Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Tenable Research

The Leader in Vulnerability and Exposure Research

Tenable Research is the source of all Tenable solutions. By providing exposure intelligence, security advisories and alerts, data science insights and zero-day research, Tenable helps organizations secure their modern attack surface.

联系我们

Research Alerts

Today's Landscape
  • CVE-2024-24919：Iran-based Cyber Actors Targeting US Organizations Leveraging Vulnerabilities for Initial Access
  • CVE-2024-3400：Iran-based Cyber Actors Targeting US Organizations Leveraging Vulnerabilities for Initial Access
  • CVE-2024-21887: Iran-based Cyber Actors Targeting US Organizations Leveraging Vulnerabilities for Initial Access
  • CVE-2023-3519：Iran-based Cyber Actors Targeting US Organizations Leveraging Vulnerabilities for Initial Access
  • CVE-2022-1388: Iran-based Cyber Actors Targeting US Organizations Leveraging Vulnerabilities for Initial Access

Meet Tenable Research

Tenable Vulnerability Intelligence

Tenable Research develops detections for vulnerabilities and exposures across the modern attack surface supporting cloud, IT IoT, OT, web apps and identity assets. New detections are released within 24 hours of high profile issues.

View the Content Portal See Latest Plugins Pipeline
Audits & Compliance

Tenable Research creates compliance audits against published standards and baselines (e.g. CIS Benchmarks, DISA STIGs) and across more than 25 security frameworks (e.g. HIPAA, NIST 800-53).

View the Audit Portal Download Audit Files
Security Response

The Security Response Team (SRT) tracks the threat and vulnerability landscapes to provide critical analysis and inform rapid detection coverage across Tenable solutions.

See Latest Security Advisories
零日漏洞研究

The team includes "white hat" researchers that analyze popular software platforms to proactively identify vulnerabilities and exposures to better protect customers.

See Latest Zero-Day Research
Attack Path Research

Tenable Research monitors the threat landscape and builds new attack techniques in support of Tenable Attack Path Analysis to uncover all potential attack paths that could impact organizations.

View Attack Path Techniques
资产管理

Tenable Research develops asset identification and configuration audit plugins to identify operating systems, devices, applications and service identifications.

Search Plugins
Tenable Research Alliance

The Tenable Research Alliance Program is an intelligence sharing initiative among leading technology organizations to help protect customers before attackers become aware of exposures through formal vendor announcements.

Learn About the Tenable Research Alliance Program

研究洞察

  • CISA KEVs - the dichotomy


    81.7% of KEV CVEs have VPR scores of 7 or higher

    3.6% for all CVEs disclosed in 2023 had VPR scores of 7 or higher

    (for 2023 CVEs)

    Review Tenable Plugins for CISA KEV

  • Vuln Remediation half life


    It takes 4 weeks on average for 50% of vulnerability exposures to be remediated for a CVE. Auto-updating software rocks!

    As an example, browsers that auto-update, reach 50% remediation rate about 4x faster

  • Tenable One Platform Research

    900 Million for Identity, 400 Million for OT, 16 Billion for WAS - data points used by Tenable researchers to cover exposures across the Tenable One Platform

  • Did you know?

    If a vulnerability is exploited / PoC exists, then that CVE is remediated 2.2x faster than those without known exploits, on average.

    Critical CVEs are remediated 33% more than the average CVE in the first week of patch availability

  • Scheduled patch releases help



    Microsoft Patch Tuesday vulnerabilities are remediated 30% faster, on average, than other vulnerabilities, and reach about a 50% remediation rate around 20 days after Patch Tuesday each month

Explore Research Resources

CISA Known Exploited Vulnerabilities (KEV) Coverage

Research Release
Highlights

Content
Portal

Plugins
Pipeline

Recent Publications

Research 博客

August 28, 2024 The Data-Factor: Why Integrating DSPM Is Key to Your CNAPP Strategy
August 20, 2024 SSRFing the Web with the Help of Copilot Studio
August 13, 2024 Compromising Microsoft's AI Healthcare Chatbot Service
August 7, 2024 Detecting Risky Third-party Drivers on Windows Assets
More Research Blogs

