Tenable One Cloud Exposure

Overview

Tenable One Cloud Exposure (formerly Tenable Cloud Security) is the cloud-native application protection platform (CNAPP) and cloud infrastructure entitlement management (CIEM) product built on Ermetic, the Tel Aviv entitlement specialist Tenable acquired in a deal that closed on 2 October 2023 for about 265 million dollars. Tenable (NASDAQ: TENB) sells it inside its Tenable One exposure management platform; the Tenable Cloud Security name now survives only in some URLs and data sheets. Ermetic was a CIEM company first and a CNAPP second, and that order still shows in the product. See the consolidation report for where this deal sits in the wider market.

What it is good at

Entitlement depth. The Cloud Exposure CIEM maps human and machine identities, including service accounts, to the permissions they hold across AWS, Azure, and Google Cloud, and surfaces excessive permissions and hidden access paths. It generates least-privilege policies from observed usage and can push them as code snippets into Jira or ServiceNow, which is how fixes actually reach the engineers who own the infrastructure. Identity findings feed its "toxic combination" prioritization, for example a publicly exposed, vulnerable workload whose role can read sensitive data.

Just-in-time access is the standout. Engineers request temporary elevated access through Slack or Microsoft Teams, approvers grant it for a fixed window, and session activity, requests, and approvals are logged for audit. Few CNAPP-embedded CIEMs document a working JIT workflow at all; this is a practical step toward zero standing privileges. For existing Tenable customers, cloud entitlement risk also lands in the same exposure scoring as vulnerability and Active Directory findings from Tenable Identity Exposure.

Where it falls short

It is an enterprise sales motion with no self-serve tier or public price. The repeated renaming (Ermetic, Tenable Cloud Security, Tenable One Cloud Exposure) makes it harder to follow which features live in which SKU, so get the module list in writing. Its runtime and workload protection is less mature than its entitlement analysis, and teams already standardized on another CNAPP will find a second console hard to justify for CIEM alone. It governs cloud permissions, not SaaS or workforce access, so it does not replace an IGA platform.

Pricing

Quote-based. Tenable's buy page lists Nessus prices but not cloud security, which is sold as part of a Tenable One Cloud Exposure or wider Tenable One subscription. See how the category compares in the pricing transparency index.

Best for, and who should look elsewhere

Choose it when the core problem is standing privilege across multiple clouds and you want JIT and least-privilege policy generation, not just a list of findings. It fits best for Tenable customers who want cloud identities in the same exposure picture as their on-premises estate. Onboarding is read-only per cloud account; the effort goes into routing generated policies to the teams that own them. Look elsewhere for CIEM bundled into a CNAPP you already run (Wiz, Cortex Cloud, formerly Prisma Cloud) or a lightweight tool. Compare options in the best CIEM for multi-cloud ranking.

Bottom line

One of the deepest multi-cloud CIEM engines available, with JIT that actually works; best for enterprises that treat cloud privilege as their main identity risk.