Nucleus Enterprise Vulnerability Management Platform

My main use case for Nucleus Security  is endpoint security. Nucleus Security  is being installed into the personal laptops of the employees, and through that, all the policies are being maintained by the central department of cybersecurity.

Nucleus Security offers excellent features including runtime addition or deletion in terms of policy implementation onto specific employees without rebooting the endpoint. The runtime deletion and the fact that we do not need to reboot endpoints has led to less reboot time, and the implementation and turnaround time have increased for the specific department.

Nucleus Security has positively impacted my organization by reducing the turnaround time in terms of implementation. The employees are happy that it does not consume much space in terms of RAM usage. From the employees' feedback, endpoint security used to take up around seventy-five percent of the RAM usage, but now it is reduced to forty percent.

Nucleus Security has done a good job, so I suggest maintaining that level of effort.

I have been using Nucleus Security for the past one year.

Nucleus Security is quite stable.

Nucleus Security's scalability is great and it is working well.

Nucleus Security's customer support is good. I would rate the customer support a nine out of ten.

I previously used a different solution called Checkpoint, but we changed it because of the complexity involved in its implementation.

I have seen a return on investment from using Nucleus Security. The primary example is that it reduces the time for the turnaround for the implementation of policies, which is a drastic reduction in terms of implementation.

Before choosing Nucleus Security, we evaluated many options, with the main competitive one being Palo Alto.

Regarding Nucleus Security's AI capabilities, I am probably not the best one to comment on it; the specific department can provide more insights. As for Nucleus Security's AI capabilities and its accuracy and reliability of output, from what I have heard, it is quite good.

Risk-based prioritization is crucial for addressing vulnerabilities in our organization, and Nucleus Security has contributed significantly by being able to address all of the queries right at runtime. Nucleus Security's integration flexibility with ticketing systems and existing tools has improved our deployment process; it can track pending tasks, and the SLAs are governed by the central ticketing tool, which has helped significantly.

Nucleus Security's ability to handle large volumes of exposure data across complex environments has adhered to all of the requirements for the department, so it has been quite good in handling large data. I have not been able to use the risk reduction measurement feature in Nucleus Security. I have not used the customizable risk model feature either, so I cannot speak to whether it has helped tailor vulnerability prioritization to reflect our environment. I have not been exposed much to natural queries or advanced logic with NQL to identify vulnerabilities, but it is probably quite good; the department was happy implementing it.

I have not been exposed to the pricing, setup cost, and licensing, so I am probably the last one to comment on that because I am just the user of it. The advice I would give to others looking into using Nucleus Security is that it is good, scalable, and robust. I would rate this review overall as a nine out of ten.

My main use case for Nucleus Security  is vulnerability management, along with audit trail  commentary and a single pane view.

I can provide a specific example of how I use Nucleus Security  for meeting management or audit trails. Nucleus Security filled a gap within the vulnerability management landscape. Multiple tools available did not provide the opportunity to comment against vulnerabilities and assign vulnerabilities automatically. Nucleus Security were pioneers in bringing threat intelligence, EPSS scoring, and threat intelligence Mandiant ratings at the time. It was an opportunity to review and prioritize vulnerabilities differently, but it provides management oversight and capability that did not exist before. The allocation of vulnerabilities, setting due dates, and commentaries were the start of what made Nucleus Security great.

Nucleus Security has impacted my organization positively by providing a single pane view of vulnerabilities from different connectors and enabling the automation of reporting and alerting on findings that are out of due date or out of SLA. Commentary has provided significant benefit, especially from a licensing perspective, meaning that if an asset exists once, I am never billed twice for those assets as long as they exist in the platform.

