Tenable Holdings, Inc. (TENB) Earnings Call Transcript & Summary

All right. Well, hello, it's still morning. Good morning, everyone. Welcome to day 1 of the Barclays TMT Conference. My name is Saket Kalia. I cover SMID Cap software here at Barclays. Very happy to have with us the team from Tenable. We've got Steve Vintz, Chief Financial Officer; also got Erin Karney, Head of Investor Relations here upfront. We've got about 30 minutes together. Let's take the first 20 or 25 minutes and do a little bit of fireside chat with Steve, which I know is going to be fun. And then let's make this interactive. If you've got any questions, just pop up your hand, we've got a mic running around and we could just make it interactive. So with all of that as a framework, Steve, thank you so much for being with us here today.

Well, thanks for having us.

Yes. Pleasure. Steve, maybe just to level set for everyone here in the room, can you just spend a couple of minutes recapping some of the points from Q3 that you personally were most proud of?

Sure. Well, first, we're pleased with the print in the third quarter, certainly against a very difficult macro. If you look at CCB growth, I think we beat -- we don't guide -- we guide to it for the year. But if you look at it relative to consensus, we beat it by roughly $4 million, we beat revenue by $5 million relative to the midpoint of our guidance, and we beat earnings by roughly $0.11. So a notable beat and some really strong operating leverage, and we generated compelling levels of cash flow. If you look at where we were having success, it's really with large deals. Net new 6-figure customers was 89, one of our best quarters ever in our history -- in the history of the company. Tenable One has certainly been a catalyst to that, and we can talk more about that. And then we continue to add hundreds of new customers. Perhaps and probably the big surprise for the quarter for a lot of investors and analysts was the discussion about cash flow and a lot of the natural leverage in the business. For the first time, we guided to free cash flow for the year. We guided to 120 to 125. And we said free cash flow would double over the next 24 months, so roughly 240 to 250. And so there's a lot of natural leverage in the business that we've been able to gradually walk up cash flows in the operating margins, and we're generating meaningful levels of cash flow. And we also talked about 20% sustainable growth. And we just feel really good about how we're executing. Again, macro is a little more challenging, and demand is not monolithic, but we've had success in certain areas of the market.

Yes. That's a really good summary and a lot of fun stuff that I'd love to dig into. But maybe since you bring up macro, I'd love to just start there. I think in the second quarter, we called out some softness in Europe, which a lot of your peers have done as well, which I think had a little bit of a magnified impact here for Tenable just because of some on-premise revenue. Maybe the question for you here is, how did the macro backdrop fare during Q3? And how are you thinking about that anecdotally fare for Q4?

