G2

Verified User in Computer & Network Security

Small-Business (50 or fewer emp.)

9/22/2026

"Fast, Agentless Cloud Risk Visibility with Powerful Identity & Entitlement Insights"

5/5

What do you like best about Tenable Cloud Security?

What I like most about Tenable Cloud Security is how quickly it gives us a clear, unified view of risk across our cloud environments. Onboarding was fast and agentless, and within a short time we had visibility into our AWS, Azure, and GCP accounts without deploying anything on our workloads.

The identity and entitlement analysis is the standout feature for me. It surfaces excessive permissions, unused access, and risky identity combinations that are extremely difficult to uncover manually, and it also generates least-privilege policy recommendations we can act on immediately. The attack-path and “toxic combination” views are genuinely useful for prioritization. Rather than drowning in thousands of findings, we can focus on the handful of exposures that actually lead to sensitive data or critical resources.

I also appreciate how well it fits into the broader Tenable ecosystem alongside Vulnerability Management and Security Center, so cloud misconfigurations, workload vulnerabilities, and identity risks show up in one place with consistent context. Compliance reporting against common frameworks saves our team significant audit-prep time, and the IaC scanning helps us catch issues before they reach production. Overall, it has made our cloud security posture more measurable and has kept our remediation work much more focused. Review collected by and hosted on G2.com.

What do you dislike about Tenable Cloud Security?

The biggest downside for me is the learning curve. The platform is very capable, but the interface feels dense, and it takes time to learn where everything lives and how to tune policies effectively. New team members typically need a walkthrough before they can be productive. The initial alert volume can also be high; until you tune exclusions and severity thresholds for your environment, some findings come across as noisy or simply low priority.

Integration with the rest of the Tenable portfolio has improved, but it still doesn’t always feel completely seamless. We sometimes have to jump between consoles, and the data and terminology don’t line up perfectly between cloud and on-prem views. Dashboard and report customization is also more limited than I’d like, especially when trying to tailor executive-level views.

Pricing is on the premium side, which can be a hurdle for smaller teams or organizations that are early in their cloud journey. Licensing can also take some effort to understand as environments grow. Finally, some documentation lags behind new features, so we occasionally rely on support to clarify expected behavior. That said, support has been responsive, and none of these issues outweigh the value the product provides. Review collected by and hosted on G2.com.

What problems is Tenable Cloud Security solving and how is that benefiting you?

Tenable Cloud Security solves a problem we couldn’t address well with our previous tools: understanding real risk across multiple cloud accounts and providers from a single place. Previously, cloud misconfigurations, identity permissions, and workload vulnerabilities were tracked in separate systems—often spreadsheets or native cloud consoles—which made it difficult to understand how individual issues combined into real exposure.

The biggest challenge it helps us tackle is identity sprawl. Over time, users, service accounts, and roles accumulated far more permissions than they actually needed. Tenable makes it clear which entitlements are excessive or unused and generates least-privilege policies we can apply. As a result, we’ve meaningfully reduced our attack surface without disrupting day-to-day workflows.

It also improves how we prioritize remediation. The attack-path analysis connects misconfigurations, vulnerabilities, and permissions to show which issues could realistically lead to sensitive data exposure or impact critical systems. Instead of chasing every finding, our team can focus effort where it matters most, which saves time and gives leadership a clearer view of risk.

On the compliance side, continuous checks against common frameworks reduce the manual work involved in preparing for audits and customer security reviews. IaC scanning also helps us catch misconfigurations earlier in the development process, before they reach production.

Overall, it supports a more measurable and proactive cloud security program: fewer blind spots, faster remediation of high-impact issues, and less time spent on manual evidence gathering. Review collected by and hosted on G2.com.