We just raised a $30M Series A: Read our story

Tenable SC OverviewUNIXBusinessApplication

Tenable SC is #5 ranked solution in top Vulnerability Management tools. IT Central Station users give Tenable SC an average rating of 8 out of 10. Tenable SC is most commonly compared to Tenable.io Vulnerability Management:Tenable SC vs Tenable.io Vulnerability Management. The top industry researching this solution are professionals from a computer software company, accounting for 25% of all views.
What is Tenable SC?

Tenable SC consolidates and evaluates vulnerability data across the enterprise, prioritizing security risks and providing a clear view of your security posture. With SecurityCenter, get the visibility and context you need to effectively prioritize and remediate vulnerabilities, ensure compliance with IT security frameworks, standards and regulations, and take decisive action to ensure the effectiveness of your IT security program and reduce business risk.

Tenable SC was previously known as Tenable Unified Security, Tenable SecurityCenter.

Tenable SC Buyer's Guide

Download the Tenable SC Buyer's Guide including reviews and more. Updated: November 2021

Tenable SC Customers

IBM, Sempra Energy, Microsoft, Apple, Adidas, Union Pacific

Tenable SC Video

Archived Tenable SC Reviews (more than two years old)

Filter by:
Filter Reviews
Industry
Loading...
Filter Unavailable
Company Size
Loading...
Filter Unavailable
Job Level
Loading...
Filter Unavailable
Rating
Loading...
Filter Unavailable
Considered
Loading...
Filter Unavailable
Order by:
Loading...
  • Date
  • Highest Rating
  • Lowest Rating
  • Review Length
Search:
Showingreviews based on the current filters. Reset all filters
JD
Sr. Principal IT Architect at a manufacturing company with 10,001+ employees
Real User
Enables us to centralize and correlate all data and understand where the gaps are in our security posture

Pros and Cons

  • "The predictive prioritization features are pretty good. They do a lot of research and we trust the research that they do internally. They have knowledge of what's going on with many companies, where we only get a view into what's going on here. So the ability to get best practices out of them as part of this solution, is valuable to us."
  • "Tenable also helps us to focus resources on the vulnerabilities that are most likely to be exploited. And since it is continuously updated, it allows us to reevaluate quickly if there are new vulnerabilities found..."
  • "There's a lot of information being streamed out of the reports. What would be nice, and maybe we just haven't found it, would be more of an executive-type view. We still expect it to collect all this information, but we would like a feature that would allow us to show it to an executive or a director or someone like that and give them some type of high-level overview but not get into the nitty-gritty."

What is our primary use case?

Our primary use case is compliance for our audits, for our customers. We were exposed in that we were not meeting contractual obligations.

We are monitoring our infrastructure: servers, switches, storage, routers, SAN storage, operating systems, and applications to the extent that the tool is able to see into them. We use it to hit the high ones like Adobe or Microsoft Office and the like. Some of the more niche products that we use may not be in their inventory of vulnerabilities.

How has it helped my organization?

It helps us prioritize based on risk and it also helps us prioritize manpower, to show we are getting the most value from the limited number of man-hours that all organizations face. We have the same problems: Where do we need to focus? Where do we need to focus money? And where do we need to focus additional expertise that we don't have or didn't think we needed.

Overall, we use it as a third-party — I don't want to say settle arguments — but as an expert opinion as to what is a true vulnerability is, versus what is something that isn't as high of a priority. It takes opinion — if two cybersecurity people are arguing or discussing if this thing is more important than that thing — and, since Tenable is not invested in our company, gives the best practice. It is very valuable in that sense.

In terms of cyber exposure, it allows us to centralize both vulnerability management and visibility. We have one place to look instead of going through: Okay, we're using the Microsoft tool, and now we're going to go use the Cisco tool, and now we're going to go use the Red Hat tool. It allows us to centralize and easily correlate all data together, and then use the prioritization or just understand where the gaps in our security posture lie. That's more valuable than saying, "Okay, here's this report for Microsoft, and now we're going to print out a report from Red Hat, and we're going to print out a report from Cisco, and we're going to print out a report from NetApp, and we're going to put them all together and then we're going to discuss it." Having it in a single view is very valuable to us in that it saves us a lot of time.

Tenable also helps us to focus resources on the vulnerabilities that are most likely to be exploited. And since it is continuously updated, it allows us to reevaluate quickly if there are new vulnerabilities found, versus ones that we're already working off and are already known to us.

And since cybersecurity and IT security are not a fix-it-and-forget-it scenario — it's a continuous process — having a tool like this, especially one that is continuously monitoring our environment, is very valuable. It's not that we're not doing this once a year, we're not doing this once a quarter. We're doing this every day.

Finally, the solution has reduced the number of critical and high vulnerabilities we need to patch first.

What is most valuable?

The continuous monitoring piece has been very valuable to us. 

The vulnerability priority setting in the software has been very useful to us as it allows us to focus on what's most important. We use it as a piece of our holistic look into our security stance.

The predictive prioritization features are pretty good. They do a lot of research and we trust the research that they do internally. They have knowledge of what's going on with many companies, where we only get a view into what's going on here. So the ability to get best practices out of them as part of this solution, is valuable to us.

The Vulnerability Priority Rating is also pretty good. It's a much more holistic view, instead of being very binary, which we tend to see. It lets us focus on what's most important to us, especially because it goes across many products that we have. It's good in that we see how each of these stacks up and where our priorities should be. Should they be in Cisco, should they be in Microsoft, should they be in Linux? That's very useful to us as well. We'd love to do all the work right now, but we have to pick some type of priority in terms of what we're going to focus on, before we focus on the less vulnerable items.

