Tenable Cloud SecurityNxSCORE with Tenable Cloud Security.
Tenable Cloud Security shows what is exposed and who has too much access. NxSCORE works alongside it on what happens next: a verdict with its evidence, a fix your engineers run, a guardrail so it stays fixed, and the evidence your auditors ask for.
You will recognise this if
- The findings are clear, but turning them into changes is slow.
- Excess permissions are flagged, and nobody wants to remove one in case it breaks a job.
- The same exposures come back with each new account or template.
- Your regulator wants a quarterly pack laid out against its own clauses.
What NxSCORE reads from Tenable Cloud Security, and what it never touches.
Tenable Cloud Security stays your scanner. NxSCORE reads what it already knows, so it only scans what nothing else covers, and it never changes anything in Tenable Cloud Security.
| NxSCORE reads | NxSCORE never |
|---|---|
| Policies, and which are switched on | Never changes a policy in Tenable Cloud Security |
| Alert rules, and which accounts they cover | Never creates or edits a rule |
| Compliance standards and their requirements | Never dismisses or resolves an alert |
| Cloud accounts and how they are grouped | Never writes anything back |
| Open alerts, and 90 days of resolved ones | Never sees your workloads’ data |
How NxSCORE sits beside Tenable Cloud Security.
Three things happen in the first days. None of them changes your cloud, or your CNAPP.
- 01
Connect Tenable Cloud Security with a read-only key.
Your team creates a read-only API key in Tenable Cloud Security and enters it once. It is encrypted as soon as it arrives and never shown again.
NxSCORE reads it the same way it reads any CNAPP: its policies and rules, compliance frameworks, cloud accounts and open findings, once a day, with 90 days of resolved findings on the first sync.
Tenable Cloud Security, first syncConnectedCloud accounts 48 Open findings 1,310 Resolved findings read, last 90 days 2,870 Of those, came back after a fix 296 - 02
Coverage worked out control by control.
For each control, NxSCORE looks at whether Tenable Cloud Security checks it, and for which accounts.
Whatever it does not check, the NxSCORE scan does. Whatever no scanner can check, such as a quarterly access review, is met with evidence your analyst accepts.
Who checked itExample- S3 buckets block public accessTenable Cloud Security
Tenable Cloud Security checks it, and an alert rule covers every account.
- EC2 instances require IMDSv2Tenable Cloud Security and NxSCORE
Both see the same failing setting. One finding, not two.
- Unused IAM roles removed after 90 daysNxSCORE
No Tenable Cloud Security policy is switched on for it, so the NxSCORE scan checks it.
- Access reviewed each quarterEvidence
No scanner can check it. Your team uploads the review and an analyst accepts it.
- 03
Every account accounted for.
NxSCORE matches the accounts in your cloud organisation with the accounts Tenable Cloud Security monitors. One that Tenable Cloud Security has switched off, or never had, is listed by name, and scanned where NxSCORE has its own read-only role.
An account nobody can read is shown as not scanned. It never appears in a report as passing.
AccountsExample- prod-paymentsCovered by your CNAPP
- data-lakeScanned
- sandbox-17CNAPP only, not scanned
- dr-siteAccess denied
Then the work after the alert.
What happens after Tenable Cloud Security raises it.
This is the part a scanner leaves to your team. With NxSCORE, an analyst does the preparation and your people make the decisions and the changes.
- 04
A verdict before anyone touches it.
Before a fix is suggested, NxSCORE reads how the resource is used: what a security group is attached to, when a key was last used, who created it. The verdict comes with its reason, so your engineers can check it.
Findings are grouped into issues, ordered on the Priorities page, and given an owner from the resource’s tags and a fix-by date from its severity. How a backlog is sorted.
Is it safe to fix?Example- Access key for svc-reportingSafe to fix
Last used 214 days ago.
- sg-payments-edgeCheck first
Attached to two network interfaces behind the load balancer.
- 05
A fix kit your engineers run.
For a safe fix, NxSCORE writes the script, with its check, apply and rollback in one file. Your engineers run it. NxSCORE’s access stays read-only.
A finding closes only when a later assessment, or Tenable Cloud Security, no longer sees the problem. How fixes are kept safe.
Fix kit: S3 buckets that allow public access- CheckLists every change it would make. Changes nothing.
- ApplyAsks before it acts, in your change window.
- RescanClosed when NxSCORE, or Tenable Cloud Security, no longer sees it.
- 06
A guardrail, so it does not come back.
When Tenable Cloud Security raises the same issue again and again, your analyst writes a prevention plan aimed at its source. Your team agrees it and makes the change.
NxSCORE marks the plan verified after 14 days with no new findings from Tenable Cloud Security or from its own scan.
Prevention planVerified - 07
Evidence for the requirements no scanner can check.
Each requirement is met by checks, evidence or both. Findings from Tenable Cloud Security count towards the checks. Your team uploads the rest once, and your analyst accepts it.
PCI DSS 4.0.1Example- Settings Tenable Cloud Security and NxSCORE checkChecks
- Policies, reviews and training recordsEvidence
Questions about NxSCORE with Tenable Cloud Security.
Does NxSCORE replace Tenable Cloud Security?
No. NxSCORE works with Tenable Cloud Security. Tenable Cloud Security stays your scanner. NxSCORE reads what it finds, checks what it does not, and runs the work after the alert with your team.
Does NxSCORE change anything in Tenable Cloud Security?
No. It reads policies, alert rules, compliance standards, accounts and alerts with a read-only key. It never dismisses an alert, edits a policy or writes anything back.
Will we see every finding twice?
No. When Tenable Cloud Security and the NxSCORE scan report the same failing setting on the same account, it is one finding, marked as found by both.
How does NxSCORE handle a permission that looks unused?
Before a fix is suggested, it reads the evidence in your account, such as when a key was last used. Anything in use is marked for review, with what uses it, and never handed over as a safe fix.
Does NxSCORE remove the access for us?
No. NxSCORE’s access is read-only. It writes the change, with a check mode and a rollback, and your engineers run it through your own change process.
Keep Tenable Cloud Security. Add the work after the alert.
Connect Tenable Cloud Security and one cloud account. After the first assessment, your analyst shows you which findings are safe to fix now, which need a decision, and the guardrail that would stop the most frequent one returning.