Tenable Holdings, Inc. (TENB) Earnings Call Transcript & Summary

All right. That's helpful. And I think -- I mean, you mentioned on your call that vulnerability management is becoming a strategic priority for CISOs. And we heard it from one of your peers on their earnings call last night as well. What do you think are the key drivers for increasing performance? And what do you think this means for VM spend over the next several years?

Well, we're very bullish on the VM market and the opportunity in front of us. So as we look at vulnerability management more broadly, but specifically through the lens of our customers and what we're seeing out in the market, we look across the customer base, and we've got a terrific customer base, 50-plus percent of the Fortune 500, 30-plus percent of the Global 2000. We see that we're only about 30% penetrated in those accounts. And so there's tremendous growth potential. They may be covering one business unit, one geo, one specific application where that's required from a compliance perspective. But they're now thinking about vulnerability management and cybersecurity more strategically. So the ability to expand, the ability to grow by continuing to sell into the customer base, it represents a tremendous opportunity. We also see the ability to sell new asset types, so not just assessing traditional desktop servers, workstations, but assessing cloud-based infrastructure, assessing DevOps environments and containers, assessing web applications, assessing operational technologies and control systems in manufacturing and factory floor and power types of systems. So there's a -- not only growth in VM, in traditional IT, there's the opportunity to assess modern assets, and we're seeing a lot of traction. I think we called it out in our last couple of earnings calls, the increased momentum we're seeing building in that cross sell. And then also a lot of greenfield in vulnerability management, which people, sometimes surprises people. It certainly surprised me when I came to Tenable about 4 years ago. But we look at this, and we're trying to be transparent about it. So we consistently see that about 1/3 of our new large enterprise transactions are coming to us from greenfield. So they have no Tenable, they have no competitive VM product, no organic VM capability. They're relying on an annual audit or an assessment from a big 4 or a security consultancy. In addition to that, we're transparent about our new customer lands on our enterprise platform. Last quarter, it was -- it was over 400. And I'd say every quarter that I can recall, it's been over -- well north of 300. So we see a lot of expansion opportunity in the existing customer base. We see a broadening of the types of assets we can assess. And hopefully soon, active directory will be part of that. And we're seeing a lot of greenfield and not a lot of new customer acquisition, which are all very healthy signs for us that there's great market potential still ahead for us.

Got it. That's helpful. And I guess on the competitive front, how does that -- how do you typically get your foot in the door? Is it maybe through either go testing Nessus and that gets into the organization or it becomes a more critical priority. So vendors look for best-of-breed and maybe there's a best-of-breed versus platform conversation. What -- how does that -- what's the typical entry point into a competitive displacement?

Yes. We do have -- the great news for Tenable is that we've got tremendous brand recognition and brand loyalty and trust in our Nessus product, which is really a sort of beloved foundational security tool to assess and audit systems. So we have tremendous respect, confidence and trust across the security community. When it comes to vulnerability management, at this point, we're the largest provider, and we invest very heavily in R&D, on the VM front more than our primary competitors combined, and we've been doing so over the course of multiple years now. So with lab testing, we have significantly more, 20-plus percent more coverage of vulnerabilities. We have 6 Sigma accuracy, so fewer false positives, fewer false negatives. And when you look at what the analysts and people in the security community say, we really are best-of-breed in that space. So that usually gets us an invite to the dance, if you will. And when you test the products, again, because of that level of R&D investment, but also because of the account management, the customer service, the support organization, the services that we offer and deliver, we show exceptionally well in competitive bake-offs and where there's a technical assessment, we almost always come out on top.

Right. Fantastic. I guess, on the opportunities of market penetration, I also want to touch on MSSP penetration, which came up recently. So you're increasing investment in the MSSP channel, how do you anticipate that may impact the business now that you've got substantial growth of partners on that platform.

Well, we think MSSP is a new route to market for us and an exciting opportunity for us long term. It also reflects our investment in the product over the past couple of years with certain -- with product in hand, we now have -- we're now aligning the investment, to go out and add new partners. We've got hundreds of partners over the past couple of years, even brokered partnerships with some of the largest MSSPS. So certainly, a new route to market for us, one that we're excited about, one that we're making investments in. And keep in mind that we've always been committed to the channel. We're, I think, the only company in our space that works directly with the channel, whether we source the deal or the channel brings opportunities for us. And over the past couple of years, it's created a lot of leverage in our business. Years ago, 4% of our business was channel in. We said a couple of years ago, over 20% at the time of the IPO, and now it's even much higher. So in the past, we've been focused on going into new markets, working directly with our channel partners, our distributors and our resellers. Now with product in hand, we're making a commitment to the MSSP market, which we think long term, could be very compelling for us.

Right, right. Excellent. Maybe I want to, on the product side, maybe an update on success and traction so far that we've gotten with Frictionless Assessment, since it was made available in the AWS marketplace, maybe around late November? How meaningful is that to the platform?

