Reduce the greatest amount of business risk with the least amount of effort
Get complete attack surface visibility and risk-based vulnerability prioritization with Tenable
- Discover and assess every asset across your complete attack surface
- Understand vulnerabilities in context of business risk
- Prioritize high-risk vulnerabilities that pose the most risk
- Communicate business risk to your executives and key stakeholders
From legacy vulnerability management to risk-based vulnerability management
Legacy vulnerability management solutions weren't designed to handle your modern attack surface and the increasing threats that come with it.
Your attack surface is no longer just traditional IT assets. It also includes mobile devices, web apps, cloud infrastructure, containers, Internet of Things (IoT) devices and operational technology (OT) assets.
In these modern networks, legacy vulnerability management tools can’t deliver complete and timely insights into all of the devices across your entire attack surface. That leaves you with blind spots and increases your exposure.
Instead, these legacy tools are limited to a theoretical view of the risk a vulnerability could potentially introduce, which can cause your security team to chase after the wrong issues while missing many of the most critical vulnerabilities that pose the greatest risk to your business.
What’s even more frustrating are the mountains of vulnerability data generally returned from legacy vulnerability management processes. How do you know which vulnerabilities to fix first? How do you know which weaknesses pose the greatest threats to your organization?
Risk-based vulnerability management eliminates guesswork.
By taking a risk-based approach to vulnerability management, your security team can focus on the vulnerabilities and assets that matter most and address your organization’s true business risk instead of wasting valuable time on vulnerabilities attackers may not likely exploit.
If you’re new to risk-based vulnerability management, check out this comparison guide. It breaks down the differences between legacy vulnerability management and risk-based vulnerability management with insight into how a risk-approach can make your vulnerability management program more efficient and effective.
Tenable Connect community: Your go-to resource for risk-based vulnerability management
Looking for a place to connect with others interested in taking their vulnerability management programs to the next level with a risk-based approach? Join the Tenable Connect community and connect with other risk-based vulnerability management professionals. It’s a great place to ask questions, share ideas and give feedback on how Tenable can help you reach your risk-based vulnerability management goals.
Feeling overloaded by the number of vulnerabilities your organization faces daily?
There were 16,500 new vulnerabilities in 2018, but only 7% of these vulnerabilities had a public exploit available. Threat actors weaponize an even smaller subset. Predictive Prioritization, a groundbreaking process from Tenable, uses advanced data science techniques to help your teams focus on the relatively few vulnerabilities that matter most.
If I scan on a particular subnet, can I get a Vulnerability Priority Rating (VPR) for those IP addresses scanned?
Yes. If you perform a scan of a set number of assets, you can then go into the results of that individual scan, click the “Vulnerabilities” tab and see results specifically for those assets. This includes the VPR for each vulnerability associated with those assets. (You can read more about VPR in our FAQ section below.)
Is there a way to accept a risk by host?
Yes. You can accept risk by plugin based on Repository, then by one of the following: asset group, IP, UUIDs (agent ID), or all available devices. To do this, simply click on the gear wheel for the plugin and make your selections as needed.
Frequently asked questions about risk-based vulnerability management
Are you new to risk-based vulnerability management? Do you want to adopt a risk-based approach for your existing vulnerability management program, but are not sure where to start? This risk-based vulnerability management FAQ is a great resource.
-
What’s a security vulnerability?
-
A security vulnerability is a software flaw that creates a security risk. These vulnerabilities are weaknesses, like a bug or programming mistake, that make your network vulnerable to attackers. Through vulnerabilities and misconfigurations, attackers can infiltrate your network to compromise systems and get access to your data and information.
-
What is risk-based vulnerability management?
-
Risk-based vulnerability management (RBVM) uses machine learning analytics to correlate asset criticality, vulnerability severity and threat actor activity so you can identify and manage risks that pose the greatest threat to your organization. You can then prioritize those critical weaknesses for remediation and deprioritize those that present less risk.
