Tenable Holdings, Inc. (TENB) Earnings Call Transcript & Summary

Good afternoon, everyone. Welcome to day 2 of the Barclays Tech Conference. My name is Saket Kalia. I cover software here at Barclays. I'm honored to have the team with us here from Tenable. We've got Steve Vintz, Chief Financial Officer; and also have Head of Investor Relations, Erin Karney here in the audience as well. So we've got about 30 minutes together. Let's spend maybe the first 20 or 25 minutes doing some fireside chat here with Steve, which I know is going to be fun. And then we'd love to make this interactive. Anyone that's got any questions, just pop up your hand. We've got a mic runner on the back, and again, I'd love to make it interactive. So with that, Steve, thanks so much for taking the time.

And thanks for having us.

Dude, it wouldn't be a Barclays conference without you. Let's just -- maybe just a level set for us here, Steve, could you just spend a couple of minutes recapping some of the points from last quarter that you were most proud of? I know there were some moving parts. There were some really good things, too. Why don't you tell us what some of those were?

Sure. Well, we're proud of a lot of things. Pleased with our performance in the third quarter, over $200 million of revenue. Revenue grew 15%. Notable outperformance in the operating margin to $10 million beat. We're on a glide path to expand the margins by over 450 basis points this year, which will bring the operating margins kind of close to 15%, so considerable expansion in the margins on higher levels of productivity. Also really pleased with customer velocity. Even in this market, we're adding 380 new enterprise platform customers. We announced a record number of 7-figure deals, a record number of $0.5 million deals, our traction in the enterprise market continues to gain steam. 45% of all of our new sales in the quarter was non-VM related. VM is a good market. But over the years, we have demonstrated the ability to deliver incremental value above and beyond VM in areas like cloud security, OT, identity, which is certainly making a big difference. 20% of our new enterprise sales are Tenable One, which has higher selling prices. The last thing I'll say here is that our strength in the public sector continues, specifically U.S. federal, which has a 9/30 year-end. And arguably, U.S. federal government is one of the most sophisticated cyber consumers in the world. Approximately 15% of our revenues come from public sector and helped us transact larger deals. Created a little bit of headwind for CCB because not all of those deals are billable in advance. But certainly, gives us the opportunity to sell more software down the road. So trends in public sector was also a major highlight.

Yes, absolutely, especially being outside of the beltway, no surprise there, definitely a leader in the public sector. Maybe just to zoom out a little bit here, Steve. I mean Tenable has always kind of talked about the traditional definition of vulnerability management, or VM, as being kind of narrow, right? And this idea that sort of assessing risk exposure is really a much bigger market than an IDC or a Gartner, for example, with size. Can you just maybe go one level deeper into that? And kind of how Tenable view this broader risk exposure market, if you will?

Sure. Well, cyber exposure is an outgrowth of the vulnerability management market. And if you look at what we do today, we help companies understand and reduce their cyber risk and answer the question, how secure are we? IT environments are much more complex today than they were years ago. It's no longer about securing servers, desktops and laptops in traditional compute environments. Today, companies are far more complex as they continue to embrace digital transformation. And we're helping customers secure assets -- discover and assess assets across the very broad surface of attack, whether that includes traditional compute, but also includes today now, cloud security, OT, external Internet-facing assets, web applications, now even identities, which is a really important problem not only in cloud but also in traditional environments, and really answering the question, as I mentioned before, how secure are we? So if you look at the VM market over the years, it certainly has evolved. Years ago, if you were an organization that collected personal identifiable information, whether it's credit card data, social security numbers, whatever it is, you were required to do an assessment of that system or that server to achieve or meet PCI compliance purposes or HIPAA perhaps. But given over the years, companies, there's been a proliferation of assets and systems, it's expanded the attack surface. We're seeing more high-profile data breaches not just on servers, but across web applications, remember, Equifax, across even SaaS applications, external Internet-facing assets. So as a result, VM has become -- taken on broader meaning. And so we have broadened the product portfolio over the years to not only assess the traditional compute environments, but also do newer asset types, whether it's cloud, OT, identity, whatever the case may be. And we also believe, finally, that our strength in VM gives us the opportunity to address a much bigger problem. Security, we believe, is a big data problem. Security is not done in a vacuum, and what we're attempting to do is combine all of the insights that we're able to collect across these different systems and devices, combine the threat that evolves with digital identities in a way that helps customers understand the risk more broadly.

