Tenable

Connect Tenable to collect vulnerability scanning evidence with automated compliance tests, switched on per workspace.

Connect with an API token

1. In Tenable:

   1. Sign in to Tenable Vulnerability Management as a dedicated user for Safeguard with a role that can generate API keys: Basic, Scan Operator, Standard, Scan Manager, or Administrator.
   2. Access the My Account page and click the API Keys tab.
   3. Click Generate. Review the warning in the Generate API Keys window (existing keys are replaced) and click Generate.
   4. Copy the new access key and secret key from the Custom API Keys section before closing the tab; you cannot retrieve them afterwards.

   Where to find the other values:

   • Environment (optional): Leave empty for the standard Tenable Vulnerability Management cloud; set it only if Tenable gave you a different environment.

   Tenable shows the secret only once, so copy it before you leave the page.

   If Generate is inactive, an administrator must enable API access for the account (Edit a User Account). Keys cover all Tenable One Vulnerability Management products the organization licenses, and generating new ones replaces the old keys for every product. Administrators can generate keys for other users. Use one API key per application. Which role is needed for vulnerability or asset export, and the cloud host name, were not on the fetched page.

   Source: docs.tenable.com, checked 2026-10-07.

   The permissions Safeguard needs: Basic (vulnerability export), Administrator or a custom Export role (asset export).

2. On Compliance › Connectors, open Tenable, click Connect, choose API token and fill in:

   Field	What to enter
   Access key	Required. Stored encrypted and never shown again.
   Secret key	Required. Stored encrypted and never shown again.
   Environment (optional)	—

3. Click Connect with token.

Frameworks

Safeguard's automated tests read Tenable and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.

These tests are switched on per workspace by the Safeguard team.

Related

• Vulnerability Scanning connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks