Most engineers think…
Most people picture vulnerability management as 'run Nessus, get a PDF full of Criticals, send it to IT'. That mental model drowns the team and fails you in an interview.
Tenable Vulnerability Management is a continuous lifecycle: Nessus scanners and Tenable Agents collect data, plugins from the feed detect each flaw, and the cloud platform (formerly Tenable.io) turns findings into prioritized work. The skill is choosing the right scan type and then prioritizing with VPR and asset criticality — not raw CVSS — so you fix the small slice that actually matters.
① What Tenable VM actually is — one continuous lifecycle
The single most important idea: Tenable Vulnerability Management is a continuous loop, not a one-off scan. Tenable frames it as five stages — discover, assess, prioritize, remediate, measure — and the platform runs that loop forever against everything it can see.
The moving parts are simple. Nessus is the scanner engine that probes hosts. Tenable Agents are lightweight software installed on endpoints that scan locally and report back. Plugins are the detection logic. And the Tenable Vulnerability Management cloud — formerly Tenable.io — is the brain that stores assets, findings, dashboards and scoring. You scan, it scores, you fix, you measure the trend.
Tenable Vulnerability Management is best described as…
② Scan types and plugins — how detection actually works
Choosing the right scan type is half the job. A network (uncredentialed) scan reaches out from a Nessus scanner and sees a host the way an outside attacker would — open ports, services and banner-based flaws. A credentialed (authenticated) scan is given valid login credentials, logs in, and runs local checks — far deeper and more accurate, with fewer false positives.
Agents and web apps
Agent-based scans run on the host itself, so they cover laptops that roam off-network and avoid sharing credentials — but they miss network-only checks like brute-forcing a login. Web application scanning crawls and tests live web apps for issues like injection. Every check is a plugin pulled from the plugin feed; plugins like 10394 (Windows SMB) and 12634 (Linux SSH) even confirm a credentialed scan truly authenticated.
The engine that probes hosts over SSH/SMB/HTTPS/SNMP. Runs network (uncredentialed) and credentialed (authenticated) scans.
Software on the endpoint that scans locally and reports back — covers roaming laptops and off-network assets, no credential sharing.
Each plugin detects one flaw or config. Downloaded from the Tenable plugin feed; some plugins confirm a scan actually authenticated.
Vulnerability Priority Rating — a dynamic 0.1–10 score, updated daily with threat intelligence, that says what to fix first (vs static CVSS).
A 'credentialed' scan that silently failed auth gives shallow, misleading results. Check the authentication-success plugins (e.g. 10394 for Windows SMB, 12634 for Linux SSH) before you trust the depth. No success plugin = you really ran an uncredentialed scan.
You need the deepest, most accurate view of a Windows server's missing patches. Which scan?
③ CVSS vs VPR — static severity vs live priority
This is the interview centrepiece. CVSS is a static, third-party score from the NVD describing how bad a flaw could be. The problem: CVSS labels roughly 60% of CVEs High or Critical, so it can't tell you what to fix first.
Tenable's VPR (Vulnerability Priority Rating) fixes this. VPR is a dynamic score from 0.1–10 that Tenable updates daily, blending the CVSS impact with live threat intelligence: exploit-code maturity, threat recency and intensity, age of the vulnerability, and product coverage. The result focuses you on the small slice — Tenable says around 1.6% — likely to be exploited soon. One-liner: CVSS = how bad it could be; VPR = how urgently it actually threatens you right now.
Treating every Critical CVSS as equal means patching ~60% of everything and burning out IT. CVSS is severity, not priority. Lead with VPR (live, daily-updated) plus asset criticality so you fix the small slice attackers will actually use.
▶ Watch a Windows server go from scan to verified fix
How one credentialed scan turns into a prioritized, verified remediation. Press Play for the healthy path, then Break it to see the classic failure.
Why is raw CVSS a poor way to choose what to remediate first?
④ Prioritize, remediate, measure — running the cycle sanely
VPR ranks the vulnerability; asset context ranks the target. The Asset Criticality Rating (ACR) scores how important an asset is (1–10, based on business purpose, type, connectivity). Tenable combines ACR with the asset's VPRs into an Asset Exposure Score (AES) from 0–1000 — a single number for 'how exposed is this box'. High VPR on a high-ACR asset is what you fix first.
