Vulnerability Management: Deprecation of Legacy ACR and AES Properties in Asset Exports

Tenable is deprecating the legacy acr_score and exposure_score properties returned by the Download assets chunk endpoint. These properties have been superseded by the enhanced v3 ACR and AES scores introduced in New ACR and AES Scores in Assets Exports on April 9, 2025.

This change affects both the asset export v1 response model and the asset export v2 response model.

• Asset Export v1 Response Changes
• Asset Export v2 Response Changes

📘

Note

The ratings object is the now the authoritative source for ACR and AES scores. Tenable recommends updating any integrations that rely on acr_score or exposure_score to use the ratings object instead.

Asset Export v1 Response Changes

In the asset export v1 model, the legacy acr_score and exposure_score properties continue to be returned for backward compatibility. However, they now reflect the enhanced v3 ACR and AES score values provided in the ratings object. To accommodate decimal precision, the data type has changed from string (integer) to string (float).

Before the deprecation:

The legacy acr_score and exposure_score properties reflect the old pre-enhanced values, and they have data type string (integer).

{
  "acr_score": "3",
  "exposure_score": "512",
  "ratings": {
    "acr": {
      "score": 5.1
    },
    "aes": {
      "score": 638.0
    }
  }
}

After the deprecation:

The legacy acr_score and exposure_score properties reflect the same enhanced v3 values as the ratings object, and they have data type string (float).

{
  "acr_score": "5.1",
  "exposure_score": "638.0",
  "ratings": {
    "acr": {
      "score": 5.1
    },
    "aes": {
      "score": 638.0
    }
  }
}

Asset Export v2 Response Changes

In the asset export v2 model, the legacy acr_score and exposure_score properties have been removed. You must now use the enhanced v3 ACR and AES scores provided in the ratings object.

Before the deprecation:

The legacy acr_score and exposure_score properties reflect the old pre-enhanced values while the ratings object provides the new enhanced v3 values.

{
  "acr_score": "3",
  "exposure_score": "512",
  "ratings": {
    "acr": {
      "score": 5.1
    },
    "aes": {
      "score": 638.0
    }
  }
}

After the deprecation:

The legacy acr_score and exposure_score properties are removed, and only the ratings object with the enhanced v3 values remains.

{
  "ratings": {
    "acr": {
      "score": 5.1
    },
    "aes": {
      "score": 638.0
    }
  }
}