Tenable One Cloud Exposure Upcoming Changes

Tip: You can subscribe to receive these release notes by email or RSS.

This page describes major planned changes in Cloud Exposure that affect how you work with the platform, including changes with potential backward compatibility issues. Planned dates are subject to change.

Change Description Date Requires Action
Product Rename and New Documentation Site Cloud Exposure will become Cloud Exposure. The documentation will move to docs.tenable.com, and the API documentation will move to the Tenable developer portal. November 16, 2026 No Action
Indirect Exposure Scanning and Network Exposure Graph The Network Scanner will show which backend resources your load balancers expose, and a new Network Exposure graph will map each exposure path from the entry point to the backend resource. Q4, 2026 No Action

What's Changing?

On November 16, 2026, Tenable will rename Cloud Exposure to Cloud Exposure. The documentation will also move to a new site.

  • Product name — The product name will change from Cloud Exposure to Cloud Exposure.
  • Documentation site — The documentation will move from docs.app.tenable.com to docs.tenable.com. It will sit with the documentation for the rest of the Tenable One Exposure Management Platform.
  • API documentation — The API documentation will move to the Tenable developer portal.

Backward Compatibility

You do not need to take action. Documentation links inside the product will update automatically on the release date.

If you bookmarked pages on the old documentation site, update your bookmarks after November 16, 2026. This includes bookmarks to API documentation pages.

What’s Changing?

The Cloud Exposure Network Scanner will show which backend resources can be reached from the internet through your load balancers, not only that the load balancer itself is exposed. A new Network Exposure Graph will show each exposure path from the internet to the backend resource.

This change has two parts:

  • Indirect exposure through load balancers — The Network Scanner will read your load balancer configuration to map the path from the entry point, through the load balancer, to each backend resource. It will use:
    • AWS: listeners and target groups
    • Azure: load balancing rules, inbound NAT rules, routing rules and backend pools
    • GCP: URL maps, backend services and target pools
    • OCI: listeners and backend sets
  • Network Exposure Graph — A visual graph will show the exposure path of a network endpoint: Entry Point → Exposing Resource → Route → Backend Resource.
Note: No action is required. The changes apply automatically.

Supported Load Balancers

Cloud Load Balancers Backend Resources
AWS
  • Application Load Balancer (ALB)
  • Network Load Balancer (NLB)
  • Classic Load Balancer
  • Amazon EC2 instances
  • IP targets
  • Application Load Balancers registered as NLB targets
Azure
  • Azure Load Balancer (including inbound NAT rules)
  • Azure Application Gateway
  • Virtual machines
  • Virtual Machine Scale Sets
GCP
  • External HTTP(S) Load Balancer
  • Network Load Balancer
  • Passthrough Network Load Balancer
  • Compute instances in target pools and instance groups
  • Compute resources behind network endpoint groups (NEGs)
OCI
  • OCI Load Balancer
  • Compute instances registered by private IP address
  • OCI Network Load Balancer (TCP listeners only)

Impact and Value

After the release, you'll see these changes on the Network Endpoints page and in the Network Exposure Graph:

  • New columns for indirect exposure. The Exposed resources column will list the backend resources that can be reached through the network endpoint, and will appear by default. An optional Hops column will display the number of hops between the entry point and the backend resource. You will be able to add it from the column selector.
  • Grouped ports in the graph — Ports on the same exposure path will be grouped together in the Network Exposure Graph.
  • Cloud-specific names — Elements will use their cloud provider's terms, for example backend sets for OCI load balancers.
  • AWS load balancers without targets are not scanned — The Network Scanner will skip AWS load balancers that have no registered targets, because no backend resource can be reached through them.
  • Network endpoint counts can change after this release — Backend resources reachable through load balancers will appear as exposed, and AWS load balancers without targets will no longer be scanned. These changes will give a more accurate view of your exposure. They won't mean new risk or resolved risk.