Which Tenable product makes sense for mixed managed and unmanaged devices?

I’d start by separating the problem into asset discovery, vulnerability assessment, and remediation. Nessus Professional is mainly a scanner, so it may not give you the ongoing inventory and coverage you want across a changing, partly unmanaged environment.

Compare the broader Tenable offerings by checking which assets they can actually discover and assess, how they handle agents versus network scans, and what reporting and prioritization they include. Ask for a demo using your mix of devices rather than relying on product names.

Don’t assume a larger vulnerability platform is the only answer. If most systems are managed, an endpoint management or EDR tool with vulnerability reporting may cover those machines, while network scanning helps find devices that aren’t enrolled.

That still leaves the practical question of patching. Check whether the tools you already own can handle remediation before adding another product, and compare total licensing and operating effort.

The shadow IT part is the tricky one. Agent-based coverage can be useful, but it won’t tell you about a device that never gets an agent. I’d ask vendors to show how they discover assets on your networks and how they distinguish a one-time sighting from an actively managed endpoint.

Also check what happens with unusual or academic devices, where installing software may not be possible. Coverage gaps matter more than a broad product label.

For a shortlist, compare the broader exposure-management offering with the more focused scanning options, but treat the packaging as something to verify. Ask for a feature-by-feature breakdown, supported asset types, licensing rules, and a clear explanation of what requires an agent.

If the main goal is simply keeping an accurate list of rogue assets, a dedicated discovery tool might be enough for that part. It would not automatically replace vulnerability assessment or remediation, though.