Tenable Exposure Management 2026 Release Notes

Tip: You can subscribe to receive alerts for Tenable documentation updates.

These release notes are listed in reverse chronological order.

June 15, 2026

Integration Updates

Snyk Third-Party Connector Availability

Tenable is excited to announce the addition of the Snyk connector within Tenable Exposure Management — the first connector in the platform to ingest Code Repository data from a third-party source. This marks a significant expansion of the Exposure Management data fabric beyond infrastructure and cloud, bringing application-layer risk — including vulnerabilities in source code, open-source dependencies, containers, and infrastructure-as-code — into your unified exposure view for the first time.

The Snyk connector supports the following Snyk products:

Snyk Code (SAST) — Identifies security vulnerabilities in proprietary source code.
Snyk Open Source (SCA) — Detects vulnerabilities in open-source dependencies.
Snyk Container — Surfaces vulnerabilities in container images.
Snyk Infrastructure as Code (IaC) — Identifies misconfigurations in cloud infrastructure templates.

Once configured, the connector correlates developer-led security findings with your broader asset inventory in Tenable Exposure Management, enabling security teams to prioritize high-risk vulnerabilities within the software supply chain alongside traditional infrastructure exposures. Users can configure this connector directly within the Connectors section of Tenable Exposure Management.

For more information, see Snyk Connector in the Tenable Exposure Management User Guide.

June 11, 2026

New Features in Attack Path Analysis

Tenable is excited to announce the following new features, aimed towards helping deepen practitioner context and unlock Attack Path data for use outside the platform.

MITRE ATT&CK Heatmap Export

Tenable Exposure Management now allows users to export data from the MITRE ATT&CK Heatmap tab in Attack Path Analysis. Users can export in two formats:

JSON (MITRE Navigator layer): Generates a .json file compliant with the MITRE Navigator schema, with techniques colored by Tenable severity. The file imports directly into the MITRE Navigator tool and can be overlaid with EDR coverage maps from tools such as CrowdStrike and SentinelOne.
CSV: Generates a tabular file containing technique names, priorities, asset counts, and deep links — suitable for use in ticketing workflows or pivot table analysis.

All exports respect active filters, including priority, category, free text, and the Show All Techniques toggle, ensuring exported data reflects exactly what is visible in the interface. For more information, see MITRE ATT&CK Heatmap in the Tenable Exposure Management User Guide.

Security Control Annotation for Attack Paths

Tenable Exposure Managementnow surfaces security controls data — including EDR and firewall tools detected by Tenable Exposure Management — within Attack Path Analysis. Security controls information is visible across the Top Attack Techniques table, Top Attack Paths table, and the Attack Path Graph, allowing practitioners to assess existing coverage at a glance.

Clicking any asset in the Attack Path Graph opens the asset detail panel, which includes a dedicated Security Controls tab listing all controls detected on that asset. A new Security Controls filter allows teams to scope their investigation to paths and techniques with or without active coverage, helping distinguish genuinely exploitable paths from those that are already mitigated.

For more information, see Attack Technique Details in the Tenable Vulnerability Management User Guide.

June 4, 2026

Integration Updates

Tenable Open Connector - Phase 3 (Sync Logic Enhancements: Full vs. Delta)

Building on the automated S3 ingestion capabilities introduced in Integration Updates, phase 3 of the Tenable One Open Connector introduces flexible data synchronization modes, giving you full control over how the platform reconciles incoming data with existing records. This update eliminates stale data and enables a predictable lifecycle for assets and findings across both manual uploads and automated S3 pulls.

Full Fetch vs. Incremental Fetch

The Tenable One Open Connector now supports two Data Update Modes:

Full Fetch (Override): Every new file fully overrides all data ingested from the previous file, providing a clean, authoritative baseline on every sync.
Incremental Fetch: After an initial full baseline sync, subsequent uploads process only new and updated records. This mode is bandwidth-efficient and designed for high-frequency pipelines where re-sending the entire dataset is not practical.

