15-Point Vetting: Tenable's Exchange Inspector Ensures Safe AI Agent Deployment for SOC Workflows
Tenable’s new Exchange Inspector uses automated checks and human verification to screen AI agents for prompt injection and other risks before deployment.
Key points
- Tenable’s Exchange Inspector vets open-source AI agents against 15 specific security issues before listing them on the CyberAgents Exchange.
- The review process combines automated screening, frontier model assessment, and human verification to ensure safety for SOC workflows.
- Three agents have passed vetting so far, with one tool reducing threat hunting time by 75% for Tenable’s internal security team.
Tenable has introduced the Exchange Inspector, a vetting mechanism designed to evaluate open-source AI agents before they are listed on its CyberAgents Exchange. According to first-hand research published by Tenable, this process addresses the rapid adoption of community-built AI skills and Model Context Protocol (MCP) servers in security operations center (SOC) workflows. The initiative aims to provide visibility into agent behavior before deployment, ensuring that tools used for alert triage and threat investigation meet rigorous security standards.
The risk
The Exchange Inspector tests candidates for 15 distinct types of security issues across three layers of the software stack. According to Tenable, these checks cover conventional vulnerabilities such as server-side request forgery (SSRF) and path traversal flaws. The review also targets agent-specific risks, including excessive permissions and memory poisoning. Tenable uses its Tenable One AI Exposure platform to screen for prompt injection attempts and exposed secrets. Additionally, OpenAI GPT Cyber models are employed to assess the underlying code and threat models of each agent.
Who is exposed
Security teams that deploy AI agents to correlate threat intelligence, investigate suspicious activity, or prioritize vulnerabilities are the primary audience for this vetting service. According to Tenable, it is critical for organizations to understand what these agents will do before deployment. The CyberAgents Exchange currently features three listings that have passed the Exchange Inspector review. Two of these vetted tools were built by Tenable, while the third was developed by Splunk. Contributors to these agents report that they accelerate tasks such as remediation triage and cloud posture investigation.
Cost and compliance
The material does not provide specific data regarding compliance frameworks or regulatory costs associated with deploying these agents. However, Tenable notes that vetted tools are driving operational efficiencies within its own organization. Specifically, the SOC Hunter agent has cut threat hunting times by 75% for Tenable’s security team. This metric highlights the potential operational impact of using verified agents versus unvetted community tools. No other financial or compliance metrics were disclosed in the source material regarding the cost of the vetting process itself.
What should you do?
Security managers should verify whether the AI agents they plan to deploy have undergone independent security vetting. Teams should specifically check for evidence of testing against prompt injection and exposed secrets before integrating tools into SOC workflows. Organizations should monitor for official vetting badges or certifications from trusted vendors to ensure the agents have passed automated and human review processes.
Background: AI agents
AI agents are software systems that perceive their environment, make decisions, and execute actions to achieve specific goals. Unlike standard models, they maintain internal state and interact with external tools, creating unique security risks around tool execution, memory retention, and autonomous decision loops that require specialized controls.
Read the full guide: AI Agents Explained: Answers to Security and Architecture Questions
What to do and how to stay safe: Tenable
- Review the security documentation of any open-source AI agent to confirm it has been tested for prompt injection and exposed secrets.
- Verify that the agent’s permissions are limited to what is strictly necessary for its intended function, avoiding excessive access.
- Check for independent vetting or certification from a trusted security vendor before deploying the agent into production environments.
- Monitor runtime behavior of AI agents in a controlled environment to detect any unexpected actions or data exfiltration attempts.
Step-by-step guide: AI Governance Explained: Building Rules for Autonomous Systems
General security guidance from the Vector Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many AI agents have passed Tenable's Exchange Inspector vetting?
Three agents have passed the vetting process so far, including two built by Tenable and one by Splunk.
What specific security issues does the Exchange Inspector check for?
The inspector tests for 15 types of issues, including SSRF, path traversal, excessive permissions, memory poisoning, prompt injection, and exposed secrets.
Does Tenable use human reviewers in the vetting process?
Yes, the process includes an automated check, a frontier model assessment, and final human verification by Tenable security researchers.