Cyber Exposure 预警

August 28, 2024 AA24-241A : Joint Cybersecurity Advisory on Iran-based Cyber Actors Targeting US Organizations
August 14, 2024 CVE-2024-7593: Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability
August 13, 2024 Microsoft’s August 2024 Patch Tuesday Addresses 88 CVEs
August 9, 2024 CVE-2024-20419: Cisco Smart Software Manager On-Prem Password Change Vulnerability
More Cyber Exposure Alerts

Webinars and Reports

報告：Auditing Pimcore Enterprise Platform
報告：2024 Cloud Security Outlook - Navigating Barriers and Setting Priorities
网络研讨会： Tenable Cloud Security Outlook 2024
Report: How Generative AI Is Changing Security Research
Tenable 2022 年威胁形势报告
网络研讨会： Tenable Research Shares Its 2022 Recap and Defender Recommendations for 2023
Report: Managing Risk in the Metaverse
Report: Router Vulnerability Present for a Decade - Why IoT Supply Chain Is to Blame

Tenable Research @ Medium

IoT firmware emulation and device fingerprinting challenges
Gathering information on a device could be tricky if you don’t have direct access to exposed services like SNMP, HTTP, FTP, or any other ports or pr…Gabriel Compan
August 6, 2024
Using conflicting objects in Active Directory to gain privileges
SummaryActive Directory (AD) uses a multi-master replication model to have a decentralized infrastructure. As long as one domain controller (DC) is up…Antoine Cauchois
July 31, 2024
Solidus — Code Review
Solidus — Code ReviewAs a Research Engineer at Tenable, we have several periods during the year to work on a subject of our choice, as long as …Joshua Martinelle
June 10, 2024
Stealthy Persistence with “Directory Synchronization Accounts” Role in Entra ID
SummaryThe “Directory Synchronization Accounts” Entra role is very powerful (allowing privilege escalation to the Global Administrator role) while…Clément Notin [Tenable]
June 3, 2024
WordPress : From vulnerability identification to compromising
WordPress Core is the most popular web Content Management System (CMS). This free and open-source CMS written in PHP allows developers to develop web …Joshua Martinelle
May 29, 2024
Another Path to Exploiting CVE-2024-1212 in Progress Kemp LoadMaster
IntroRhino Labs discovered a pre-authentication command injection vulnerability in the Progress Kemp LoadMaster. LoadMaster is a load balancer product…Ben Smith
April 2, 2024
Stealthy Persistence & PrivEsc in Entra ID by using the Federated Auth Secondary Token-signing Cert.
Exploiting Entra ID for Stealthier Persistence and Privilege Escalation using the Federated Authentication’s Secondary Token-signing CertificateSumm…Clément Notin [Tenable]
January 31, 2024
Entra Roles Allowing To Abuse Entra ID Federation for Persistence and Privilege Escalation
IntroductionMicrosoft Entra ID (formerly known as Azure AD) allows delegation of authentication to another identity provider through the legitimate fe…Clément Notin [Tenable]
January 9, 2024

Learn More About Tenable

人才招聘

Secure your spot @ Tenable Research

Explore

Awards

See why customers trust Tenable

Explore

社区

Learn, share, and contribute

Explore
免费试用 立即购买

Tenable Vulnerability Management

可全面访问基于云的现代化漏洞管理平台，从而以无可比拟的精确度发现并追踪所有资产。

Tenable Vulnerability Management 试用版还包含 Tenable Lumin 和 Tenable Web App Scanning。

Tenable Vulnerability Management

可全面访问基于云的现代化漏洞管理平台，从而以无可比拟的精确度发现并追踪所有资产。 立即购买年度订阅。

100 项资产

选择您的订阅选项：

立即购买
免费试用 立即购买

Tenable Vulnerability Management

可全面访问基于云的现代化漏洞管理平台，从而以无可比拟的精确度发现并追踪所有资产。

Tenable Vulnerability Management 试用版还包含 Tenable Lumin 和 Tenable Web App Scanning。

