tenable Security Center Reviews

In our organization, we only use Nessus for vulnerability assessment. We are using Tenable.sc and Nessus as threat scanners.

The most valuable feature of this solution is the vulnerability assessment. Also, the scanning and reporting are very straightforward.

The solution needs to improve the vulnerability assessment because we have experienced some challenges with accuracy.

Tenable.sc would benefit from a more user-friendly interface for the hands-on users of the configuration assessment. It is difficult to modify the policies because they require significant expertise that regular users do not have. 

I have been using Tenable.sc for more than five years.

We have a team of four people that manage Tenable.sc on a daily basis.

Customer service and support with Tenable is good. They are knowledgeable and responsive. I would rate their service a four and a half out of five. 

Positive

The initial setup of Tenable.sc is very easy. I would rate the implementation a five out of five for ease of setup.

We implemented the solution through our in-house team.

For anyone considering implementing Tenable.sc into their organization, I would recommend that they have the proper design of the solution and the proper placement of the scanners before implementing the solution. 

Tenable is a good product, I have no concerns with it as a solution.

I rate this product a nine out of ten overall.

Vulnerability assessment and compliance auditing are our primary use cases. That includes baseline configuration scanning. We use it to protect everything in the enterprise environment: servers, workstations, pretty much all operating systems, networking gear. We are doing cloud and we are doing some IOT. We are not using their web application scanning tool.

The ability to view the plug-ins, the way that the plug-in library works, is really good. It's not an individual list of 80 million different CVEs. We can actually just say, "Hey, here's a plug-in," and it really helps us to boil things down. Instead of having a million CVEs, here's the specific plug-ins that are actually tying the CVE families together. That helps our platform owners, if there is an issue, to see what it is and understand better how to fix it.

Also, the fact that they display the very specific plug-in output in their details area helps our platform owners know, if there's an issue, specifically what was checked and what versions it was on at the time of the test. That's just huge. It increases the trust in the information from the tool. It cuts down on accusations of false-positives and it helps people do their job better.

It helps us to understand our cyber-exposure. At the end of the day, if you don't know what you have, then you cannot defend against it. Understanding what services, what technologies, and all those components will also give us an idea about how to predict what kinds of attacks are the things that we need to guard against in the future.

It also helps us focus resources on the vulnerabilities that are most likely to be exploited. Looking at what actually has an exploit available along with consideration of other things such as network proximity times and information about the threat - either VPR or CVSS - pulling all that together does allow us to identify pretty quickly what are the high-priority targets that we should work on.

One of the most valuable features is their distributed scan model for allotting engines to work together as a pool and handle multiple scans at once, across multiple environments. Automatic scanning distribution is a distinguishing feature of their toolset.

Also, the ability to trend data back as far back as we have disk space for, is helpful.

Finally, the ability to write custom audit files is a really helpful and useful feature. That's something that not a lot of assessment companies have gotten right. There's room for improvement, but literally being able to take the text file, open it up, and adjust the changes, write your own regex and write your own checks, is huge.

It's good at creating information, it's good creating dashboards, it's good at creating reports, but if you want to take that reporting metadata and put it into another tool, that is a little bit lacking. It does great for things for the API. For instance, if we say, "What vulnerabilities do we have?" or "How many things have we scanned?" those things are great. But if we want to know more trending stuff over time, it can create a chart, but that's in a format which is really difficult to get into another program. Integration into other reporting platforms, or providing more specific scanning program metadata, would be an opportunity.

It does have a fully-bolstered API which is available online that you can look at, but it is more aimed at getting more vulnerability information out instead of reporting information out.

We've had more problems with the underlying stuff that is running the operating system, as opposed to actually running Tenable. Tenable SecurityCenter has been pretty stable. We've only had one or two smaller technical issues. There have been other issues, but they've not been Tenable's fault.

It does have an upper limit. You can go on their website and see what their upper IP limit is.

We have seen that more and more teams want to get access to the data and get access to their vulnerability information, and it really has helped us grow our program.

Their tier-one, initial tech support is pretty bad. Their premium support is excellent. Whether premium support comes at an extra fee depends on how your negotiations go.

We migrated from Nexpose. We switched because Nexpose is not a scalable product for an enterprise. Also, in most instances, SecurityCenter is less false-positive prone and the detection seems to be better in most instances.

The initial setup was very straightforward. In fact, for some of our teams, we've actually done - "capture the flag" is a bad word for it - but effectively that type of an activity, and they pretty much go from naked box to Tenable scanning instances within a couple of hours. It's very easy to set up.