-
How is risk-based vulnerability management different from legacy vulnerability management?
-
Risk-based vulnerability management is different from legacy vulnerability management in several ways.
First, legacy vulnerability management generally assesses only traditional on-premises IT assets such as desktop computers, services, and devices on your network. Because this approach ignores other parts of your attack surface, such as mobile devices, web apps, cloud environments, IoT, OT and containers, it creates blind spots that put your organization at risk. Risk-based vulnerability management allows you to assess traditional and modern assets across your entire attack surface and then combine this data with threat and exploit intelligence, as well as asset criticality, to predict each vulnerability’s impact on your organization.
Here are a few other ways the two disciplines are different:
Legacy vulnerability management
- Only meets minimum compliance requirements
- Provides static, point-in-time snapshots of vulnerability data
- Is reactive
Risk-based vulnerability management
- Uses best practices to reduce risk across your organization
- Facilitates continuous and dynamic visibility into your assets and vulnerabilities
- Is proactive and focused
-
What is active scanning?
-
Active scanning generates network traffic and interacts with devices on your network. It gives you detailed information about your assets, including open ports, known malware, installed software and security configuration issues. Unauthenticated scans, authenticated scans and agent-based scanning are active scanning variants.
-
What is a Common Vulnerability Scoring System (CVSS) score?
-
The Common Vulnerability Scoring System (CVSS) takes a theoretical view of the risk a vulnerability could potentially introduce. CVSS starts with 0 as the lowest priority and goes up to 10 — the most critical.
Unfortunately, CVSS assesses about 60% of all vulnerabilities with a high or critical CVSS score, even though they may pose little risk to your organization. CVSS is unaware of real-world risk and doesn’t take into account the criticality of each asset within your environment. These are critical pieces of information you need to prioritize remediation effectively.
Tenable supplements CVSS with Predictive Prioritization, an Asset Criticality Rating (ACR) and a Vulnerability Priority Rating (VPR), which are defined below. VPR gives you better insight into risks by also considering threat and attack scope, vulnerability impact and threat score. VPR performs in-depth analyses to determine the top 3% of vulnerabilities that should be remediated first.
-
What is a Vulnerability Priority Rating (VPR)?
-
A Vulnerability Priority Rating (VPR) is the output of Tenable’s Predictive Prioritization process.
VPR assesses more than 150 data points, including Tenable and third-party vulnerability and threat data. It then uses a machine-learning algorithm to analyze all the vulnerabilities in the National Vulnerability Database (plus others vendors have recently announced but have not yet been placed in the NVD) to predict which vulnerabilities have the greatest risk of being exploited in the near-future.
VPRs, rated from 0 to 10, help you prioritize remediation. VPRs at 10 indicate the most critical threats for priority remediation.
-
What is predictive prioritization?
-
Predictive prioritization uses a risk-based approach to vulnerability management to determine the probability an attacker may leverage a weakness against your organization.
Predictive prioritization includes asset and threat intelligence and adds machine learning to prioritize vulnerabilities based on the likelihood of an attack. Predictive prioritization gives each vulnerability a score called a Vulnerability Priority Rating (VPR). VPRs are from 0 to 10, with 10 the highest possible threat, so you can prioritize which weaknesses should get priority attention.
-
What is an Asset Criticality Rating (ACR)?
-
An Asset Criticality Rating (ACR) represents how critical each asset is on your network based on several key metrics including business purpose, asset type, location, connectivity, capabilities and third-party data. ACRs are from 0 to 10. If an asset has a low ACR, it is not considered business critical. If it has a high ACR, it is business critical.
-
What is an Asset Exposure Score (AES)?
-
An Asset Exposure Score (AES) uses both your Vulnerability Priority Rating (VPR) and Asset Criticality Rating (ACR). AES accounts for an asset’s vulnerability threat, criticality, and scanning behavior to quantify its vulnerability landscape.
-
What is a cyber exposure score?