Frictionless Assessment, it's something that we're particularly -- I'm particularly excited about. As you said, it came out late in Q4. And so early in the go-to-market with that. But it represents tremendous opportunity and a really strategic shift in how people think about and conduct vulnerability management, and how they can think about assessing the security of their cloud deployment. So for those of you that don't know, Frictionless Assessment allows us to go in through our cloud-native connectors, initially with AWS, to use the APIs that are available to us through AWS, to assess -- well, first of all, identify what systems exist, whether they're active or not within that AWS environment. And then to assess the security and integrity of those systems and their level of Cyber Exposure. And to do it without deploying additional agents and to do it without impacting their performance and to do it without introducing risk into those operating environments, which are often mission-critical. So in a typical cloud environment, historically, we may have visibility into, call it, 15% of their cloud-based assets because there's a reluctance to or a concern about deploying agents and impacting live mission critical systems. Then using Frictionless Assessment, we can literally just flip a switch and have a continuous and instantaneous understanding of vulnerabilities, risk associated with all of the systems in that AWS environment. So as you said, we're early in the go to market. We have many users at this point, using those -- leveraging those cloud connectors, testing a few systems with frictionless, but they're already asking questions about 5,000, how quickly can I turn up 10,000 or even significantly more systems in my environment? And the answer is immediately. All you need is licenses. You don't have to deploy any software. And so customer response here has been -- early feedback has been tremendous, and it's something that we're particularly excited about.

Got it. And maybe I need to follow-up on that. You mentioned your cloud-native nature of that platform. And a question I get a lot from investors is, when they talk about Tenable, they ask me, is it cloud-native and it depends what product you're looking at. How do you think about -- and maybe this is a question for Steve around unit economics. But how do you think about building a platform with cloud-native versus hybrid in mind and how that benefits the platform longer term. How do you respond to investors that are looking for more exposure to cloud-native products?

I'll start off and then turn it over to Steve. Everything that we've been doing for more than 4 years now is cloud-native by design. So if you look at our Tenable I/O platform, could-native, you look at what we're doing with frictionless, cloud-native. You look at what we're doing with DevOps and containers, cloud-native. You look at the ability to assess network effect, the ability to do benchmarking against peers, the ability to assess hygiene, your level of hygiene and preparedness against because, all of, Lumin, all of those things are cloud-native. That said, it's incredibly important to us because it's incredibly important to our customers that we also operate and enable hybrid capability and that we continue to enhance our on-premise products. So adding functionality like predictive prioritization. Yes. Cloud-native, we also added that functionality to our SC and for our SC customer base because it's an important capability that they need. And most of the enterprises that we work with, and I would say, almost all large enterprises, are not exclusively cloud. They're increasingly cloud. New technology is going into the cloud, but many of them, and I would say almost all of them have some amount or even a significant amount of on-prem and legacy infrastructure that's critical to them, that they need to be able to manage risk around. And so we want to make sure that, yes, we're cloud-native, but that we're not leaving or forgetting the risk associated with on-prem. I mean people could be cloud-native, but when SolarWinds pops or a SolarWinds-like incident rears its head, just about every government agency was concerned and potentially compromised and about 18,000 enterprises around the world were. So it's this hybrid environment that we think is mission-critical today.

Got it. That's super helpful. And we've only got a few minutes left, so I didn't want to neglect some financial questions for Steve. I guess the first one, I've done after your earnings, you got a lot of calls and questions around your guidance. So maybe if you can help just kind of set the stage there, philosophy behind setting the guidance. I mean you've got a pretty good track record of meeting or raising, but how did -- and obviously, with the acquisition maybe it's a little bit higher now. But how would you frame that philosophy? How do you think about setting guidance for '21?

Sure. Well, first, we're coming off of a great quarter. We grew CCB 20%. Short-term RPO, I think, was 21%. We talked about customer velocity. We added over 460 new enterprise customers, one of our best quarters ever, 66 net new 6-figure customers, that was our best quarter ever. So certainly transacting a lot of business during difficult times and a lot of large deals. So we are clearly having success in the market. And I think that's a reflection of our best-of-breed focus and our commitment to the market. We also saw an uptick in expansion rates. And we said on the backs of broader asset coverage and more cross-sell. If you look at the past couple of quarters, how it played out, when the pandemic for surface, we grew CCB in Q2, calculated current billings, 13%. We talked about some timing of deals that kind of came in late in the quarter that weren't invoiced and weren't reflected in that number. And then in Q3, CCB growth was 21%. If you kind of normalize the timing of some of this -- these deals, midyear, we grew 17% in the average of those 2 quarters. So now we saw only step-up in the fourth quarter. So by any measure imaginable, we clearly had a good quarter. That certainly gives us a lot of confidence, momentum going into the year. The CCB number is something that we haven't guided to in over a year. When the pandemic first surfaced, we talked about really how it's influenced by multiyear prepaid deals, early renewals, a multitude of factors that make it difficult to forecast. But given how the quarter's played out and our success during the year and specifically in Q4, we felt like it was the right thing to do to provide a CCB guide for the full year. It's a starting point for us. There's a lot of selling left. It also doesn't reflect some of the potential tailwinds from SolarWinds that could potentially lead to better spending environments. The new administration here in the White House certainly has a stronger bias towards cyber. And is advocating some pretty sizable spend with -- in the U.S. federal sector. We have one of the largest footprints in U.S. Federal. So we look at it and say, hey, going into this year, we have a lot of confidence coming off of a strong quarter. There are some things that are not contemplating the guidance, such as SolarWinds, which frankly, are difficult to estimate at this time. And also the timing of that, and we look forward to updating investors throughout the year on our progress.

Got it. Super. With that, I think we're out of time, so unfortunately. So guys, congratulations again on the Alsid deal, and Amit and Steve, thank you very much for joining us for our conference. We really appreciate it. Thank you for all of you on the webcast. I certainly enjoy having you on as well.

Great, Brian. Thank you.

Have a great day.