What is Tenable OT?
Tenable OT is a cybersecurity platform from the US company Tenable that maps industrial networks, exposes vulnerabilities in PLCs, SCADA systems and other OT assets, and detects suspicious behaviour in ICS environments by combining passive network monitoring with targeted, protocol-aware active queries. The product grew out of the 2019 acquisition of the Israeli company Indegy and was first called Tenable.ot, then Tenable OT Security, and in recent documentation Tenable One OT Exposure. It is used in energy, water, pharmaceuticals, chemicals, manufacturing and building automation, covering HMIs, DCS environments and embedded devices as well as controllers.
🧠 What does Tenable OT do?
Tenable OT addresses the three questions every OT security programme has to answer first: what is on the network, how vulnerable is it and what is happening right now. To do so, the platform combines:
- Asset Discovery and Asset Inventory - automatic identification of controllers, RTUs, IEDs, historians, engineering stations, switches and also IT and IoT devices on the OT network
- Vulnerability Management - matching discovered firmware and software versions to known CVEs and advisories
- Threat detection - policies that flag configuration changes, anomalous network traffic and attack signatures
- Network visualisation - a map of who talks to whom, as the basis for network segmentation
Besides IP and MAC addresses, the platform records for each asset details such as vendor, model, firmware version, serial number, rack and slot position and protocol role. That data forms the basis for asset management, synchronisation with a CMDB and risk assessments.
Tenable OT is therefore a monitoring and visibility platform, comparable to Claroty, Nozomi and Dragos. It does not block traffic itself.
🔧 What are the components of Tenable OT?
The architecture follows the layout of an industrial network according to the Purdue Model:
| Component | Function | Place in the network |
|---|---|---|
| Sensor | Small device that captures traffic on a segment, compresses it and forwards it; from version 3.14 a sensor can also send active queries | On SPAN ports or TAPs, up to one per managed switch |
| Industrial Core Platform (ICP) | Central appliance that runs network detection and Active Query and maintains the asset database | In the OT Network or a management zone |
| Enterprise Manager (EM) | Overarching management and reporting across multiple ICPs and sites | On-premises appliance or virtual machine in a private or public cloud |
| Tenable One / Security Center | Merging OT assets and findings with IT vulnerabilities and risk scores | IT environment, often via the IDMZ |
Tenable offers cloud, on-premises and hybrid models. On-premises suits isolated or air-gapped OT networks; the cloud option gives a central view across many sites. Events are sent via Syslog or APIs to a SIEM or SOC, and user management can use Active Directory (LDAP), while the Enterprise Manager supports single sign-on via SAML, for example with Entra ID. This lets the platform follow the organisation’s existing IAM policy.
🔍 How does Tenable OT combine passive monitoring and Active Query?
Tenable OT is often described as purely passive, but that is not accurate. The strength of the product, and the reason Tenable bought Indegy, is precisely the combination of two techniques.
Passive monitoring reads copies of network traffic and dissects industrial protocols such as Modbus TCP, Ethernet IP, ProfiNET, BACnet, DNP3, IEC 60870-5-104, OPC UA, S7 Comm and S7 Comm Plus. This shows which devices are active, which roles they play and when an engineering station downloads a program to a PLC.
Active Query sends targeted read requests in the device’s own protocol, for example to retrieve firmware version, serial number, and backplane and module details. The technique comes from Indegy, which held a patent on it, and Tenable presents it as safe and non-intrusive. The benefit is that quiet devices that rarely communicate, or modules behind a backplane, also end up in the inventory. PLC project files, SCD/ACD files and CSV lists can additionally be imported to enrich the inventory.
A conventional IT scanner is something else. From the console you can start a Nessus scan on selected Windows and network devices, by default limited to 5 hosts at a time, 2 checks per host and a 15-second timeout. Tenable itself advises against using Nessus on OT devices, because it can disrupt their normal operation.
🛡️ Which threats does Tenable OT detect?