Sure. And so first, a little bit of context here. So if you look at the second quarter, we're one of the first cyber companies to announce results, for those who have a 12/31 year-end. And what we talked about in Q2 was, overall, first of all, the print was relatively strong. We had good CCB growth. But where the quarter started and where it ended was very different and how we got to those results was just different than what we've seen in the past. And if we rewind the tape, Q1 was -- we did 30% CCB growth. As a matter of fact, for the 5 -- for 5 consecutive quarters headed into Q2, we saw accelerating CCB growth. So going into the second quarter, we were very well positioned. However, the last 2 weeks in June in Q2, we saw more levels of review and scrutiny. It was a little different than the beginning of the quarter. And certainly we're seeing some impact from the broader economy with higher interest rates, a stronger dollar, concerns about inflation and talk about a long and protracted recession. And we saw that more so in Europe, but it wasn't pervasive. It wasn't in every country. And so what we said while we are very candid with investors and the street, and we said, hey, look, we're just seeing more levels of review and scrutiny. We've been doing this for a long time now. And when you see that, we think the right thing to do is extrapolate that out. So when we gave guidance for the second half of the year, it was more muted expectations, and we said we should assume this is our new reality. As we headed into the third quarter, July and August felt a lot like the last couple of weeks in June. We also took note of the fact that a lot of our buyers were traveling those 2 months, perhaps more time than anything we saw over the last 3 years since the pandemic. And then headed into September, September was -- proved to be exceptionally strong for us. We closed 70% of our large deals in September. I mean, typically, you would expect maybe like a 50%. So a quarter we're certainly more back-end loaded. And into the third quarter, I think the big takeaway for us is we did a good job understanding where to hunt coming out of Q2, right? I think it was -- we were a little surprised with what we saw, given the strength in the 5 quarters that proceeded the June quarter. And so we saw strength in Q3 in the enterprise market. We have good conversion rates there. That's roughly 60% of our total sales, approximately about 20% or so was in the mid-market. And if you look at the mid-market, we define it as 500 employees, up to 3,000. At the upper end of that market, we saw areas of strength there. At the low end, towards the 500 employee mark that tends to function like a small business and that tends to be more impacted by the broader economy. Certain verticals like tech and telecom and even public sector saw really strong conversion rates, whereas others may be associated with consumers saw lower conversion rates. So demand is not monolithic. I think we've learned some things coming out of the second quarter. And then headed into the fourth quarter, we expect really a continuation of some of those trends. I think it's important to note that despite the beat in CCB in the third quarter relative to the consensus, we did not raise our CCB guidance for the full year. So that would imply that the expectation that we're setting is even more conservative in the fourth quarter than Q3. So I think overall, we're setup well for success in the fourth quarter, but it is a more challenging macro. And I think we're doing a good job considering all of those things.

Yes. Absolutely. That's a great summary, by the way. Maybe zooming out, clearly, macro has a lot to do with this, but it's interesting, one of your competitors earlier this year maybe implied that customers might be prioritizing vulnerability management or VM differently in this macro backdrop. And so maybe the question for you, Steve is, do you agree with that? Or do you think that enterprises that you sell to are viewing VM similarly from a strategic perspective as they have in the past?

Well, I think when you talk about VM, it depends really on how you define it. So first, we believe that vulnerability management will continue to be a priority, and it's a foundational technology, a top 5 spending priority. And it's funny when we reported our Q2 results, the question we were getting is, okay, because we were the first ones with this commentary about the broader market, more levels of review, more levels of approval, potentially longer sales cycles, and that has certainly proved to be the case. Again I think we're doing a good job operating in a very challenging macro. But some of the questions we got coming out of Q2 is like, okay, well, some of your traditional VM companies are not -- don't have that thought track. So are you seeing win rates change or vary? And the fact is that we're not, we believe we're the clear market leader in vulnerability management, according to device coverage, growth, customer size, things like that. Over the years, we've evolved to become a much more strategically relevant and important partner to our customers because we're addressing other areas of the attack surface and we're just coming to launch in Tenable One. So the good news for us is that Tenable One has certainly been a catalyst of growth for us. When people talk about VM, how it's been traditionally found is servers, desktops and laptops, traditional compute. But we now address -- we're in OT security, cloud security, active directory security, web application security. So collectively the TAM is much larger than what it was a few years ago. And so it remains really important to our customers to assess other areas of the attack surface and understand their risk holistically. So overall, we believe that the core VM market is strong, but no one is impervious to broader market conditions and you're now starting to see that play out perhaps in other security categories.

Yes, absolutely. I'd love to transition to Tenable One. But maybe just to ask a dumb question, right, just because, I mean, I was -- Tenable.ep is such a fun product just because of all the kind of whiz-bang things that you can get with it. Tenable One, I think Amit had talked about it as an evolution from EP. Can you just remind us kind of what the differences are and kind of how we should be thinking about it going forward?

