Tenable provides the exposure management guardrails that help enterprises adopt AI safely, claims Rajnish Gupta, MD & Country Manager, Tenable India. In an exclusive conversation with Bhavya Bagga, Business Reporter, CXO Media & APAC Media, Gupta informs how Tenable treats AI risk as a part of the broader attack surface because cloud workloads, identities, prompts, AI agents and proprietary data are all interconnected.
Tenable offers solutions across exposure management, vulnerability management, cloud security, identity security and AI security. How are enterprises using these capabilities today, and what are the key use cases you are seeing across different industries?
Enterprises are moving away from siloed point tools and putting these five capabilities together to answer one question: where’s our real risk, and what matters most right now? Most teams are using vulnerability management for risk-based prioritisation, cutting through thousands of findings to focus on what’s actually exploitable. Exposure management is what stitches that together with cloud, identity, and OT risk into a single view, since attackers routinely chain a cloud misconfiguration with a stale on-prem flaw to get in.
Cloud security use cases are about identity hygiene right now. Our own research found 65% of organisations are sitting on “ghost secrets” (unrotated cloud credentials) and nearly half have dormant identities with excessive access. That’s driving demand to find and shut down that exposure before it is exploited, alongside securing cloud-native workloads from code to runtime. Identity security extends the same logic into Active Directory and hybrid environments, mapping attack paths like privilege escalation that traditional scanning misses entirely.
AI security is the fastest-growing use case we are seeing. We found 70% of organisations have adopted AI or MCP packages with no central security oversight, and 18% have given AI services admin-level access that’s rarely audited. So enterprises, especially financial services and healthcare, are using it to discover shadow AI, see what data agents can touch, and enforce acceptable-use policies before an incident forces the issue.
By industry, these are the ones Tenable is focusing on currently:
- financial services, technology service companies and government lean on exposure management for adversary-facing risk reduction and regulatory reporting;
- healthcare weights vulnerability and cloud security around patient-data protection;
- manufacturing and critical-infrastructure customers use us for converged IT/OT visibility, since a compromised controller has physical consequences a typical IT vulnerability doesn’t.
Tenable has a broad presence across sectors such as BFSI, technology, manufacturing and healthcare. Which industry verticals are seeing the strongest demand for exposure management in India and APJ, and what security challenges are driving that demand?
What we are seeing in India and across APJ isn’t concentrated in one sector; it is broad-based, and that’s arguably the more interesting story. BFSI, technology, manufacturing and healthcare are all showing strong, comparable demand, just driven by slightly different pressures.
In BFSI, it is regulatory pressure combined with attacker focus — regulators across the region, including RBI’s cybersecurity guidelines in India and similar mandates elsewhere in APJ, are pushing banks and NBFCs toward continuous, provable risk visibility rather than point-in-time audits.
In technology and IT services, the driver is the pace of cloud and AI adoption outstripping security oversight. Our own research found 70% of organisations have adopted AI or MCP packages with no central security review, and that gap is especially visible in India’s large tech and GCC (global capability center) ecosystem.
Manufacturing demand is being pulled by IT/OT convergence, as factories connect operational technology to IT networks and inherit IT-style attack surfaces without IT-style visibility. And healthcare’s driver is data sensitivity plus modernisation with digital health records and cloud migration expanding the attack surface around patient data.
What ties all four together, and what’s really accelerating adoption across the region generally, is regulation catching up with reality: India’s DPDP Act and CERT-In’s six-hour breach-reporting rule, alongside similar data protection and critical infrastructure regulations elsewhere in APJ, are forcing every sector toward the same thing — knowing their exposure continuously and being able to prove it, not just patch reactively. That regulatory convergence is why exposure management demand looks broad rather than concentrated in any single vertical right now.
You work closely with CISOs across APJ. How has the conversation with CISOs evolved from traditional vulnerability management to broader exposure management, and what are they prioritising differently today?
CISOs today have moved beyond the “patch everything mindset”. There are over 70,000 critical vulnerabilities and exposures in 2026 with tens of thousands of vulnerabilities being disclosed every year. Security teams can’t really patch every single one of them as it is impossible to do so. At the same time, relying on standard CVSS scores doesn’t really narrow down on the vulnerabilities that pose the greatest risk to the organisation. Prioritisation is the hardest part of cybersecurity given the tsunami of vulnerabilities and misconfigurations.
This shift has moved the conversation from patching isolated vulnerabilities to figuring out entire attack paths. An unpatched edge server may appear manageable on its own but clubbed together with an overprivileged identity and a cloud misconfiguration, it becomes highly risky. Exposure management helps security teams identify those toxic combinations, focus on the choke points and break the attack path before an attacker gets to it.
That’s why CISOs want a single, defensible view of risk. Siloed point solutions generate separate findings, priorities and workflows that leave teams chasing the loudest alert. Exposure management unifies those signals across cloud, identity, web applications, OT and legacy infrastructure. That context helps security leaders direct limited resources toward the exposures that create the greatest business risk and explain decisions clearly to the board.
With AI introducing new risks across applications, identities, cloud environments and AI agents, what role does Tenable see itself playing in securing the AI ecosystem? How is Tenable adapting its platform and capabilities to address these emerging exposures?
Tenable provides the exposure management guardrails that help enterprises adopt AI safely. We treat AI risk as a part of the broader attack surface because cloud workloads, identities, prompts, AI agents and proprietary data are all interconnected. Our platform continues to expand across four areas.