Incremental Delta Modes

When using Incremental Fetch with files that contain both assets and findings, you select one of three delta modes to define how Tenable Exposure Management handles records absent from the incoming file:

Additive Only: All existing assets and findings remain active. Only new or updated records from the file are processed. No data is removed or archived.
Strict Inventory: Assets missing from the file are immediately archived to keep your inventory clean. Existing findings for those assets are retained until the asset is fully decommissioned.
Dynamic Remediation: Findings missing from the file are automatically marked as Fixed. Assets not present in the file remain active to preserve historical context.

Remap Columns

The new Remap Columns option on the connector setup page lets you revise field mappings and uniqueness criteria without uploading a new file. Once saved, Tenable Exposure Management re-syncs the existing data using the updated configuration.

Connector Logs

The Connector Logs section now indicates whether each synchronization ran as a Full Fetch or an Incremental Sync. Hovering over an entry in the Activity column displays the active delta mode — Additive Only, Strict Inventory, or Dynamic Remediation — and a short description of how Tenable Exposure Management handled records missing from that sync file.

For more information, see Tenable Open Connector in the Tenable Exposure Management User Guide.

May 20, 2026

May 19, 2026

Tenable Hexa AI

Tenable Hexa AI — the agentic engine of the Tenable One Exposure Management Platform — is now generally available. Tenable Hexa AI moves cybersecurity beyond the chatbot: instead of answering questions about your exposure data, it executes the complex, multi-step actions that allow security teams to begin operating at machine speed.

This GA release introduces two surfaces for the same agentic engine

Hexa UI: Embedded directly into the Tenable One platform, with Tenable's out-of-the-box agents ready to act on day one.
Hexa MCP: A Tenable-hosted Model Context Protocol (MCP) server that lets power users and AI-savvy teams bring their own LLM and orchestrate custom agents on top of the Tenable Exposure Data Fabric.

Both formats share the same foundation: Tenable's Exposure Data Fabric, the industry’s most comprehensive repository of contextualized exposure data.

Tip: Review the Tenable Hexa AI Prompt Cookbook for more information on how to get started with Tenable Hexa AI prompting!

Tenable Hexa AI Pre-Built Agents

Pre-built agents in the Tenable UI provide the agentic experience for the security practitioner who wants the outcome, not the plumbing. Tenable Hexa AI is embedded in the Tenable One platform and grounded in your live exposure data, so every recommendation reflects your environment and not a generic playbook.

The first generation of Tenable-built agents covers the areas where customers reported the highest administrative load:

Contextual Asset Management: Organize and search your attack surface at machine scale instead of by spreadsheet.
Dynamic Visualization: Turn raw exposure data into dashboards from existing Tenable templates and in-chat reports on request.
Assessment Configuration: Take the mystery out of failed scans and risk adjustments so your data stays trustworthy.
Risk Adjustment: Recast findings and their severity according to your internal guidelines.
Remediation Workflows: Mobilize findings and create Exposure Initiatives, Combinations, and Jira tickets.
Attack Path: Identify and investigate your top attack paths and other toxic combinations based on your entire attack surface.

Tenable will continue to expand this collection of capabilities. Customers should expect new agents to appear in-product without requiring action from administrators, as long as Tenable Hexa AI is enabled for that user.

Trust and Governance

Tenable Hexa AI respects existing role-based access control (RBAC). It never operates with elevated privileges.
Container administrators can enable or disable Tenable Hexa AI for the entire environment.
Every Tenable Hexa AI action resulting in a state change is captured in the standard Tenable audit log.
Human-in-the-loop confirmation is required before any state-changing operation.

For more information, see Use Tenable Hexa AI via User Interface in the Tenable Exposure Management User Guide.

Tenable Hexa AI Custom Agents via MCP

With Tenable Hexa AI, you can build custom agents via the MCP server to achieve unique security workflows. It exposes Tenable's Exposure Data Fabric as a set of structured, governed tools to any MCP-compatible AI client. It lets your team bring its own LLM and orchestrate bespoke agents that reflect your unique workflows, vocabulary, and priorities.