Risk-based prioritization is crucial for addressing vulnerabilities in my organization, and Nucleus Security contributes significantly in this area. It is important to note that it is not just Nucleus Security that performs prioritization; multiple vulnerability management scanners do so based on their own threat modeling capabilities. One notable feature of Nucleus Security is its leverage of capability through Google Mandiant, providing real-time threat analytics. The ability to add context to assets, such as whether they are internal or external facing and whether they are critical, is key. Depending on what is important to my company or ecosystem, the prioritization is adjusted, enabling informed decisions on what to tackle next.

One of the main benefits of Nucleus Security is having built-in capability or connectors into multiple threat intelligence or vulnerability scanning tools, which enables me to interpret this data with a single connector click without having to do any of that work myself.

The best features Nucleus Security offers are its automation capabilities and the ability to alert application or system owners on their vulnerability posture, letting them know when things are out of SLA and alerting them when things are fixed. It closes the communication cycle, and the most important capabilities are the commentary features, which give visibility of the movement on certain items and the status features. Many vulnerabilities do not get remediated, some are false positives, while others require risk acceptance. The capability to have full control and visibility of the movement of vulnerabilities, whether active or not, is crucial.

The automation and commentary features have changed the way my team works day-to-day. Having a system owner comment on why something has been delayed or when it may be going into production provides context to the vulnerability findings and potential movement.

One of the main issues with Nucleus Security is its lack of reporting capability. The user interface resembles an early 2000s application style, and although its speed is decent, it could be improved as more data is ingested. The overall appearance and feel need work, especially compared to modern applications from Rapid7, Qualys, and Tenable, which have more engaging user interfaces. The reporting capability is severely lacking; not being able to filter to granularity or have custom built queries is an annoyance that needs an overhaul. Additionally, there are bugs that have not been resolved, such as when you create a report and remove an asset, the asset still appears in the report despite not being present in the system anymore, leading to issues that need to be addressed quickly.

Nucleus Security can become a difficult investment because I already have a vulnerability management solution, and I question where Nucleus Security fits with its licensing model. While I acknowledge automation has been described, it would be amazing to control the entire vulnerability management workflow from Nucleus Security without needing to log onto other systems. Having controls or actions that can be sent from the console down to the scanner for rescans would be beneficial. If Nucleus Security is going down this path, it should ensure that it becomes a one-stop shop for vulnerability management across multiple applications.

I have been using Nucleus Security for about three to four years.

Nucleus Security is stable.

The scalability of Nucleus Security is fairly impressive; even when ingesting multiple assets, there is no noticeable impact. I have been in environments with several thousand assets, and it scales in the background without any issues.

Customer support is great; I have always had communication with executive leaders, been able to have roadmap calls, and talk with support. They are fairly responsive with no issues.

The ease of using natural queries or advanced logic with NQL to identify vulnerabilities is fairly simple; it gives an idea of how to build queries and is relatively easy to use.

The integration flexibility with ticketing systems and existing tools has simplified and positively impacted my deployment process with Nucleus Security, as it allows for easy integration into multiple tools.

Nucleus Security excels in handling large volumes of exposure data across complex environments; I believe it is second to none. Even before continuous threat exposure management became a focus, Nucleus Security already identified the potential gap. Although larger players from Rapid7, Qualys, and Tenable have since developed their capabilities, I find Nucleus Security fairly impressive in handling large volumes of exposure data without a noticeable impact on the platform.

I have not seen a return on investment in terms of metrics involving fewer employees or money saved, but Nucleus Security saves time. While any deployment requires initial time and effort, once it is set up, the value stream is substantial. Automation handles reporting on a scheduled basis and alerts system owners about their posture each week. In terms of employees, we still need the same number to remediate findings.

The licensing model is straightforward, with one license across multiple assets for multiple connectors. It is always a tough ask regarding budgeting for additional security tools, but in terms of positioning, I find it relatively simple. I cannot recall if the pricing differs from an asset to a container or cloud security workload.

I do not have anything else to add about the features.

I have not really needed to use the customizable risk model feature since we rely on the out-of-the-box capabilities.

I rate Nucleus Security a seven out of ten. I rate customer support an eight out of ten.