Yes. Yes, absolutely. Definitely a broader definition there that you guys have been so successful with. I think that one strategic highlight this quarter, I think, was the acquisition of Ermetic, which really brings Tenable deeper into cloud security, right, this area of CNAPP. Maybe without getting too deep into the technology, could you just maybe walk us through the strategy behind that deal? And why there is synergy between such a strong sort of cyber exposure business and CNAPP?

Sure. Well, cloud security is certainly a large market opportunity for us. I'll say, first, TAM expansionary, it expands our TAM to well over $30 billion a year. So customer-driven, we're helping customers understand their exposure across the attack surface. And we're strong in infrastructure as Code. We also have an agent base and an [ Agilent ] solution to help customers -- that helps monitor runtime environments. But where Ermetic is strong and where its expansion area is that they have a unified CNAPP solution. And specifically, they automate the asset discovery, the risk analysis, the compliance and the remediation in these public cloud environments. And they have also solved one of the biggest challenges in cloud security today, which is managing all the identities and the entitlements. That's a big task, both discovering and visualizing both human identities and service identities. And they provide context-aware prioritization that reveals these toxic combinations of privileged access with public-enabled vulnerable workloads in a way that drives remediation, helps them reduce risk. So clearly, the 2 offerings are very complementary. We're strong in areas where they're not. They give us a much broader footprint in cloud. It's one of the largest and fastest-growing TAMs. And we're seeing certainly a lot of customer pull in that regard. And we believe that going forward, we'll be able to sell it in a number of different ways, sell it stand-alone and go head-to-head with any provider in the cloud security market today on a feature-for-feature basis but also sell it as part of a broader offering in Tenable One.

Yes, absolutely. I definitely want to come to some of that pricing packaging later on, but I want to go back to some of the things that you mentioned earlier. I mean, Tenable has always been such a strategic vendor to the public sector, particularly U.S. federal. I think you touched on this a little bit, but what are you seeing from the public sector on their willingness to invest in security? And are they looking at broader products now than -- from Tenable than they have in the past? Talk to us a little bit about that.

Yes. I mean, public sector is a tremendous opportunity and not only includes U.S. federal, but also public sector and governments really all around the world. We've talked about our footprint over the years. We've been fortunate enough to win some pretty sizable programs in U.S. federal alone, both on the DoD and the civilian side. As I mentioned before, certainly, one of the most demanding cyber consumers and success in the public sector we've seen over the years has translated to success in the commercial and the enterprise environments. Over the past couple of years, we've seen mandates from the administration to strengthen cyber defenses, both at the federal level as well as at the state, and even encouraging the private sector to do the same. There's also a number of geopolitical events as we're all -- I'm certainly well aware, where cyber has now become part of military operations and cyber warfare, and with concerns specifically about protecting critical infrastructure. So what we've -- so given these mandates, the spend and strength in cyber defenses, one of the things we've talked about is, look, we know there's going to be a slowdown of dollars, specifically in public sector, U.S. federal, more particular, but companies didn't always have perfect visibility at how those dollars would flow down at the agency level. We, this year, have -- are seeing a tremendous momentum here closing large deals. And we're not talking about just -- these are deals north of 7 figures and well above that. These deals are much more strategic in nature. They're part of -- they're one phase of a multiphase project to spend. And our success here is not just really in VM. As we talked about on this last call, we're seeing like a particular emphasis on OT security, and not just at the federal level, but the feds also backstopping a lot of these states as well, where the states are starting to spend more, whether it's on critical infrastructure like manufacturing facilities or power plants, things like that or even operational technology, which has been an area of emphasis for us, where we're helping U.S. federal government really understand their exposure with regard to some of these industrial control systems, designing programs around that, securing critical sites, where we're landing here and there's an opportunity to spend much, much more. So federal government is an exciting opportunity for us. There'll be tailwinds of growth. And certainly, we're seeing a lot of momentum this year transacting larger deals there on VM.