-
A Cyber Exposure Score (CES) represents your organization’s cyber risk. CES combines your Vulnerability Priority Rating (VPR) with your Asset Criticality Rating (ACR).
CES ranges between 0 (minimal risk) and 1,000 (highest risk) and represents the average of all Asset Exposure Scores (AESs) in your organization.
CES helps prioritize remediation by examining asset criticality and your business goals, the severity of each potential threat within your network, how likely an attacker may exploit the threat in the next 28 days, and the context of the threat related to how prevalent the exploitation risk is in the real world.
Your CES also helps benchmark your vulnerability management and vulnerability assessment success internally and against peer organizations.
-
What is a Proof-of-Concept (POC) exploit?
-
A Proof-of-Concept (POC) exploit is a way for an attacker to demonstrate that someone can successfully exploit a vulnerability.
-
What is PCI ASV?
-
PCI ASV is an abbreviation for the Payment Card Industry (PCI) Approved Scanning Vendor (ASV). It is related to the PCI Data Security Standard (DSS) Requirements and Security Assessment Procedures for quarterly external vulnerability scans, which must be conducted or attested to by an ASV.
Risk-based vulnerability management in the cloud
Risk-based vulnerability management isn’t just a process for on-premises assets. It’s also applicable to all your cloud environments.
A risk-based approach to vulnerability management can help you discover, assess, prioritize, remediate, and measure all of your cloud assets to build a mature vulnerability management program.
Here’s how it works:
Discover cloud assets in a dynamic environment
Continuous visibility into your cloud environments is the foundation of risk-based vulnerability management. It ensures you’re not blind to short-lived assets in production and development.
Run assessments built specifically for the cloud
Using security best practices and environment hardening templates from the Center for Internet Security (CIS) and cloud service providers like Amazon Web Services (AWS) and Microsoft Azure, you can audit your cloud environment, find vulnerabilities within your cloud stack and adopt a variety of scanning and monitoring methods to meet your organization’s cloud needs.
Prioritize exposure context
Risk-based vulnerability management helps you understand the context of exposures within your cloud environment so you can prioritize which to fix first. Risk-based vulnerability management helps you allocate your remediation resources to threats that pose the greatest risk to your organization, and you can share that information easily with your DevOps team and automatically send information to your SIEM for response.
Remediate vulnerabilities
When it comes to vulnerabilities, finding them in your live environment is only half the battle. Risk-based vulnerability management helps you remediate vulnerabilities before production by integrating directly into your CI/CD pipeline and image creation processes. With Tenable, you can also integrate bug-tracking and remediation tools using powerful APIs so you know which vulnerabilities your team fixes and when remediation is complete.
Measure and benchmark for better decision-making
Risk-based vulnerability management can help you quickly understand your organization’s Cyber Exposure, even for dynamic assets in the cloud. By including your cloud environments in your CES score, you can compare how well your cybersecurity program works across internal departments, as well as against industry peers.
Want to learn more about risk-based vulnerability management for cloud environments? Check out our Cloud Risk-based Vulnerability Management Solutions page.
Risk-based vulnerability management process
Legacy vulnerability management doesn't give you a unified view of your entire attack surface, which makes it difficult to know which vulnerabilities to fix first. Risk-based vulnerability management helps you see which vulnerabilities actually pose the greatest risk to your organization and puts them into context so you can prioritize remediation. Moving from a compliance-driven approach of legacy vulnerability management to a risk-based approach, your organization can evolve from an infrastructure and IT focus to addressing your entire attack surface. Here’s a quick look into the risk-based vulnerability management process related to the Cyber Exposure Lifecycle:
1. Discover
Identify and map all of your assets across your entire attack surface so you have visibility into all of your computing environments.
2. Assess
Understand the state of all of your assets across all of your environments including vulnerabilities, misconfigurations and other security health issues.
3. Prioritize
Understand the context of your exposures so you can prioritize remediation based on how critical each asset is to your organization, its threat context and vulnerability severity.
