Tenable folds application security into Tenable One exposure platform

Exposure management company Tenable Holdings Inc. today expanded its Tenable One Exposure Management Platform to pull application security risk into the same view as the rest of an organization’s exposure data. By adding static code vulnerability information, the platform now tracks risk from code through to runtime across the attack surface.

The addition targets a gap that has grown as software ships faster. Vulnerable code often reaches production before anyone can review it, a problem Tenable says generative artificial intelligence is making worse. Developers using AI assistants write code three to four times faster while introducing flaws at up to 10 times the rate, according to a research note from the Cloud Security Alliance.

Application security teams have typically worked from tools that flag code flaws without the infrastructure context needed to judge whether a given vulnerability actually threatens the business. Tenable argues that disconnect leaves an exploitable blind spot, with security staff unable to tell which of thousands of findings matter.

Tenable One now ingests and normalizes data from application development and security sources, including AI-powered application security tools such as Claude Security. It then links that data to the wider exposure picture Tenable already collects, spanning endpoint protection, cloud security, vulnerability management and operational technology security, along with business context drawn from sources such as configuration management databases.

The company says the combined view connects code-level risks to the runtime systems, cloud workloads, identities and attack paths they put at risk. The goal is to move customers from reactive application scanning toward prioritizing the exposures most likely to be used against them.

“Bringing application security data into Tenable One, we’re giving our customers the context they’ve been missing,” said Eric Doerr, chief product officer of Tenable. “Security teams don’t need to wade through a sea of vulnerabilities. With Tenable One, security teams know exactly where they are exposed the moment an exposure is created, whether an agentic AI security tool discovers a new zero-day in an open-source library or a human error introduces risk.”

The application security integrations are available now to all Tenable One customers.

The expansion continues a run of additions to the platform. Tenable launched AI Exposure in August to bring generative AI risk into Tenable One and updated its Vulnerability Priority Rating system in July 2025 to sharpen how it ranks the flaws that pose real business risk.

Image: Tenable