Tenable Holdings, Inc. (TENB) Earnings Call Transcript & Summary

All right. Good morning, everyone. Thank you for joining us. My name is Brian Essex. I'm JPMorgan Security Software Analyst. And with me today, I have Steve Vintz, CFO of Tenable; and Erin Karney, VP of Investor Relations. I don't know if you guys need to read anything before we get started or no, we're good? All right. So maybe the most important question is how is Amit doing?

Amit is doing well. Some of you may know that Amit recently disclosed that he's been diagnosed with cancer. He started his treatment first week of April. The good news is that he has likely finished his last treatment this past Friday, so he was able to ring the bell, which is great news. And we're excited and looking forward to his return to work, subject to confirmatory tests. So pretty exciting news.

That's amazing, and he's had a phenomenal outlook. So good friend and I am so glad to hear that. Maybe with regard to the company, a good place to start would be on the results of the quarter just to kind of recap, yours were meaningfully better than your peers. And how do you see demand in your markets when you encounter your 2 primary peers? What are win rates like? And what kind of factors drive competitive wins?

Sure. Well, first, for those of you who are not familiar with Tenable, we're the exposure management company. We help organizations understand and reduce their cyber risk. So we have technology that discovers and assesses systems, devices for vulnerabilities and exploits and then across not only the network but also public cloud environment, OT, industrial control systems, external Internet-facing assets. And then we're able to aggregate all that data, vulnerabilities and threats and the identities and the access to those systems and the configurations of those systems into a singular platform that we call Tenable One and where we can identify, recommend remediation and provide a holistic assessment of risk. We answer the question how secure are we. With regard to Q1 and the demand environment, we're off to a good start for the year. CCB revenue and earnings all exceeded estimates, which is a good thing. Our expectations, more importantly, we added 400 new customers in the quarter and we're seeing strength in a lot of areas in our business, but one of which is vulnerability management. And we believe we're the unequivocal leader in vulnerability management. It's a foundational market and we're seeing good demand there. I would characterize that the demand in VM as stable. This market tends to be very fluid. Things can change from quarter-to-quarter. But where we're seeing strength, in particular, is really in the enterprise market. About 60% of our total sales comes from large customers. These are employees -- companies with employees 5,000 and above. And then we also -- about 25% of our sales is in the mid-market. And our definition of the mid-market has changed a little bit over the years. It's roughly, call it, 250 employees up to 5,000. Ever since COVID, one of the things we've learned that we can cost effectively sell and transact large deal sizes to mid-sized organizations over the phone and close even $100,000 plus deals. So where we're having success, specifically in VM, Brian, to your question, selling in the enterprise market, but the upper end of the mid-market. So we're seeing good traction there. And our close rates continue to be very high. We've disclosed publicly before, our close rates currently range between 60% and 70%, closer to the 70% threshold. So win rates tend to be good as our close rates in the quarter, which we've talked about on our earnings call.

With that, one of the interesting things you just noted was 400 new customer adds. I think logo adds have been really challenging across the board, not just in VM, but across the board in our space. Is there anything in particular about some of the new customer wins like any kind of trends you can point to that's leading to some success there?

