Tenable Holdings, Inc. (TENB) Earnings Call Transcript & Summary

Well, I think it's still good morning. Good morning, everyone. Welcome to day 1 of the Barclays Tech Conference. Honored to have with us the team from Tenable. We've got Steve Vintz, CFO and Interim Co-CEO. We've also got Erin Karney, Head of Investor Relations in the audience. We've got about 30 minutes together. Let's spend maybe the first 20 or 25 minutes to run through some fireside chat here with Steve, which I know is going to be really fun, a lot to talk about. And then we'd love to make this interactive. So anyone that's got any questions, just pop up your hand. We've got a mic runner in the room. We would love to, again, make it interactive. So with maybe all of that, Steve, thanks so much for being with us here today.

Thanks for having us. We're happy to be here.

Yes, absolutely, it wouldn't be conference without Tenable. So Steve, maybe just to help us level set, we're all on the same page, could you just maybe spend a couple of minutes recapping some of the points from last quarter's call that -- or last quarter's result that you were most proud of?

Sure. We're pleased with the results of the third quarter. The print was very clean. We did $248 million in CCV and growth there was like 11%. Revenue grew 13% at $228 million roughly. Operating margins were 10%, we continue -- sorry, 20%. We continue to drive real leverage in the business. Look over the last couple of years, our operating margins have increased from 10% 2 years ago to 15% last year, and now they're circa 20% now, and that's what the guide for the full year implies. Similarly, cash flow was really strong as well. We delivered roughly $60 million plus of unlevered cash flow. And the demand environment has been good, too. If you look at the number of new customers we added, it's 400 new enterprise platform customers, 60 net new 6-figure customers. So we're very pleased with what we're seeing in the market. Some of the areas of outperformance for us have been the exposure platform, which we can talk more about it, the unified platform that allows us to sell many of these different capabilities that we brought to market over the years and deliver greater insights to customers with regard to risk and also cloud in particular. Cloud is a capability that we had in market a couple of years ago. We acquired the more expansive CNAPP offering from Ermetic about a year ago. We've been in market with the broader offering since the beginning of the year, seeing tremendous traction there, much higher selling prices. It's growing 100% year-over-year, and we expect it to continue for the foreseeable future.

Yes. There's so much to dig into there. That was a really great start. actually, Steve. So -- but maybe before we get into some of the fundamentals, I think we all saw the 8-K about Amit. Let me just say that we all certainly look forward to him returning to the stage soon and healthier than ever, right? But maybe in the meantime, can we just talk a little bit about the new interim co-CEO model and how things are sort of being split between you and Mark in the meantime?

Sure. As some may or you may not know, Amit disclosed that he was diagnosed with cancer earlier in the year. And subsequently, he was on a modified work schedule, receiving treatment, but also maintaining his responsibilities at work. He returned to work and then more recently disclosed that it requires additional treatment. And so he has decided to -- and with the Board's support, obviously, in support of the management team to take a leave of absence, which is obviously the right thing for me. And we're delighted that he decided to prioritize his health. He's in good spirits. The love and support has been overwhelming, and everyone is passing on their good wishes. He has every intention to returning to work. That is our expectation. That's the Board's expectation. His prognosis is good. And the co-CEO model is -- so the Board has appointed myself as Co-CEO and Mark Thurmond, who is our Chief Operating Officer. I've been with the company 10-plus years. Mark has been here with -- for nearly 5 years. So we have long tenure, really a good and deep understanding of the business, understanding the market. And frankly, the formality really reflects how we've been managing the company for the better part of the year with -- given Amit's treatment. So we also have a very talented executive team. So everyone is kind of stepping up. We're focused on executing Amit, while he's stepping away from his day-to-day responsibilities, will still be involved with product direction and strategy and certainly never misses an opportunity to call me and harass me for a wide range of things. And anyone who knows Amit, that -- knows that that's his true self. So he's in good spirits and doing well and appreciate the good wishes.

Absolutely. We look forward to having him on stage, asking some of those tough questions of all of us next year. So maybe zooming out, Steve, I mean, to maybe your point that you alluded to earlier, I mean, for years, we've talked about Tenable sort of viewing the traditional definition of vulnerability management or VM being somewhat narrow, right? And this idea really assessing exposure is really bigger than kind of the VM market that IDC or Gartner size, right? You've been saying that for years, right? So can we maybe go one level deeper into that? And how -- I mean, you talked about exposure before. I mean, how Tenable defines the exposure management market?

