Current Use of AI for Exposure Management

The sections below describe each technique in more detail.

Machine Learning

Tenable uses machine learning to proactively identify and prioritize vulnerabilities, helping you focus on the most critical threats:

  • Vulnerability Priority Rating (VPR): Predicts the likelihood that a vulnerability will be exploited within 28 days, enabling risk-based prioritization. Available across the Tenable One platform.

  • CVSS Metrics Prediction: Predicts CVSSv3 metrics, providing a key input to the VPR model.

  • Operating System Prediction: Improves remote operating system fingerprinting, even with limited scan data, leading to better device management. Available as Tenable Nessus plugin 132935.

  • User Criticality Rating: Assesses the importance of individual users within your organization based on their job titles and access rights, enabling risk-based exposure management within Tenable One Identity Exposure and Tenable One.

Deep Learning and Small Language Models

Tenable One AI Exposure

Tenable One AI Exposure uses deep learning models and fine-tuned small language models (SLMs) to secure interactions across any AI platform, including chatbots, agents, and applications.

  • AI Threat and Misuse Detection: Identifies potential adversarial attacks targeting your AI platforms, and detects misuse such as unauthorized data access or unsafe reliance on AI for decisions.
  • Data Exposure Detection: Detects sensitive data that an AI engine or agent exposes or leaks.
  • Prompt Translation: Uses AI to translate prompts from non-English languages to English for analysis.

These models are trained by Tenable using open-source libraries. Your AI activity is evaluated at runtime against pre-built detection policies to identify risk; that activity is not used to train or modify the models.

Generative and Agentic AI

Tenable leverages generative AI and pre-trained Large Language Models (LLMs) from Google’s Vertex AI and Amazon’s Bedrock platforms to deliver clear, concise, and actionable information, including for:

Prioritizing Vulnerabilities

  • Vulnerability Priority Rating (VPR): Analyzes vast amounts of content from cyber news media, security advisories, vendor blogs, and related sources to help predict the likelihood of exploitation within 28 days. Incorporates context-rich vulnerability insights as inputs to the threat model, updates key drivers, and enriches metadata, including threat and remediation summaries. Available across Tenable One.

Assessing Attack Path Risks

  • Attack Path Summary: Distills complex attack paths into easy-to-understand summaries.

  • Attack Path Assistant: Lets you ask natural language questions about specific attack paths and their components.

  • Attack Path Mitigation Guidance: Offers step-by-step instructions for addressing identified attack path risks.

These features summarize and explain attack paths that Tenable’s existing Attack Path Analysis has already identified. They are distinct from Adversary View, a Hexa AI capability described below that uses Claude Mythos to reason across raw exposure data and surface new attack chains, rather than explain ones already found.

Managing Inventory

  • Asset Summary: Provides detailed descriptions of your assets and highlights their most critical exposures.

  • Natural Language Search: Lets you search your asset inventory using natural language.

Monitoring Exposure Signals

  • Exposure Signals Description: Explains specific exposure insights.

  • Exposure Signals Summary: Explains why an asset is included in a particular exposure insight.

Utilizing Tenable Hexa AI

Tenable Hexa AI uses agentic AI to plan and carry out multi-step security workflows over your own Tenable data. It breaks complex requests into a sequence of steps and takes action through Tenable’s existing platform capabilities, working against the vulnerability, asset, identity, configuration, and AI-system data your Tenable products have already collected, plus whatever you type into it directly.

Tenable partners with Anthropic to deliver these agentic capabilities across Tenable One. No customer data is used to train the underlying models.

Users interact with Tenable Hexa AIthrough two channels:

  • Chat: A conversational interface embedded in Tenable One, Tenable One Vulnerability Management, and Tenable One Cloud Exposure. Users describe what they want to accomplish in natural language; Hexa AI plans the steps, surfaces its reasoning, and asks for confirmation before making any change.
  • Model Context Protocol (MCP): A Tenable-hosted endpoint that exposes Hexa AI capabilities to MCP-compatible AI assistants of the customer’s choice, letting customers use Hexa AI through the AI client they already use.

Hexa AI capabilities drive common security workflows and Tenable product features, including:

  • Asset Tagging and Organization: Search the asset inventory using natural language, create tags and tag categories, and apply tags to matched assets at scale.
  • Exposure Investigation and Organization: Search and inspect vulnerabilities and exposures across Tenable One; review affected assets and asset details or adjust finding risk.
  • Dashboard and Report Creation: Build, update, or remove dashboards on demand.
  • Scan Operations: Create, configure, launch, and monitor scans and scan policies.
  • Remediation Workflows: Create, update, or remove Combinations, Initiatives, and leverage third-party integrations to create ticketing or change-management artifacts.
  • Adversary View (Attack Path Discovery): Powered by Anthropic’s Claude Mythos model, reasons across the exposure, asset, and vulnerability data already collected in Tenable One to reconstruct how an attacker could move from an initial point of access to critical systems, surfacing the evidence behind each step and recommending the remediation action that would break the path. Unlike the tagging, dashboard, and remediation-workflow capabilities above, Adversary View is read-only; it analyzes and recommends, but does not modify any data itself.