Well, I think a simple way to think about it is that Tenable One is the same as EP, EPC exposure platform. And so when we -- and there's 2 flavors of Tenable One. There's the standard edition and the enterprise edition. So those customers who have purchased the exposure platform, and by the way, EP has been in the market a little over a year now. But those customers who purchased the exposure platform are now using -- have been migrated or now using Tenable One standard in the mission has gone up, right? And so EP was really a bundle of all of these different asset types that we would sell back into our account base, and it was a way for us to kind of leverage the broader product portfolio. Tenable One is really the integration of all of these things together into a single platform with a more fluid licensing mechanism. And it's really the preposition to selling a more expansive set of analytics. So if you look at the enterprise edition of Tenable One, what it does is it takes all of the vulnerability data that we collect, all of this threat data, it combines it with the digital identities piece that we deliver via our active directory security product, identifying privileged users, those who can make lateral movements, combining threats involved in digital identities into attack path analysis, which is the ability to graphically display a likely path of exploit for a bad actor. And so in a market where customers are really struggling to understand risk, proliferation of assets, limited resources, tighter budgets, we're helping customers operationalize, preventive security and helping them identify their most important risks and exposures. And I think that's a really important value prop.

Yes, absolutely. Very clear and very helpful. So maybe that was a good segue just to dig a little bit deeper into Tenable One, which I think Tenable One, EP, I think, have been very important drivers of bigger deal sizes, I think, through the year. And I think what you said, Steve, historically is that the uplift on Tenable One versus traditional VM is about 70%. Could you maybe break out -- break that down for us in terms of how many more assets are you getting? Or how does that sort of break out in terms of number of assets, price per asset and products, if you will? Does that make sense?

Yes. So yes, we are seeing a 70% higher selling price. This is realized price, not just list price when we sell Tenable One, the unified platform versus the standalone VM offering. And so we have an asset-based pricing model. So we live in a world where more assets are coming online, our customers' compute environments are very dynamic. And they have hybrid compute environments, which is on-prem, they have assets in the cloud. They have assets that go across a number of different asset types, as we just talked about. And so Tenable One addresses a pretty important problem for them, which is assessing risk holistically. Security is not done in a vacuum. So they want to understand their exposure. So the reason why we have 70% higher selling prices is because; A, the price per asset is roughly 30% higher in Tenable One versus our standalone VM offering. So if you have the same amount of assets, you would achieve a 70 -- roughly a 30% higher selling price. The 70% higher selling price is, what that implies is that we're not only realizing a higher price per asset because there's more utility in Tenable One, capability, but we're also covering more asset types. The Tenable One includes not just traditional VM, but it also includes cloud security, active directory security, web app, all of these things. So we're able to assess exposures across a very broad surface of attack, cover more areas of the attack surface, consequently, we're seeing higher asset counts and higher selling prices as a result.

Yes. Yes. That's been a great part of the story. I mean, I think you've said that Tenable One was being used by about 5% of the customer base. How is that adoption rate maybe compared to your own expectations? And where do you think that adoption rate can go in coming years?

Yes. So we have roughly 40,000 total paying customers, one of the largest customer bases and all security. That's a massive customer base over the course of time. By the way, that's notwithstanding a free product that we offer. We have Nessus, that's a free -- there's a free version of Nessus and a paid version of Nessus. The free version of Nessus has been downloaded 3 million times cumulatively, represents the sum total of all security professionals in the world. So we have a massive community of free users. We have 40,000 paying customers, of the 40,000 paying customers, about 12,000 of those are in what we call use the enterprise, one of the enterprise products. And of that 12,000, approximately 600 are using Tenable One. So roughly the penetration back into our account base is 5%. Now one of the leading indicators for us is new sales. And so like what percent of your new sales is coming from Tenable One? And what we said is just a year into the product -- a little more than a year into the product launch, it's already 15%, 1-5, 15% of our total -- approximately the mid-teens percentage of our total new sales. So the good news is that the take rate on new sales is higher than the penetration back into the base. When customers renew either on IO or SecurityCenter, they're using Tenable One as a means to step up and make a larger purchase. And directionally, I think that 5% will continue to grow over the course of time into a more meaningful percentage. And I think long-term, probably over 50% of our total customers will be using the Tenable One platform. I won't put a date to it, but it's a very natural and healthy path of progression for customers to use Tenable One.

