Tenable Holdings, Inc. (TENB) Earnings Call Transcript & Summary

All right. We will get going here. Thank you all for being here. I'm Roger Boyd, I cover cybersecurity here at UBS. Very happy to have the team from Tenable here. Matt Brown is the new CFO of the company; and Erin Karney is VP of Investor Relations. So thank you both for being here.

Thanks for having us. Appreciate it.

But I wanted to start high level and go back to a comment that Steve made on the earnings call last month. But he called out that the AI threat landscape is exposing the limits of a traditional kind of reactive approach to security. Can you just explain what that view means, this idea of more fireproofing versus firefighting? And how does that kind of align with what you've built in the exposure management category?

Sure. I'll start and Erin can fill in on some of the details as well. So what we really talk about with respect to AI is, it represents a significant amount of change, right? Everybody talking about AI. And what every Board -- you're going to hear in every Board and every management team are 3 key questions. One, how are you incorporating AI in your products to make them more competitive? -- fine. How are you leveraging AI internally to be more productive, and efficient. Great. makes sense. The third is how are you safeguarding your use of AI, right? And that last one is super important and represents brand-new opportunities for us. And so one of the ways that we are doing that is by providing visibility to our customers for what AI is being used in their environments. There are many companies that know that AI is being used in their environments, but they can't tell who's using it and which specific models are being used. And so our product AI Aware, which is incorporated into our VM products, gives companies the ability to see what models are being used and and then it informs them on how they can protect themselves. It can expand beyond that, though, right? So with our most recent acquisition with Apex, they brought a tremendous amount of AI capabilities that we are now incorporating into Tenable One, which includes really our -- more broadly speaking, AI exposure, which now not only allows companies to see the AI that's being used in their environment, but also how it's being used, the prompts that are being input, how do you safeguard the models from attempts, jailbreak attempts and other types of prompts that can try to get the AI models to do things that are not intended. And then how do you make sure that what being fed into those models as in compliance with your policy. So all of that represents brand-new opportunities now that we think Tenable is extremely positioned to go capitalize on.

Yes. I guess maybe to follow up there, how do you feel this kind of evolves as a demand environment? And I look at 3Q results, fairly strong. Do you feel like we're starting to see this? Do you need kind of additional lever to come from like regulatory angle, like the pessimistic view would be, we need to see something happen in the threat environment that kind of forces enterprise's hands? Like how do you see this kind of evolving from a budget perspective?

Yes. I think the biggest piece is companies are realizing that only detecting and responding to threats is not sufficient. And by the time there's an attack that takes place, it's -- in many cases, it's too late. It's very costly in the form of downtime and disruption and, in some cases, real financial impact. And as a result, then companies are realizing that in order to have the best practice on their security posture, they really have to take a proactive approach. And that's what we -- when we talk about fireproofing rather than firefighting, the most mature companies that have developed their exposure management programs are looking at vulnerabilities across the entire landscape and assessing where those risks are before they happen. There's various estimates out there from some third-party analysts that the amount of dollars that are being spent on detect and response, going forward, some of that is going to shift into more preemptive security measures, which is really what exposure management is all about.

Cool. Yes, I want to dive a little bit into 3Q and again, a fairly strong quarter. The net adds continue to stand out. You added almost 450 new enterprise customers. I wanted to dig a little bit deeper into what drove -- what was driving some of the momentum on a customer adds perspective? And how are you thinking about kind of sustainability of that going forward?

Yes, we were really happy with Q3, had nice new logo growth, as you mentioned. Most of that is being driven by Tenable One. So we saw 40% of that new business growth was within Tenable One, which is our exposure management platform. And that's really important for us because Tenable One represents an important opportunity for our customers and also an important opportunity for us going forward, where we're seeing more customers that are transitioning from point solutions, whether it's in VM or some of our other point exposure management solutions into the platform where they can see now holistically across their environment a much broader view into what the exposures are. Tenable One allows customers to see their vulnerabilities, but then really importantly, how do they assess those vulnerabilities from a risk ranking perspective. So you can imagine a CISO that is overwhelmed with the number of vulnerabilities that are in their environment, they have to find some way to prioritize them. And what Tenable One allows our customers to do is cast a very wide net, scan many assets across on-prem, cloud, OT/IT, AI and on, and then risk rank them, giving them business context who has access, what type of access, what data is included? What are some predicted attack path analyses? How does that all factor in order to then prioritize risks and vulnerabilities that need to be addressed now. That's what's really, really value add for our customers. And so -- and that's what they get in Tenable One. So A lot of that optimism that we're seeing, the new customer growth came from Tenable One but that's what gives us a lot of optimism as we look out to the future as well.

Yes. When you talk about the strength of Tenable One, how do you think about new logos from a greenfield, brownfield perspective? And I know all of your competitors have been moving towards this vision of exposure management, for you, it's Tenable One. Competitively, have you seen any big shifts in the landscape? And what have you seen specifically on kind of the brownfield side of new logos?

Yes. I mean it's one of the most exciting areas, actually, and I want Erin to weigh in on this too. I don't want her to getting lonely over there. So I'll kick it to you in 1 second. The greenfield -- some of the greenfield opportunities is what we touched on a minute ago with AI. I mean that's clearly greenfield. We think that's really interesting, has an opportunity then to grow so -- with some of the cloud opportunities that we have. But when we think about brownfield, there's an enormous opportunity that we have to transition our existing VM customers over to Tenable One. So yes, Erin, you can touch on that a little bit as well.

