Tenable Research Reveals Growing AI Exposure Gap Fueled by Supply Chain Risks and Lack of Identity Controls
Rhea-AI Summary
Tenable (NASDAQ: TENB) released its Cloud and AI Security Risk Report 2026, finding widespread AI-related exposures across cloud, supply chain and identity. Key metrics: 86% host third-party packages with critical vulnerabilities, 70% use AI/MCP packages, and 65% expose unused cloud credentials.
The report warns of rising non-human identity risk, recommends least-privilege controls, secret rotation, unified visibility across code, VMs, identities and cloud to reduce an accelerating AI exposure gap.
Positive
- 86% of organizations identified hosting third-party code with critical CVEs
- 70% have integrated at least one AI or MCP third-party package
- 65% of organizations identified ghost cloud credentials, enabling targeted remediation focus
Negative
- 18% granted AI services administrative permissions that are rarely audited
- 52% of risk now resides in non-human identities versus 37% in human users
- 13% deployed packages with a known history of compromise
Key Figures
Market Reality Check
Peers on Argus
TENB slipped 0.5% while key peers like RELY gained 3.42 and appeared in momentum scans with a 20.13 up move, indicating stock-specific dynamics rather than a sector-wide software rotation.
Previous AI Reports
| Date | Event | Sentiment | Move | Catalyst |
|---|---|---|---|---|
| Feb 12 | AI recognition | Positive | -1.9% | Gartner named Tenable the company to beat for AI exposure assessment. |
| Jan 27 | AI product launch | Positive | -1.6% | General availability of Tenable One AI Exposure for unified AI risk management. |
| Aug 06 | AI platform expansion | Positive | +1.0% | Launch of Tenable AI Exposure to manage enterprise generative AI risks. |
| Jul 24 | AI feature upgrade | Positive | -1.1% | AI-powered VPR enhancements to narrow high-risk vulnerabilities to 1.6%. |
| Jun 16 | AI awards & M&A | Positive | +1.5% | AI security awards and Apex Security acquisition to bolster AI capabilities. |
AI-related announcements have generally been positive in tone but often saw modest, mixed price reactions, with a slight tendency toward small negative moves following AI news.
Over the past year, Tenable has repeatedly highlighted AI innovations and recognition. AI-focused releases on Jun 16, 2025, Jul 24, 2025, and Aug 6, 2025 showcased new AI capabilities and external awards, with modest single‑day moves between about -1% and +1.5%. More recent AI news on Jan 27, 2026 and Feb 12, 2026 emphasized extending exposure management to AI and Gartner validation, yet drew small negative reactions. Today’s AI risk report fits this ongoing AI-focused narrative.
Historical Comparison
Recent AI-tagged headlines for TENB produced an average one-day move of -0.4%, suggesting historically modest, slightly negative reactions to AI-focused announcements.
AI news has evolved from awards and early AI exposure products in mid-2025 to broader platform expansion and Gartner leadership recognition, with today’s report adding thought-leadership around AI and cloud risk exposure.
Market Pulse Summary
This announcement highlights Tenable’s emphasis on AI and cloud exposure, quantifying risks like critical third-party vulnerabilities (86%) and "ghost" cloud secrets (65%). It extends a narrative seen in earlier AI launches and recognitions, positioning the company in AI-driven security visibility. Investors may watch how these insights translate into product adoption, revenue trends, and future AI-focused updates relative to prior AI-tagged news, which averaged a modest -0.4% move.
Key Terms
Model Context Protocol (MCP) technical
Exposure Management technical
AI-generated analysis. Not financial advice.
Report finds
COLUMBIA, Md., Feb. 19, 2026 (GLOBE NEWSWIRE) -- Tenable® (NASDAQ: TENB), the exposure management company, today released its Cloud and AI Security Risk Report 2026. The research reveals organizations face a zero‑margin AI exposure gap as they inherit cyber risks faster than they can address them. Engineering velocity — driven by AI adoption, third-party code and cloud scale — has outpaced the human-led ability to assess, prioritize and remediate risks before threat actors exploit them.
