Product Security and Privacy

This section highlights the major security features of Tenable One AI Exposure.

Hosting Regions

An instance of the AI Exposure service is hosted in each of the following broad geographic regions:

  • United States
  • Australia
  • Brazil
  • Canada
  • Europe
  • India
  • Japan
  • Singapore
  • South Korea
  • United Arab Emirates
  • United Kingdom
  • United States Gov Cloud

Data stored in a given region will stay in that region, and will never be transmitted to a different region.

AI Exposure is a multi-tenant SaaS platform, where each of the service instances mentioned above serves multiple tenants, with logical separation between customers. Alternatively, Tenable does provide support for single-tenant instances upon request, which affects how the solution is priced.

Tenable Console URL

AI Exposure Region URL
Global (All regions) https://app.tenable.com
United States Gov Cloud https://app.tenable.us

Data Segregation

Within an instance, there is full data segregation, ensuring that each customer’s data is fully separated on the database level. To support this, Tenable stores each customer’s data in an independent, and logically separated, database or set of databases. Such segregation provides the scale and benefits of multi-tenant services, while strictly preventing customers from accessing one another's data.

Data Encryption

All data in transit across open networks is encrypted using TLS 1.2. Similarly all data is encrypted at rest using AES-256.

High Availability and Disaster Recovery

Each AI Exposure service instance is highly available, with all components (for example, compute, database, and networking) spread across multiple availability zones. Tenable uses a load balancer to automatically distribute incoming application traffic across multiple instances and availability zones.

Customer data is continuously backed up once a day, and, additionally, backed up externally via external persistent storage, once a week.

Compliance and Certifications

AI Exposure maintains internal controls that meet the most stringent information security requirements for data protection and privacy. Tenable has achieved the following certifications:

  • SOC 2 Type II — This report demonstrates Tenable's commitment to the most rigorous security, availability, processing, confidentiality, and privacy standards in the industry, and verifies that our security controls are aligned with the AICPA (The American Institute of Certified Public Accountants).
  • ISO/IEC 27001 — One of the industry’s most recognized information security certifications, ISO/IEC 27001:2013 demonstrates that Tenable meets the highest standards for protecting its cloud delivered CNAPP service.

Annual Penetration Tests

Tenable engages with third-party organizations to conduct penetration tests of the production environment, which occur annually, at a minimum. Results are reviewed by Tenable, and high priority findings are tracked to resolution.

Key Management

Tenable has an established key management process in place, using AWS Key Management Service (KMS) to support the organization's use of cryptographic techniques.

Authentication

Tenable supports the following modes of authentication for login to the AI Exposure Console:

  • Microsoft Entra ID
  • Google SSO
  • IdP SAML SSO
  • Username and password (See Password Policy.)

Users can log in to the AI Exposure Console via SSO by establishing trust between your external identity provider (IdP) and Tenable. This eases user provisioning by leveraging the existing corporate identities of your users. It does not, however, provide for automatic user provisioning: after trust is established, you still need to add new Tenable users or groups via the console, or via API. For more information about enabling SSO login, see Single Sign-On.

Password Policy

The AI Exposure password policy requires that passwords be at minimum 8 characters long and contain the following:

  1. Uppercase letter
  2. Lowercase letter
  3. Number

Timeout Settings

To enhance account security and reduce the risk of unauthorized access, administrators can configure two types of timeouts for the web Console:

  • Inactivity Timeout — Ends a session after a period of user inactivity. The default value is 12 hours.
  • Session Timeout — Ends a session after a fixed duration, regardless of user activity. This setting is disabled by default.

These settings can be adjusted based on your organization's security and compliance needs. For more information, see Console Timeout Settings.