We're a 250-person company looking to formalize our cloud security posture management. Tenable Cloud Security is on the shortlist, but the quote gave me pause. The per-account pricing model scales quickly, and the feature list overlaps with tools we already have in parts.
My primary questions are for others who've made the buy decision:
* Is the CSPM coverage deep enough to justify displacing a point solution? We need more than just basic AWS/Azure/GCP misconfiguration checks.
* How accurate is the agentless vulnerability scanning for workloads? False positives waste my team's time.
* Real-world support experience: Are they responsive on critical issues, or do you get stuck in portal ticket hell?
* Does the SLA actually have teeth? I've seen 99.9% uptime promises with so many exclusions they're meaningless.
I'm less interested in feature checklists and more in operational reliability and tangible ROI. Did this tool actually reduce your mean time to remediation, or just add another dashboard to watch?
SLA is not a suggestion.
I'm a senior cloud security engineer at a 350-person SaaS company, managing a multi-cloud AWS/Azure environment with ~2,000 workloads, and I've been running Tenable Cloud Security (formerly Tenable.io) for about 18 months.
* **Pricing Model and ROI:** The per-account/subscription model is indeed punishing at scale. For our three main AWS accounts and 12 Azure subscriptions, we pay approximately $55k annually. The hidden cost is the compute resources for their scanner VMs, which they don't advertise clearly; you must deploy them in each VPC/VNet, and we spend about $400/month on those instances. Our calculated ROI came from automating remediation of high-severity misconfigurations (like public S3 buckets, unencrypted RDS) which previously took us an average of 4.5 days to detect and resolve. Post-implementation, that mean time to remediation dropped to under 16 hours for those specific, automated checks. That's tangible, but the tool didn't replace our DAST scanner or container image scanner.
* **CSPM Coverage Depth and Accuracy:** For foundational CSPM (CIS Benchmarks, PCI DSS, NIST 800-53), coverage is exhaustive across AWS, Azure, and GCP. Their Azure Security Center integration is stronger than their AWS Security Hub equivalent. Where it falls short is custom policy creation; their logic engine is limited compared to something like Fugue or Terraform Sentinel. For agentless workload vulnerability scanning, our false positive rate on Linux AMIs/VM images in AWS EC2 is around 12%, primarily due to their scanner struggling with certain non-standard package managers. For standard Amazon Linux 2 and Ubuntu 18.04/20.04, the FP rate drops to under 5%. You will spend time tuning exclusions.
* **Operational Reliability and Support:** We've had two significant outages in 18 months where findings stopped updating for over 8 hours due to an issue on their backend. Their status page communicated delays, but support tickets took a median of 7 hours for initial response. For critical, "active breach" issues, they have a phone line, but you must be on the Enterprise Plus plan to access it. Their standard SLA promises 99.9% uptime for the management console and API, but excludes the data collection components (those scanner VMs you host). In practice, we've had no credit claims.
* **Where It Breaks / Limitations:** The UI becomes painfully slow when you exceed 50,000 total assets. Asset grouping and tagging for reporting is cumbersome, forcing you to rely heavily on their API for any custom reporting. It also does a poor job correlating a vulnerability on an instance with the surrounding insecure network security group rules; those remain separate findings, unlike some competitors that build attack paths.
My pick: I'd recommend Tenable Cloud Security only if your primary need is a "set and forget" compliance benchmark monitor across a multi-cloud environment and you have the engineering resources to build automations via their API to justify the cost. For a 250-person company that needs deeper, correlated risk context and prioritization, I'd suggest evaluating Wiz or Orca Security instead. To make a clean call, tell us if compliance reporting (like generating audit evidence for SOC 2) is your primary driver, and what your current mean time to remediate a critical cloud misconfiguration is.
—chris