Tenable Holdings, Inc. is expanding its technology and partner ecosystem with Tenable OPEN for AI, a program designed to connect security workflows across organizations’ technology environments. It offers validated, ready-to-use AI workflows that combine Tenable exposure intelligence with customers’ chosen AI models, agents and tools.
Launch partners include BeyondTrust, Cohesity, Command Zero, Corelight, Infoblox, Recorded Future, Securonix, SentinelOne, Setyl, Snyk, Sparkle In and Splunk. The initiative is part of the Tenable Open Partner Exchange Network (OPEN), the company’s technology partner program.
AI workflows across security tools
Tenable OPEN for AI is intended to help security teams use AI to investigate risk, prioritize exposures and respond more quickly. The program supports standardized MCP connectors and direct APIs, allowing organizations to connect their preferred tools rather than rely on a single platform.
This enables them to work with data from multiple vendors without developing custom software
“Tenable is the only exposure management provider offering a truly unrestricted, vendor-agnostic ecosystem of validated AI use cases, based on customer demand,” said Eric Doerr, chief product officer, Tenable. “By supporting both standardized MCP connectors and direct APIs, Tenable OPEN for AI provides security teams complete freedom to integrate their AI tools of choice and build custom, agentic workflows without artificial restrictions or forcing reliance on a single proprietary platform.”
Customers can connect the Tenable Hexa AI MCP Server with partner MCP servers through the AI tools they already use. This enables them to work with data from multiple vendors without developing custom software. Use cases are available as documented workflows that teams can recreate with their AI tool of choice, or as ready-to-use skills on CyberAgents Exchange, an AI agent marketplace powered by Tenable.
Use cases available at launch include:
- Cross-Platform Security Triage (SentinelOne): Lets security teams investigate alerts, vulnerable assets and misconfigurations using natural language in one AI chat window.
- Network Threat & Blast Radius Mapping (Corelight): Combines Corelight network telemetry with Tenable asset context to help triage active threats and prioritize investigations and remediation based on the potential impact of exposed assets.
- Code-to-Runtime Risk Correlation (Snyk): Connects Snyk application security findings with Tenable runtime exposure data to check whether code-level vulnerabilities are present in production.
- Identity-Enriched Exposure Triage (BeyondTrust): Uses privileged account, session and entitlement data from BeyondTrust alongside Tenable findings to rank asset risk with identity context.
Partner integrations add investigation context
SentinelOne and Tenable say their integration brings endpoint analysis and exposure intelligence together for cross-platform triage.
“The ability to unite disjointed data across both endpoints and enterprise risk exposure and take coordinated, automated action transforms security teams,” said Melissa K. Smith, SVP Global Strategic Partnerships & Initiatives at SentinelOne. “Our partnership with Tenable OPEN for AI enables customers to see SentinelOne’s endpoint analysis and Tenable exposure intelligence side by side. Together, we’re delivering a cross-platform triage engine that prioritises risk based on context-rich, real-world insights without requiring complex custom integrations.”
The Splunk workflow can add Tenable vulnerability context to alerts so analysts can assess whether an asset is exposed during an investigation.
“Every SOC analyst knows the question that follows an alert: is this asset actually vulnerable?” said Robert Rossetti, Partner Engineer at Splunk. “Tenable OPEN for AI answers it inside the investigation. Analysts can, for example, ask questions in plain language and get Splunk alerts back with Tenable vulnerability context attached, so they can confirm whether a critical asset is under active attack and respond faster.”
Infoblox’s integration combines network identity data with exposure intelligence to give AI-driven workflows additional device context.
AI-driven workflows
Command Zero’s workflow sends Tenable exposure findings into an investigation
“As AI assistants take on more of the day-to-day work of security operations, they need ground-truth network context to produce answers teams can act on,” said Matt Landry, Senior Vice President of Product Management, Infoblox. “By combining Infoblox network identity data with Tenable exposure intelligence through an open protocol, security teams can understand both what a device is and how exposed it is. This on-demand, correlated view gives AI-driven workflows a network source of truth for prioritizing the right assets and moving from signal to action faster.”
Command Zero’s workflow sends Tenable exposure findings into an investigation and returns an approved verdict to Tenable, with investigation steps recorded for review.
"Every exposure finding raises the same follow-up question: is anyone taking advantage of it?" said Dov Yoran, co-founder and CEO of Command Zero. "With Tenable OPEN for AI, a priority exposure finding from Tenable feeds directly into a Command Zero investigation, where it provides critical context and helps analysts prioritise response. Every step is recorded and reviewable, and the approved verdict goes back to Tenable so exposure and investigation teams eliminate the need to pivot between platforms."