Sure. Well, when we went public in 2018, we had established ourselves as the leader in vulnerability management. We said, hey, there's a big opportunity there. We're #1 in device coverage, #1 in zero-day research, largest vendor and 400-plus new customers a quarter, VM as well as some of these other products. But at the time, we described a much bigger mandate, which is exposure management. And so exposure management is the outgrowth of VM, given the proliferation of devices and assets. We've seen it create complexities in compute and the attack surface has expanded consequently dramatically over the years. And so where we're really -- our roots are really in vulnerability management, the ability to discover and assess vulnerabilities and exploits on network-based devices and then in the -- more recently over the past couple of years, we have taken that core value prop and applied that to different areas of the attack surface. Web app security brought a new product to market. OT security, things like cloud, which we'll talk about more and even ASM, external Internet-facing assets and also assessing identities. So we've gone broader across the attack surface in terms of the assets that we can discover and assess for vulnerability and exploits. And then really connecting all of those findings, all of those insights in a way where we're helping customers understand and reduce the risk and understand the risk in between those assets and domains. Often, there's a path of exploit for a bad actor, which maybe they compromise credentials on the network and then make lateral movements into other areas to access sensitive and valuable information. So helping customers understand the likely path of exploit, integrating vulnerabilities, threats, identities in a way that allows them to operationalize preventative security, which is a thing. And exposure management, clearly, while it's a category we've created, we're seeing Gartner now more recently come out and say, hey, we're going to develop an MQ for exposure management. We're seeing IDC and Forrester and some of these others talk about the importance of this. A lot of our partners are hiring exposure management engineers. So certainly, it's something that's here to stay, and we're well positioned to continue to take and win share in this market.

Yes. The market seems like it's expanding beyond that sort of traditional definition to your point. Maybe that's a good segue into Tenable One, your marquee exposure management platform. Maybe the first question is, what assets are getting analyzed here beyond sort of the traditional VM assets, if that makes sense? And then secondly, how much more value is Tenable able to command for what I would call a more holistic solution?

Sure. On our last call, we kind of unpacked our growth rate a little bit. We talked -- presented a new growth algo for the business. And what we said is we have roughly 20% of our business, which is circa a couple of hundred million dollars, growing 30%, seeing outsized growth. And within that, cloud is growing 100%. And then consequently, obviously, the inference would be, we have 80% of our business, which is VM, where we're the clear leader where it's an important market that's growing kind of high single digits. And so for us, over the course of time, we've brought new products to market, and we were selling those individually, but now Exposure Solutions represents our ability to secure and assess new asset types. And for us, we're selling it as part of a broader platform where the selling prices are notably higher when a customer is using stand-alone VM and then moves to exposure management, the selling price can be anywhere from 50% to 100% higher. ASPs are very notable. We have roughly 2,000 customers that are spending in excess of $100,000. And already, since we've been in market with this over the last 18 months, we have 500 customers that are spending 6 figures with us in exposure management. It also represents our ability to sell the product stand-alone. So we can sell cloud security or web app security or OT security stand-alone to address a very specific use case with the customer, and that can serve as tip of the spear for our sales organization to develop a relationship with the customer. But also increasingly, we sell it as part of a broader offering. So we're having success. It's galvanized the sales team. And obviously, we expect continued momentum and growth in our exposure solutions.

Yes. So maybe thinking about Tenable One as sort of that anchor exposure, like the SOC, I didn't realize it was the Tenable SOC, but if we think about sort of Tenable One as that anchor exposure tool, I think we've kind of -- we've sometimes talked about the parallels of Tenable One to Tenable.io, right, which was the last sort of generation kind of the VM tool for Tenable. Maybe the question is, how do you sort of compare and contrast the adoption curve of Tenable One to Tenable.io, whether that's from a customer perspective, a dollar perspective, however you sort of think about that comparison?

