Tenable launches open AI partner network for security

Tenable has expanded its open technology and partner ecosystem with the launch of Tenable OPEN for AI. The programme adds validated AI workflows for security teams using third-party models, agents and tools.

The offering sits within the company's Open Partner Exchange Network and is designed to connect data and workflows across the security stack. Customers can use Tenable's exposure intelligence with their preferred AI tools through standardised Model Context Protocol connectors and direct application programming interfaces.

The launch group includes BeyondTrust, Cohesity, Command Zero, Corelight, Infoblox, Recorded Future, Securonix, SentinelOne, Setyl, Snyk, Sparkle In, Splunk and others. The aim is to let security teams investigate risk, prioritise exposures and take action across vendor environments without building custom software.

Under the model, customers connect the Tenable Hexa AI MCP Server with partner MCP servers through AI tools they already use. This setup allows teams to interact with datasets from several vendors at the same time.

Each use case is offered in two formats: a documented workflow that can be reproduced with a chosen AI tool through the Tenable Hexa AI MCP Server, and a ready-to-use skill on CyberAgents Exchange, the company's AI agent marketplace.

Use cases

Tenable highlighted four examples available at launch. One, developed with SentinelOne, focuses on cross-platform security triage and is designed to let teams investigate alerts, vulnerable assets and misconfigurations through natural language in a single chat window.

A second, built with Corelight, combines network telemetry with live Tenable asset context to help security teams assess active threats and prioritise remediation based on the likely blast radius of exposed assets. Another, with Snyk, links application security findings with runtime exposure data to check whether code-level vulnerabilities are present in production environments.

The fourth featured workflow, with BeyondTrust, combines privileged account, session and entitlement data with Tenable findings to rank assets using identity context. The broader partner list also includes companies contributing data, workflow or investigation context across different security functions.

Eric Doerr, Chief Product Officer at Tenable, described the move as an open approach to AI integration in security operations.

"Tenable is the only exposure management provider offering a truly unrestricted, vendor-agnostic ecosystem of validated AI use cases, based on customer demand," said Eric Doerr, Chief Product Officer at Tenable.

"By supporting both standardised MCP connectors and direct APIs, Tenable OPEN for AI gives security teams complete freedom to integrate their AI tools of choice and build custom, agentic workflows without artificial restrictions or forced reliance on a single proprietary platform," Doerr said.

Partner companies said the model gives analysts a way to combine security alerts and asset exposure data within a single workflow. Several of the examples focus on reducing the need for teams to move between separate tools during an investigation.

"The ability to unite disjointed data across both endpoints and enterprise risk exposure, and take coordinated, automated action, transforms security teams," said Melissa K. Smith, Senior Vice President of Global Strategic Partnerships and Initiatives at SentinelOne. "Our partnership with Tenable OPEN for AI enables customers to see SentinelOne's endpoint analysis and Tenable exposure intelligence side by side. Together, we're delivering a cross-platform triage engine that prioritises risk based on context-rich, real-world insights without requiring complex custom integrations."

Splunk pointed to the use of plain-language queries that return alert data with vulnerability context attached. The approach is intended to help analysts determine whether a critical asset is under active attack during an investigation.

"Every SOC analyst knows the question that follows an alert: is this asset actually vulnerable?" said Robert Rossetti, Partner Engineer at Splunk. "Tenable OPEN for AI answers it inside the investigation. Analysts can, for example, ask questions in plain language and get Splunk alerts back with Tenable vulnerability context attached, so they can confirm whether a critical asset is under active attack and respond faster."

Infoblox said network identity data can add another layer of context to AI-driven workflows. Command Zero, meanwhile, said Tenable findings can feed directly into its investigations and return an approved verdict to Tenable.

"As AI assistants take on more of the day-to-day work of security operations, they need ground-truth network context to produce answers teams can act on," said Matt Landry, Senior Vice President of Product Management at Infoblox. "By combining Infoblox network identity data with Tenable exposure intelligence through an open protocol, security teams can understand both what a device is and how exposed it is. This on-demand, correlated view gives AI-driven workflows a network source of truth for prioritising the right assets and moving from signal to action faster."

"Every exposure finding raises the same follow-up question: is anyone taking advantage of it?" said Dov Yoran, Co-Founder and Chief Executive Officer of Command Zero. "With Tenable OPEN for AI, a priority exposure finding from Tenable feeds directly into a Command Zero investigation, where it provides critical context and helps analysts prioritise response. Every step is recorded and reviewable, and the approved verdict goes back to Tenable, helping exposure and investigation teams avoid pivoting between platforms."