Yes, for sure. That definitely came through in the last quarter. Maybe that's a good segue to just touch on some of the moving parts in the last quarter to understand some of the components of CCB. I think what we said on the call was that about 12 million of business didn't get recognized into CCB this quarter, which kind of made that just a little bit less helpful of a metric than it has been in the past. I know you talked about CRPO, and we'll get to that in a second, but can we just break down that $12 million a little bit more? And why maybe from an accounting perspective that didn't flow into CCB?

Yes. Certainly, a lot to explain here and certainly not our favorite topic when we have to talk about professional services and perpetual licenses. But as we said before...

Sorry, Steve.

No, next time, you should ask [ Steve ] that question, he'll give you a very thorough answer. But as we said before, certainly a sizable footprint in the public sector. And historically, they've had a procurement bias towards perpetual licenses. We sell both subscriptions and perpetual licenses. Perpetual licenses isn't a big area of focus for us, and our sellers actually make less money selling licenses. But what we've seen -- what we saw in the third quarter is the level of perpetual licenses in professional services was higher than anything that we've seen before, more than double the mix of business, public sector, in terms of the -- public sector mix was more than double than what we've seen historically, which is really good. It speaks to our momentum in public sector and the opportunity to close larger deals. But perpetual licenses for us, under the accounting rules, we recognize not upfront, which is what most customers do, we recognize over 5 years. That means 4/5 of the contract value for perpetual license is not included in CCB, it's included in long-term deferred revenue. And also because these deals, as I've talked about before, are more strategic, well above the 7-figure threshold, where we're doing program design and implementation, includes not only the perpetual license but also higher levels of professional services, which we know makes the product stickier, drives higher renewal rates, more expansion opportunity. Unlike our enterprise customers, where we'll provide professional services, we're able to invoice upfront, because a lot of these are productized. Our arrangement with the federal government is that we can't invoice those until the work is completed. So consequently, the higher levels, the outperformance in public sector, which is impressive, result at higher levels of perpetual licenses, result at higher levels of professional services, which consequently minimally contributed to CCB. And CCB historically, has tracked within 100, 200, 300 basis points of the underlying growth of the business, we manage the company in terms of ACV bookings. But this quarter was such a big disparity because of that public sector dynamic.

Yes, absolutely. I mean, I think the way -- maybe the way that I would think about it is this wasn't a fundamental demand problem. It was really just kind of how the accounting behind how some of those contracts came in, which I think is interesting. Maybe the follow-up question there, though, is do we think that more of this is going to happen in the future? And should we start looking more at CRPO as just a more important metric, going forward? Or are we still going to really be focusing on CCB again? Is that a better long-term indicator of the health of the business?

Saket, we try to be -- try to provide a level of visibility that's important to investors. We disclose CCB. I do it on an annual basis, and we guide to it. I'll come back to that in just a minute. We disclose a number of new enterprise platform customers, number of large deals. We disclose our net dollar expense rate, the exact rate for the quarter -- well, in the quarter we disclose, which is on an LTM basis. So a lot of data points that we provide that give you the ability to monitor and measure the overall health of the business. And we know in a subscription business, the focus sometimes moves from the P&L to the balance sheet, right? And people take the change in deferred revenue, current portion of deferred revenue, add it to revenue recognized. And that is a close but not perfect proxy of what you invoice. Again, we manage the company in terms of ACV bookings. There is no one single indicator here that is -- that closely approximates the underlying performance of the business. In the past, CCB has been a close approximation. This quarter, a big disparity, we set current RPO, which grew 15% this past quarter. It was a closer approximation of the underlying performance of the business, growth in ACV bookings. CCB growth came in at 8% because of some of the mix in public sector. I think going forward, we'll continue to monitor, determine what the best leading indicator is. We know that if we don't talk about it, investors will still tend to focus on the balance sheet. We'd rather help shape that narrative. But at the same time, we want investors to know that CCB growth or even if current RPO growth may not reflect the underlying performance of the business. It's one of the reasons this quarter that we raised our guide in revenue, we raised our guide in free cash flow, and -- despite some of the headwinds we saw in CCB due to mix issues.

