Singapore – Tenable has expanded its open partner ecosystem with a programme that lets security teams run validated AI workflows using the models, agents, and tools they already use.
The exposure management company announced Tenable OPEN for AI on 21 October, with 12 launch partners: BeyondTrust, Cohesity, Command Zero, Corelight, Infoblox, Recorded Future, Securonix, SentinelOne, Setyl, Snyk, Sparkle In, and Splunk.
The programme sits within the Tenable Open Partner Exchange Network (OPEN), the company’s technology partner scheme. Tenable says it is designed to help security teams use AI to investigate risk, prioritise exposures and act faster.
Eric Doerr, Chief Product Officer of Tenable, said, “Tenable is the only exposure management provider offering a truly unrestricted, vendor-agnostic ecosystem of validated AI use cases, based on customer demand. By supporting both standardised MCP connectors and direct APIs, Tenable OPEN for AI provides security teams complete freedom to integrate their AI tools of choice and build custom, agentic workflows without artificial restrictions or forcing reliance on a single proprietary platform.”
On the technical side, Tenable links its Hexa AI MCP Server with partner Model Context Protocol (MCP) servers through the AI tools customers already run. According to the company, this allows users to query datasets across vendors simultaneously, without custom software development.
Each use case comes in one of two forms. Security teams can replicate a documented workflow with their preferred AI tool through the Hexa AI MCP Server, or they can use a ready-to-use skill on the CyberAgents Exchange, an AI agent marketplace powered by Tenable.
Among the featured use cases, Cross-Platform Security Triage, built with SentinelOne, lets teams investigate alerts, vulnerable assets and misconfigurations in natural language from a single AI chat window, Tenable says.
Network Threat & Blast Radius Mapping, developed with Corelight, combines Corelight network telemetry with live Tenable asset context. Tenable says teams can use it to triage active network threats and prioritise investigations and remediation by the potential blast radius of exposed assets.
Meanwhile, Code-to-Runtime Risk Correlation, built with Snyk, joins Snyk’s application security findings with Tenable runtime exposure data. The aim, according to Tenable, is to confirm quickly whether code-level vulnerabilities are deployed in production.
A fourth use case, Identity-Enriched Exposure Triage with BeyondTrust, combines BeyondTrust privileged account, session and entitlement data with Tenable findings. Tenable says it risk-ranks assets based on complete identity context.
Partners also outlined how the integrations work in practice. Melissa K. Smith, SVP Global Strategic Partnerships & Initiatives of SentinelOne, said, “The ability to unite disjointed data across both endpoints and enterprise risk exposure and take coordinated, automated action transforms security teams.”
“Our partnership with Tenable OPEN for AI enables customers to see SentinelOne’s endpoint analysis and Tenable exposure intelligence side by side. Together, we’re delivering a cross-platform triage engine that prioritises risk based on context-rich, real-world insights without requiring complex custom integrations,” Smith continued.
Turning to security operations centres, Robert Rossetti, Partner Engineer of Splunk, said, “Every SOC analyst knows the question that follows an alert: is this asset actually vulnerable? Tenable OPEN for AI answers it inside the investigation. Analysts can, for example, ask questions in plain language and get Splunk alerts back with Tenable vulnerability context attached, so they can confirm whether a critical asset is under active attack and respond faster.”
On the network side, Matt Landry, Senior Vice President of Product Management of Infoblox, said, “As AI assistants take on more of the day-to-day work of security operations, they need ground-truth network context to produce answers teams can act on. By combining Infoblox network identity data with Tenable exposure intelligence through an open protocol, security teams can understand both what a device is and how exposed it is. This on-demand, correlated view gives AI-driven workflows a network source of truth for prioritising the right assets and moving from signal to action faster.”
For investigation workflows, Dov Yoran, Co-Founder and CEO of Command Zero, said, “Every exposure finding raises the same follow-up question: is anyone taking advantage of it? With Tenable OPEN for AI, a priority exposure finding from Tenable feeds directly into a Command Zero investigation, where it provides critical context and helps analysts prioritise response. Every step is recorded and reviewable, and the approved verdict goes back to Tenable so exposure and investigation teams eliminate the need to pivot between platforms.”
