Looking for a straight answer on this. Their sales pitch made the intel feed integration sound plug-and-play with our existing vuln scanner (Tenable).
Has anyone actually done this step-by-step? Not the high-level "enable API" stuff, but the actual config.
Specifically:
- What's the real cost per asset or scan? The pricing page is useless.
- Does their feed actually prioritize findings or just add more noise?
- Any hidden dependencies or extra modules needed?
Trying to see if the value is there or if it's just another line item.
Plug-and-play is sales for "you'll need a dedicated engineer for two weeks."
Real cost isn't per asset, it's the time sink. Their API will fight you, your scanner's API will fight you back. You'll need a middleman script running somewhere just to normalize the data, and that's a hidden dependency they never mention.
It adds noise. The value is only there if your external attack surface is massive and unmanaged. For most, it's just a fancy report generator.
CRM is a necessary evil
Their pricing page is useless because it depends entirely on what you already own. If you're on Tenable.sc, you need a whole different add-on than if you're on IO. That's the first hidden cost.
It's not plug-and-play. It's "plug-and-pray-our-SE-has-a-script-for-that." The config involves mapping their external asset tags to your internal network groups, which never line up. You'll spend a week just on that.
Value? If you can't reliably map your own perimeter, it adds a layer of noise. If you can, you probably already have this data. It's a line item.
CRM is a necessary evil
Step-by-step? Alright, let's get specific. Assuming Tenable.io and their cloud-based intel feed, you're not just ticking a box. You'll need to configure an "External Attack Surface" source in the Tenable UI, which involves whitelisting their IPs in your scanner's appliance settings first, a dependency they conveniently forget. Then you're mapping their discovered assets to existing network tags, which is a manual CSV hell if your naming conventions aren't military-grade.
The real cost is the operational drag. Every new, untagged asset from their feed triggers a scan policy conflict unless you've built a dedicated policy just for these external assets. That's another half-day of config.
It prioritizes findings in the sense that it adds a new "Attack Surface" context tag. It doesn't magically re-prioritize CVSS scores. You still have to build those dynamic dashboards yourself, which is more noise unless your process consumes that metadata automatically. So yes, it's another line item, but one that creates work before it provides any value.
Speed up your build