Tenable Expands Security Ecosystem with Open for AI Partner Workflows

Tenable has announced Tenable OPEN for AI, an expansion of its technology partner ecosystem designed to connect exposure intelligence with the AI models, agents, and tools organizations already use.

Announced on October 21, 2026, the program introduces validated workflows intended to help security teams investigate risks, prioritize vulnerabilities, and coordinate action across different security platforms.

The initiative is part of the Tenable Open Partner Exchange Network, the company’s technology partner program. Its focus is on bringing information from separate tools into a shared investigation, giving analysts more context when assessing potential threats.

Connecting security data across platforms

Security investigations often require teams to examine several sources of information. An alert from one platform may need to be checked against vulnerability findings, network activity, or privileged account data before analysts can determine its significance.

Tenable OPEN for AI connects the Tenable Hexa AI MCP Server with partner MCP servers through customers’ existing AI tools. According to Tenable, this allows teams to work with datasets from multiple vendors without building custom software for each supported workflow.

The program supports both Model Context Protocol connectors and direct APIs, giving organizations different ways to integrate their preferred tools.

Eric Doerr, Tenable’s chief product officer, said the approach is intended to let security teams build customized AI workflows without requiring them to rely on a single proprietary platform.

Four featured workflows

Tenable highlighted four use cases available at launch, each addressing a different part of security investigation and risk assessment.

• SentinelOne — Cross-Platform Security Triage: Investigate alerts, vulnerable assets, and misconfigurations through natural-language questions in one AI chat window.
• Corelight — Network Threat and Blast Radius Mapping: Combine network telemetry with Tenable asset context to assess threats and the potential scope of their impact.
• Snyk — Code-to-Runtime Risk Correlation: Connect application security findings with runtime exposure data to determine whether vulnerable code is deployed in production.
• BeyondTrust — Identity-Enriched Exposure Triage: Add privileged account, session, and entitlement information to Tenable findings when ranking asset risk.

These workflows are designed to help analysts answer practical questions about an alert: whether the affected asset is vulnerable, whether vulnerable code is actually running, and how account privileges may influence the risk.

More context for investigations

Other launch partners described how the program can bring additional information into security operations.

Splunk highlighted the ability to return alerts alongside Tenable vulnerability context through plain-language queries. Infoblox pointed to combining network identity information with exposure intelligence to help teams understand both a device’s identity and its security exposure.

Command Zero described a workflow in which a Tenable finding informs an investigation, with recorded, reviewable steps and an approved verdict returned to Tenable.

The launch partner roster also includes Cohesity, Recorded Future, Securonix, Setyl, and Sparkle In.

Two ways to access the workflows

Each use case is offered as a documented workflow that teams can replicate using their preferred AI tool through the Tenable Hexa AI MCP Server.

Alternatively, teams can access ready-to-use skills through CyberAgents Exchange, the vendor-agnostic AI agent marketplace powered by Tenable.

Organizations can explore the available use cases at Tenable OPEN for AI.