Yes. So if you look at new business for us, we said -- if you look at -- in terms of the products that we sell, over 55%, almost 60% of what we sell is some of these newer products. It's the integrated platform, which includes a lot of these capabilities or stand-alone cloud or WaaS or some of these individual products that are outside of the traditional VM definition. And then consequently, we have a portion of our business that's still where we continue to sell VM. Like the VM market is not going away anytime soon. But what we do recognize is that there's probably a little vendor fatigue in security. I think increasingly, a lot of our customers are turning to companies that have real scale, have a big customer base and have a real leadership position in a core market. So there's clear use cases for us to be able to sell some of these newer offerings. And so if someone wants stand-alone VM, we're able to sell that. And we're the market leader. We have high win rates, and we think it's our opportunity to lose. But increasingly, customers want more utility from their existing vendor. And so what we've been able to do is demonstrate the ability to win outright in cloud, in some of these strategically important markets or even things like web app, which are really an extension of the core -- I mean, web app or ASM, external internet-facing assets, which are an extension of the core VM market. So we're a multiproduct company, and we can address a wide range of use cases. Increasingly, customers want a platform. I know platform gets a lot of use -- overuse perhaps today. But our mandate has always been clear, which is helping customers understand risk. We have the ability -- we ingest a lot of data from our customers. We have a massive customer base, lots of findings, and we're able to do that in a way that allows us to deliver greater insights to customers and help them drive recommended remediation, automation of key workflows. So the platform sell has delivered great traction. It's 10% of our total enterprise base. The ASPs anywhere from 50% to 100% higher. So our expectation is 10% of our enterprise customers using the platform. We think over the course of time, short order, that can double. And long term, midterm, should I say, that can be over 50% of all of our customers using the exposure platform.

That's super interesting. And I mean, within that, I want to -- I definitely want to touch on one area, which is cloud security because I felt like that was just -- that was an area that really stood out within exposure, that really stood out last quarter, in my view. And I think you repeated it here, but I think we said that it grew -- doubled year-over-year last quarter. And what's interesting is that we started talking about cloud security as Ermetic at the time of the acquisition. And now we're talking about it as a full CNAPP offering, if that nuance makes sense. Could we just maybe talk about how that cloud security portfolio has evolved?

Sure. Look, we've been in market selling a cloud solution for a couple of years now. Previously, we were selling infrastructure as code, and we were also inspecting container registries. And we've had some success selling that. What we've seen here, though, is clearly a lot of market pull for our customers. Cloud -- assessing the cloud is often not sole sourced for our customers. They don't use one vendor. They can use several vendors. By the way, the opportunity in cloud is enormous. It's a, what, $15 billion-plus TAM. The largest player is a private security -- it's a private company that's about $500 million. So a big TAM, low penetration. And it won't be a zero-sum game. There's a lot of companies that stand to win in cloud, of which we'll be one. So we recognize there's a need to offer broader capability and accelerate the road map. So the acquisition of Ermetic was very much customer-driven, where Ermetic started was really at the upper end of the market, specifically something called CIEM, cloud infrastructure and entitlement management and kind of helping customers in these public cloud environments reveal these toxic combinations of publicly facing vulnerable workloads and those who have privileged access, which is not good in providing a great visualization of that and exposure for that. And then over the course of time, they began developing a broader capability, something called CNAPP, which includes a lot of components, everything from CSPM to run time to -- even we have things like infrastructure as code. So for us, we've been in market selling the broader offering, which includes kind of the core capabilities of Ermetic as well as that of our own. We've been having really good success here. Sales cycles have been shorter. It's our -- ASPs in cloud are the largest of any product in the company. The ASPs in cloud now are double what they were last year. At the upper end of the market, we're winning customers like a Fortune 100 financial services company. So at the upper end of the market, you can have very specific requirements, and we can win like in areas like identity if they have a Wiz who's an incumbent. But we're also seeing a ton of green shoots in the mid-market that, quite frankly, that wants quicker time to value, wants good capability there, and there's been -- we're having a lot of momentum there. So we believe we can continue to double sales in cloud for the next 3 to 5 years. We're not setting expectations with Wall Street, but something that we think we have the ability to do, and we're investing to try to make that happen. So cloud will be an area of focus for us and continue to be.

Got it. Got it. I want to talk about expectations for Wall Street in a second, right? But the other thing that stood out from last quarter was just I think it was a relatively healthy U.S. federal corridor, right? And obviously, a very key end market for Tenable, always a very strategic vendor for the U.S. government. Maybe the question is because I've gotten this around several of my coverage companies, understanding that it's early, how do you feel about this vertical kind of going into a new administration, particularly with some of the initiatives around kind of managing government spending?

Sure. So we have a large presence in the public sector and specifically U.S. federal, 15% of our total sales roughly is from public sector, not just domestically, but also abroad, and we probably serve every 3-letter federal agency you can imagine, both on the DoD and the civilian side. I think it's fair to say that there's clear bipartisan support for cyber. And I don't think that's going to change anytime soon. We're monitoring the situation very closely. And short term, we don't expect to see dramatic changes. But I know Trump remains hawkish on security, we believe. If you look at what he's done in his first term, he established CISA, a critical infrastructure security agency. He proposed the largest budget increase for cyber that we've known ever, which is $17 million budget. I think roughly about $2 billion, about 10% of that was CISA, which we'll come back to in just a minute. He unified a lot of these different cyber agencies into a single federal agency who now rolls up under DHS. He signed numerous executive orders. There is some talk that funding perhaps will be cut in some agencies, some security agencies, like specifically CISA, but it's widely believed and we continue to believe that funding will go up in others, more broadly defense. So overall, we think it's a huge opportunity for us. We're well positioned. We have a clear leadership. And it's going to be -- and we'll sell not only VM, but we are confident very soon, we will be selling cloud -- doing cloud deals in public sector. So a lot of confidence that -- in our ability to execute, but also sell some of these newer offerings back into our public sector base.