And I mean, I think that looking back at prior product cycles, I'm trying to remember how long it took or what the adoption rate is for Tenable.io? You talked about some stats there in terms of what that adoption curve looks like. Anything you can refresh us on there in terms of how Tenable.io, that curve look like, just to give us a sense?

Sure. And it's potentially on a similar path, similar trajectory to Tenable.io. So we went public in 2018. And one of the comments that we made is that we said that Tenable.io was roughly 20% of our total new sales. So not all that different than where we are with regard to Tenable One. And we said, look, we believe this is going to be our flagship product going forward. And we said over the next 5 to 7 years, it could represent 50% of our total new sales. And well, we were able to do that in 36 months, in 3 years. So I'm not going to -- we're not going to set that expectation with Tenable One. But I think it is potentially -- it has the ability to follow a similar trajectory here. But the takeaway is that it should continue to grow in percentage and you'll see continued penetration back into our base.

Absolutely, absolutely. I want to zoom out a little bit, Steve. I mean I think at Analyst Day, which was super helpful last year, I think you talked about just a mix shift in the business towards exposure products versus traditional VM, I think, as a real key driver to that 20%-plus growth annually in CCB. Can you just -- and listen, maybe the answer is just Tenable One. But can you just remind us what falls into that Exposure bucket versus VM? And how you sort of see that mix shift happening over time?

Sure. And so we've defined as exposure solutions and all of its pieces and then what we call traditional VM and traditional VM is really 2 products, which is SecurityCenter, which is the traditional on-prem VM product and then Nessus. And both are a very important products for us. Years ago, SecurityCenter and Nessus represented about 95% of our total sales. And what we said last year was roughly collectively about 60% and so -- during the Analyst Day. And so however, consequently, last year, at the Analyst Day, we talked about 40% of our business is in exposure solutions. So exposure solutions includes all of these newer asset types, which is web application security, external attack surface management, external internet-facing assets, cloud security, active directory security, all of these other new pieces that address different areas of the attack surface. It also includes Tenable One, which is the combination of those things and Tenable One includes IO, so as well as the other areas. So for us, exposure solutions is 1 of our 2 foundational products, which is IO or Tenable One and all these standalone products that we sell separately. And so consequently, that's about 40% -- that was 40% of our total sales last year. It's even higher now, a year into it. And the growth is higher than what we're seeing and what we -- what has been traditionally defined as the vulnerability management market, which is the on-prem traditional compute type assets.

Yes, sure, sure. A lot of fun stuff to talk about from the top line. But actually I thought a major highlight from last quarter was the greater emphasis on profitability and cash flow. And so maybe we could just spend a few minutes on that. I think, Steve, we talked about -- I think margins were up about 700 bps sequentially last quarter or about 13%. And it sounds like that could be the new baseline, and you correct me there if I'm wrong. But historically here, the pace of margin expansion here was more measured. So maybe the question is, what was the catalyst for maybe re-rating to this new level?

Sure. Well, I don't think there was any defining event that said, okay, that resulted in a new philosophy. I think our philosophy hasn't changed in terms of how we're managing the business. We're very much a balanced grower and historically always have been, demonstrating good growth, the ability to grow 20% plus, sometimes higher in stronger markets and sometimes lower in more challenging markets, but we've been able to grow sustainably so at 20% plus. And we began -- we also have demonstrated operating leverage since we've become a public company, and we began walking up the margins, both the operating margins and the free cash flow margins. Last year, we became a Rule of 40 company. Well, in the second half of the year, it's usually planning season for us. And when we built our operating plans, we look out not only next year, but also the next 2 years. And we have a long-term plan that we're trying to execute too. As we're taking that look out, one thing we realized is that; A, there wasn't a clear consensus on free cash flow in the current year. We guide to CCB annually. We guide the revenue and EPS. So you think sometimes free cash flow would be a natural consequence, kind of an output to some of those things. But there wasn't a clear consensus. And if you look out 2 years, I would think there was only a handful of published estimates. So given the fact that we've always been a balanced grower, we wanted to make sure that street understood how we plan to manage the company. And so what we said is that free cash flow is expected to double over the next 2 years and that we would generate higher levels of margin, operating margin. And so what that implies is that operating margins will continue to grow 100 to 200 basis points a year, sometimes more in some years and sometimes perhaps less. And we're very confident in our ability to generate expanding margins and healthy levels of cash flow. Look, the takeaway is that we have a really good business model. We have 95% recurring revenue. We have really strong gross margins, high gross and net dollar renewal rates. And so really, it's the ability to continue to balance growth with profitability. We're still going to invest. We're going to hire more people next year, add more quota capacity, but there's a lot of natural leverage in the business.

