Tenable adds multistep reasoning and MCP support to Hexa AI agent

Exposure management company Tenable Holdings Inc. today unveiled new capabilities for Hexa AI, the agentic engine inside its Tenable One Exposure Management Platform, pushing the tool into general availability with multistep reasoning and Model Context Protocol support that the company says can shrink the gap between vulnerability discovery and remediation.

The announcement was made at Tenable’s Exposure 2026 conference in Boston. Tenable is pitching the update as a response to a security workflow problem that has worsened as frontier artificial intelligence models accelerate vulnerability discovery. The company argues that manual remediation processes cannot keep pace with discovery cycles now measured in minutes rather than months, leaving organizations exposed.

Hexa AI sits as an orchestration layer on top of the Tenable Exposure Data Fabric, the company’s repository of contextualized exposure data. It connects to existing security and information technology tools and lets customers either deploy Tenable’s prebuilt agents or build their own. The end goal, according to the company, is automating workflows that run from discovery through to remediation without security staff stitching context together by hand.

The headline addition is advanced multistep reasoning, which lets the engine execute end-to-end workflows spanning multiple exposure surfaces from a single request.

Tenable is also rolling out automated remediation workflows that create and route tickets, generate custom policies and produce audit-ready reports. A third capability, billed as end-to-end exposure path insights, allows practitioners to query environments by identity attributes such as service accounts, privileged users and Active Directory groups to surface exposure paths that traditional asset inventories miss. The same module offers guided assistance for complex Active Directory sensor configurations.

MCP support, the open standard created by Anthropic PBC for connecting AI agents to external tools and data, is central to the release. It’s the mechanism by which customers can build custom agents and workflows that plug into Hexa AI without bespoke integration work.

“AI agents operating without the right guardrails and harness can be unpredictable, brittle, or unsafe in real-world enterprise environments,” said Chief Product Officer Eric Doerr. “This is where Tenable Hexa AI shines. It doesn’t just suggest the next step; it orchestrates the entire workflow to neutralize risk before it can be exploited.”

Tenable says that Hexa AI operates within an agentic harness designed to give security teams continuous visibility, guardrails and auditability over agent actions, an attempt to address the trust issues that have slowed enterprise adoption of autonomous AI tooling.

Hexa AI is available now to Tenable One Foundation and Tenable One Advanced customers under the company’s flex pricing model.

Image: Tenable