Sure. Well, our ability to add customers really depends on the core use case. So we have, as I mentioned before, we sell an integrated and unified platform, includes everything from VM to web application security to cloud security, both [ pre-production ] Infrastructure as Code to runtime environment within those public cloud environments to things like OT, external Internet-facing assets. So the ability to sell that as an integrated platform has helped quite a bit. And there's no secret that in cyber, it's a very fragmented market. There's tens of thousands of private security companies, all calling on large established organizations trying to sell their offering. What we really found principally that you have to be a leader in a market that matters for one. VM, it's a really important market. And then when we went public in 2018, one of the things that we talked about was really the outgrowth of that market, what we call exposure management, which is the ability to assess these systems not only just in traditional network environments, but across a broad surface of attack. So selling the platform has paved the way, it results in higher selling prices. And we cover more asset types. We have an asset-based pricing model. So as customers look to place more assets and systems in their environment, increasingly, they turn to us and look for us to help secure and assess more of those systems and devices. We also sell product stand-alone. So if someone has like a cloud security mandate, we have a stand-alone and a very broad unified CNAPP offering that automates the asset discovery, risk analysis and the compliance and remediation aspect of it and solves one of the biggest problems in cloud, which is the entitlements and identities. So we sell products standalone to address a specific use case or increasingly, we sell it as a broader platform, and we're having good success as customers increasingly look to consolidate a lot of their spend. And just as an example, our largest deal in the quarter was a sizable 6-figure deal, is a European manufacturer. It started off as an RFP for cloud security. And we went through the POV and we won that. And the conversation turned to is like, well, okay, well, you're strong in VM. So if we're going to buy Tenable One to do cloud security, the customer then said, okay, well, then you have the ability to displace the current incumbent VM, which we did. And then we also sold OT. So that's a great example of something starting with a singular focus in an important area such as cloud and then closing a sizable deal that covers not only cloud security but also OT, VM and other assets.

[indiscernible] cloud, who are you competing with in that case? And how do they decide on Tenable to include in that RFP process?

We're -- I guess it really depends. Cloud security market is arguably what, $10 billion, plus or minus, depending on what TAM you're reading or market study you read, anywhere from $7 billion to $17 billion. So call it $10 billion. The largest player is a private company that's roughly $400 million in revenue. So big TAM, relatively low penetration rate, and there's probably a handful of us that have any level of scale in that market. So when the RFP came in as a cloud security mandate, it can really depend. Within cloud security, there's multiple categories. There's Infrastructure as Code, which is some customers need help assessing, doing the -- assessing the TERA scripts. We do Terrascans, making sure that the programming language to push out the application to a public cloud environment is compliant with their policy. So some customers focus on preproduction type activities, other customers focus on identity and entitlements which we believe is one of the most important problems in cloud, as I mentioned earlier, understanding the toxic relationships between the configuration of your public cloud environment and the access and entitlements of those, understanding the toxic relationships between access to a public cloud environment and the publicly facing vulnerable workloads. So for us, the mandate can vary. But for us, it was a broader CNAPP RFP which we've won, and then was able to display some of the other incumbent vendors.

Great. Great. And then maybe on Tenable One for a minute. How often are you leading with your analytics platform. And as you look at your installed base, how penetrated is Tenable One into your installed base, how much room to run it? Do you have just on customers that you have established already.

Yes. With regard to the latter, we have about 44 -- call it, 44,000 customers. So we have one of the largest customer bases of any security company, public or private, very sizable customer base. About 1/3 of those are enterprise customers that use one of our enterprise offerings. It could be Tenable.io, security center or Tenable One. And so if you look at our penetration of Tenable One into our enterprise customer base, it's roughly about 10%. So still lots of greenfield opportunity and lots of runway for continued growth. We also mentioned that when we sell Tenable One, the selling prices tend to be higher because it's a desire for a customer to do not only VM, vulnerability management, but also something else. That's usually what compels the purchase would be VM plus. It could be WAS, it could be cloud security or OT or some other types of assets. And so when we sell Tenable One, on average, we see higher asset counts because there's more capability and future functionality, but also because of the ability to deliver a greater insight with regard to risk, the cost per asset is slightly higher. So that results in, we said, roughly a 70% higher selling price. Now for us, one of the problems. The problem that we're helping solve is when there's a likely path of attack, it's not just usually, okay, what was the vulnerability that led to that breach. It's a combination of understanding the gaps within your security stack. So yes, we can assess and secure various domains like the network, such as the cloud, such as industrial control systems and other types of assets. But what typically happens is you have to be able to connect the dots between vulnerabilities, threat, identities and the context of those assets, so you understand the likely path of exploit. And that's usually where bad actors tend to focus. It's usually a path of attack that usually occurs that leads to a security incident.