Yes, yes, absolutely. I think -- I mean, the point on cash flow consensus is well taken. I mean, I think the team mentioned the unlevered free cash flow guide for this year, I think, of $120 million is targeted to double, I believe, in fiscal '24. So call it, $240 million to $250 million in unlevered free cash flow. I think, back of the envelope, we were kind of coming to non-GAAP operating margins sort of in the mid-teens to sort of get there. So maybe first of all, is that in the ballpark? And then secondly, more importantly, what lines do you really expect to be the biggest drivers of that leverage in getting there? You talked about maybe 1 or 2 points, but I'm curious in terms of that, where are we going to get that leverage in your model?

Yes. So I think the fair inference is that operating margins will be in the teens. We haven't talked about whether -- we're within that range. But we feel really good about our ability to drive margin expansion there. I think the leverage is going to come from a couple of different line items, but most notably sales and marketing, right? Years ago we were spending 60% of our revenue in sales and marketing. This year we're spending kind of like mid-40% range. We think long-term it will be -- certainly have a 3 handle on it. And we're seeing a lot of leverage in sales and marketing. So keep in mind, like years ago, we had a handful of sales reps in 4 countries and a handful of channel partners. So if you look at the leverage in sales and marketing, we've invested a lot in go to market. We're now -- we have feet on the street in 35 countries. And we transact sales in 160. And so for us, as we look at leverage, #1, it corresponds with the broader product suite, larger expansionary TAM opportunity. And so we are putting more product in the hands of our sellers. We're seeing higher levels of productivity. We rose quotas going into the year. Our expectation is that we raise quotas next year, not because it's wishful thinking, but just because the opportunity is much larger. So we're seeing a higher yield per rep with our sellers. And our goal is that quotas will continue to increase as the opportunity continues to grow here. So higher levels of productivity, which corresponds with the broader product suite. And then also, if you look at channel, channels work really well for us. We're the only company in our space that's made the commitment to the channel. Years ago, 4% of all of our business was inbound from the channel. The IPO was roughly around 20%. Last year, we disclosed it was 38%. It's even higher this year. So we're continuing to leverage the channel in a way where they're bringing us new opportunities and it lowers our customer acquisition cost too.

Yes, yes, absolutely. I think we've got about 5 or 6 minutes left. I think this was a really important topic just on the cash flow and profitability inflection here. Any questions here from the audience? Steve, maybe on this point, I think one of the most surprising points of the guide is that you still reiterated the 20% plus annual CCB growth long-term, even with more efficiency built into the model. And I think you touched on this a little bit, Amit touched on this a little on the call, but what are some of the bigger investments that Tenable may be frontloaded in prior years that you think you'll be able to leverage in a bigger way without sacrificing growth?

