Tenable Vulnerability Management Reviews & Product Details

What I like most about Tenable Vulnerability Management is that it is very intuitive. Everything is well-organized and easy to navigate, even for people who are not experts in the field of cybersecurity. The interface is very intuitive: one can hardly go wrong while looking for such sections as Scans, Reports, and Sensors. What I like about Tenable is that all previous scans are stored in one place. I appreciate the option to save the scans as folders because critical monthly scans can be stored separately for easy access. The details of each scan are given clearly and concisely, and helpful tips appear when needed. Overall, this software is very intuitive and user-friendly. Review collected by and hosted on G2.com.

What I like least about Tenable Vulnerability Management is the absence of an option to check if the scan asset was authenticated or not. For example, when conducting monthly Advanced scans using big organizational templates with +50 IPs, some assets fail to be authenticated, and it is quite tedious to locate these IPs and check their status. It would be much more convenient and time-saving if there was a separate column indicating the Success or Failed status for each asset in the Vulnerabilities by Asset view.

I believe that this option would considerably improve the product and become a great addition to the current set of tools for scanning and managing network vulnerabilities. Review collected by and hosted on G2.com.

Instead of getting overwhelmed by thousands of raw CVSS scores, VPR incorporates real-time threat intelligence and exploitability data, which helps us focus our remediation efforts on vulnerabilities that actually pose an immediate threat. One unexpected benefit has been how effective it is as a continuous asset inventory tool. Running discovery scans alongside Tenable Agents and Nessus Network Monitor quickly brought several untracked development hosts and shadow IT devices to light—systems that were completely missing from our standard asset lists. Review collected by and hosted on G2.com.

The biggest drawback is how the built-in CIS Benchmark audit templates behave when auditing non-English operating systems. In addition, console localization is quite limited; the lack of a native Spanish interface can slow onboarding for junior team members. Finally, from a UX perspective, dark mode is still inconsistently applied across the platform—navigating between modern dashboards and certain module screens abruptly switches back to a glaring white background. Review collected by and hosted on G2.com.

I like Tenable Vulnerability Management's accuracy because 99% of the time, it has no issues with false positives or negatives. I also appreciate the Vulnerability Intelligence feature, which offers a quick look into external issues and how they relate to our environment. The improved customer support is another aspect I value, as it allows for actual troubleshooting sessions rather than just relying on ticket management. Additionally, the initial setup was very easy, making the transition smooth for our team. Review collected by and hosted on G2.com.

I find it frustrating that the AI feature isn't available to all Tenable users regardless of their plan. It would be great if Hexa AI could be integrated into Tenable Vulnerability Management without needing to upgrade to Tenable One for AI capabilities. Additionally, I miss the Assurance Report Cards feature that was available in Tenable.SC, which isn't present in Tenable Vulnerability Management. Adapting to these changes was a bit challenging during the transition. Review collected by and hosted on G2.com.

I use Tenable Vulnerability Management to scan our company asset inventory and keep an updated, categorized list of findings. I rely on it for complete visibility across our perimeter and as a central source of truth for finding vulnerable software versions on our servers and misconfigurations in server deployments. I especially like the flexibility in tagging, scan options, and VPR scoring, which helps us make informed decisions about vulnerability patching and prioritization. Review collected by and hosted on G2.com.

I find the plugin release feed should move at a faster pace. The effectiveness of non-authenticated scans can leave gaps in visibility, especially when there isn’t a plugin or an unauthenticated way to identify known vulnerabilities on assets outside standard servers, like network equipment. This makes analysis of newly released CVEs more difficult and delayed. I also had some friction configuring the firewall rules and service accounts because we don’t use agents on the assets. Review collected by and hosted on G2.com.

What I like most about Tenable Vulnerability Management is how easy it is to see vulnerabilities across different systems from one place. The interface is simple to work with, scans are easy to manage, and the risk information helps me focus on the issues that need attention first. Review collected by and hosted on G2.com.