I can safely say that it can be deployed with one person. And it doesn't require a lot of maintenance. It depends on how much you use it for, but it's mostly just set-it-and-forget-it. Then there is just the mechanical stuff of patching the box and applying system updates, but it actually does a pretty good job most of the time.

We've seen return on investment through visibility, scan stability, ensuring that we're able to assess our environment. Also, ensuring that we are able to have good confidence in the data, and that we're able to do out-of-the-box reporting and various other dashboards that really help us drive our program and help sell our case.

We evaluated Qualys. It depends on whether you want to do on-prem or in the cloud. Qualys really is a black box. You literally put this thing on your network, you can't touch it, and if you want to do something like troubleshoot, it is just not very friendly from an "if things go wrong" perspective.

Make sure that your sizing is done correctly, in terms of the hardware size. When you do buy Tenable, a lot of times you'll use Professional Services to help you implement the tool. Whatever advice Tenable has, listen to it very specifically and also talk to them specifically about what your goals are. Instead of talking tactics, talk about goals. What's going to happen is that they may say "Hey, we're going to do things slightly differently than how you used to do it," but in a lot of instances, they're going to be right.

In terms of features that we're looking forward to, VPR is one that we're going to start using more. And they also recently had a SAML integration for single sign-on. That was a new feature in 5.9.

Overall, Tenable is easily a nine out of ten. It's not a ten because there is no perfect tool out there, and Tenable SecurityCenter does have its limitations.

The primary use case is to perform vulnerability assessments across the entire network.

This solution has given us visibility of the vulnerability in our network. It also shows what needs to be done to negate the vulnerabilities by providing links to the solution for those issues. Generally, we are now able to manage our vulnerabilities better. We can identify them, prioritize them, and then negate them. It has improved our security posture.

The most valuable feature is its ability to scan for vulnerabilities in our important systems, networks devices, and so on.

The web application scanning area can be improved.

A feature that I would like to see is the ability to integrate with exploit tools. 

It's a really stable solution. So far, I have not had any issues. Once it was installed it was very stable, very few bugs. It has topped expectations.

It's easily scalable. If you are required to scan more assets then you just request for it to be expanded, such as from two thousand to five thousand. Scalability is not an issue.

The system is used by around thirty-five users including system admins, who ensure that the system is up, and the application admins who are responsible for fixing the issues that are picked up with the solution.

We use it across our entire network so we cannot expand its use any further.

Their technical support is quite good, and they're very responsive. If there is any issue they perform quite quickly. Also, the local partner is well versed in the solution so they give us the support we need.

We did not use a solution prior to this one.

The initial setup, including the GUI, is very straightforward.

The implementation took about three months, and then the maturation took about six months.

We have about two people for maintenance.

We were working with a local partner for the deployment.

We have seen ROI for this solution. It has reduced our security vulnerabilities. Even during the national audit, one of the findings is that this solution is helping us be more productive. We're able to find these issues before somebody else finds them. We can fix them before they are discovered by others.

The licensing costs for this solution are approximately $100,000 US, and I think that covers everything.

Before choosing this solution we evaluated Qualys Labs and Rapid7.

This is a good solution for evaluating vulnerability in the network. It gives wide coverage, and it is able to scan most platforms on the network.

I would rate this product an eight out of ten.

Basically it reviews our threat landscape vulnerability. So, we just want to be sure that we check compliance in terms of our configuration and compliance to our policies. But, the key is to make sure that we are not exposed to vulnerabilities that can be exploited. So, it's more of just securing our threat landscape.

It easily detects issues, and alarms the site.

One valuable feature is the Assurance Report Card. with the Assurance Report Card, we are able to give our overview about security posters in just a glance. And with a report to cut this we can quickly, our executives can quickly consume that without going into the difficulties of the vulnerability issue.

In terms of the configuration of the reports, there's some level of flexibility that we are not able to achieve. In terms of configuring the reports to achieve certain percentages and all of that. So, that's really the main thing I've noticed. But, apart from that, I think it's one of the best vulnerability management tools I've used, in terms of giving us the full visibility into the environment.

One to three years.

There were no crashes, or anything of that sort. The solution is stable. At times, we have had the typical bugs, but it's not something I would say is a big deal. It is maybe once in a quarter--insignificant.

