Tenable One Vulnerability Management
Continuous vulnerability management within an exposure management platform.
For: CISOs and heads of security, Security teams that need a unified view of risk and other profiles
Learn more about the product Application Security
Tenable One Web App Scanning
Web applications fail in ways infrastructure scanning can't see. The server can be fully patched, the operating system free of pending CVEs, and the application can still accept input it shouldn't. Tenable Web App Scanning is a dynamic application security testing (DAST) tool: it assesses the running application through its interface, the way a user — or an attacker — would encounter it.
The problem
Infrastructure with no vulnerabilities doesn't mean the application is secure
A large share of the flaws exploited in web applications come from the application's own logic and input handling, not from an outdated package. These are problem classes that only surface with the application running — and they grow in number at the same pace the team ships new releases.
- Published applications without recurring security testing.
- Third-party components without vulnerability tracking.
- APIs exposed outside the assessment's scope.
- Application and infrastructure findings kept in separate reports.
Who it is for
Intended audience
- AppSec teams
- Development teams responsible for published applications
- DevSecOps
- Organizations that need automated, recurring scanning of web applications
What it offers
Key capabilities
Information as stated by the vendor. See sources at the end of the page.
Mapping the running application
Crawls the application through its interface to build a site map of pages, links, and forms, defining what will be tested.
OWASP Top 10 coverage
Checks aimed at the OWASP Top 10 vulnerability classes, including XSS and SQL injection.
API scanning
Assessment of APIs, beyond traditional browsing interfaces.
Third-party components
Detecting vulnerabilities in third-party components used by the application.
Certificates and server configuration
Identifying problems in SSL/TLS certificates and inadequate server configurations.
Single-page applications (SPA)
Analysis of single-page applications, whose content is assembled dynamically in the browser.
Role-based access control (RBAC)
Setting permissions by user role within the tool.
Flexible scheduling and deployment
Automated tests on a configurable schedule, with SaaS and on-premises deployment options.
Practical application
Use cases
Recurring testing of published applications
Automated scanning on a defined schedule, tracking how applications evolve between releases.
API coverage
Assessment of programmatic interfaces that usually fall outside the scope of browsing-centered tests.
Unified view with infrastructure
Application and infrastructure findings brought together on the same platform, avoiding parallel reports.
Support for compliance requirements
Evidence that applications go through documented, periodic technical assessment.
How it works
Process steps
-
Target configuration
Defining the application to be assessed, the allowed scope, and, when applicable, authentication credentials.
-
Crawling
The tool crawls the running application and builds the map of pages, links, and forms that will serve as the basis for testing.
-
Dynamic testing
Sending crafted requests to detect known vulnerability classes and observing the application's behavior.
-
Analysis and prioritization
Consolidating findings with severity information to guide the remediation queue.
-
Remediation and retest
Routing to the responsible team and re-running the test to confirm the fix worked.
When to consider
This product tends to make sense when...
- There are published web applications that don't currently go through recurring assessment.
- APIs are part of the exposed surface and need to be brought into scope.
- There's a need for scheduled tests, not just one-off assessments.
- It matters to see application and infrastructure findings in one place.
When to evaluate another option
Another path may be worth considering when...
- The scope is essentially network infrastructure, with no significant web applications. See Nessus Professional →
- There are few applications, and the need is a one-off scan within a larger assessment effort. See Nessus Expert →
Frequently asked questions
What is DAST?
DAST (Dynamic Application Security Testing) is security testing performed with the application running, assessing it from the outside without access to the source code. It complements SAST, which analyzes code statically, and SCA, which examines third-party components.
Does DAST replace code review or manual pentesting?
No. Automated dynamic testing covers known vulnerability classes well, at scale and with frequency. Business logic flaws and specific exploit chains still depend on human analysis. The approaches complement each other rather than replacing one another.
Is testing in production safe?
Dynamic tests generate real traffic against the application and can create records or trigger actions. The usual practice is to start in staging, adjust scope and configuration, and only then carefully define what will be tested in production — always with formal authorization from whoever owns the application.
What are the purchasing terms?
Licensing usually varies based on the number of applications assessed and the deployment model. Check current availability and purchasing terms.
How to buy
Commercial terms, availability and licensing models are defined by the vendor and may change. Check the official purchase page or talk to a specialist to assess your organization’s scenario.