What needs improvement?

Using the product — especially very early on — even though we have things like prioritization, it can be a little verbose in that there's a lot of information being streamed out of the reports. What would be nice, and maybe we just haven't found it, would be more of an executive-type view. We still expect it to collect all this information, but we would like a feature that would allow us to show it to an executive or a director or someone like that and give them some type of high-level overview but not get into the nitty-gritty.

For how long have I used the solution?

We started using this iteration of it two years ago, but we had been a previous customer of theirs as well.

What do I think about the stability of the solution?

We haven't had any problems with it. It seems stable. They make changes to it regularly, to both the vulnerability database and the product itself. They seem to be going through with a reasonable update path and they support previous versions for the expected amount of time.

We haven't seen any crashes or spikes.

What do I think about the scalability of the solution?

It scales just fine. We're a Fortune 500 company so, obviously, we have very large networks here. As far as we know, it should scale. We don't think we can outpace the scalability of it. There are best-practices that we need to follow, but will this product be able to meet our needs for future growth. We expect it to be able to handle that.

Usage will be increased. There are two parts to the business. There's the business that is our overall corporate business, which is covered 100 percent by the solution. And then there's the manufacturing and design business. On that side, the solution is still growing. We have two contracts with Tenable for their SC product.

How are customer service and technical support?

We think technical support is pretty good. We have specific needs as defense contractors and they're able to meet those. We have a good account team. We have a customer success manager, Ryan Zentz, and we have a good account executive, Scott Mahan, and they do as much as they can to head off any issues that we have, instead of putting in a ticket or getting something escalated. They do a good job of helping us.

Which solution did I use previously and why did I switch?

We previously used their lower version of security management. It was their single-install product, Nessus. We were using the standalone, non-enterprise version.

How was the initial setup?

The solution would be fairly simple, but because of our implementation it was fairly complex and we hired Professional Services to do it. We're not a typical example. As a straightforward install, I think it would be very easy. But because of our size and scope, it was a little tricky.

We have multiple deployments so we hired Professional Services for two weeks to do them. Some installations were done in a few hours and some of them took a few days. But, overall, we hired ten days of Professional Services.

We were focusing on installing first in our non-production environments; getting familiar with the installation, the capabilities, and what the overhead of the product was going to be on the network. From there did some testing and ran that through some discussion and a panel of in-house experts and decided that we would be good to go forward with production. 

We then repeated that, where we would install in a small section of production, run a test to make sure that it didn't break anything or that it didn't cause undue harm. And then we went forward with expanding it out.

Now we have a process in place for installing for any new section of the network that comes up or any new infrastructure that we put together. It's a little easier for us to handle now that we're not tackling the big network. We're just handling delta changes over time.

What about the implementation team?

We used their in-house professional services. Our experience with them was good. They had someone onsite and who was well-versed in the defense industry. He was able to get it installed and answer our questions. We didn't have any problem with him. We liked him so much that we brought him back for another week.

What was our ROI?

Having Tenable is a requirement. It is a compliance piece which is part of our business. But it is money well-spent in that it focuses us to work on problems that are prioritized and it allows us to cut down on the manual integration of multiple reports from Microsoft and Linux, etc. It does save us considerably in that we can have less staff assigned to it, versus having a Linux team and a Windows team and a NetApp team, etc.

Running with a much smaller team of two people probably saves 80 percent of manpower. I would assume that the team would be ten people or so if we had to mash together multiple reports and spend time doing that.

What's my experience with pricing, setup cost, and licensing?

I don't know our licensing costs but they're in the seven figures. We have an enterprise license, so I believe everything is tied up in that. We do not have any additional cost other than our large enterprise license.

The licensing is a little involved from both sides. That may be due to our specific implementation of it because we are a defense contractor. I feel we rely a lot on their customer service and they rely on us to do a lot of manual labor to get licensing installed or to get licensing. If there were some type of smoother transaction, that would be great.

I would like more self-service in the granting and rescinding of SC licenses, and that way we wouldn't have to be involved with customer service as much or with our account executive.

Which other solutions did I evaluate?

We did two sets of white papers looking at the competition. We did a white paper in 2015 and another one in 2018. We selected Tenable after the 2018 white paper was written.

Between 2015 and 2018, the market had contracted considerably. Many of the products that we evaluated in 2015 had either been bought out by a competitor or just no longer existed. When we looked at it in 2018, Tenable had the strongest pedigree. They also had the ability to scale the deployment, versus some of the other products. 

We looked at Ivanti, which really wasn't designed for vulnerability management; it was a bolt-on. We looked at Qualys. That was too heavy-handed. It was a good product, but there was too much overhead in managing or maintaining that product.

Tenable was the best fit for our needs. Tenable is also the provider for the ACAS solution for the US government. Since the vast majority of our customers are government customers, and our auditors are government officials, it was seen as an easy way to get past an audit, or at least that we would be looked upon favorably.

We did not test any of the competitors. We had done some tests in 2015, but again, many of those competitors were no longer in business or they had been bought out. The other product that made it as a finalist was Qualys, but there was a significant commitment and infrastructure needed. We felt that if that was the minimum just to get it tested, then it was not going to work for us on an enterprise scale.

What other advice do I have?

Go in with open expectations. Companies don't realize how big their infrastructure really is before they can get a single pane of glass view, which Tenable provides. Don't be disheartened when you run that first scan. It is a process. This is not a sprint, this is a marathon. If you're not willing to invest in this for the long run, then maybe your organization just isn't ready.

