Choose between Advanced and CNAPP Complete

Objective

Your team holds a Tenable One Advanced license and needs to decide whether the CNAPP Complete add-on is worth adding. The answer depends on which capabilities you need in your cloud environment, and leadership wants the tradeoff before approving budget. This playbook helps you map your security requirements to each license and estimate how the add-on affects your resource count.

Note: Playbooks are blueprints for operationalizing security workflows within the platform. The steps outlined show a repeatable method for matching your cloud security requirements to the right license.

Step 1: Confirm Your Current License

Licensing names changed over time, so start by confirming what your organization holds today. The name you see in the console determines which comparison applies to you.

To confirm your license:

  1. In the Tenable One Cloud Exposure Console, navigate to Settings > Licensing.
  2. Under the license information, note the license types you are subscribed to.
  3. If your license shows Standard, CIEM, JIT, or Cloud VM, you hold a legacy license. See Feature Comparison for Legacy Licenses instead of this playbook.
Note: Enterprise is the legacy name for CNAPP Complete. If you see Enterprise in the console, you already have the full CNAPP Complete capabilities.

Step 2: Match Your Requirements to Each License

Advanced covers posture management, vulnerability scanning, and network exposure. CNAPP Complete adds code security, data protection, identity least privilege, and threat detection. List the capabilities your team needs, then check which license provides each one.

The following table shows the capabilities that require the CNAPP Complete add-on.

If You Need To... Advanced Advanced + CNAPP Complete
Scan CI/CD pipelines and IaC repositories for security issues ✗ ✔
Scan buckets and managed databases for sensitive data ✗ ✔
Scan data platforms such as Snowflake ✗ ✔
Get least privilege recommendations for identities, resources, and Kubernetes ✗ ✔
Use the Kubernetes Admission Controller ✗ ✔
Monitor cloud events and runtime events ✗ ✔ (90 days)
Use anomaly detection ✗ ✔
Grant just-in-time access to cloud accounts ✗ ✔

The following capabilities are in Advanced, so you do not need the add-on for them: CSPM policies, KSPM inventory and misconfigurations, AI-SPM, dynamic network exposure, agentless, in-account, and agent-based Kubernetes vulnerability scanning, container registry and CI/CD container image scanning, malicious files detection, automatic remediation, and Hexa AI.

Note: For the complete list, see Feature Comparison by License.

Step 3: Estimate the Effect on Your Resource Count

Some CNAPP Complete capabilities scan additional resource types, and each scanned resource counts toward your license. Estimating this before you decide avoids a surprise overage later.

To estimate your resource count:

  1. Go to the Cloud Exposure downloads page{target=_blank} and download the sizing scripts for your cloud providers.
  2. Run the scripts, as described in the Environment Sizing Guide.
  3. Compare the output with your current usage under Settings > Licensing.
  4. Share the output files with your Tenable representative for a pricing review.
Note: The sizing scripts capture a point-in-time snapshot, not a historical average. Account for expected growth before you share the results.
Note: Data protection scanning (buckets and managed databases) adds billable resources only when you enable it. See Billable Resources for the resource types and ratios.

Step 4: Share the Decision with Your Leadership

Leadership needs two answers: what the add-on gives you, and what you lose without it. Use the table from Step 2 as the capability summary and the output from Step 3 as the resource summary.

To share the decision:

  1. Copy the rows from the Step 2 table that match your requirements.
  2. Add your resource count estimate from Step 3.
  3. Send both to your Tenable representative to confirm the licensing terms in your order form.
Note: If you add CNAPP Complete and later move back to Advanced, Cloud Exposure retains data related to the disabled capabilities for 30 days. See License Downgrade for what changes and how to prepare.
Caution: The comparison shows capabilities, not contract terms. Your order form or other signed agreement defines what you purchased.