Got it. Got it. Look forward to hearing about those at some point in the future. Maybe in the time that we've got left, Steve, I'd love to shift to some financial questions. It was super helpful last call. I mean we kind of discussed calculated current billings or CCB for next year. Maybe thinking about growth being closer to the exit rate here that we'll see in Q4, let's call it, high single-digit growth. And you guys correct me there if I'm wrong. And you hinted at this or you talked about this earlier, you've got some parts of the business that are growing a lot faster than others. But can we just maybe flesh out some of the dynamics even qualitatively, as you think about the drivers of that, again, I'll call it, high single-digit CCB growth next year?

Sure. Well, let's start with last quarter, probably a good starting point. We grew CCB 11%. And we said Exposure Solutions grew 30%, and our VM business consequently is kind of high single digits. We said as we look out, we guide to not on the quarter, but for CCB for the full year. So there's a clear implied guide for CCB in the fourth quarter. And we said expect growth in the 7% to 9% range. And within that, we expect 30% plus growth in Exposure solutions. So that would suggest that growth in VM would moderate down to single digits. We said also, that's probably a good starting point for 2025. Look, we're -- as we talked about for VM, we believe there is certainly some level of cyclicality here. And the reason why we say that is because, yes, growth has moderated in VM. In 2022, VM software more broadly, but also vulnerability management, perhaps is a little over consumed, different spending environment, interest rates, but also we had Log4j, the most pervasive Internet vulnerability. And certainly, we saw tailwinds of growth there. So while growth has moderated, what we're seeing today and talking to our customers is that we have -- we believe that growth in VM could inflect higher. And the reason why we say that is for a couple of reasons. Number one, monitoring fiscal policy, obviously, but we don't control that. But PCI compliance requirements, both in the enterprise and commercial market, but also U.S. federal. And with regard to the former, years ago, if you collected personal identifiable information, you were required to scan, do an assessment of a server. But now with these new compliance requirements, you require more frequent scans, but also broader scans with the infrastructure that touches and connects to that server. So compliance certainly, we believe would be a good use case, clear use case. The second thing would be repatriation of workloads. Our largest, most sophisticated customers are telling us that they expect to repatriate some workloads from public cloud to private cloud. I'm not saying that cloud won't continue to grow, but what I am saying is that customers are pulling some of this in and expect to do so, greater control, visibility and cost. And we're the only company in our space that's able to assess both on-prem as well as cloud. We're in a hybrid world. So look, we -- this market is foundational to exposure management. We believe there's opportunities to continue to drive growth higher. And then obviously, given the traction that we have in the exposure platform and cloud in those new areas, certainly has the potential to create tailwinds. So we think we're setting the expectations right. Each market -- each quarter is different in its own right, and we look forward to updating you in February.

Got it. Got it. Super helpful. Obviously, we talked about sort of the top line for next year. I definitely want to touch on profitability because I think Tenable has done an excellent job expanding operating margins nearly 10 points from fiscal '22 to I think what's implied in the guide here for '24. Maybe the question, Steve, is, how should we think about operating margin expansion from here, whether that's sort of a rough -- kind of framework, like a framework versus revenue growth? Or any qualitative thoughts in terms of how that looks going forward, given the success that you've already had over the last couple of years?