Absolutely. Let's get some of that accounting stuff behind us now. I want to talk about a really fun topic here, which is Tenable One, which, I mean, I would really call a game-changing go-to-market strategy for Tenable. And I think this past quarter, I think we said Tenable One -- or you mentioned, represented about 20% of new sales in the quarter. I think grew like 100% year-over-year, but you guys correct me there if I'm wrong, right? But can we just recap why this is so compelling for customers? And how it's also driving additional value to Tenable as well?

Yes. Well, historically, if you look at the security market, it's fairly fragmented, right? I think there's tens of thousands of private security companies in the world or a number of security companies, period. Maybe 80% of them, 90% of them are less than $20 million of revenue. So it's always been best of breed and characterized by point solutions. And there'll certainly always be a need for kind of best-in-class solutions, certainly in some markets. But we're seeing more recently, there's a little vendor fatigue, and we're a big believer in operationalizing preventive security. And it's -- yes, our ability to secure maybe traditional compute environments, secure these industrial control systems or maybe external Internet-facing assets, public cloud environments. But increasingly, what customers want to understand is the intersection of all that data, of all those insights that we collect. So we go, we broadened the product portfolio to help assess different assets across the attack surface, but we've also been hard at work building this massive data lake and integrating all of the insights, all of these vulnerabilities across all these different systems, combining this with the threat and the identities, who has over-provisioned access, who can make lateral movements, to come back and provide a likely path of exploit for customers to drive recommended remediation. And so I think that's a really important problem that we're helping our customers solve, which is, "Hey, there's no shortage of data in security, but understanding kind of the intersection of all these vulnerabilities and threats with the identities with all these different asset types to help drive remediation." So it's -- Tenable One, it's a product that we launched last year. We know that when we sell Tenable One, the selling prices are 70% higher, and the growth there has been very notable. And going forward, we're landing increasingly with Tenable One, and it's a way to cover more assets and secure more of those different systems.

Yes, absolutely. I want to loop Ermetic back in here. And just for context, I mean, I think there have been other acquisitions that Tenable has done, where -- that have been very natural adds back into Tenable One, right, sort of that packaging. Maybe the question is on Ermetic, is this also something that you think gets folded into Tenable One, or is it maybe a little bit of a different sale? Talk to us a little bit about the go-to-market as you think about Ermetic and Tenable One together.

Well, our go-to-market is really twofold. Number one, for a customer that has a specific cloud security use case, we'll sell you the unified CNAPP solution. Or if it's a, call it, a larger customer, perhaps a more mature customer, where maybe they have a CNAPP offering that they've built or maybe they -- they bought from a third party, we can sell a stand-alone cloud security offering specifically to address identity, has market-leading king capabilities, cloud identity and title management. So for a customer who has a stand-alone use case and a specific need in cloud security, we can address that via CNAPP or the stand-alone identity product. But, however, we also recognize that cloud security is a very important part of your attack surface. And so if customers want to understand risk more broadly and aggregate that cloud security data with these different systems and devices across the attack surface, then obviously, they would have an inclination to buy Tenable One. So we believe cloud security is another layer in security. We -- and Tenable One for us, going forward, represents kind of our mandate since going public, which is to help customers understand and reduce their risk. It's an outgrowth of the VM market, where we're the clear leader. And also going forward, that also means for us that we want to be able to ingest third-party data. We don't, nor can any security company, secure all these different asset types, right? It takes a bit of a different approach. So the ability to ingest data, whether it's at the endpoints or firewalls or otherwise, and combine that with our own massive data lake to provide deeper and richer insights with regard to risk is really important. So we think this is where security going -- is going. Again, we answer the question "How secure are we?" which is -- for our customers, which is a really important one. And this is certainly something that we own with the customer.

