Tenable and Qualys have been competing in the same market for two decades and their training programmes are a neat illustration of two different philosophies about what education is for. Qualys gives away training and certification and treats the whole thing as customer enablement. Tenable gives away the foundations and charges properly for the specialist tier and the credential, treating the certification as a product. Neither is wrong, but the comparison is unavoidable and it does not flatter the pricing here.
The free tier is genuinely free and genuinely useful. Tenable made a deliberate move some years ago to open its on-demand foundational courses to anyone, and the Tenable One Vulnerability Management Introduction course and the Nessus Fundamentals course are both available without a customer relationship. Nessus in particular is worth knowing. It has been the default vulnerability scanner in a huge number of environments for a very long time, including plenty of small organisations running the free tier, so scanner literacy built here travels.
The specialist courses are better constructed than the free ones, as you would hope. The Vulnerability Management Specialist and Exposure Management Specialist courses combine roughly three hours of lecture and product demonstration with around two and a half hours of lab work, and the labs are the part that earns the money. Reading about scan policy tuning teaches you very little. Tuning a policy against a target environment and seeing the difference in findings teaches you a lot.
Where the content is strongest conceptually is on the shift from vulnerability management to exposure management. The argument is that counting unpatched CVEs is a poor proxy for risk, that asset criticality and attack path reachability matter more than raw severity, and that a security programme should be prioritising by business exposure rather than by scanner output. That argument is correct and the training makes it well. Where I would push back is that exposure management is also a category Tenable has commercial reasons to promote, since it repositions the company from scanner vendor to platform vendor, and the training presents the framing as settled industry consensus rather than as one vendor's strategic bet.
A learner should hold both things in mind: the underlying argument about prioritisation is sound, and the packaging of that argument into a product category is a marketing act. The price is my substantive complaint. An exam at roughly $450, with regional variation that is not clearly published, sits at the top end of this category. Workato charges $300 and includes two attempts.
Starburst charges $49. Qualys, competing in the same market with comparable content, charges nothing. New Relic gives away both training and certification. Against that field, $450 for a single attempt at a vendor credential requires a justification that the value of the badge in the labour market does not currently support.
Tenable certifications are recognised, but not so much more so than a free Qualys credential that the gap makes sense. The specialist course pricing not being listed is the smaller version of the same complaint. Publish the number. Three point five.
Free foundations worth doing, well-built labs in the paid tier, a genuinely useful argument about risk-based prioritisation, and an exam price that only makes sense when somebody else is paying it.