This is how Tenable customers can implement a tailored maturity model: your model, your prompts, Tenable ground truth. This includes:

Universal AI adapter: A single, Tenable-hosted HTTPS endpoint at cloud.tenable.com/mcp/, compatible with Claude Desktop, Claude Code, Cursor, and any client that supports MCP over HTTP. No local install, no proxy, no infrastructure to maintain.
Agentic command of your Tenable environment: Tools spanning scan management, asset and finding search across your Tenable One inventory, dashboards and widgets, tagging, reporting, policy, and agent operations.
Bring your own LLM, keep our ground truth: Whichever model your organization standardizes on; your data is reasoned over by your model of choice, while every action is executed against the same governed Tenable MCP.
Cross-platform orchestration: Combine Tenable Hexa AI via MCP with other MCP servers (ITSM, IdP, ticketing, patching) to compose end-to-end workflows that span Tenable and the rest of your stack.

Tenable Hexa AI is included at no additional cost with Tenable One Foundation and Tenable One Advanced licensing packages. Token-based limits apply per tier. You can view your consumption on the Account Details and Tenable Hexa AI Settings pages within your Tenable One workspace.

Trust and Governance

Authentication uses standard Tenable Vulnerability Management API keys via the X-ApiKeys header. No new identity model to manage.
The MCP server has no elevated privileges. Every call is executed under the authenticated user's existing Tenable role and permissions.
All actions are written to the standard Tenable audit log.
The MCP server does not run autonomously, does not store conversation state, and does not make decisions on your behalf; every action originates from a user request through their AI client.
Because Tenable Hexa AI via MCP is a Bring Your Own LLM model, customers select an LLM provider whose data-handling practices meet their compliance requirements.

For more information, see Use Tenable Hexa AI via MCP Server in the Tenable Exposure Management User Guide.

May 18, 2026

Attack Path Lifecycle Management

Tenable is thrilled to announce that we are shifting APA from a list of techniques to an actionable traceable list. This update enhances collaboration and empowers an "Inbox Zero" workflow. This update includes:

Technique Statuses: Track real progress with To Do, In Progress, In Review, Done, and Accepted.
Intelligent Path Logic: Introduce Attack Path statuses that are automatically calculated. Marking one technique as Done sets the entire path to Chain Prevented, helping you prioritize "breaking the chain" with minimal effort.
Risk Acceptance: You can now Accept a risk with mandatory reason (e.g., False Positive, Compensating Control) the action will be recorded in a permanent Audit History Log and prevent duplicate investigation effort.

This means that default views now hide mitigated or accepted items, focusing you only on active exposure, which also helps enhance collaboration between team members.

Better Collaboration: No more investigating paths already blocked by team members.

Note: Existing "User Archived" items are now moved to the Open state with a status of Accepted. This ensures these items match the new model while preserving your historical intent.

For more information, see Attack Path and Technique Statuses in the Tenable Exposure Management User Guide.

April 15, 2026

March 26, 2026

Attack Path Full Export and AI Service Support

Tenable is thrilled to introduce the following highly requested features to the Attack Path section of Tenable Exposure Management.

Attack Path Top Paths/Techniques Export

Full export capabilities for Attack Path are now generally available! This feature is designed to bridge the gap between high-level visualization and actionable offline intelligence.

So far, Attack Path data export was limited to selected rows or a single page to CSV through manual UI export only. This new feature allows to move beyond these limitations and extract full datasets for Top Attack Paths and Top Attack Techniques directly into CSV or JSON formats.