I don't know how to assess our vulnerability status compared to that of our peers. The defense industry is fairly secretive about what goes on. But I think we're doing the right things. Having the licensing and the investment that we put in place puts us ahead in the industry. I can only really speak for myself, but I think that we are doing the right things, and investing the right dollar. And if our competitors are doing that, good for them. If not, I wish they would.

Security Center is generally run by either the information security manager or the information security officer. There are a few dozen people who have access to it and their roles would be two-fold: There are the lower-level, cybersecurity folks who are dealing with it on a day-to-day basis. And there are the more managerial types who would be getting reports and making decisions off of it. Lastly, the general IT staff would be using the reports or the remediation recommendations for making changes to their environment.

For deployment and maintenance of the solution we don't need that many. We had Professional Services in and we added a team of four to the Professional Services engineer to help us get it stood up over those two weeks. In terms of ongoing support of the solution, we have one or two people who are tasked with updating the vulnerability database and verifying scans and the like. But it's not overly burdensome. They are information security officers or cybersecurity specialists.

I would rate Security Center at eight out of ten. First, it's a little heavy-handed for us from a licensing perspective and second, there are some features and functionality that we'd like to see in the future which would make it more user-friendly for non-technical or more managerial types. It seems that the product is really written for technologists, especially on the reporting side.

Disclosure: IT Central Station contacted the reviewer to collect the review and to validate authenticity. The reviewer was referred by the vendor, but the review is not subject to editing or approval by the vendor.
Manoj Nair
Tech Specialist at Select Softwares
Real User
Top 5Leaderboard
Provides clear and precise vulnerability details with few false positives compared to other solutions

Pros and Cons

  • "This solution has a much lower rate of false positives compared to competing products."
  • "The vulnerability scan does not work correctly until the access privileges are set by the system administrator."

What is our primary use case?

I use this solution to perform vulnerability assessments and then patch my systems using third-party tools.

The vulnerability scan is pretty fast and once you give it the right access privileges on the target system, you get very clear and precise details of the vulnerabilities.

How has it helped my organization?

This solution has a much lower rate of false positives compared to competing products.

It can operate in hybrid mode, too. The greatest strength of the product comes up when the agent is deployed on the endpoint to be scanned. Thereafter, even if the agent is out of the office network, it can still be scanned and will also send back data to the parent console.

What is most valuable?

The dashboard and the templates used to delvelop reports are awesome.

It is easy to run, scan, and categorize an asset as and when needed. The same asset can be present in two or more groups based on the identification.

This solution can now be deployed in cloud setups.

This solution provides a good reporting system and with a reasonably good level of third-party integration. McAfee has leveraged this capability beautifully in its Policy Orchestrator.

What needs improvement?

We need to give more customer demos and also highlight the strengths of the product that have been developed over a twenty-year period.

The vulnerability scan does not work correctly until the access privileges are set by the system administrator.

For how long have I used the solution?

I have been using this solution for a few years.

What do I think about the stability of the solution?

This system is stable under normal configurational mode. It is important to understand how many hosts it will handle and size the system accordingly.

What do I think about the scalability of the solution?

This is a very highly scalable system.

How are customer service and technical support?

I have not contacted technical support so far, as there was no issue to escalate.

Which solution did I use previously and why did I switch?

We did not use another solution prior to this one.

How was the initial setup?

I have worked on a few demos and they have been pretty straightforward to setup.

What about the implementation team?

I perform the deployment of this solution.

What was our ROI?

Yet to be calculated.

What's my experience with pricing, setup cost, and licensing?

Costing is pretty reasonable compared to the competition.

Which other solutions did I evaluate?

We evaluated Rapid7 and Qualys before choosing this solution.

Disclosure: My company has a business relationship with this vendor other than being a customer: I work for a software dealership and we have had good responses from customers on the product and its capabilities
Learn what your peers think about Tenable SC. Get advice and tips from experienced pros sharing their opinions. Updated: November 2021.
554,676 professionals have used our research since 2012.
JK
IT Security Specialist at a consultancy with 1,001-5,000 employees
Real User
Automatic scanning distribution and the ability to write custom audit files are distinguishing features

Pros and Cons

  • "One of the most valuable features is their distributed scan model for allotting engines to work together as a pool and handle multiple scans at once, across multiple environments. Automatic scanning distribution is a distinguishing feature of their toolset."
  • "It's good at creating information, it's good creating dashboards, it's good at creating reports, but if you want to take that reporting metadata and put it into another tool, that is a little bit lacking."

What is our primary use case?

Vulnerability assessment and compliance auditing are our primary use cases. That includes baseline configuration scanning. We use it to protect everything in the enterprise environment: servers, workstations, pretty much all operating systems, networking gear. We are doing cloud and we are doing some IOT. We are not using their web application scanning tool.

How has it helped my organization?

The ability to view the plug-ins, the way that the plug-in library works, is really good. It's not an individual list of 80 million different CVEs. We can actually just say, "Hey, here's a plug-in," and it really helps us to boil things down. Instead of having a million CVEs, here's the specific plug-ins that are actually tying the CVE families together. That helps our platform owners, if there is an issue, to see what it is and understand better how to fix it.

Also, the fact that they display the very specific plug-in output in their details area helps our platform owners know, if there's an issue, specifically what was checked and what versions it was on at the time of the test. That's just huge. It increases the trust in the information from the tool. It cuts down on accusations of false-positives and it helps people do their job better.

It helps us to understand our cyber-exposure. At the end of the day, if you don't know what you have, then you cannot defend against it. Understanding what services, what technologies, and all those components will also give us an idea about how to predict what kinds of attacks are the things that we need to guard against in the future.

