Tenable Explained: Nessus Scans, Agents, VPR Scoring and Running a Scan-to-Remediate Cycle

Tenable makes Nessus, one of the most widely used vulnerability scanners, and a cloud platform built around it. If you interview for vulnerability management or security operations, you will likely be asked how scanning works, why scan results drift, and how you would turn thousands of findings into a short list of fixes.

What it is

Tenable's main products, under their 2026 names, are:

• Tenable Nessus, the scanner.
• Tenable One Vulnerability Management, the cloud vulnerability management service, formerly Tenable.io. It uses Nessus scanners and Tenable Agents.
• Tenable Exposure Management, part of the Tenable One platform, which pulls in Tenable data and third-party findings such as Snyk, GitHub and Checkmarx results, scores exposure and maps attack paths.
• Tenable One Cloud Exposure, the cloud security platform that came from the 2023 acquisition of Ermetic. It covers posture, identities, data and infrastructure code.

Tenable also bought Vulcan Cyber, a remediation orchestration company, in February 2025.

How it works

Tenable's documentation sets out the trade-offs plainly. Non-credentialed scans find what an outside attacker could use but "can be disruptive" and miss client-side and patch detail. Credentialed scans give "a complete enumeration of software and patches" but need credentials for every host. Agents assess laptops and intermittently connected hosts without stored credentials, but "are not designed to perform network checks". Tenable recommends discovery scans first, to find assets, then assessment scans to find vulnerabilities on them.

Scoring. In Tenable One Vulnerability Management, severity comes from CVSS. VPR (0.1 to 10.0) adds threat context such as exploit code maturity, exploitation probability and presence on CISA's Known Exploited Vulnerabilities catalogue, and is updated daily. Vulnerabilities without a CVE do not get a VPR, and customers cannot edit it. On 1 July 2026 the enhanced VPR became the platform standard, and release notes call it Unified Risk Scoring. Asset Criticality Rating reflects how important an asset is; exposure scores roll findings up by asset and organisation.

How to use it

Day one: deploy sensors and find assets

Deploy Nessus scanners where they can reach each network segment, and agents on laptops and cloud hosts that are hard to scan. Run discovery scans to build the asset list before scanning for vulnerabilities; an asset you have not discovered cannot be assessed.

Week one: fix the scan before fixing the findings

1. Make scans credentialed wherever you can, and monitor authentication success. When credentials expire, local checks silently stop, and the vulnerability count falls for the wrong reason.
2. Check coverage against your CMDB or cloud inventory: which assets were never scanned, and which scanned assets have no owner?
3. Set asset criticality for the systems that matter most.

Every day: prioritise, assign, verify

Filter findings to those with high VPR on critical or internet-facing assets, and give special weight to anything on the KEV catalogue. Create a Remediation Project for each batch of related work, with owners and a Remediation Goal, either a rolling number of days or a fixed date. After owners patch, rescan to confirm findings move to Fixed. Report on time to remediate by severity and asset criticality, not on the total count.

Where it stops

• Scanners only see what they can reach. Segments without a scanner, hosts without credentials and assets nobody discovered are blind spots.
• Scores are models. VPR is Tenable's view of threat; it does not know your compensating controls. Severity and VPR can also disagree between products.
• Agents and scans differ. An agent with an out-of-date plugin set reports yesterday's checks; network checks need scanners.
• Finding is not fixing. The bottleneck is usually ownership and change windows, not detection.

How it comes up in interviews

• "Our vulnerability count fell 40% overnight. Good news?" Check scan authentication, coverage and scan failures first.
• "CVSS, EPSS, KEV and VPR: how would you combine them?" KEV means exploited now; EPSS estimates exploitation likelihood; CVSS measures severity if exploited; then add asset criticality and exposure.
• "Design a vulnerability management programme for 10,000 hosts." Discovery, credentialed coverage, agents, prioritisation, owners, SLAs and verification.

Sources

Checked on 13 November 2026: Tenable documentation on discovery and assessment scans, agent scans versus network scans, risk metrics and VPR, remediation projects and remediation goals, and Tenable Exposure Management; Tenable developer changelog on the VPR transition (July 2026); Tenable Exposure Management 2026 release notes; Tenable press releases on the Ermetic acquisition (September and October 2023) and the completion of the Vulcan Cyber acquisition (7 February 2025); CISA Known Exploited Vulnerabilities catalogue; FIRST EPSS and CVSS v4.0 documentation.