Yes, absolutely. I think it makes a lot of sense. Last 10 minutes, I'm going to shift to some maybe forward-looking financial questions, right? So I think that -- I think on the last call, we talked about sort of mid-teens CCB growth for next year. As a starting point, right, let's not call it a guide, maybe a starting point, right? And I think that what we're doing is we're including some inorganic from Ermetic there, I think let's call it about 2 points of contribution. You correct me there if I'm wrong. And so I think we get, organically, let's call it low teens, 13% CCB. You tell me if I'm out of the range. That growth rate isn't terribly out of the ZIP code of what Tenable has been doing, has been growing CCB historically. But I think it almost implies just a little bit of acceleration in '24 compared to what we've guided to here for '23. Plenty of reasons for why that could be. What do you want us to know about that? What are you trying to say with that guide, that outlook?

Good question. Let's unpack that a little bit. First, I want to be clear that we're not assuming stronger demand environment next year. We're not assuming things to change. And we're not assuming acceleration. So if you're going to unpack the guide on this call -- because normally, we talk about -- we give guidance in February for the full year after Q4. The fourth quarter is, in terms of absolute dollars, is our largest. That's an important data point to have in hand. So we'll talk about the business for the full year next year in more specific terms on our February call. However, we wanted to provide some directional comments. We said mid-teens growth. Whether that's 14% or 15% or whatever that -- like we'll figure that out after we have Q4 behind us. So we said mid-teens growth. If you unpack that a little further, 2 points of growth is expected -- in terms of CCB growth, is expected from Ermetic, so that could be 12% or 13% growth. And if you look at kind of the compares year-over-year, obviously, we have, number one, more favorable compares just because of the -- what we saw in CCB in the third quarter, that's roughly a point of growth. And so we kind of look at it and unpack the growth, it assumes the same or slightly more modest growth on a year-over-year basis. We're trying to set the expectations at the right level. And I think that's really important. And I think we feel good -- really good about the guide. And obviously, we'll talk more about next year in February. And also, you have to understand, we've done a good job over the years setting expectations and then over-delivering, specifically on the bottom line. So there'll be an ability to hopefully drive margin leverage higher and hopefully, gives us the ability to also over-deliver on the top line. This time last year, first half of last year, we were growing 30%. Second half of last year, we were growing 20%. Obviously, this is a new budget cycle and the macro is tougher and our growth has been in terms of performance of the business, kind of mid-teens. And we certainly have an ability to drive higher levels of growth. Don't want to set that expectation, but we think we're doing all the right things to put us in a position to do that if there's a better macro.

No, absolutely. And I think that really -- as you look back historically, a lot of good prudent approaches to forward-looking growth. So totally appreciate the strategy. I want to spend some time on margins and free cash flow because I think it's just really been an impressive shift that we've seen in the model. So maybe first of all, talk us through what you said about operating margin and just unlevered free cash flow from sort of a long-term perspective. Are we at inflection?

Yes. Long term, we're very confident in our ability to drive continued margin expansion. When we said long term, which we haven't put a timetable to, that our operating margins will be 25% plus, free cash flow margins will be 30% plus, I have every confidence that we'll be able to achieve it. Our operating margins this year probably will be 14%, 15%, based on the guide. We're increasing the operating margin by 400 bps this year alone. We expect the margins to continue to increase. I actually believe that we have the ability to drive higher levels of growth above and beyond what we provided previously for our long-term target model. So certainly, good -- more leverage to come.

Wow, that's really impressive. Now, of course, Ermetic is still a growing business, right? I mean, really big market opportunity, as you said. Just remind us how much that's impacting margins here in Q4. And how do you think about that impact kind of going forward as you drive some synergies from the combination?