Detection runs through policies, grouped into four families:
| Policy category | What is detected | Example |
|---|---|---|
| Configuration Events | Activity on controllers (Controller Activities, Controller Validation) | New logic download, firmware change, PLC put into stop mode |
| Network Events | New assets and unusual communication flows | Unknown engineering laptop, IT system talking to a PLC |
| SCADA Events | Changes to process parameters | A set point moved outside its normal range |
| Network Threats | Known attack patterns based on Suricata signatures | Port scans, known ICS malware, exploit attempts |
Policies can include time windows, so that a program change outside a maintenance window is reported as critical, for example. Detections are mapped to MITRE ATT&CK for ICS and shown in a heatmap, so a SOC can classify them in familiar terms. Suspicious RDP sessions to HMIs or new external connections to controllers are typical examples.
📊 How does Tenable OT prioritise vulnerabilities?
OT vulnerability management differs from IT: assets often run for twenty years or more, patches need vendor approval and every restart affects production. Tenable OT correlates discovered versions with CVEs, CISA ICS advisories and vendor advisories and scores them with its own Vulnerability Priority Rating (VPR), which, alongside CVSS, weighs whether a vulnerability is actually being exploited. The criticality you assign to an asset also counts.
Typical findings:
- Outdated firmware - end-of-life PLC firmware without updates
- Insecure protocols and services - unencrypted Modbus, open FTP or Telnet
- Default passwords - factory accounts on HMIs and switches
- Unpatched Windows systems - old HMI and historian servers
- Unintended connections - direct paths from IT into OT
Because many findings cannot be patched immediately, the output is mainly input for patch management, compensating controls and the risk assessment.
🧭 How do you deploy Tenable OT step by step?
A common approach at a production site with Siemens or Rockwell Automation controllers:
- Map the network - decide which switches and segments (cell, supervisory, IDMZ) need monitoring and where SPAN or TAP is possible.
- Start passively - let the platform only listen for a few weeks to build a baseline of normal traffic and assets.
- Enable Active Query in phases - first in a test or maintenance window, per segment and query type, in consultation with the process owner and the vendor.
- Assign criticality - mark assets that directly affect safety or production, such as an SIS or main PLC.
- Tune policies - configure maintenance windows and filter noise so the SOC is not flooded with alerts.
- Integrate - send events to the SIEM and SOAR, synchronise assets with the CMDB and add Threat Intelligence.
- Act - use the communication map for zones and conduits, tighten Firewall rules and restrict external access.
🌐 What does the communication map reveal in practice?
In older OT networks the first communication map almost always contains surprises. Typical findings at a plant with Siemens PLCs, SCADA servers, historians and vendor maintenance connections:
| Finding | Risk | Follow-up measure |
|---|---|---|
| Flat network without zoning | One infected HMI can reach every controller | Zones with VLANs and firewalls, and microsegmentation where needed |
| Unknown engineering laptops | Unauthorised logic changes | Fixed engineering stations, alerts on new assets |
| Open SMB shares on HMIs | Ransomware spreading | Close the shares, introduce application whitelisting |
| Vendor connection outside the maintenance window | Uncontrolled external access | Access through a managed jump host, by appointment only |
| Unused protocols between zones | Unnecessary attack surface | Restrict firewall rules to what operations actually need |
Shadow OT also comes to light this way: devices once installed by a vendor or technician that appear in no inventory at all. By measuring the real flows first and only then tightening the rules, you reduce the attack surface without production stopping unexpectedly.
🔐 How does Tenable OT support IEC 62443 and the Cybersecurity Act?
An up-to-date asset inventory and continuous monitoring are requirements in almost every OT framework. Within IEC 62443 this includes the component inventory (SR 7.8) and continuous monitoring (SR 6.2) from IEC 62443-3-3, and the management of conduits between zones. Tenable also provides reports for NERC CIP, NIST CSF, NIST SP 800-82 and ISO 27001.
In the Netherlands, the Cybersecurity Act (Cyberbeveiligingswet), the Dutch implementation of NIS2, has been in force since 15 August 2026. Its duty of care requires insight into your systems and risks, and the reporting obligation requires you to recognise incidents quickly. A platform such as Tenable OT helps, but it is not a complete compliance solution: governance, processes, Defense in Depth and Zero Trust principles remain organisational work.
