Synack and Tenable Integration Guide: Validate Scanner Findings
Import the vulnerabilities your Tenable Vulnerability Management scans already surface, then have the Synack Red Team or Sara confirm which of them an attacker could actually use. This guide covers the keys you need, the setup steps in the Synack Portal, how to scope the import and the questions that come up most.
What the integration does
Import your Tenable findings
Vulnerabilities found by Tenable Vulnerability Management flow into the Synack Scanner Findings list (also called the Suspected Vulnerability list), each one connected to the asset it sits on. Import once, or enable a daily import. Asset tags and severity can narrow the scope.
Validate what is exploitable
The Synack Red Team, Sara, or both work the imported findings to establish which are genuinely exploitable and how exposed the affected assets are. Scanner output becomes evidence rather than a queue.
Fix it and prove it is fixed
Validated findings come with remediation recommendations, and Synack verifies the patch afterwards. This helps teams prioritize and remediate confirmed exploitable vulnerabilities.
Two ways to work the imported findings
Setup takes two steps: ask your Tenable administrator for an Access Key and a Secret Key, then connect them under Settings, Integrations in the Synack Portal. A Synack Admin role is required. You can narrow the import by Tenable asset tag or severity, and choose whether publicly accessible host assets found by Tenable are added to your Synack Asset List automatically. Once findings are importing, you have a choice of workflow.
Human-led testing by the Synack Red Team
Filter the Scanner Findings list to see what came from Tenable, add the affected assets to an assessment, and the Synack Red Team confirms exploitability and assesses exposure through human-led testing.
AI-supported testing and triage with Sara
The Synack Autonomous Red Agent triages imported findings and confirms exploitability, which shortens the path from scan to answer. Your Synack team can advise which test offering fits the assets in question.
What Tenable products does Synack integrate with?+
The integration works with Tenable Vulnerability Management (VM), formerly known as Tenable.io, running standalone or as part of a Tenable One subscription. A separate Synack guide covers the integration with Tenable Web Application Scanning (WAS). The integration does not currently work with other Tenable scanning solutions such as Tenable Security Center or Tenable Nessus.
Why can I not see Tenable on my Integrations page?+
You must be a Synack Admin user to see the Integrations page.
Can FedRAMP customers use the Tenable integration?+
Yes, the integration is supported, provided you are using the FedRAMP instance of Tenable Vulnerability Management or Tenable One. In that case you log in to the FedRAMP instance of the Synack Portal at login.synack.us rather than the commercial portal. Which testing workflows are available in the FedRAMP environment depends on your entitlements, so check with your Synack team.
How long does the first import take?+
On initial configuration it can take some time. A one-time import can take anywhere from a minute to an hour depending on the scope of vulnerabilities. For scheduled recurring imports, it may take up to 24 hours until the next daily import cycle begins, depending on the time of day you enabled it.
My integration used to work and has stopped importing. What happened?+
A Failed Import message usually means the API token has expired or was deleted. Check in Tenable that the token still exists and is active. If it has expired or was removed, generate new keys in Tenable and reconfigure the Synack integration with them.
Why are only some of my Tenable vulnerabilities importing?+
The integration only imports vulnerabilities associated with assets already present in the Synack Asset List. Assets can be added through Synack Attack Surface Discovery, the Palo Alto Xpanse ASM integration, assessment creation, or manually. Enabling asset creation in the integration settings adds publicly accessible assets found by Tenable automatically, but it does not add internal assets.
Why do the vulnerability counts differ between Tenable and Synack?+
The two platforms count differently. Tenable reports the count as the number of uniquely vulnerable assets, each of which may be affected by multiple CVEs. Synack counts every vulnerability individually, even when several sit on the same asset. For the same set of assets, the Synack count may therefore be higher.
Who do I contact if I am still having trouble?+
Email [email protected].
Get the Tenable Integration Guide
Nine pages covering the keys to collect, the setup steps in the Synack Portal, how to scope the import, both testing workflows and the questions that come up most. No form, no email required.