How Tenable Research Uses AI

Tenable Research has integrated AI-assisted workflows to address the accelerating pace of vulnerability disclosures and the demand for high-quality exposure intelligence, spanning all sensors across Tenable One. This work aims to provide value in three areas: faster time to quality coverage of exposures and contextual intelligence, new features that help customers prioritize and remediate, and frontier research that surfaces emerging threats, attack surfaces, and technologies that will shape the future of exposure management.

Tenable Research (the team that builds the detections and vulnerability content behind Tenable’s plugin feed) uses AI throughout its content development process. This is a researcher-facing use: it runs inside Tenable’s development environment to help build detection content, and the AI models involved are not packaged into or distributed as part of the plugin feed, audit files, or other content customers receive.

Researcher-Augmented Content Writing

Individual researchers use AI tooling locally to speed up manual content development, automated feed development, and exposure intelligence collection and analysis, primarily for more complex development tasks. Tenable Research continues to develop and share new AI skills, agents, and tools across the team to take on more of this work.

Agentic Content Writers

Tenable Research has integrated agentic content-writing skills into its development pipeline. In this model, an AI agent handles the bulk of initial content development, and a researcher is responsible for review, approval, and release. This augments the manually written content track rather than replacing researcher judgment on quality and accuracy.

Translating a vendor advisory into executable detection content is not always straightforward: vendor advisories often contain caveats and workarounds that require human interpretation. Tenable Research uses AI agents and agentic judge models to reach high-accuracy consensus on a vendor’s intent, producing automated plugin coverage that would not otherwise be attainable.

A small percentage of vulnerability configuration coverage is released without human review, but only when both of the following are true:

The content matches a strict allowlist of approved vendor configuration commands or regular expressions, which prevents the generation of any malicious commands. All commands are strictly read-only "show" commands that cannot change any configuration.
Multiple independent agentic judge models agree on the result with very high confidence.

If either condition is not met, the content is routed to a human reviewer before release.

Multi-Language Detection Evaluation

Tenable Research uses AI to extend its AI Exposure detection models to additional languages, running automated translation pipelines across its evaluation and training sets. This allows Tenable to build detections with high fidelity across multiple languages and a wider range of security use cases.

Risk Classification of AI Agent Tools

As organizations connect AI agents to enterprise data through platforms such as Microsoft 365 Copilot Studio, Tenable Research uses AI to assess the security risk each available agent tool introduces. A single AI agent can invoke hundreds of connectors (for example, Salesforce, OneDrive, or Dataverse), and each connector exposes many individual actions, such as updating a row, retrieving a file, or deleting an item. Determining which actions are risky in the hands of an autonomous agent is a high-volume, expert-judgment task well suited to AI-assisted review.

Several guardrails preserve researcher oversight:

Governed question lifecycle: New risk questions start in an evaluation state and only affect live risk scoring after a researcher promotes them to production.
Evaluation against a human-labeled golden dataset: Before promotion, the pipeline re-runs classification against a curated set of actions whose correct risk status was set by human experts, and reports the precision impact of the proposed change and exactly which actions it would affect.
Human review and override: Researchers can inspect every action, its AI-generated summary, and its classification, and can override the automated result: a human decision always takes precedence over the model, so an action a researcher marks as not risky is excluded regardless of its computed score, and vice versa.
Coverage and redundancy analysis: Tooling reports how many risky actions each question catches, helping researchers keep the question set high-signal and free of redundancy.

Development Pipeline Workflow

All Tenable Research content passes through a CI/CD pipeline that automatically tests the quality of every new or modified plugin, plus a peer review process in which multiple reviewers must approve the underlying NASL code before it merges into the feed and ships in Tenable products. The one exception is the narrow agentic-judge path for vulnerability configuration coverage described above, under Agentic Content Writers. As with the rest of this document, AI models used in this pipeline are not packaged into or distributed as part of any content that reaches customer environments.

For more on Tenable’s plugin QA/QC process, see Customer Outreach on Tenable Plugin QA/QC Processes.