As IT and OT converge, traditional security tools leave organisations blind to real threats. Tenable’s hybrid discovery method combines safe active queries with continuous passive monitoring, delivering complete, accurate visibility across IT, OT and IoT systems. By prioritising risks based on business impact rather than volume, Tenable helps companies focus on what truly matters – protecting their most valuable assets while reducing operational disruption. Walid Natour, Senior Manager, Security Engineering, Middle East & North Africa at Tenable, shares how Tenable is reshaping exposure management.
How is the role of the CISO evolving compared to their traditional IT responsibilities?
Traditionally, a CISO’s responsibilities were tactical, centred on implementing security controls and responding to threats. They were often seen as the ‘no’ department – responsible for hindering business initiatives in the name of security. That has changed. Evolving from a purely technical function within the IT department, CISOs today are elevated to a strategic, business-focused leadership position and a crucial part of the C-suite who report directly to the CEO or board.
The CISOs focus has shifted from managing IT security to managing enterprise-wide business and technical risk – which now includes the entire computing infrastructure, encompassing operational technology (OT) and critical infrastructures, the Internet of Things (IoT) and smart cities. Modern CISOs must translate complex technical risks into business language, enabling senior leadership to make informed decisions about risk appetite. They are collaborators, not just gatekeepers, and work with all departments to embed a security-first culture. With rising data privacy regulations and increased legal liability, they are also responsible for ensuring compliance and navigating the legal landscape.
The modern CISO’s success hinges on a blend of technical knowledge and business acumen, making them a strategic enabler of growth and innovation.
How does Tenable’s approach to hybrid discovery differ from traditional OT identification techniques and what is the benefit of this?
Today, the biggest challenge isn’t a lack of security data, it’s having too much of it. The convergence of IT and OT has blurred lines, but siloed security tools still operate in isolation, generating a sea of noisy findings that leaves organisations blind to their true cyber exposure. This isn’t just a technical problem; it’s a strategic business risk where a single weakness can lead to a catastrophic operational event.
Our approach helps leaders cut through that noise by providing an attacker’s perspective. We don’t just find vulnerabilities; we connect the dots to show you the most likely attack paths to your most valuable assets – your “crown jewels”.
The Tenable One Exposure Management Platform prioritises risk based on business impact, not just technical severity. It provides precise vulnerability prioritisation with AI power Vulnerability Priority Rating (VPR). This allows teams to focus their efforts on critical “choke points” – single fixes that close the most attack paths and dramatically improve security posture. For OT environments, which are incredibly sensitive, this is critical.
Traditional methods offer a no-win scenario: dangerous, disruptive active scans or incomplete, passive-only visibility. Our patented hybrid discovery method solves this safely and comprehensively. It combines non-disruptive, continuous passive monitoring with safe, targeted active queries that use the right protocols for the devices. This provides a complete, accurate inventory without ever risking operational continuity, ensuring you can manage the entire converged attack surface as one. This is why it’s not just about patching; it’s about prioritising what matters most to your business.
Tool consolidation is a growing priority – how does Tenable help reduce ‘tool sprawl’ while improving visibility and control over IT, OT and IoT systems?
Tool consolidation is a growing priority because a fragmented approach to security creates blind spots and leaves organisations open to attack. Threat actors don’t honour security silos; they move laterally across IT, OT and IoT environments to find a weakness to exploit. Traditional tools, which are built for individual technologies, create a “sea of noisy findings” that make it nearly impossible to distinguish true exposure from low-priority alerts.
Tenable helps solve this by providing a singular, all-enterprise exposure management platform. Instead of a fragmented security toolset, the platform unifies visibility and insight across the entire attack surface. This gives security teams a complete, central view of all assets and identities – whether they are in IT, OT, cloud or IoT environments – and the risks associated with them. The platform also unifies data from third-party tools, consolidating them into a single pane of glass and providing full risk context.
This enables organisations to see all their cyber risks in one place, identify the true exposures threatening their business value, and make more informed investments to optimise their overall security posture.
Can you share a real-world example or use-case where Tenable’s OT solutions have made a significant impact?
A regional beverage manufacturer has been using Tenable Nessus and Tenable Security Center as a key part of its vulnerability management strategy in the IT network for several years. It asked Tenable to support it with a Proof of Value (PoV) for its OT environment. The test installation at a remote site, which was scheduled at short notice and implemented within just two weeks, proved to be a real game changer.
Although the facility runs the most diverse machine park of all the sites, ranging from modern high-tech systems to legacy devices from the late 1980s, which is not unusual for OT environments, Tenable OT Security delivered a detailed inventory after a short period of fine-tuning. In addition to a comprehensive list of systems, it also contained extensive information about the system software, the software versions and the vulnerabilities, thus laying a robust foundation for securing the environment.
This manufacturer quickly decided to transfer the PoV to live operation at the beginning of 2024 and rolled out the system successively at all locations. As of today, all sites are connected to Tenable OT Security.
In late fall 2024, they commissioned a new dosing system for chemicals at one of its sites. While the system was being set up, Tenable OT Security detected that several of the machine’s control systems had massive known security vulnerabilities for which patches had actually been available for years. Without Tenable OT Security, the production environment would inevitably have become vulnerable.
When first installed, Tenable OT Security generated over 80 alerts per 1,000 systems. Today, our customer has reduced that number by more than 52%, bringing it down to just 38 per 1,000. This represents a remarkable improvement, with nearly all of the remaining vulnerabilities classified as non-critical.
What do you see the future of exposure management in OT holding?
Organisations are increasingly realising that you can’t address your risk by looking at different areas of the business – you have to look at it holistically. Technology has evolved, obliterating the barrier between IT and OT. This sprawling, ever-changing landscape of laptops, servers, cloud platforms, mobile devices and interconnected operational technologies increases business risk that has to be addressed holistically.
Exposure management, as a discipline, does exactly that by providing unified visibility, better insights and preemptive action. Security teams can’t reduce risk when everything is scattered. Just like how the IT and OT worlds have collided, we now have to bring all our threat intel together.