Tenable One AI Exposure provides real time visibility into interactions with tools such as ChatGPT Enterprise and Copilot. It helps organisations detect and block data leakage, jailbreak attempts and prompt injection. Through the CyberAgents Exchange AI Inspector, we combine Tenable’s detection capabilities with OpenAI’s frontier models to review community-built agents, skills and MCP servers for malicious instructions and excessive permissions before deployment.
We also use Claude Mythos 5 in Tenable One to power Adversary View, which analyses scan data from an attacker’s perspective and uncovers complex vulnerability chains. Tenable Hexa AI automates exposure workflows, including asset categorisation, scan configuration and remediation triggers. Its agentic harness applies zero trust controls, bidirectional prompt guardrails, least privilege execution and human approval gates. Those controls keep autonomous defensive AI within authorised boundaries.
As Tenable continues to expand across APJ, what are the key pillars of your go-to-market strategy? How are partnerships, customer education and industry-specific solutions contributing to growth in the region?
Our APJ growth rests on a few pillars. First is platform consolidation, with Tenable One as the answer to the fact that enterprises typically run 30-50 disconnected security tools. It is already driving a large share of bookings globally, and that same pitch resonates strongly here as regional organisations rationalise their security stacks.
Partnerships are close to the whole go-to-market model, not one channel among several. We are explicitly channel-first, avoiding house accounts that compete with partners. In APJ we’ve backed that with deal registration protection, renewal assurances, and active encouragement for partners to move beyond reselling into managed security services and professional services, which deepens the relationship and gives partners more durable revenue.
Customer education matters because cloud and AI adoption are outpacing customer teams’ ability to hire and train for it. We invest in formal certification and training programs, and design Tenable One itself to reduce that expertise burden by surfacing prioritized, contextualized risk rather than raw vulnerability lists.
Industry-specific solutions show up most concretely in regulated and critical-infrastructure sectors. Australia’s SOCI Act compliance work is a clear example, alongside dedicated solutions for financial services, government and critical infrastructure across the region.
The cybersecurity market has several players offering vulnerability and exposure-management capabilities. What differentiates Tenable’s approach, technology and platform from other solutions available to enterprises?
What sets us apart is breadth combined with depth in one platform. Tenable One spans IT, cloud, identity, OT, web apps, third-party risk and AI. Most competitors are strong in one or two of those and bolt on the rest without a shared data model. Gartner named us a Leader in its 2025 Magic Quadrant for Exposure Assessment Platforms, ranking us highest on “Ability to Execute” and furthest on “Completeness of Vision,” largely on that combination.
The second piece is what we do with that breadth: AI-driven prioritisation that traces attack paths across domains, not just severity within one. A low-risk finding in isolation can be critical when it links a cloud misconfiguration to a privileged identity, and tools that only see one layer miss that chain. Gartner called this out specifically, naming Tenable the “company to beat” in AI-powered exposure management.
Third, we are open by design: 300+ integrations mean third-party telemetry feeds into the same risk model rather than sitting in a separate dashboard.
Versus newer cloud-native rivals, it is a difference in philosophy more than capability: some lead with agentless, API-driven cloud scanning; we pair that with deeper agent- and scan-based coverage across on-prem, hybrid and OT. For genuinely hybrid enterprises, that combination is the differentiator.
India is rapidly adopting cloud, AI and digital infrastructure. What are the biggest exposure-management gaps you currently see among Indian enterprises, and where does Tenable see the greatest opportunity to help organisations address them?
India’s digital acceleration has expanded the attack surface than many organisations can secure it. The most pressing gap involves unmanaged non-human identities. Teams often grant broad permissions to machine credentials, API keys and autonomous AI agents to keep software development moving. They may closely monitor human access while not treating machine identities as digital employees. Hence they go ungoverned. Attackers can use orphaned credentials with excessive permissions to move laterally.
Third-party and supply chain dependencies create another major exposure. Enterprise portals often rely on open source plugins, external frameworks and downstream code. Without continuous monitoring, teams miss vulnerabilities in those dependencies. Organisations also need to address prompt injection, shadow AI use and security risks that emerge when employees vibe code without proper controls.
Tenable can help Indian organisations bring AI, cloud, web applications, on-prem assets and identities—both human and machine—into a unified view through Tenable One. The exposure management platform reduces noise, identifies attack paths that put critical assets and operations at risk and helps security teams focus on the actions that will reduce exposure. That approach supports innovation while offering stronger control over the risks they introduce.
As organisations move towards proactive exposure management, how does Tenable help security teams move beyond simply identifying vulnerabilities to understanding which exposures could have the greatest impact on their business?
Boards do not really understand what a CVSS score is really doing for risk management. They want to know whether the organisation is secure and how it compares with peers. Raw vulnerability counts and technical decks are incomprehensible to most people outside of the cybersecurity sphere and they do not answer the questions Boards ask. Tenable helps security leaders translate technical data into business impact in three practical ways.
First, Tenable One maps assets to business units and revenue streams. Clear exposure scoring helps executives see which critical operations face risk and why that matters. Second, Tenable Research links over 600 known treat groups to live customer environments. Teams can see which adversary can reach their network through specific CVEs and non-CVE exposures. Third, the platform helps with prioritisation. Tenable One identifies systemic root causes and attack choke points, This approach gives security leaders a clear, prioritised plan for reducing exposure and gives boards a more meaningful way to assess whether security investments protect the business.