I would advise others looking into using Nucleus Security to consider the value offering, especially if they have multiple tools and need a single pane view. While Nucleus Security is great, it is debatable whether it will be the best tool or provide the best value in 2026, as many competitors have moved into the Continuous Threat Exposure Management  space. I would recommend assessing existing vulnerability management solutions first before exploring Nucleus Security, as it can be a difficult investment when you have solutions that already meet your needs.

I have been using Nucleus Security  for a year.

My main use case for Nucleus Security  is primarily for vulnerability management. I can give you a quick, specific example of how I use it for vulnerability management in my organization: we connect that with our public clouds such as Azure . It connects to Azure . For example, if Azure has Defender for Cloud enabled and the vulnerabilities on Azure are being replicated into Nucleus Security, with Nucleus Security, we have asset groups, and we can make sure that we provide good visibility to the required teams.

I have something else to add about how I use Nucleus Security: we have many subscriptions as an example. If we take Azure, we have many Azure subscriptions and all these subscriptions are being looked at by different teams, but the portfolios and the leadership that they report to are almost the same. With Nucleus Security, we have a centralized dashboard for the leadership as well as the teams. We can make sure that role-based access could be granted, so that they can only see the vulnerabilities relevant to them.

Nucleus Security has positively impacted my organization because we were able to escalate vulnerabilities on time to relevant teams.

I can tell you about specific outcomes: we did not have a centralized platform earlier, which is why we onboarded Nucleus Security. With this, we have really good remediation tracking and workflow management. When new vulnerabilities come in, we have created Jira  workflows to create tickets on the respective application teams' Jira  board. They are now being prioritized accordingly.

The best features Nucleus Security offers, in my opinion, are that it is really great in showcasing things and providing centralized vulnerability management. It also has risk-based prioritization.

The risk-based prioritization has helped my team focus on the most critical vulnerabilities by considering severity, asset context, and the remediation priorities, rather than just looking at the raw vulnerability counts.

Nucleus Security's ability to aggregate, normalize, and organize vulnerability data from different sources into a central, manageable view is also a significant advantage.

I have used the risk reduction measurement feature in Nucleus Security, and it is valuable because it helps translate vulnerability remediation activities into a clearer view of overall security improvement rather than only reporting the number of vulnerabilities closed. It helps the team track reduction in overall exposure all the time and progress against remediation goals.

I believe Nucleus Security can be improved due to some integration issues. It could be integrated with SentinelOne, but it was not showing any SentinelOne alerts. If these things could be improved and if those could also be showcased at Nucleus Security, it will be better, not just the vulnerabilities.

Nucleus Security is stable.

Nucleus Security's scalability is acceptable.

The customer support is average.

I have seen a return on investment, but I cannot share the exact metrics.

My experience with pricing, setup cost, and licensing was average.

On a scale of one to ten, I would rate Nucleus Security overall a six.

I chose six out of ten because vulnerability management alone is not enough when it comes to security operations. I think if Nucleus Security could provide more features across various other areas, it will be better.

Regarding Nucleus Security's AI capabilities, I do not have any concerns about its governance and security because we reviewed the data classification and all, so we are happy with how they are operating currently.

Regarding Nucleus Security's AI capabilities, in general, it does a good job regarding its accuracy and reliability of output.

I did not purchase Nucleus Security through the AWS Marketplace .

I elaborated on Nucleus Security's feature of providing unified exposure visibility across all tools I use earlier regarding the SentinelOne example.

Risk-based prioritization is very crucial for addressing vulnerabilities in my organization, and I think it helps the team focus on the most critical vulnerabilities.

The integration flexibility with ticketing systems and existing tools has affected my deployment process with Nucleus Security because we were able to do this with Jira workflows very easily.

The advice I would give to others looking into using Nucleus Security is that it is a good tool and covers many areas and tools.

My overall rating for Nucleus Security is six out of ten.