It also helps us focus resources on the vulnerabilities that are most likely to be exploited. Looking at what actually has an exploit available along with consideration of other things such as network proximity times and information about the threat - either VPR or CVSS - pulling all that together does allow us to identify pretty quickly what are the high-priority targets that we should work on.

What is most valuable?

One of the most valuable features is their distributed scan model for allotting engines to work together as a pool and handle multiple scans at once, across multiple environments. Automatic scanning distribution is a distinguishing feature of their toolset.

Also, the ability to trend data back as far back as we have disk space for, is helpful.

Finally, the ability to write custom audit files is a really helpful and useful feature. That's something that not a lot of assessment companies have gotten right. There's room for improvement, but literally being able to take the text file, open it up, and adjust the changes, write your own regex and write your own checks, is huge.

What needs improvement?

It's good at creating information, it's good creating dashboards, it's good at creating reports, but if you want to take that reporting metadata and put it into another tool, that is a little bit lacking. It does great for things for the API. For instance, if we say, "What vulnerabilities do we have?" or "How many things have we scanned?" those things are great. But if we want to know more trending stuff over time, it can create a chart, but that's in a format which is really difficult to get into another program. Integration into other reporting platforms, or providing more specific scanning program metadata, would be an opportunity.

It does have a fully-bolstered API which is available online that you can look at, but it is more aimed at getting more vulnerability information out instead of reporting information out.

For how long have I used the solution?

We've been using it for about two years.

What do I think about the stability of the solution?

We've had more problems with the underlying stuff that is running the operating system, as opposed to actually running Tenable. Tenable SecurityCenter has been pretty stable. We've only had one or two smaller technical issues. There have been other issues, but they've not been Tenable's fault.

What do I think about the scalability of the solution?

It does have an upper limit. You can go on their website and see what their upper IP limit is.

We have seen that more and more teams want to get access to the data and get access to their vulnerability information, and it really has helped us grow our program.

How are customer service and technical support?

Their tier-one, initial tech support is pretty bad. Their premium support is excellent. Whether premium support comes at an extra fee depends on how your negotiations go.

Which solution did I use previously and why did I switch?

We migrated from Nexpose. We switched because Nexpose is not a scalable product for an enterprise. Also, in most instances, SecurityCenter is less false-positive prone and the detection seems to be better in most instances.

How was the initial setup?

The initial setup was very straightforward. In fact, for some of our teams, we've actually done - "capture the flag" is a bad word for it - but effectively that type of an activity, and they pretty much go from naked box to Tenable scanning instances within a couple of hours. It's very easy to set up.

I can safely say that it can be deployed with one person. And it doesn't require a lot of maintenance. It depends on how much you use it for, but it's mostly just set-it-and-forget-it. Then there is just the mechanical stuff of patching the box and applying system updates, but it actually does a pretty good job most of the time.

What was our ROI?

We've seen return on investment through visibility, scan stability, ensuring that we're able to assess our environment. Also, ensuring that we are able to have good confidence in the data, and that we're able to do out-of-the-box reporting and various other dashboards that really help us drive our program and help sell our case.

Which other solutions did I evaluate?

We evaluated Qualys. It depends on whether you want to do on-prem or in the cloud. Qualys really is a black box. You literally put this thing on your network, you can't touch it, and if you want to do something like troubleshoot, it is just not very friendly from an "if things go wrong" perspective.

What other advice do I have?

Make sure that your sizing is done correctly, in terms of the hardware size. When you do buy Tenable, a lot of times you'll use Professional Services to help you implement the tool. Whatever advice Tenable has, listen to it very specifically and also talk to them specifically about what your goals are. Instead of talking tactics, talk about goals. What's going to happen is that they may say "Hey, we're going to do things slightly differently than how you used to do it," but in a lot of instances, they're going to be right.

In terms of features that we're looking forward to, VPR is one that we're going to start using more. And they also recently had a SAML integration for single sign-on. That was a new feature in 5.9.

Overall, Tenable is easily a nine out of ten. It's not a ten because there is no perfect tool out there, and Tenable SecurityCenter does have its limitations.

Disclosure: IT Central Station contacted the reviewer to collect the review and to validate authenticity. The reviewer was referred by the vendor, but the review is not subject to editing or approval by the vendor.
Joey Smith
Medical Device Cybersecurity Analyst at a healthcare company with 10,001+ employees
Real User
Enables very customized policies to routinely scan, while simultaneously not causing impact

Pros and Cons

  • "What is useful to me is being able to fulfill very customized scanning policies. In the clinical environment, because of vendor control, we can't perform credential-vulnerability scanning. And network scans, which I've done before, can cause a lot of impact. Being able to create very customized policies to be able to routinely scan and audit our clinical networks, while simultaneously not causing impact, is important to us."
  • "If I want to have a very low-managed scan policy, it's a lot of work to create something which is very basic. If I use a tool like Nmap, all I have to do is download it, install it, type in the command, and it's good to go. In Security Center, I have to go through a lot of work to create a policy that's very basic."

What is our primary use case?

I'm the one who scans and performs assessments on clinical and medical equipment in our environment. I manage the clinical endpoint devices: MRI systems, bedside monitoring, Alaris pumps, fusion pumps, CTUs, EEGs, EKGs, wireless defibrillators, and a lot of IP cameras that are part of operation room labs. My colleague handles all the regular enterprise IT, database servers, etc. From a scanning standpoint, I do everything from discovery scanning to full-credential auditing and anything and everything in between. That's just for the medical space in a 24/7 production medical environment.