Got it. And then how should we think about Tenable's ability to consolidate share across your platform, establish a platform? And how does that compare with -- even though they're not even competitors now, but those that have also evolved from like a VM origin? How would you differentiate Tenable versus what you're seeing with, for example, Rapid7 or Qualys that also originated from VM and have kind of tried to push into adjacent markets?

Well, I think it really depends on your focus and your origin as a company. So for us, our routes are in vulnerability management. What we do really well is the ability to assess these systems and devices. And there's a lot we learn about that, the operating systems, the configuration of those devices. And -- but we always believe that there was a bigger opportunity, which is to be able to do that across different asset types that go broader across the attack surface in terms of the things that we can discover and assess and then also deeper in terms of the analytics and the insights that we can deliver. And I do think there is -- consolidation has been talked about a lot in cyber over the years. We're certainly starting to see more of that as rates have gone up, corporate spending tends to pull back and customers look at the security and say, "Hey, what we want to do is drive more utility around vendors that have real scale that solve an important problem and that address a critical need for us in a really important market." So why go out there and buy a stand-alone, whether it's cyber asset management solution or web app security when you can get a lot of that feature functionality out of a platform. With regard to the other VM companies who are strong competitors, we have different focus. For us or always been on helping customers understand their risk and reduce their risk, and expanding on that core VM value proposition, whereas another company may have more of a downward focus or a different-sized customer. And different size customers lend itself to different opportunities where you can go into things like SIEM where we partner with a lot of the enterprise SIEM companies [ or we can do ] incident response. So there's things that we -- that are not natural for us, for our enterprise customers that may be more natural for a different-sized customer. So we all started in similar places, but have slightly different strategies.

Got it. Maybe real quick on the macro. We're halfway through the quarter. I understand that you guys have an extremely back-end loaded quarter typically. But any view you can share on budgets and spending as you've seen it so far. How does it compare to last year when maybe some were worried about a greater probability of a recession happening by the end of the year. And maybe we'll just start with that and then got some others to follow.

Sure. And -- so look, in a market like this, we're all running agile companies. Markets can be very fluid. And demand is not monolithic. And so I think that's just something you have to be mindful of. So in Q1, as Brian mentioned earlier, out of the gate, we have a strong start to the year. We beat expectations. Every quarter is different in its own right and some economies are doing better than others. U.K. largely has been in a recession since Q4 of last year. Middle East has historically -- has been strong. Spending environment remains healthy there. APAC continues to be really good for us. We have real scale in North America. So overall, we're pleased with what we're seeing out of the gate. The close rates in Q1, close rates on average for us tend to be slightly lower in the first quarter relative to others, just historically speaking, I've been here for 9 years. That's just the historical patterns of the business. But we had some of the highest close rates in the first quarter that we've seen in several years, dating back to Q1 of -- even stronger than Q1 of '22, when growth was, call it, circa 30%. We also commented on the call that growth from new logos was also particularly strong this quarter. Look, in this market, new business is tougher to transact. So we're pleased that we added 400 new customers, but the growth from those new logos result -- ACV growth was over 30%. So every quarter, pipeline opportunities between new and upsell can vary, but this particular quarter new was strong, which we think is a positive sign. But we see lots of untapped opportunity as we look kind of into the year, public sector and other areas, we would expect to be strong.

Great. And then we had you on the road in what I think March and I think you're positive in March. I think you sounded really positive on the earnings call with federal spending in particular. I think one of the words you used was spectacular. What are you seeing that is making it so strong? I mean, is it the level of visibility that you may have into the pipeline? Is it regulatory drivers, maybe something else? Would you say there's a greater probability of this spend materializing than other segments of the business? Like how should we think about the federal vertical for Tenable?