Yes. Well, keep in mind, if you look at our net dollar -- if you look at the growth algorithm for the business, it's not that complex. So massive customer base. We have a broader product suite. So we're selling more back into the base. And if you look at our net dollar expansion rate, I think in quarter it was roughly 118%. So call it a teens. So there's a lot of -- as customers renew, they naturally turn to us to help secure more of their assets. So we're getting good growth back into our customer base. We've been able to grow 20% plus because we've also been able to add a good number of new customers. So we're adding hundreds of new customers a quarter. And whether that's through good times and in bad, and we expect that trend to continue. So for us, the growth algorithm is, call it, roughly 15% growth, plus or minus, back into our account base, the ability to add new customers. ASPs continue to inflect higher because of Tenable One. And so we feel like the investments that we're making both in terms of engineering, both in terms of go-to-market, which collectively represent about 80% of our total headcount in those 2 areas are to continuing to -- continue to move us forward. So yes, we feel like we have a good model that we have dialed in. Again, this is a tough macro. There's no doubt about that. But I think companies have to realize that demand is not monolithic. I think you have to look under the covers and figure out where you're going to see potentially higher conversion rates and try to better qualify opportunities and focus on the pipeline that is likely to see higher conversion rates.

Yes. Absolutely. Very helpful. Steve, I guess, with the inflecting cash flow that we're seeing, can we talk a little bit about capital allocation. I think Tenable has added to the portfolio inorganically in the last couple of years, and I think it's been great -- a great addition to the portfolio. I mean do you think that pace of M&A continues? Or do we pivot to other uses of cash like delevering stock buyback, et cetera?

Yes, it's a good question. We look at it and just say, okay, well, first of all, there's a lot of -- you talked about kind of the natural leverage in the business. As we look at the market, the market is fairly fragmented. We talked about before, there's probably 10,000-plus private security companies in the world. A lot of them are less than $20 million in revenue. And there's a lot of innovation in the space. And if you look at the M&A we've done, it's mostly been kind of early stage, Series A types, these are Series A types investments where we're buying a compelling product suite. It solves an important pain point for our customers, right? And there's an important secular trend there, such as in cloud security, the preproduction infrastructure is combining that with postproduction abilities in cloud security. If you look at the conversions of active directory security or even OT environments where you have a plant manager that historically has been responsible for security. And increasingly, you're seeing the CISO oversee the responsibility for security and with these industrial control systems. So what we've done in the past could be a good indication of what we'll do in the future. We've done -- a lot of early-stage companies that don't come with a sizable customer base and a lot of revenue. So we've done a lot of the heavy lifting, integrating it back into the broader product platform and then leveraging our sellers to be able to go out and sell it. Our hope was over the course of time that we'll continue to use M&A as a means to bring product to market sooner and expand the utility of our -- of the Tenable One offering. So I think M&A will continue to be selective there. And then we expect to continue to generate more meaningful levels of cash flow, and there's lots of potential uses. But I would say, first and foremost, would be on the M&A side.

Got it. Got it. On the roughly minute and a half that we've got left, one of the last questions we're trying to ask all of the companies here at the conference, maybe for Tenable is, what percentage of your annual CCB or revenue or however -- whatever metric you'd like to look at, what percentage of the business has historically come from new logo business? And how has that trended in prior downturns?

Sure. So if you -- we guide to CCB. And if you look at CCB, the composition of such, more than half of our revenue comes from renewals, okay? So then there's a healthy new business piece. If you look at the new business piece, there's new dollars from new logos, which we disclosed. We had hundreds of new customers a quarter. And then there's upsell from existing customers. And so of that new business piece, I think it's fair to say that over 50% of that new business bogey can come from upsell from existing customers. And so consequently, there's a smaller piece that comes from new logos. And so that feels like really good. And one of the upsell -- we have a massive upsell opportunity, not only when you consider the size of our customer base, but the fact that customers who buy Nessus often step up and make a larger enterprise platform purchase. And then once you're an enterprise customer, when you renew, you're adding more asset types, and we are able to expand the relationship there. So both are important to us, but more so weighted in upsell opportunity.

Great. Well, I think that's about all the time that we have left. Steve, thank you so much for taking the time. I really enjoyed it. It was very helpful.

Thank you, Saket, for having us. Appreciate it.

Absolutely. Yes, for sure.