The AI Exposure Gap is a largely invisible form of exposure that emerges across applications, infrastructure, identities, agents and data, and that most security teams are not equipped to manage. Tenable’s analysis of cloud environments identifies severe risks across four key security areas: AI security posture, supply chain attack vectors, least privilege implementation and cloud workload exposure — all of which demand immediate attention. The report includes actionable guidance for security and business leaders to reduce risk across cloud and AI environments.
Key findings from the Cloud and AI Security Risk Report 2026 include:
70% have integrated at least one AI or Model Context Protocol (MCP) third-party package, embedding AI deep into applications and infrastructure, often without central security oversight.86% host third-party code packages with critical-severity vulnerabilities, making the software supply chain a primary and persistent source of cloud exposure. Furthermore, nearly 1 in 8 (13% ) have deployed packages with a known history of compromise, such as the s1ngularity or Shai-Hulud worms.18% of organizations have granted AI services administrative permissions that are rarely audited, creating a "pre-packaged" catalog of privileges for attackers to claim.- Non‑human identities such as AI agents and service accounts now represent higher risk (
52% ) than human users (37% ), forming “toxic combinations” of permissions and access that fragmented tools fail to connect. 65% possess "ghost" secrets—unused or unrotated cloud credentials—with17% of these tied specifically to critical administrative privileges.49% of identities with critical-severity excessive permissions are dormant.
“AI systems embedded in infrastructure pose a critical risk that CISOs and defenders must address, in addition to anticipating emerging threats from both AI and cloud technologies. Lack of visibility and governance means teams are at the mercy of new exposures, including over-privileged identities in the cloud,” said Liat Hayun, Senior Vice President of Product Management and Research at Tenable. “By focusing on the unified exposure path, organizations can stop managing ‘security debt’ and start managing actual business risk.”
To manage emerging risks, organizations must secure the AI integration process through comprehensive visibility and identity-centric controls. This includes enforcing least privilege for AI roles, neutralizing "ghost" identity risk and eliminating static secret exposure. Third-party code and external accounts are now extensions of organizations' infrastructure; steps to reduce extended supply chain exposure include unifying visibility across code packages, virtual machines, identity access and cloud environments.
The 2026 Cloud & AI Security Risk Report presents findings from the Tenable Research team, analyzing anonymized telemetry from diverse public cloud and enterprise environments collected from April to October 2025 (AI findings extended through December 2025).
Exposure Management is the practice of identifying, evaluating, and prioritizing the risks posed by all entry points an attacker could exploit. This includes not just software vulnerabilities (CVEs), but also misconfigurations, excessive user privileges (identity risk), cloud security gaps, and the "shadow" assets created by AI and third-party supply chains.
Download the report here.
Read today’s blog post here.
About Tenable
Tenable® is the exposure management company, exposing and closing the cybersecurity gaps that erode business value, reputation and trust. The company’s AI-powered exposure management platform radically unifies security visibility, insight and action across the attack surface, equipping modern organizations to protect against attacks from IT infrastructure to cloud environments to critical infrastructure and everywhere in between. By protecting enterprises from security exposure, Tenable reduces business risk for over 40,000 customers around the globe. Learn more at tenable.com.
Media Contact:
Tenable
tenablepr@tenable.com
FAQ
What did Tenable (TENB) report about third-party code vulnerabilities in the 2026 Cloud and AI Security Risk Report?
How prevalent are unused cloud credentials in Tenable's (TENB) 2026 findings and why does that matter?
What does Tenable (TENB) say about AI and identity risk in cloud environments for 2026?
Which immediate controls does Tenable (TENB) recommend to reduce AI exposure gaps in 2026?
How common is administrative privilege granted to AI services according to Tenable (TENB) 2026 report?
