Today Tenable announced Tenable OPEN for AI, a program that gives security teams validated, ready-to-use AI workflows built on Tenable exposure intelligence. Command Zero is one of twelve launch partners, alongside BeyondTrust, Cohesity, Corelight, Infoblox, Recorded Future, Securonix, SentinelOne, Setyl, Snyk, Sparkle In and Splunk. (Read Tenable's announcement.)
I want to use this moment to explain what the integration does, and also why it matters to us. It goes straight to the reason we started this company.
The question every exposure finding raises
Here's how I put it in Tenable's announcement:
"Every exposure finding raises the same follow-up question: is anyone taking advantage of it? With Tenable OPEN for AI, a priority exposure finding from Tenable feeds directly into a Command Zero investigation, where it provides critical context and helps analysts prioritize response. Every step is recorded and reviewable, and the approved verdict goes back to Tenable so exposure and investigation teams eliminate the need to pivot between platforms."
Exposure management is very good at telling you where you're weak. On its own, it can't tell you whether someone already found that weakness and used it. That second question belongs to the SOC. In most organizations, answering it still means an analyst copying an asset name out of one console, pasting it into three others, and rebuilding a timeline by hand. Closing that gap is what this integration is for.
Why we built Command Zero
I've spent my career in security operations from a lot of different angles. My brothers and I built Riptech, one of the early managed security services companies, which Symantec acquired. I co-founded ThreatGRID, which brought malware analysis and threat intelligence together and became part of Cisco, and I later led strategy and business development for Cisco's Security Business Group. My co-founders, Al Huger and Dean De Beer, carry similar scar tissue. Between the three of us we've built more than a half dozen security companies.
Across all of it, one pattern never changed. Detection kept getting better. Telemetry kept getting richer. The investigation itself stayed stubbornly manual, and it stayed dependent on a small number of senior people.
When an experienced investigator looks at an alert or an exposed asset, they don't run random queries. They ask a specific sequence of questions, and they know which questions not to bother asking. They know what a normal answer looks like in that environment and what should make them dig further. That knowledge is the most valuable asset in a SOC. It's also the hardest to scale, the hardest to hire, and the first thing that walks out the door when someone leaves.
We started Command Zero in 2022 to capture that expertise and put it to work on every investigation. The core idea is simple: the question is the unit of investigative expertise.
Command Zero runs a growing library of thousands of expert-built security questions. Each question encodes what to ask, why it matters, how to interpret the result, and which query to run against which source. Governed AI agents work from those questions, and they can only use validated questions and approved response actions. That's what keeps investigations consistent and defensible instead of improvised.
We also made two architectural decisions early that shape everything else.
Query the data where it lives. Security teams have spent years and serious budget on their stack. We didn't want to ask anyone to move data into yet another platform before an investigation could start. Command Zero queries identity, endpoint, email, collaboration, cloud, SaaS, SIEM, and data lake sources directly.
Show the work. An AI verdict nobody can inspect is a liability in a SOC. Every Command Zero investigation preserves the plan, each question and response, the reasoning, the timeline, and the verdict chain. Analysts can step in and redirect the work at any point, and anyone reviewing a case later can see exactly how the conclusion was reached.
How the Tenable workflow runs
Here's what happens when a Tenable finding enters Command Zero:
- A priority exposure triggers an investigation. A high-priority finding from Tenable arrives as investigation context, carrying the asset, the vulnerability, and Tenable's risk scoring with it.
- Agents ask the questions a senior investigator would ask. Is there evidence of exploitation activity on this asset? Have unusual identities authenticated to it? Is there process or network behavior consistent with the vulnerability class? Did related activity touch the asset's owner in the same window?
- Questions run against the customer's own sources, through their native APIs, with no data migration.
- Every step is recorded and open to analyst review and direction.
- The approved verdict returns to Tenable, so the exposure team sees whether a finding was exploited, not just whether it exists.
Tenable lists our use case, Exposure-to-Verdict Investigation, on its OPEN for AI partner page. See the Command Zero use case on Tenable's site.
Under the hood, Tenable OPEN for AI supports both standardized MCP connectors and direct APIs. The Tenable Hexa AI MCP Server connects with partner MCP servers through the AI tools a customer already uses, and each validated use case is available as a documented workflow or as a ready-to-use skill on Tenable's CyberAgents Exchange. Use cases are live now at tenable.com/partners/technology/ai.
Why this matters for SOC and exposure teams
Exposure and investigation teams usually work from different consoles, different queues, and different definitions of done. Vulnerability owners close tickets when a patch lands. SOC analysts close cases when they're confident there's no compromise. When those closures happen independently, you can end up with a patched asset that was compromised before the patch ever shipped.
Tying the two together through a shared, auditable record changes the remediation conversation. A finding with evidence of active exploitation is no longer a patching task. It's an incident with a scope. A finding with a clean investigation behind it can be prioritized with confidence.
It's also why we built native API and MCP support into Command Zero. Enterprises are assembling their AI SOC from many parts: internal agents, LLM tools, partner skills, and the platforms they already trust. Our questions and evidence need to be callable from wherever that work happens. An open ecosystem like Tenable OPEN for AI is exactly where that approach pays off for customers.
We're proud to be part of the launch, and I'm looking forward to seeing what security teams build with it.
About Command Zero
Command Zero is a question-based AI SOC platform for autonomous and analyst-led investigations. Governed AI agents run expert-built investigative questions directly against customer data sources, covering Tier 1 triage through Tier 3 investigations and proactive threat hunting. Every investigation is transparent and reviewable, with granular policies controlling what each analyst and agent can see, run, and act on. Customers can bring their own questions and logic, so team knowledge becomes part of every investigation. Founded in 2022, Command Zero is backed by Andreessen Horowitz, Insight Partners, Crosspoint Capital, Okta Ventures, Schneider Electric Ventures, and more than 50 cybersecurity executives.