We're also using a bit of the Passive Vulnerability Scanner and, eventually, I want to get to using the agents, but we haven't gotten to that stage yet.

How has it helped my organization?

My department is not enterprise-managed. We don't use like tools like SCCM to push out patches. Everything is manual updating. I need to be able to track and audit against our devices and know what exactly what Microsoft hotfixes I need to see. I need to identify what specific patches are missing on devices. Or, for example, there was a Microsoft CVE alert that was put out a couple of weeks ago for RDP, Remote Desktop Protocol. I'm using the scanner now to try to identify what devices we actually need to look at to address risk on. Including IP cameras for our different labs, I manage over 40,000 devices. So I really need to know what exactly I need to focus on for a given vulnerability, such as the Microsoft one, as they come about. Tenable really helps with the identification piece, in a way that traditional IT policies and procedures and tools cannot.

It saves me time. When I get into actually identifying impacted assets in my environment - and having to deal with fewer false positives - it could save me up to eight to ten hours a week, for things like the RDP issue we're dealing with now; for the things that really come out as priorities.

Security Center helps to limit our organization's cyber exposure. In our environment there is a lot of stuff we can't deal with in terms of endpoints, but it has definitely helped in identifying the devices we have out there which haven't had Microsoft updates applied in years, potentially. It's really helped identify those, the low-hanging fruit. But then, you get into the devices that are relatively up to date but their vendor application has been the same for however many years. In the least, we're able to identify and understand which devices those are and what the risks are, even if we can't immediately address it.

In terms of reducing the number of critical and high vulnerabilities we need to patch, it has helped me to identify them, and I address them accordingly. As I said, there is stuff we can't address, but at least it helps us identify them, and we are able to address some of them. It's helped us identify vulnerabilities and put in compensating controls and mitigating controls. It has definitely reduced the risk exposure we've had.

Also, rather than rely on high-level communication from vendors about whether or not their products may be impacted, I can use scans to actually identify what is impacted or in scope for a given vulnerability. It used to be, a couple of years ago, if I had to identify systems, I had to know at a high level if some of these devices could be impacted. It would create a lot of false positives. Since we've been using the scanner, I've been able to narrow that down quite a bit. I still get false positives, but I certainly get a lot fewer than I used to. It helps me have a more managed focus with any scope I'm looking at.

What is most valuable?

What is useful to me is being able to fulfill very customized scanning policies. In the clinical environment, because of vendor control, we can't perform credential-vulnerability scanning. And network scans, which I've done before, can cause a lot of impact. Being able to create very customized policies to be able to routinely scan and audit our clinical networks, while simultaneously not causing impact, is important to us. That requires a lot of flexibility in how we create the policies, so flexibility in policy-creation is a big feature. 

For me, another useful feature of the tool is the dashboard and reporting. That is a big piece for me. The reporting covers most of my needs.

In terms of integrations, so far, from what we've seen and for what we're trying to accomplish, it's been pretty flexible.

The Vulnerability Priority Rating is useful. I run scans on all of our medical equipment and we have stuff that's still Windows 2000. Equipment is so expensive to upgrade and replace. I find a lot of it shows up red for vulnerabilities that we really can't do anything about. The predictive stuff helps prioritize some of those risks. At a high level, it helps narrow that scope. There is still a lot of manual work on my end because, as I mentioned, I really have to know what equipment I'm looking at exactly from a medical standpoint. But it does help narrow the scope.

What needs improvement?

In terms of the reporting, it's good for IT tools, but it doesn't give me contextual insight into what device, what kind of medical equipment it is. And in my world, that's a big deal. That's a con, given what my needs are. We can't integrate it with our biomed database to correlate data. So I can know what vulnerabilities are on it by IP address, but it doesn't tell me what device it is. Is it an MRI or a workstation? Is it the workstation which is running MRI's or is it the one that's just pulling patient images? Things like that are things that I need to know, and usually the tool can't do that in and of itself. With that said, we do have some work toward some other integrations to try to improve some of that.

Also, I don't know of a process right now to do what I'll call mass risk-acceptance. I have thousands of devices which allow high and critical vulnerabilities and there's really not much I can do about it. But if we put a firewall in front of it, the risk of the whole device is accepted. I need to be able to accept all those risks in the tool. It's really not easy to do within my workflow at this time. There are ways to get around it, but they're not conducive to what I do in my work.

If I want to have a very low-managed scan policy, it's a lot of work to create something which is very basic. If I use a tool like Nmap, all I have to do is download it, install it, type in the command, and it's good to go. In Security Center, I have to go through a lot of work to create a policy that's very basic.

Finally, the way we're using it now, for routine scans, it's only good for as long as a device is active on the network. That's one of my biggest concerns at this time: What about the stuff I don't have access to on the network when it runs the scans?

What do I think about the stability of the solution?

We have quirks every now again. Sometimes, when I click into the analysis dashboard, I get errors. For example, it will say it can't pull up a specific query. I just let the problem persist. I can work around it and, eventually, it just seems to fix itself.

Beyond that, it's been pretty stable. We have a lot of firepower behind it and in my experience, it has always been up. There aren't that many operational issues with it.

What do I think about the scalability of the solution?

When you throw in the Passive Vulnerability Scanner, just being able to spit out more hardware if we need it, it seems like it scales well, at least with respect to our environment. When we first had it, we only had a handful of servers powering it and scans took forever. I don't know how many servers we have on the back end powering it now, but it's a lot faster. We've added to it to give it more juice. That's been pretty easy and straightforward as well.

How are customer service and technical support?

I don't generally talk to tech support. That's handled by my colleague or someone else in the security team. But I talked to them when I was at my previous organization where we used Security Center. From what I vaguely remember they were helpful.

Which solution did I use previously and why did I switch?

We used Rapid7 Nexpose. In our view, Security Center is a more thorough tool. It has more plugins to scan against a lot of vulnerabilities, and it is a bit more granular. Overall, it's been a better tool to use.

How was the initial setup?

As for the initial setup, that would be a tech question. The only thing I've set up is the Passive Vulnerability Scanner. That was pretty straightforward. When I got to the point of setting it up with Security Center, it took my colleague and me under an hour. That was just our first one. It's pretty straightforward once you know how to do it.

We have an enterprise issue, so for us to be able to capture all that is needed from the clinical side, we would have to have deployed it at every site. It's because there is a lot of Layer 2 traffic. Since we have Security Center centralized, traffic will route out. Since we have networks at the sites that don't route out, we can't scan that traffic remotely. The idea is to have one at each site but, because of the standards in our organization at this time, we can't do that.

What was our ROI?

It's less a question of ROI and more a question of cost avoidance, meaning avoiding the potential cost from having a vulnerable device that can be breached. Security is a sunk cost in any organization. You never truly know its value until you have an incident.

What's my experience with pricing, setup cost, and licensing?

The pricing is more than Rapid7 Nexpose. PVS and the agents, etc., are all part of that agreement. So it's pretty comprehensive, but I don't know how much it is.

Which other solutions did I evaluate?

In my own work, I've used some open-source solutions like Nmap. I've messed around with Retina, another open-source solution. Most of the stuff I've used has been freeware, open-source tools. In terms of a commercial competitor, the one I've used most is Nexpose, Rapid7's tool.

One thing I liked about Rapid7 Nexpose, that Security Center does not have, is that when we scheduled scans in Rapid7 Nexpose, there was a graphical calendar that showed when scans are taking place. Security Center doesn't have that. It's a small thing, but it helps to visualize what's happening.

What other advice do I have?

In my type of medical environment, when you get into an operational technology environment, PVS or something that's a passive scanner is more the way to go than something that actively goes out and scans and tries to interrogate endpoints, because that can cause impact. When dealing with the healthcare space or, say, the electrical grid, the consequences can be very widespread or can cause significant impact. Something like PVS is a great idea to look into.

If you're scanning operational technology, definitely use connectionless-oriented discovery policies. For example, perform UDP scans instead of TCP scans. From my experience, TCP scans have definitely brought down systems.

When it comes to insight, it helps but, the way we're using it now, scans only pick up what's active on the network, while the scan is occurring. For my environment, I perform most of my scans overnight, so I'm missing a lot of stuff that is used during the day in the clinical environment. That includes point-of-care devices, ultrasonography, and some other stuff. I don't scan the networks during the day, for the most part, so I do miss a lot of that stuff. PVS, the passive scanner, would pick up on a lot of that. When talking about actually detecting intrusion, I think it would be more powerful if we're able to get it deployed everywhere.

Two people in our organization actively use it for a lot of scanning. Some of the other security guys use it, but for the most part, it's just my colleague and I who use it. I have my scheduled, routine scans that run automatically and there are the scans I schedule for overnight. I run discovery scans daily. I run my vulnerability audit scans every other month. I'm doing the RDP scans now. I log into it daily and I run scans in it several times a week manually, outside of the scheduled scans. I use it heavily.

Right now there is just one person who manages the solution. I handle some of the PVS stuff but it's my colleague who is running the show.

Overall, I would give Security Center a nine out of ten. Of all the tools I've used, when it comes to managing the vulnerabilities and risks of a whole enterprise environment, I don't think I've used a better tool than Security Center. The reason I say nine and not a ten, is because I like to have a lot of control. When I use a Nmap, I'm able to write my own scripts. Security Center has a lot of that built-in, but I feel like there's very deep and more granular control once you know how to use some of the open-source tools out there.

Disclosure: IT Central Station contacted the reviewer to collect the review and to validate authenticity. The reviewer was referred by the vendor, but the review is not subject to editing or approval by the vendor.
DN
Senior Information Security Analyst at a financial services firm with 1,001-5,000 employees
Real User
A scalable solution for detecting and pro-actively mitigating network vulnerabilities

Pros and Cons

  • "I think that this is a good solution for evaluating vulnerability in the network."
  • "The web application scanning area can be improved."

What is our primary use case?

The primary use case is to perform vulnerability assessments across the entire network.

How has it helped my organization?

This solution has given us visibility of the vulnerability in our network. It also shows what needs to be done to negate the vulnerabilities by providing links to the solution for those issues. Generally, we are now able to manage our vulnerabilities better. We can identify them, prioritize them, and then negate them. It has improved our security posture.

What is most valuable?

The most valuable feature is its ability to scan for vulnerabilities in our important systems, networks devices, and so on.

What needs improvement?

The web application scanning area can be improved.

A feature that I would like to see is the ability to integrate with exploit tools. 

For how long have I used the solution?

Two years.

What do I think about the stability of the solution?

It's a really stable solution. So far, I have not had any issues. Once it was installed it was very stable, very few bugs. It has topped expectations.

What do I think about the scalability of the solution?

It's easily scalable. If you are required to scan more assets then you just request for it to be expanded, such as from two thousand to five thousand. Scalability is not an issue.

The system is used by around thirty-five users including system admins, who ensure that the system is up, and the application admins who are responsible for fixing the issues that are picked up with the solution.

We use it across our entire network so we cannot expand its use any further.

How are customer service and technical support?

