Tenable Security Center — On-Prem Architecture, Repos & ARCs

① What Tenable Security Center actually is — on-prem VM with Nessus at the core

Tenable Security Center (SC) is Tenable's on-premises vulnerability management platform. At its core, Nessus scanners run credentialed or uncredentialed scans against hosts; SC is the management layer above them — the console where you schedule scans, store results, build reports and set policy.

The key identity: SC lives entirely on infrastructure you control. Your data never leaves your network. That makes it the right choice for organisations with strict data residency rules, air-gapped environments, or compliance mandates that prohibit cloud-hosted vulnerability data. In contrast, Tenable Vulnerability Management (formerly Tenable.io) is the SaaS alternative hosted in Tenable's cloud.

SC's licence model is typically IP-based and perpetual (plus annual maintenance), whereas Tenable Vulnerability Management uses a subscription. Both use the same underlying Nessus scan engine and plugin library — the difference is where the management console and data live.

② SecurityCenter architecture — console, scanners and repositories

The SC architecture has three logical tiers. At the bottom are Nessus scanners (and optionally Nessus Network Monitor for passive traffic analysis, or Nessus Agents for offline endpoints). Above them is the Security Center console — a Linux-based appliance or VM that orchestrates scans, receives results and stores them. At the top are the users and integrations — security analysts, CISO dashboards and SIEM feeds.

Repositories — the heart of the data model

Repositories are the key architectural concept. A repository is a logical data store inside SC that holds scan results for a defined IP range. You create separate repositories for different segments — production, DMZ, OT, cloud-migrated hosts — and assign RBAC to each. Active-scan repositories hold results from Nessus active scans; passive repositories hold data from Nessus Network Monitor; agent repositories hold results from Nessus Agents on endpoints that scan themselves. Repositories are also the unit of data retention and trending — SC keeps historical snapshots so you can track patch velocity over time.

③ Dashboards and Assurance Report Cards — turning data into answers

Raw vulnerability data is useless without context. SC's dashboards are customisable views built from dashboard components — widgets that query the repository data in real time. Tenable ships hundreds of pre-built dashboard templates aligned to frameworks (PCI DSS, NIST, ISO 27001, CIS Controls) and you can build custom ones. Dashboards are the daily tool for the SOC analyst.

Above dashboards sit Assurance Report Cards (ARCs) — SC's executive layer. An ARC is a collection of policy statements that each return a simple pass or fail based on live repository data. A CISO writes the questions in business language — 'Are all critical-severity vulnerabilities remediated within 30 days?' — and SC answers them automatically every time the dashboard loads. ARCs were the industry's first such feature and remain the headline SC differentiator for compliance-driven organisations.

Reports are the third tier — scheduled PDF or HTML exports from dashboards or ARCs. They cover audit evidence, executive summaries and asset-level detail, and can be distributed automatically by email.

④ SC vs Tenable Vulnerability Management — choosing and deploying right

The decision between SC and Tenable Vulnerability Management (cloud) is primarily about data residency and control, not features. Choose SC when: regulations require data on-premises (GDPR specific clauses, government mandates, defence sector); the environment is air-gapped or has limited internet access; your licence model suits perpetual IP-based billing; or you need deep custom repository segmentation with local RBAC. Choose Tenable Vulnerability Management when: faster onboarding matters; you scan ephemeral cloud assets (AWS, Azure, GCP) at scale; Tenable manages upgrades and HA; or you want Lumin (Tenable's risk-scoring layer) fully integrated.

Deploy SC sanely

Size the SC console VM with enough RAM and disk for your repository retention period — large estates scanning frequently fill disk fast. Place Nessus scanners inside each network segment (avoid scan traffic crossing firewalls when possible). Run credentialed scans (SSH/WMI) for deep coverage — uncredentialed scans miss most software vulnerabilities. Start with monitor-only mode on new segments, review false positives, tune plugin families, and build ARCs aligned to your compliance framework before going to a full board report.