Asset Prioritization

Required User Role: View only, Active User, Cloud Connector Manager, or Business Administrator.

Tenable One Attack Surface Management ranks your assets and assigns each asset a severity ranking based on its security risk. Use the severity ranking to prioritize the assets that need attention first. The Severity column in the assets table shows the severity ranking of an asset as None, Low, Medium, High, or Critical.

How Tenable One Attack Surface Management Calculates a Severity Ranking

Tenable One Attack Surface Management calculates the severity ranking for an asset by matching the asset information with a given set of criteria. Any change or update to the asset changes the severity level of that asset. For example, an asset with a Critical severity with a vulnerability issue moves to Medium or Low severity after you remediate the issue and rescan the asset.

The criteria that contribute to an asset's severity ranking include, but are not limited to, the following:

Criterion	Description
Certificate validity	Whether the asset presents an expired SSL/TLS certificate.
Protocol versions	The proportion of the asset's supported protocol versions that are outdated, such as TLS 1.0, TLS 1.1, SSL 2.0, and SSL 3.0.
Sensitive open ports	The proportion of the asset's open ports that are commonly associated with sensitive services, such as database ports.
Known vulnerabilities	The highest CVSSv3 score among the Common Vulnerabilities and Exposures (CVEs) associated with the asset.
Server errors	Whether the asset returns an HTTP server error response, either directly or after redirects.
Authentication responses	Whether the asset returns an HTTP authentication or authorization response, either directly or after redirects.
IP address reputation	Whether the asset's IP address appears on a real-time blocklist.
Address type	Whether the asset resolves to an internal IP address or to the address of a well-known public DNS resolver.
Non-production hostnames	Whether the asset's hostname includes a subdomain that indicates a non-production or administrative environment, such as dev, qa, uat, staging, or test.
Geographic location	The country associated with the asset's IP address.
Bug bounty participation	Whether the asset is part of a bug bounty program.

Tenable does not customize these criteria for your organization. Tenable One Attack Surface Management does not publish the weight of each criterion or the numeric value behind a severity ranking. Only the severity ranking appears in Tenable One Attack Surface Management and in the API.

The severity ranking applies to an asset, not to an individual finding on that asset. Tenable One Attack Surface Management does not assign a severity ranking to a suggested domain.

What a Severity Ranking of None Means

A severity ranking of None means that the asset matched none of the criteria that Tenable One Attack Surface Management evaluates. It does not mean that the assessment of the asset is incomplete.

On the Dashboard page, the severity ranking chart excludes assets that have a ranking of None from its total asset count. For more information, see Dashboard.

How the Severity Ranking Relates to ACR and AES

The severity ranking is specific to Tenable One Attack Surface Management. It differs from the Asset Criticality Rating (ACR) and the Asset Exposure Score (AES) in Tenable One Vulnerability Management. The severity ranking does not contribute to those values.

For an asset that Tenable One Vulnerability Management also detects, the asset details page shows the ACR and AES values separately from the severity ranking. For more information, see View Asset Details for Host and Web Application Assets.

When a Severity Ranking Changes

Tenable One Attack Surface Management recalculates the severity ranking of an asset immediately when the asset data that the criteria evaluate changes. The severity ranking always reflects the most recent data that Tenable One Attack Surface Management has collected for the asset.

Because Tenable One Attack Surface Management continues to collect data about your assets, a severity ranking can change without any action from you.

For example, a known vulnerability can give an asset a Critical ranking. After you remediate the vulnerability, the asset moves to a lower ranking.

View the Criteria for an Asset's Severity Ranking

The asset details page lists the criteria that the asset matched, so you can see why Tenable One Attack Surface Management assigned a particular severity ranking.

To view the criteria for an asset's severity ranking:

1. In Tenable One Attack Surface Management, in the upper-right corner, click the Inventory drop-down list.

2. Click the inventory that contains the asset.

   The Explore page appears and shows the assets for the inventory.

3. In the assets table, click the asset name.

   The asset details appear.

4. View the Severity Breakdown section.

   Tenable One Attack Surface Management lists the criteria that contributed to the severity ranking of the asset.

Tip: You can also retrieve this information for a single asset through the Tenable One Attack Surface Management API. The severity breakdown endpoint returns the severity ranking of the asset, the criteria that the asset matched, and the highest CVE with its CVSSv3 score. For more information, see Get the severity breakdown for the specified asset in the Tenable Developer Portal.

Enable the Severity Column

You must enable the Severity option in Tenable One Attack Surface Management for the column to appear in the assets table.

To enable the Severity column for your assets:

1. On the Explore page, in the assets table header, click Columns.

   The Customize Columns drop-down list appears.

2. Select the Severity checkbox.

   Tenable One Attack Surface Management includes the Severity column in the assets table.