Flexibly Managed, Integrated by Design

Whether you prefer a hands-on approach or automated workflows, this feature is engineered to fit modern security operations:

Manual UI Control: A high-visibility global export button at the top-right of tables allows you to trigger background jobs for massive datasets without interrupting your current workflow.
Granular Scope & Customization: Users can select between Selected Rows, the Current Page, or Entire Results matching their filters, while picking specific columns for the final export file.
Asynchronous Performance: To prevent browser timeouts, the system performs a direct high-speed fetch from the database and uses "Toasty" notifications to alert you when your file is ready for automatic download.
API-First Integration: Achieve full API Parity by using the Tenable Public API to programmatically extract path data directly into your SIEM, SOAR, or custom reporting tools.
Audit Ready: To meet enterprise standards, every action is logged in the Tenable platform Activity Log, recording the user, timestamp, applied filters, and export scope.

This initiative aligns Attack Path with the Tenable Exposure Management platform standard, moving us closer to our vision of a unified, world-class leading product on the Tenable One platform.

For more information, see Top Attack Paths and Manage Techniques in the Tenable Exposure Management User Guide.

Support for AWS and Azure AI Services

As organizations increasingly integrate Generative AI and Machine Learning into their cloud infrastructure, the attack surface expands. This update introduces comprehensive support for AWS AI services and Azure AI services, specifically focusing on:

Amazon Bedrock
SageMaker
Azure Cognitive Services
Azure Machine Learning

By mapping these entities and their complex relationships with cloud storage and IAM, security teams can now visualize how an attacker might pivot from a standard identity to poisoning a custom model or exfiltrating sensitive training data.

For more information, see Attack Path in the Tenable Exposure Management User Guide.

February 17, 2026

February 2, 2026

January 28, 2026

January Updates

Tenable is excited to announce the following highly requested additions and updates to the Tenable Exposure Management application.

Widget to Inventory Drill Down

Gain deeper insights with the new Widget Drill Down capability. Users can now click directly on the dashboard’s widgets to view the underlying data in the Assets or Findings Inventory pages.

Contextual Navigation: Redirection is intelligently mapped based on the widget’s specific measures.
Persistent Filtering: Any filters currently applied to your dashboard will automatically carry over to the inventory view, ensuring you never lose your place during an investigation.

For more information, see Drill Down to Inventory Data in the Tenable Exposure Management User Guide.

Dashboard Grid Mode & Snap to Grid

Introducing a new Grid View to the dashboard creator and editor, providing a visual guide for precise widget placement.

Toggleable Gridlines: Use the View menu to toggle gridlines on or off (off by default) to suit your design preference.
Snap-to-Grid: Perfect your layout instantly. By selecting a widget and clicking Snap to Grid, the widget automatically aligns with the nearest grid lines for a clean, organized look.

For more information, see Create a Dashboard in the Tenable Exposure Management User Guide.

Orca Security Third-Party Connector Availability

Tenable is excited to announce the addition of the Orca Security connector for use with Tenable Exposure Management. This new integration allows you to automatically ingest assets and security findings from Orca’s agentless platform directly into Tenable.

By unifying Orca’s multi-cloud visibility with Tenable’s exposure analytics, you can now assess and prioritize cloud-native risks alongside your traditional infrastructure, ensuring comprehensive coverage of your entire attack surface.

For more information, see Orca Connector in the Tenable Exposure Management User Guide.

Multi-Instance Support for Tenable Vulnerability Management

Tenable Exposure Management now supports the ability to connect multiple, distinct Tenable Vulnerability Management accounts into a single workspace.

This "connector" approach is designed for large enterprises managing segmented environments, acquisitions, or regional instances. It allows you to aggregate asset and vulnerability data from separate Tenable Vulnerability Management tenants into one centralized view, ensuring a unified global risk assessment without needing to merge accounts manually.

For more information, see Tenable Vulnerability Management Connector in the Tenable Exposure Management User Guide.

Tenable Open Connector - Phase 1 (Upload Static File)

We are excited to introduce the Tenable Open Connector, a flexible new method to bring data from any source into theTenable platform.

This feature enables the manual ingestion of asset and vulnerability data via static file upload (e.g., CSV, JSON). This is critical for organizations that need to track assets from custom internal tools, manual pen-test reports, or air-gapped systems. Once uploaded, this "offline" data is fully correlated with your existing platform metadata, ensuring a comprehensive risk view that leaves no gaps.