I understand Tenable’s perspective that it’s not just a sniffer or IDS and it really is relying on logic that much more closely resembles an active scanner, but it also will never, ever, be able to catch hosts that just aren’t talking. Of course, active scanners do diddly squat for client-vulns without credentials, so there definitely are advantages to each.