Their technical support is quite good, and they're very responsive. If there is any issue they perform quite quickly. Also, the local partner is well versed in the solution so they give us the support we need.

Which solution did I use previously and why did I switch?

We did not use a solution prior to this one.

How was the initial setup?

The initial setup, including the GUI, is very straightforward.

The implementation took about three months, and then the maturation took about six months.

We have about two people for maintenance.

What about the implementation team?

We were working with a local partner for the deployment.

What was our ROI?

We have seen ROI for this solution. It has reduced our security vulnerabilities. Even during the national audit, one of the findings is that this solution is helping us be more productive. We're able to find these issues before somebody else finds them. We can fix them before they are discovered by others.

What's my experience with pricing, setup cost, and licensing?

The licensing costs for this solution are approximately $100,000 US, and I think that covers everything.

Which other solutions did I evaluate?

Before choosing this solution we evaluated Qualys Labs and Rapid7.

What other advice do I have?

This is a good solution for evaluating vulnerability in the network. It gives wide coverage, and it is able to scan most platforms on the network.

I would rate this product an eight out of ten.

Disclosure: I am a real user, and this review is based on my own experience and opinions.
BJ
Information Security Expert at a comms service provider with 5,001-10,000 employees
Real User
Quick turnaround time but needs a good plugin editor

Pros and Cons

  • "We really love the Security Center dashboard. It basically performs vulnerability scanning and then outputs a vulnerability data."
  • "A good plugin editor would be a good additional option for the Security Center."

What is our primary use case?

I primarily use this solution for vulnerability assessment on the assets that we have. This includes servers, network equipment, appliances, routers, firewalls, and switches. 

How has it helped my organization?

Before, we did manual management of our assets. We have an EXO file that has all our assets in it. They have the IP address and all the details of each equipment. We manually enrolled those assets to our vulnerability scanning tool for them to be scanned on a monthly basis and check what new vulnerabilities they may have. With the  Security Center, we are able to automate. We were able to automate how we enroll our assets in the Security Center, and the scheduling of when we scan each asset, and how we report them to respective system owners. We are trying to use it as a channel of a self-service platform to the system owners or system administrators. It helps to access the Security Center for them to review the vulnerabilities that the equipment or the servers may be assigned or under the domain.

What is most valuable?

We really love the Security Center dashboard. It performs vulnerability scanning and then outputs vulnerability data. When you are working with one, two, three, up to 10 IT pieces of equipment, managing the vulnerability data would just be fine, but when you are managing assets across an organization of 10,000+ employees, you have a really hard time normalizing those vulnerability data. The dashboard helps us out to map what things need to be prioritized, what is our current threat landscape and what would be the latest threats that we have in our network.

What needs improvement?

One of the challenges that we may have experienced with that platform would be the flexibility of how to modify or create. They have this configuration compliance audit function, so if ever an organization has their own configuration standards that should be set on their servers, you have to modify those plugins in Tenable for it to match the specific values that you are looking for when you perform the configuration assessment on your equipment. It is a small challenge because it uses regular expressions on their plugins and so we are having a hard time either creating a blank template from scratch. We usually base our compliance audit plugin on an existing one and then modify the values or describe whatever is not up to our standards. A good plugin editor is an additional option for the Security Center.

For how long have I used the solution?

One to three years.

What do I think about the stability of the solution?

Whenever you have a vulnerability scan running of  5000 IP addresses all at the same time running, it tends to keep resources on the Tenable server itself, a huge amount of CPU and memory. Right now, it's still goes up, but at least it's below the threshold, which I think would be 73% or 75%.

What do I think about the scalability of the solution?

As long as you can buy the license, you can easily add up until you need an additional scan engine.

Which solution did I use previously and why did I switch?

We previously used Qualys Virtual Scanner Appliance.

How was the initial setup?

Setup is easy as long as you have the right hardware requirements. The deployment took about a week. We used two network guys, two system admins, one application admin, and two security admins to implement the solution.

The longer process was on the hardening part of the components of the servers. We had to install everything on servers, all the dependencies, all of the software that Tenable needs, including the Security Center itself, and then once everything is installed, meaning everything is locked down, no other software is needed to be added to it. We performed a patch check and configuration checks on it to see they have met our standards. After that, we requested the connectivity performance from our firewall team and performed discovery across our network, if it will be able to see all the systems or all the IPs or all the networks that we have in our network. That would be one of the long processes that we took since there were a lot of different network segments that each engine or each Tenable component will pass through. We had to look for each one, just to make sure that we have the full coverage of our network.

What was our ROI?

We're able to save because we don't have to employ more staff members to help with the scheduling of the scans, running the reports or sending them out to the system owners. That alone is a big ROI. A massive security breach would cost us a lot. This is a preventative measure worth our investment.

What other advice do I have?

Before, just preparing the monthly scans alone would take us about two weeks to set up. Then, we would have to wait for at least another two weeks for those assessments to be done, for the scanning to be done, and then it will take us about another two weeks to generate the report before we can send them out to the system owners. That's the reason why those were our main drivers, as well, for us to push the use of the Tenable Security Center as a self-service platform to the system owners. The quick turnaround time in terms of generating reports and sending them out to the respective system owners is significant.

Disclosure: I am a real user, and this review is based on my own experience and opinions.
Abill Nerry
Senior Manager, IT Security at a financial services firm with 5,001-10,000 employees
Real User
With the Assurance Report Cards, we can have a quick review of security concerns in a simple glance.

Pros and Cons

  • "The most valuable feature of the product is the Assurance Report Card, which gives us an overview of the security poster in just a simple glance."
  • "Initial setup was pretty straightforward."
  • "It basically reviews our threat landscape vulnerability."
  • "In terms of configuration, there is some level of flexibility that we are not able to achieve."
  • "At times we have had the typical bugs."