🔄 How does it differ from a traditional IT scanner?
| Aspect | Traditional IT scanner | Tenable OT |
|---|---|---|
| Technique | Active scanning of ports and services | Passive listening plus targeted queries in the native protocol |
| OT protocol knowledge | Limited | In-depth (S7, CIP, Modbus, DNP3 and more) |
| Risk to PLCs | Can cause faults or restarts | Low, provided queries are introduced in phases and tested |
| Detection of logic changes | No | Yes |
| Process context | No | Criticality, roles, set points |
| Used in | Office and data centre networks | ICS, SCADA and DCS networks |
⚠️ What are the limitations of Tenable OT?
- No active protection - the platform does not replace an Industrial Firewall, IPS, NAC, EDR or safety instrumentation, although integrations can have firewall rules updated.
- Dependent on network coverage - without proper SPAN or TAP access on every relevant segment, blind spots appear, especially for serial traffic and fieldbuses.
- Legacy protocols - older protocols reveal little metadata, so identification is coarser.
- Follow-up takes capacity - without OT knowledge in the SOC or an OT SOC, alerts go unhandled.
📈 What role does Tenable OT play in IT/OT convergence?
Within IT OT Convergence, Tenable OT brings OT assets into the same risk picture as IT. Through Tenable One, OT assets, vulnerabilities and, from version 4.4, policy violations with ATT&CK techniques are synchronised into a single exposure view. The result is joint IT and OT monitoring, and enterprise security gains the OT context it lacks: which PLC is critical, which maintenance windows apply and which protocols are operationally required. That helps OT engineers, IT security teams, network administrators and compliance departments speak the same language, while availability and safety on the plant floor stay the priority.
❓ Frequently asked questions
Is Tenable OT fully passive?
No, Tenable OT combines passive network monitoring with Active Query, targeted read requests in a device’s own protocol. Active Query is optional: you enable it per network segment and can switch individual query types on or off. Many organisations therefore start passively and switch on the queries later in phases.
What is the difference between Tenable OT and Nessus?
Nessus is Tenable’s classic active vulnerability scanner for IT systems. Tenable OT is built for industrial networks and uses passive analysis and protocol-aware queries. Tenable itself advises against using Nessus on OT devices such as PLCs.
Where does Tenable OT come from?
Tenable OT grew out of the acquisition of the Israeli OT security company Indegy, which Tenable announced on 2 December 2019 for 78 million US dollars. The product was then called Tenable.ot and later Tenable OT Security. In recent documentation it is called Tenable One OT Exposure.
What are the competitors of Tenable OT?
The best-known alternatives to Tenable OT are Claroty, Nozomi Networks, Dragos and Microsoft Defender for IoT. All of them offer OT asset inventory, vulnerability insight and threat detection, with differences in detection technique, threat intelligence and integration. Tenable mainly stands out through its link with its own IT vulnerability platform.
Can Tenable OT run on an air-gapped network?
Yes, Tenable OT can be installed fully on-premises with sensors, an Industrial Core Platform and optionally an Enterprise Manager. No cloud connection is needed in that case. Vulnerability updates must then be brought in under controlled conditions.
Does Tenable OT help with the Dutch Cybersecurity Act?
Tenable OT supports the duty of care and the reporting obligation of the Dutch Cybersecurity Act with an up-to-date asset inventory, vulnerability insight and continuous detection. The act, however, also requires risk management, governance and incident processes. Tenable OT is therefore a tool rather than a complete compliance solution.
📌 In summary
Tenable OT gives you visibility of your industrial assets, vulnerabilities and suspicious activity by combining passive monitoring with safe, protocol-aware Active Queries. With sensors, an Industrial Core Platform and integrations with SIEM, SOC and Tenable One, it supports IEC 62443, NIS2 and the Dutch Cybersecurity Act, but it does not replace segmentation, firewalls or well-organised OT processes.