One thing I dislike is that the scan section can feel a bit crowded and confusing at first. In my opinion, this part is easier to navigate in Tenable Security Center. It becomes manageable once you get used to it, but the layout could be more intuitive. Review collected by and hosted on G2.com.

It’s very easy to use and really helpful for identifying vulnerabilities. Scheduling scans is convenient and straightforward. Because it’s a cloud product, management is rarely an issue, and it receives automatic updates. Integration has been simple as well—we just need to whitelist the scanner IPs. It’s been reliable for us, so overall performance has been solid. Pricing isn’t bad either, and it seems to be widely used. Whenever I need help, I reach out to support, and they respond quickly and assist. We don’t have an AI/intelligence feature in the product yet, but I’m looking forward to that. Its smart in a way when it decides which plugins to try automatically on whichever server is responding. Review collected by and hosted on G2.com.

Sometimes, even when the issue is very simple, we can’t figure it out and have to contact the support team. They often ask for a lot of debugging files, and in the end it sometimes turns out that something is wrong with the plugin itself. Then the engineering team fixes it and releases an updated plugin. In those cases, the whole process feels like a bit of a waste of time. Review collected by and hosted on G2.com.

Various scanning options whether it be agent, on prem scanner or Cloud scanners.

Scan results are extremely useful and plugin output makes it clear as to why the vulnerability has been identified.

The reports and dashboards make it easy to visualize the data in Tenable.

Remediation projects make it easy to divvy out vulnerabilities to the relevant teams.

Azure data connector makes it easy to get a full asset inventory.

Scans, especially agent-based scans are fast and lightweight.

Onboarding is fairly quick and easy, the nice UI makes it easier to navigate.

Vulnerability intelligence allows me to see what CVEs are being exploited in the wild, allowing me to focus on those patches first. Review collected by and hosted on G2.com.

Responses from support can sometimes be slow, they can sometimes ask you for information which you have already provided which further prolongs a resolution.

There seems to be a rise in false positive plugins recently too which can be quite frustrating especially as an MSSP that manages many containers. Review collected by and hosted on G2.com.

Its plugin coverage and scan accuracy are excellent, and VPR makes prioritization much more realistic than relying on CVSS alone. The API is also a big strength: we’ve automated bulk creation of compliance scans and built custom reporting from exports, which saves us a lot of time when managing multiple clients at scale. Review collected by and hosted on G2.com.

The native reporting and dashboards are limited for client-ready deliverables, so we often end up exporting data and building our own reports externally. Creating or managing many scans through the UI is also tedious, and some recurring findings, like untrusted SSL certificates, add noise that needs extra analysis to separate real risk from configuration issues. Review collected by and hosted on G2.com.

Tenable Vulnerability Management is a solid choice for centralized scan management, with accurate plugins, an intuitive interface, and clear risk prioritization.

The platform is easy to navigate even for non-experts, thanks to clearly labeled sections for scans, reports, and sensors.

Historical scans are stored in one place and can be organized into custom folders, which makes it easier to keep everything structured and find what you need later. Review collected by and hosted on G2.com.

Licensing and overall costs are expensive and can be prohibitive for smaller or budget-conscious organizations.

In my experience, the Nessus Tenable agent is not very stable. In our case, it gets corrupted quite often due to external factors, and repairing it is usually a tedious process. Because of that, we often end up doing a full reinstallation instead.

We’ve also experienced occasional slow response times and communication delays from the customer support team. Review collected by and hosted on G2.com.

I appreciate the ability to validate vulnerabilities, including those that show up in software dependencies—for example, embedded Java components within Control-M Agent or Veritas. Review collected by and hosted on G2.com.

To accomplish the assessment correctly, sometimes we need to enable the option "Perform scan with thorough checks". This can impact servers that are running unsupported software. Review collected by and hosted on G2.com.