Tenable Vulnerability Management

可全面访问基于云的现代化漏洞管理平台，从而以无可比拟的精确度发现并追踪所有资产。 立即购买年度订阅。

100 项资产

选择您的订阅选项：

立即购买
免费试用 立即购买

Tenable Vulnerability Management

可全面访问基于云的现代化漏洞管理平台，从而以无可比拟的精确度发现并追踪所有资产。

Tenable Vulnerability Management 试用版还包含 Tenable Lumin 和 Tenable Web App Scanning。

Tenable Vulnerability Management

可全面访问基于云的现代化漏洞管理平台，从而以无可比拟的精确度发现并追踪所有资产。 立即购买年度订阅。

100 项资产

选择您的订阅选项：

立即购买
免费试用 立即购买

试用 Tenable Web App Scanning

您可以通过 Tenable One 暴露风险安全管理平台完全访问我们专为现代应用程序量身打造的最新 Web 应用程序扫描产品。可安全扫描全部在线资产组合的漏洞，具有高度准确性，而且无需繁重的手动操作或中断关键的 Web 应用程序。立即注册。

Tenable Web App Scanning 试用版还包含 Tenable Vulnerability Management 和 Tenable Lumin。

购买 Tenable Web App Scanning

可全面访问基于云的现代化漏洞管理平台，从而以无可比拟的精确度发现并追踪所有资产。 立即购买年度订阅。

5 个 FQDN

$3,578

立即购买

免费试用 联系销售人员

试用 Tenable Lumin

使用 Tenable Lumin 直观呈现及探索您的风险暴露管理，长期追踪风险降低状况，并比照同行业者进行基准衡量。

Tenable Lumin 试用版还包括 Tenable Vulnerability Management 和 Tenable Web App Scanning。

购买 Tenable Lumin

联系销售代表，了解 Tenable Lumin 如何帮助您获取整个企业的洞见并管理网络安全风险。

申请演示 Tenable Security Center

请将您的联系方式填写在此表格中，

我们的销售代表很快与您联系安排演示。

* 字段为必填字段

申请演示 Tenable OT Security

获得符合需求的运营技术安全性。

降低不必要的风险。

申请演示 Tenable Identity Exposure

持续检测并响应 Active Directory 攻击事件。无需代理。无需特权。

本地或云端部署。

申请演示 Tenable Cloud Security

卓越的云安全随时听从您的调遣！

我们将向您展示 Tenable Cloud Security 如何帮助您提供多云资产发现、经过优先级分析的风险评估和自动化合规/审计报告。

了解
Tenable One
的实际应用情况

现代攻击面的风险暴露管理。

了解 Tenable Attack Surface Management 的实际应用情况

了解任何平台上每项资产的风险暴露状况。

免费试用 立即购买

免费试用 Tenable Nessus Professional

免费试用 7 天

Tenable Nessus 是当今市场上功能最全面的漏洞扫描器。

新 - Tenable Nessus Expert
现已推出

Nessus Expert 添加了更多功能，包括外部攻击面扫描，以及添加域和扫描云基础设施的功能。单击此处试用 Nessus Expert。

填写下面的表格可继续试用 Nessus Pro。

购买 Tenable Nessus Professional

Tenable Nessus 是当今市场上功能最全面的漏洞扫描器。Tenable Nessus Professional 可帮助自动化漏洞扫描流程、节省合规周期的时间，并调动起 IT 团队的积极性。

购买多年期许可，即享优惠价格添加高级支持功能，获取一年 365 天、一天 24 小时的电话、社区和聊天支持。

选择您的许可证

购买多年期许可，即享优惠价格

添加支持和培训

立即购买
续订已购许可证 | 寻找经销商
免费试用 立即购买

免费试用 Tenable Nessus Expert

免费试用 7 天

Nessus Expert 针对现代攻击面而量身打造，可以查看更多信息，保护企业免遭从 IT 到云中漏洞的攻击。

已经有 Tenable Nessus Professional？
升级到 Nessus Expert，免费试用 7 天。

购买 Tenable Nessus Expert

Nessus Expert 针对现代攻击面而量身打造，可以查看更多信息，保护企业免遭从 IT 到云中漏洞的攻击。

选择您的许可证

购买多年许可证，节省幅度更大。

添加支持和培训

立即购买
续订已购许可证 | 寻找经销商