4. Remediate
Prioritize which vulnerabilities to remediate first and apply the appropriate remediation or mitigation technique.
5. Measure
Understand your Cyber Exposure so you can calculate, communicate and compare cyber risks internally and against peer organizations to make better security and business decisions.
Risk-based vulnerability management best practices
While risk-based vulnerability management is a relatively new approach to vulnerability management, you can take steps toward a risk-driven program for your organization by implementing these best-practice recommendations:
Data fidelity and your attack surface
An effective risk-based vulnerability management program should continually gather and analyze data from across your entire attack surface, including on-premises infrastructure, endpoints, cloud infrastructure, web applications, containers, mobile devices, IoT and OT.
Process automation
Streamline your risk-based vulnerability management processes including configuration management, change management, asset management and incident response.
Customized analytics
Your risk-based vulnerability management solution should provide analytics and customizable reports for your organization’s needs. You can use the reports to provide each key stakeholder with role-specific analytics. Topline analytics also provide insight into how well your teams collect asset and assessment information, including success metrics to remediate prioritized vulnerabilities.
With risk-based vulnerability management best practices, your security team can build a successful program that delivers high-fidelity data and automated processes to effectively manage your Cyber Exposure across your entire attack surface.
Discover. Assess. Prioritize.
Stop guessing about which vulnerabilities to fix first.
Reduce the number of vulnerabilities that need your immediate attention by 97% and focus on what matters most with Tenable One.
Risk-based vulnerability management blog bytes
Risk-based vulnerability management blog bytes
5 tips for prioritizing vulnerabilities based on risk
Pinpointing vulnerabilities that pose the greatest risks to your business is challenging, but these five tips can improve the way you handle vulnerability remediation processes.
Should you still prioritize exploit kit vulnerabilities?
The objective of strategic vulnerability remediation prioritization is to identify vulnerabilities that pose the greatest risk to your organization. Many organizations rely on the Common Vulnerability Scoring System (CVSS) to prioritize, but given the time and resources available, CVSS often yields far too many “critical” vulnerabilities for most to realistically remediate.
Transitioning to risk-based vulnerability management
Today, your modern attack surface constantly expands with diverse asset types, from traditional IT to OT and the cloud. If you're still using traditional vulnerability management practices for all of these asset types, you're likely overlooking critical exposures with blind spots that increase your cyber risk.
On top of that, most vulnerability management tools mark far too many vulnerabilities critical or high, most of which attackers won't ever actively exploit or they're not relevant to your unique attack surface.
In this on-demand webinar, learn more about making the shift to risk-based vulnerability management and:
- Best practices to prioritize, automate, report and manage your vulnerability and asset data
- How to automate asset and vulnerability tracking
- Conduct compliance audits using easy-to-understand dashboards
Gain insight into your organization’s overall cyber risk with Tenable One
Tenable One can help you visualize, analyze and measure your cyber risk across your entire attack surface. It transforms vulnerability data into meaningful insights so you can manage exposures and focus on the top 3% of vulnerabilities that pose the greatest risk to your organization.
Risk-based scoring and prioritization
Combine vulnerability data with asset criticality and threat intelligence so your security team can focus on vulnerabilities that matter most.
Total attack surface visibility
With complete visualizations of your entire attack surface, your team can quickly measure and communicate cyber risk.
Exposure analytics and benchmarking
Powered by the industry’s richest set of vulnerability intelligence, you can quantify your cyber risk and benchmark internally to determine your program’s effectiveness.
Tenable One
Request a demo
The world’s leading AI-powered exposure management platform.
Thank You
Thank you for your interest in Tenable One.
A representative will be in touch soon.
Form ID: 7469
Form Name: one-eval
Form Class: c-form form-panel__global-form c-form--mkto js-mkto-no-css js-form-hanging-label c-form--hide-comments
Form Wrapper ID: one-eval-form-wrapper
Confirmation Class: one-eval-confirmform-modal
Simulate Success