Remediate and measure
Route prioritized findings to patching, push fixes, then re-scan to verify the flaw is gone — remediation isn't done until a clean scan proves it. Dashboards and reporting in the cloud track the trend over time so you can prove risk is going down. The classic failure is treating every Critical CVSS as equal and patching 60% of everything; prioritize by VPR + ACR and you fix the right 2% first.
Vivek at a Pune fintech faces this
The first Tenable scan returns 4,000 'Critical' CVSS findings and management wants them all patched this week — IT pushes back, nothing gets fixed.
The team sorted by CVSS severity, which marks ~60% of CVEs Critical/High, and ignored threat context and asset value.
Open the findings view — most Criticals have low VPR and sit on low-ACR test boxes; only a few have high VPR on production servers.
Tenable VM ▸ Findings ▸ sort by VPR, then by Asset Exposure Score (AES)Re-rank by VPR and ACR, target the high-AES production assets first, route those to patching, and schedule the long tail.
Re-scan the patched assets: the high-VPR findings clear, AES drops, and the dashboard shows risk trending down — with a believable weekly workload.
Never close a vulnerability on 'IT says it's patched'. Re-scan the asset and confirm the plugin no longer fires. The clean finding — and a falling Asset Exposure Score — is your proof, not a hunch.
Which finding should a team remediate first?
🤖 Ask the AI Tutor
Tap any question — instant, scoped to this lesson. No login, no waiting.
Pre-curated from vendor docs + community Q&A, scoped to this lesson. For a live prod issue, paste your export into chat.techclick.in.
📝 Wrap-up assessment — six more
You've answered 4 inline. Six left. 70% (7 of 10) marks the lesson complete on your profile. Tap Submit all answers at the end.
🧠 In your own words
Type one line: why does a Tenable team prioritize with VPR + ACR instead of just patching every Critical CVSS? Then compare with the expert version.
🗣 Teach a friend
Best way to lock it in — explain it in one line to a teammate. Tap to generate a paste-ready summary.
📖 Glossary
- Tenable Vulnerability Management
- Tenable's cloud platform (formerly Tenable.io) that stores assets, findings, scoring and dashboards and runs the VM lifecycle.
- Nessus
- Tenable's scanner engine that probes hosts over SSH/SMB/HTTPS/SNMP to run network and credentialed vulnerability scans.
- Tenable Agent
- Lightweight software installed on an endpoint that scans locally and reports back — ideal for roaming and off-network assets.
- Credentialed (authenticated) scan
- A scan given valid login credentials so it can run deep local checks on patches and config — more accurate, fewer false positives.
- Uncredentialed (network) scan
- A scan with no login that sees a host as an outside attacker would — ports, services and banner-level flaws.
- Plugin / plugin feed
- A plugin detects one specific flaw or config; the plugin feed continuously delivers new and updated plugins to scanners and agents.
- CVSS
- A static, third-party severity score (from the NVD) for how bad a vulnerability could be — but it rates ~60% of CVEs High/Critical.
- VPR (Vulnerability Priority Rating)
- A dynamic 0.1–10 score Tenable updates daily using live threat intelligence to show which flaws to remediate first.
- ACR (Asset Criticality Rating)
- A 1–10 score of how important an asset is to the business, based on purpose, type, location and connectivity.
- AES (Asset Exposure Score)
- A 0–1000 score combining an asset's ACR with its vulnerabilities' VPRs to show how exposed the asset is.
📚 Sources
- Tenable Docs — CVSS vs. VPR (risk metrics, VPR drivers and daily updates). docs.tenable.com/vulnerability-management/Content/Explore/Findings/RiskMetrics.htm
- Tenable Docs — Vulnerability Assessment / Scanning (authenticated vs unauthenticated, scanner role, plugins). docs.tenable.com/cyber-exposure-studies/vulnerability-management
- Tenable Docs — Tenable Nessus Credentialed Checks and authentication-success plugins. docs.tenable.com/nessus/Content/NessusCredentialedChecks.htm
- Tenable Docs — Tenable Agent: benefits and limitations vs network scanning. docs.tenable.com/agent/Content/benefits-and-limitations.htm
- Tenable Docs — Tenable One Scoring Explained: ACR and AES. docs.tenable.com/quick-reference/scoring-explained
- Tenable Blog — What Is VPR and How Is It Different from CVSS?. tenable.com/blog/what-is-vpr-and-how-is-it-different-from-cvss
What's next?
Got the Tenable lifecycle? Compare it side by side with the Qualys VMDR lesson — same discover-to-remediate idea, different scoring (QDS vs VPR) and agent model — so you can answer either tool in an interview.