Yes, certainly, super excited about Ermetic. As I mentioned, their capabilities in cloud are very complementary to ours. In the fourth quarter, we're hard at work at integrating these capabilities and launching a new version of our cloud security offering, which we'll more formally bring to market at the beginning of next year. So the impact to the top line from Ermetic will be somewhat nominal in the fourth quarter as we work to close our Q4 pipeline opportunities. In terms of the margins themselves, we expect the impact on the operating margins for the fourth quarter to be $4 million to $6 million, call it $5 million, dilutive in the operating margins in the fourth quarter. On free cash flow, roughly, I think we said $14 million to $16 million, so call it $15 million because it includes the lost interest income because it's a cash deal, and some of the transaction expenses. And we said in terms of next year, it would add 2 points of CCB growth, 1 point of revenue growth due to the ramp. And the activity levels and the engagement from our sales force and customers out of the gate has been overwhelmingly, I'll call it, phenomenal, has been really -- it's been really strong. And then in terms of the bottom line, we said it would impact, call it, free cash flow to the tune of, call it, $10 million to $15 million. And we expect it to be accretive in the fourth quarter and breakeven, I'll say, in the fourth quarter in terms of free cash flow and then accretive to free cash flow and operating income for the full year '25.

Got it. So kind of short-term pain for long-term gain, basically, right?

Yes. Again, highly strategic in one of our fastest and growing and largest markets.

Yes, absolutely. When you kind of put all that stuff together and you get some really nice free cash flow generation, maybe the question is, how does the Board think about capital allocation? We just saw a nice share buyback here recently, maybe touch on that as part of the answer. But just broadly, how are we thinking about capital allocation here, given that cash flow that we're seeing?

Yes. And one point on the cash flow before I get into the capital allocation is that, despite that with the Ermetic deal, where it comes with some initial dilution, this year, our level of free cash flow will be roughly $170 million. Our directional comments on the third quarter said -- pointed to $213 million, call it, $215 million in free cash flow despite that dilution, growing the free cash flow and certainly with the ability to drive even higher, depending on how the year plays out. And in terms of capital allocation, the good news is we're a balanced grower, and we're generating increasing levels of cash flow and expanding the operating margins. We announced a stock repurchase plan or program here a couple of weeks ago, to the tune of $100 million, indefinite time period. But that represents -- as I mentioned before, we'll generate over $200 million of cash flow next year. So I feel like it's a fresh start dipping our toe in the water, offset some of the share creep. And just over the course of the next few years, as we mature and grow here, we will look to use some of our free cash flow to offset the full share creep. And then, the market is fragmented. I think we have our head down right now with the Ermetic acquisition, committed to making it accretive. And -- but certainly, the balance to share buyback is making sure that you're continuing to add to free cash flow and you're in a position to do things strategically, should you need to do so. The last thing I'll say is, we do have public debt and a credit rating. And recently, S&P upgraded us from, I think, B to BB.

I saw that. Yes.

And because we considerably delevered the business over the years, and so we have a much stronger credit rating, puts us in a position to do some good things, if we so choose.

Got it. Got it. Maybe another minute or 2 left here. I've got a couple of last questions, but any questions here from the audience? Steve, one question that we didn't touch on is just the competitive backdrop. You've got a competitor that's maybe going through some of their own sort of exercises, if you will. Any comments you want to make just on sort of the competitive backdrop here in the business?

We have a lot of respect for our competitors. But when it comes to VM, we believe that we're the clear market leader, largest in terms of customer base, number of new customers, added a quarter device coverage, a whole host of measures. VM is a really important market. That has translated to opportunities in other adjacent markets such as cloud. And some of these opportunities, whether it's AD, cloud security, ASM, you see slightly different competitors. And so for us, there's a tremendous opportunity ahead, and we've broadened the product portfolio. We play in a much larger sandbox. And certainly, we have the ability to have attractive levels of growth here, sustainable levels of growth with expanding margins and have confidence in our ability to drive price appreciation.

Absolutely. And some great big customers with deep budgets like the federal government, to your point, right? All right. Well, I think that's about all the time that we have. Steve, thanks so much for the time. Really enjoyed it, as always.

Thank you, Saket. Congratulations on your II rating, #1.

Thanks, buddy.