Yes. Well, first, our philosophy is that we want to grow responsibly. We're a balanced growth company. It's something that we haven't talked about just more recently. We've continually pounded the drum on that. So balancing growth with profitability is really important, leaning in and investing in areas of our business to be able to sustain growth and even drive growth higher and then also walking up the margins. If you look at kind of how we've managed the business over the years, our margins, as you mentioned, we've driven tremendous leverage. Operating margins have gone from 10% 2 years ago to 15% to now 20%. Unlevered free cash flow margins have followed similar trajectory. We gave a soft guide, maybe a hard guide for unlevered free cash flow for next year. And we said we expect to deliver $280 million to $290 million, and that would suggest kind of a high 20% unlevered free cash flow margins. On our last call or maybe the quarter before, we gave a new long-term target for the business. We increased it from 30% up to 35% plus, emphasis on the plus. We believe we'll continue to balance growth for profitability, make investments and then walk those margins up in a very natural way. And if we look at how we're -- on the expense side, we have done a great job driving higher levels of productivity. We raised quotas 12% coming into the year. We're seeing higher achievement rates this year with the higher quota than we've seen any time over the last 2 prior years. So higher levels of productivity, which is really important to us. We place more products in the hands of our sellers. We're having success selling it. We talked about cloud and the platform. As a result, sales and marketing expense as a percent of revenue has come down from over the years or even last year, like 45% to call it, high 30% this year. And yet we're growing R&D 30%. So we're investing in innovation, broadening the product portfolio, becoming more efficient in go-to-market. The channel is a big enabler of that as well and certainly adding 400-plus new customers a quarter. So a lot of confidence we'll continue to balance, striking the right balance. If we grow faster than what we're anticipating, our expectation and that creates upside that we would drop some of that to the bottom line and then obviously reinvest a portion of that as well to be able to drive even higher growth. So we think it's the right approach to the business and confidence we can continue to strike the right balance.

Yes, absolutely. I think that word balance is important in terms of growth and profitability, and it certainly showed. Maybe the other metric, and you touched on this, as well is that unlevered free cash flow because it really feels like that's what's been the North Star for the team. We've also seen nice unlevered free cash flow margin expansion for the past few years, maybe longer term, right? Because again, you've got a guide for next year, so it's pretty straightforward. But longer term, how should we sort of think about the pace of unlevered free cash flow margins to EBIT margins? Like is there a connection there you would think about? Should both of them move largely intact? Or is there some difference between the 2 that we should keep in mind over time?

In the past, they've moved largely intact. And so our expectation is that we haven't given guidance for operating income. And there can always be some variability between the growth in free cash flow margins and the growth in the operating margins. But notwithstanding a couple of points here and there, directionally, it tends to move in unison with each other. And there's -- unless there's some significant changes, which we're not contemplating. So just making the point that operating -- just the growth in free cash flow margins doesn't mean that expansion here, it's the same exact expansion in the operating margins. You may or may not, but there can be a little variability, but they move directionally in unison with one another.

Got it. That's helpful. Maybe that's a good segue into the last line of question here just on capital allocation. I think the other news from the Q3 call is the Board here authorized an additional $200 million in share buyback. So maybe just at a higher level, how do you think about Tenable's capital allocation philosophy?

Look, we -- the good news is that we're generating real and meaningful cash flow as we talked about. Next, we're expecting $280 million to $290 million. Actually -- more recently, we updated our unlevered free cash flow target for this year, I think, on our Q2 call because we update it every other quarter. So we feel really good about our ability to drive leverage in the business, and we're delivering real cash flow. We announced a buyback, an increase in the authorization to the tune of $200 million. That's above and beyond the $100 million that we announced last year. So with $200 million, just kind of doing the math, $40 a share, you're taking 5 million shares out of the market. So that's more than offsets any share creep that you would see and you're actually reducing shares. So we think that's kind of the right approach for now, creating and delivering some of that capital to shareholders, investing in growth, trying to balance the 2, walking the margins up. And so we're trying to be mindful of not only short-term but long-term consequences. And we think that's the right thing to do for the business.

Got it. Got it. Maybe in the last minute that we've got, unless there are any questions here from the audience. The last question we'd like to ask some of our management teams here at the conference is we're in the thick of 2025 planning right now. Just qualitatively, how do you feel about just the health of the underlying market and the macro backdrop going into 2025?

I think we're cautiously optimistic. I think there's a lot of reasons, as we talked about earlier, to believe that growth potentially -- I'm not talking about Tenable, but just more broadly across the sector, security and even software will inflect higher. But there's probably 2 narratives. So one narrative is like, hey, things are going to be a lot better. We have an administration politics aside that perhaps more conducive to spend. This talk of tariffs is really a means to get nation states to the table and make concessions on our imports, reduce tariffs. And so we're in essence, exporting our inflation to other countries. The other narrative is, hey, things won't change. The reality is that it's probably somewhere in between. So we're cautiously optimistic. We do plan to add quota capacity next year, which is different than what we've done this year. The focus this year was making sure that we had high achievement rates with all of our sellers.

Got it. Got it. Great. Well then, Steve, Erin, thanks so much for the time. Really enjoyed it. Thank you.

Thank you.