I did not have any issues with scalability. This is because once you scope the main control, the Security Center box, you do proper saving on the main box in terms of storage. Initially, when we did the first installation, we did not properly size our storage. So, we quickly entered issues. But, since it was  Linux box, we were able to reconfigure and make development for additional storage. Once we did that, there has not been anything that tested the scalability. So, when the growth becomes a little high, we just add a box and provide a scanner. Then, you define the territory within which you can scan, because each scanner can be assigned to a given territory in terms of sub-nets, and so on.

The tech support was fairly good enough. I would not rate them as top-notch, but it was fairly good enough. I would give it a rating between 70-80%.

I considered Rapid7 Nexpose and Metasploit in the past.

It was pretty straightforward.

It is slightly more expensive than other solutions in the same sphere.

If you are considering a product like this, you must take into account and properly plan, scope, and scan. You need to know how to properly place your scanners and how to schedule automatic scans. You need to properly schedule your scans, so for example you don't need to scan your data center during that day when your business is most active, you can schedule your scans to run in the middle of the night, when your systems are least active.

If you wake up on LAN, then you can even scan clients during the night. You schedule wake up on LAN, your boxes are woken up on LAN, then the scanning is run, and then the boxes are shut down once the scan is over. So that's proper scoping and planning with this solution.

Compared to other products, the most valuable features of the solution are its ease of use and ability to provide visibility over scan results while providing many templates to users, making it a helpful tool.

Though the solution's technical support is responsive, they do take a lot of time, making it one of the solution's shortcomings that needs improvement.

I have been using Tenable Security Center for two years. I use the solution's latest version.

Stability-wise, I rate the solution an eight out of ten.

Scalability-wise, I rate the solution an eight out of ten.

It is difficult for me to comment on the number of users of the solution since our company's sales team manages it.

The solution's technical support does respond to my company's queries.

I haven't worked with other products apart from Tenable Security Center.

The installation of Tenable Security Center is not difficult.

The solution is deployed on the cloud and on-premises.

The installation of Tenable Security Center takes an hour or two.

I don't know about the product's pricing model since I am a part of the technical team. The pricing part is an area handled by my company's sales team.

Two or three engineers in my company are involved in the maintenance of the solution.

I recommend the solution to those planning to use it.

I rate the overall product an eight out of ten.

We use Tenable SC for compliance and vulnerability scans. 

We are fully updated in terms of the version, and we have its latest version.

Compliance and vulnerability scans are most valuable. Compliance scan helps in validating how our teams are complying, and vulnerability scan helps in future-proofing. Its vulnerability detection is accurate.

Its reporting can be improved. It is not easy to generate a scan report the way we want. The data is okay, but we can't easily change the template to make it look the way we want.

I have been using this solution for about two years.

It is stable and reliable, but it also depends on the on-premise resources.

It is easy to scale. It is currently being used by a few people in our company.

We sometimes took support from Tenable when we had issues with the scans and we couldn't get the results. They were helpful. It is easy to get support.

It is easy to set up. We need to set it up from the appliance.

We can do it on our own, but we sometimes need help from the vendor.

Its maintenance is done from our side.

It is a bit expensive. Everything is included in the license.

It has been good so far. I would rate it an eight out of 10.

We use Tenable for security. I'm an information security officer and we are customers of Tenable. 

The solution is very intuitive as are the dashboards. It provides good visibility to the vulnerabilities in the company. 

We currently have local authentication for Tenable but I'm looking to create connections with our active directory. I'm having some issues with that and it's holding things up. I'd like to have access to some training or documentation. As a security officer, I think there can always be improvements made to that aspect of a product. 

I've been using this solution for a few years but only for the past couple of months in this new company I've joined. 

The solution is stable. 

The solution is scalable. 

The initial setup is reasonably straightforward. We currently have about five IT people who are users of this solution. 

I like this tool a lot but I work in the security area, so my concerns are always about security and how we can increase the security of everything that we have. It's important to be cautious about who gets access to what. 

I rate this solution eight out of 10. 

We use Tenable to scan all of our environments and plugins for vulnerabilities. Tenable helps us discover network vulnerabilities to threats and piracy. 

Tenable's reporting engine needs improvement. It needs to be more efficient and add more features.

I've been using Tenable for one year.

Tenable is scalable. 

Tenable technical support needs improvement.

Setting up Tenable SC was straightforward, and it took two months to deploy. 

A third-party vendor implemented Tenable for us.  

I rate Tenable SC nine out of 10. It needs some improvements in the reporting engine and training. For example, I need the ability to easily check what happened on Tenable specific dates.