What is our primary use case?

Basically it reviews our threat landscape vulnerability. So, we just want to be sure that we check compliance in terms of our configuration and compliance to our policies. But, the key is to make sure that we are not exposed to vulnerabilities that can be exploited. So, it's more of just securing our threat landscape.

How has it helped my organization?

It easily detects issues, and alarms the site.

What is most valuable?

One valuable feature is the Assurance Report Card. with the Assurance Report Card, we are able to give our overview about security posters in just a glance. And with a report to cut this we can quickly, our executives can quickly consume that without going into the difficulties of the vulnerability issue.

What needs improvement?

In terms of the configuration of the reports, there's some level of flexibility that we are not able to achieve. In terms of configuring the reports to achieve certain percentages and all of that. So, that's really the main thing I've noticed. But, apart from that, I think it's one of the best vulnerability management tools I've used, in terms of giving us the full visibility into the environment.

For how long have I used the solution?

One to three years.

What do I think about the stability of the solution?

There were no crashes, or anything of that sort. The solution is stable. At times, we have had the typical bugs, but it's not something I would say is a big deal. It is maybe once in a quarter--insignificant.

What do I think about the scalability of the solution?

I did not have any issues with scalability. This is because once you scope the main control, the Security Center box, you do proper saving on the main box in terms of storage. Initially, when we did the first installation, we did not properly size our storage. So, we quickly entered issues. But, since it was  Linux box, we were able to reconfigure and make development for additional storage. Once we did that, there has not been anything that tested the scalability. So, when the growth becomes a little high, we just add a box and provide a scanner. Then, you define the territory within which you can scan, because each scanner can be assigned to a given territory in terms of sub-nets, and so on.

How are customer service and technical support?

The tech support was fairly good enough. I would not rate them as top-notch, but it was fairly good enough. I would give it a rating between 70-80%.

Which solution did I use previously and why did I switch?

I considered Rapid7 Nexpose and Metasploit in the past.

How was the initial setup?

It was pretty straightforward.

What's my experience with pricing, setup cost, and licensing?

It is slightly more expensive than other solutions in the same sphere.

What other advice do I have?

If you are considering a product like this, you must take into account and properly plan, scope, and scan. You need to know how to properly place your scanners and how to schedule automatic scans. You need to properly schedule your scans, so for example you don't need to scan your data center during that day when your business is most active, you can schedule your scans to run in the middle of the night, when your systems are least active.

If you wake up on LAN, then you can even scan clients during the night. You schedule wake up on LAN, your boxes are woken up on LAN, then the scanning is run, and then the boxes are shut down once the scan is over. So that's proper scoping and planning with this solution.

Disclosure: I am a real user, and this review is based on my own experience and opinions.
CV
Network Security Analyst at Arkansas Department of Finance and Administration
User
Lacks a powerful and flexible query engine, not a useful solution for network event investigations

What is our primary use case?

I use SecurityCenter currently to investigate daily network security events from reports I receive. Our network support team uses it to track, manage, and remediate system vulnerabilities. It works well for the latter, not so much for the former.

How has it helped my organization?

In terms of vulnerability mitigation, SecurityCenter has worked quite well and is a perfect replacement for GFI LanGuard. Unfortunately, it's also being posed to my team as what we're supposed to use in place of ArcSight Express, which I've worked with for several years now.  SecurityCenter could be much more useful to our agency as a whole if it were configured better, but I'm not sure that the team that directly manages that system knows how to do that, or has the right licenses they need to bring in all of the data my team needs in SecurityCenter to make good use of it.  Basically, it comes down to two teams trying to use the same product for very different purposes, and while one team is pleased with the results, the other (mine) is not.

What is most valuable?

The 'raw syslog' search functions are fairly nice for tracking down debug info from an event, but it's usefulness is extremely low when compared with ArcSight in terms of its usefulness in network event investigations. SecurityCenter's strongest focus seems to be its vulnerability scanning, but I'm told I should be able to use it to replace ArcSight, and from experience with both products, I know that's not the case.  To be honest, if my mission were more aligned with our other team's goals, I might like SecurityCenter a lot more than I do; but as is, it's like trying to fit a square peg into a round hole.

What needs improvement?

Security Center's vulnerability scanners are excellent in terms of compliance reporting, and the dashboards certainly seem to make the less technical of our staff all starry-eyed, but to be honest, I find SecurityCenter to be lacking in too many ways where my usage of it has been concerned.  Dashboards, to me, are much less interesting than a powerful and flexible query engine, and that's an area where I find SecurityCenter most lacking.

For how long have I used the solution?

Less than one year.

Which solution did I use previously and why did I switch?

ArcSight Express; my employers sought a less expensive solution. If I'd had any sway on the decision, it wouldn't have happened, or at least, it would have happened differently.  The two products compliment each other well, but separately, they're designed with very different goals in mind.

Which other solutions did I evaluate?

No, I wasn't given the opportunity. SecurityCenter was brought in, vetted, and implemented by a separate team from the one I work with daily.

What other advice do I have?

Know what you're getting into, and know the difference between security compliance suites and SIEM suites. The two are very different, which is why I'm very unhappy using SecurityCenter, because it's been forced upon me as a replacement for a product that it doesn't even compete with.

Disclosure: I am a real user, and this review is based on my own experience and opinions.
Product Categories
Vulnerability Management
Buyer's Guide
Download our free Tenable SC Report and get advice and tips from experienced pros sharing their opinions.