Tenable teaches its AI threat detectors nine more languages without a translator

Why English-only detection falls short

The detectors in Tenable One AI Exposure cover AI threats, harmful content and other policy risks. They were originally English-centric. To assess threats written in other languages, the product used a "translate-then-detect" process: identify the language, translate the input to English with a large translation model, then run the English detector.

Tenable says this worked but had four downsides:

• Latency: a large translation model needs hundreds of milliseconds for short inputs and seconds to tens of seconds for long ones.
• Cost: every non-English request pays for a full translation pass.
• Operational overhead: another heavyweight model has to be served, scaled and maintained.
• Lost signal: meaning and intent blur in naive translation, which weakens detection.

The company argues that a prompt attack written in Spanish, Arabic or Hindi is as dangerous as one in English, so an English-only detector leaves organizations exposed.

An agentic pipeline for label-preserving data

Tenable found it did not need a translator LLM in production. It needed high-quality multilingual data for a training set and a trustworthy test set, both preserving the original labels. The company notes that translation can flip a label, turning a malicious sample into a benign one, or soften the security-relevant language so a clear positive reads as borderline.

Tenable rejected several options. Human-expert translation is slow and needs a fluent reviewer for every language. Standard machine translation can strip malicious intent or produce unnatural text. Off-the-shelf LLMs may refuse to translate material such as weapons synthesis or self-harm prompts. Always-on online translators add per-request latency and costs that scale with traffic.

Its solution is an agentic pipeline with three stages:

• Translate: a frontier LLM produces a transcreation, guided by the task, the item's label and the target language, rather than a word-for-word rendering.
• Estimate: a panel of independent judges scores fluency, meaning integrity and whether the label still holds.
• Gate: only translations that pass every check are kept.

Two recovery loops handle hard cases. If the frontier model refuses a sensitive item, a controlled open-source small language model takes over, and its output goes through the same gate. If a translation fails the gate, it is sent back for refinement instead of being discarded. Because the task and labels are parameters, Tenable says the pipeline can serve future detection tasks that need multilingual support.

Rather than train from scratch, Tenable fine-tuned a compact model already pretrained on many languages. For some tasks, the model generalized to other languages using only English training data. For harder tasks, the company translated only into the languages where the model underperformed.

Results Tenable reports

Detection now runs natively in tens of milliseconds, compared with seconds before, which Tenable puts at roughly 20-800 times faster per item. The memory footprint is about 12-14 times smaller: under 1 GB versus 12-14 GB.

The multilingual training and benchmark data cost under $10,000 and was generated once. According to Tenable, that cost does not grow with customer traffic, unlike an always-on translator. The company also says the budget is tunable, as the pipeline adjusts the LLM tier and the amount of refinement per item.

A neutral LLM-as-a-judge from a third-party model family preferred Tenable's transcreations over those from a commercial machine translation model and a strong open translation model in the large majority of head-to-head comparisons. Every Tenable One AI Exposure detector gained support for nine languages: Spanish, German, French, Italian, Portuguese, Mandarin Chinese, Japanese, Arabic and Hindi. English performance held or improved.

What it means for customers

For organizations using Tenable One AI Exposure, the change means non-English threats are checked directly, without a separate translation step in the path. Tenable says the underlying model was pretrained on a very broad set of languages, so it can read and flag attacks in thousands of languages it was not trained on. The company stresses that only the 10 supported languages have been formally validated, and that the wider reach needs further testing before it can be relied on.