Sure. Well, spectacular is a strong word. I'm not sure if it's in my lexicon, if it was, maybe I had too many Red Bulls before the earnings call. And this is about as excited as I get as our CEO often says. But I will say that I would characterize public sector. Certainly, that's an area of focus for us. For those of you who don't know, about 15% of our total sales come from public sector that includes federal, state, local and certainly higher ed. Over the years, we've won some pretty sizable contracts, both on the DoD and the civilian side. And U.S. Federal is arguably one of the most sophisticated cyber consumers in the entire world. So success there often translates to success in the enterprise and the commercial space. Last year, we saw a really strong Fed, specifically in Q3, we talked about closing very sizable 7-figure deals with a couple of large agencies. And what we saw this year, what we're seeing this year is that it has the potential to be even better. And not just in Q3 but potentially the rest of the year. Now I'm not saying it will be, but it certainly has the potential. One of the differences this year is where we saw strength in a couple of large agencies on the defense side last year, we're seeing sizable pipeline opportunities in dollars slowdown with lots of large federal agencies, both defense and civilian. We're also starting -- we're seeing early signs that fund flows, dollar flows could flow down to the agencies for some of the smaller agencies, we'll call them even nonessential agencies. So Fed is certainly a major opportunity for us, and we characterize the spending environment as healthy. CR was a little bit of an overhang in Q1 just because the budget uncertainty did not get resolved until March, late into the quarter. And the other thing I would comment would be state and local, where we're seeing whole of state opportunities and states are often backstopped by the Fed. And last year, we talked about winning a sizable state deal with one of the southern states where they standardize on Tenable across all of their agencies and municipalities, and there's many more of those. So certainly, we're seeing opportunity there at the state and local level as well as U.S. federal.

Great. And AI is something I wanted to touch on if we talk about the platform. And obviously, at RSA, it didn't disappoint AI. It was everywhere you looked. What is -- and just thinking about the whole kind of like risk profile or exposure level when you add AI and expand attack surface, you have to think about the data environment, you have to think about the model environment and the inferencing environment, the usage environment and the infrastructure that supports all 3 of those kind of categories, what's Tenable's AI story outside of leveraging it for your own business, but in terms of the expansion of the attack surface and your ability to address the threats across that surface?

Yes. Well, certainly, AI has the potential for -- has the potential to create a dramatic impact on the security industry. Not only -- I'll talk about the product in just a minute, but not only does it help you or can help you become better and smarter on how you identify and close opportunities. We're leveraging AI in a way. This is what opportunities have a higher likelihood to close. Is it with large companies or smaller companies? Is it product-based? Is it geo-based? Is it based on industry looking at those corollaries? And then obviously, how you support customers and how you do all other things. I believe that companies long term will be more profitable because of AI and the ability to leverage data and insights and do things in a much faster and better way, including bringing new products to market, rapid -- more rapid development cycles. On the product side, I think, you're seeing adoption of AI more so with bad actors and nation states. I think we've even seen our first attacks leveraging AI as recent as a couple of weeks ago. But imagine a technology that can read anything ever written about you as a person, your family, your business relationships, your company and be able to ingest that in a way to create a very targeted and sophisticated attack. So that's where we're seeing adoption out of the gate. Right now, AI is being leveraged in a way where there's a lot of data that security companies can deliver to a security professional or Infosec team, volumes of data, and it's really hard to sort through it and understand what's important and what's not. So driving higher levels of prioritization, looking at corollaries between unusual usage patterns across asset types, configurations, looking -- combining that with access and identities. All the things that we've been talking about today, the connect the dots and walls and threats and identities across a very broad surface of attack. AI is going to allow us to do that much smarter and much more efficiently. And we announced our more -- our recently AI capabilities, which is the AI, call it a bot, if you will, where you're entering questions in natural language processing and you're getting very simple answers as a result. So certainly, there's short-term use cases and long term, but AI certainly is here to stay. I think companies with large language models are sitting on vast amounts of data. We disclosed more recently that we have over 900 billion aspects of data, various threat identity configuration. Other data that we've collected over the years, 40,000-plus customers, over 3 million customers or 3 million users of our free version of Nessus. So between the sizable community of Nessus users, our paying customer base, all of the data that we've collected over the year, we think AI will be a force multiplier in helping us better secure customers' environment.