Yes. Yes, definitely. So we're seeing really strong win rates pretty consistently across the board against all the competitors. What I think when you drill in, what's really interesting is the -- what we're -- the progress we're seeing within Tenable One. So that broadens the competitors because you're dealing with cloud, OT, these other areas, but it gives us an opportunity to displace them and then be able to expand within that into those greenfield areas. So even when you're looking at the brownfield, there's a huge amount of opportunity to display some of those competitors. And third-party data helps with that, which is a recent company we acquired, that allows us to ingest that data, maybe displaced down the road. So really all starts with Tenable One and then within that, you have brownfield and greenfield.

Makes sense. And then the other side of the growth formula, net retention, it's been somewhat stable in kind of the single digits, 105%, 106%, 107% range. I recognize it's a trailing 12-month metric. But how do you think about kind of the trajectory there? And given the strength you've seen in Tenable One, 40% of new business last quarter, what's the pathway to getting that to reaccelerate here?

Yes. Eventually, it stabilizes and even inflect higher. But we know in the near term, it's going to tick down. So for example, it was at 106% this last quarter. as you mentioned, it's a trailing 12-month metric. That was as expected. And next quarter, it's very likely to be 105%, right? It's going to go down another percentage point. Well, why is that? Well, you're looking back 12 months. And when you look at Q4 of '24, that growth rate was significantly higher than what we're projecting in Q4 of '25 to be. And so that quarter rolls off, the new quarter rolls on, it's just going to end up being math. So that's not going to surprise us either. But it does stabilize from there and it starts with -- it really kind of starts and ends with Tenable One and Tenable One adoption. I mean that really is where our focus is internally on the product development side as well as go to market, we think that, that has an opportunity to really inflect higher. And importantly, we're pretty early there, and there's quite a bit of runway given the percentage of our customers and our overall book of business that is currently in Tenable One, we've got a lot of room to ramp.

That's a good segue. I think that number is close to 17% today in the high teens. Is there kind of a target you think about internally about how far Tenable One can go in the installed base?

I think it can go really far. We haven't talked about a specific target. Are we ever going to get to 100%, I doubt it, but it can certainly grow from there. 17% is the number of our enterprise customers. So we think of something like 3,000 out of 18,000 is that math. But some of those customers are our larger customers. So it skews slightly higher when you think about total amount of bookings or revenue today but we expect that number to grow. And it's going to grow in a couple of different ways. Number one, we're going to get our traditional either core VM or other point exposure management customers into the platform. That's the first way. And then the other is that once those customers are in the platform, they're actually growing faster than customers that are outside of the platform. There's higher retention rates and higher upsell and cross-sell opportunities. So both of those ways are going to grow that number higher, and we expect as that becomes a higher and larger proportion of our business, while that's growing higher, that's going to help the overall growth rate as well.

Yes. Okay. The other kind of impact, I think we've seen is customers making bigger commitments to Tenable. And I'm sure part of that is around Tenable One. I think last quarter, you mentioned the discrepancy between CCB and RPO and certainly, I think, seeing longer deals show up. Can you elaborate on that dynamic? And I see more of these big commitments. What does that mean for some of those metrics?

Yes. The first thing to point out is we really like that trend. So we want our customers to be engaging with us on larger, more strategic longer-term deals, but we're no longer requiring that they pay upfront for those transactions, right? So what that means is that we end up seeing our contract duration moving up significantly because they committed, right? But because we're no longer requiring these companies to pay upfront, we're actually allowing for annual installment billings, our billings duration has gone down. And what's interesting then is you end up with this distortion effect on CRPO, which in Q3 was 13% year-over-year. That was distorted somewhat positively. Conversely, but for the same reasons, CCB was actually impacted negatively because billings duration went down. So then the question becomes, okay, well, what's the right metric. Revenue grew at 11%. I think revenue is a great metric. And so it could just be that CCB and CRPO are both distorted and they're going to be distorted for some period of time and that revenue is the best metric.

Okay. Makes sense. I wanted to talk a little bit about cloud security. And I think there's an investor perception out there that, that's been a difficult competitive environment. We've obviously seen some transactions in that space. To what degree have you seen that change the environment for those deals? I know you called it out as an area of strength with Tenable One. And what sort of momentum have you seen with specific deals around cloud security?

I'm going to let Erin answer because I've got something going on the road and then you can come back to me.

Happy to jump on that one. So I would say the cloud space has been somewhat competitive, but I don't think anybody would be surprised that there's one competitor in particular that's been pretty strong. We see 2 things. One, we have a really strong cloud product, and we can stack it up against most, and we feel really positive about that. But we weren't necessarily getting all of the opportunities. So either there wasn't a broad RFP out there or they didn't realize Tenable had cloud. So we've really made a big effort to make sure customers know what we have to offer, that we have a strong product. And M&A, recent M&A has definitely helped customers to want to cast a wider net. So I would say it's really all of those things that are allowing us to have these opportunities where we're displacing competitors. And it isn't necessarily just one of those things, but definitely all of them is helping to contribute. And we're really happy with how cloud is growing. And then within Tenable One, it's even more compelling for our customers.

Yes, it's a strong spot for us. We highlighted a competitive win in the last earnings call that we're really proud of. The good thing about the cloud space is it's a pretty big space. And we think there's room for a couple of strong competitors there and we're one of them. So we're going to win our fair share, and it continues to be a good source of strength for us.

Yes. Similar question around AI security and Apex. And I'd be curious to get your perspective. I mean, in some ways, it feels like the first place enterprises are going to turn to trying to enforce AI security is going to be around risk assessment and posture management and just getting visibility into what they have. That should set you guys up in a pretty good spot. But how do you think about that demand showing up over time? And how do you think about your right to win? We've seen a lot of companies in the space acquire into like the AI visibility, AI posture management space. What gives Tenable the right to win with kind of this broader Tenable One posture?

Yes. I mean it's a huge opportunity for us. One of the things that we did differently with Apex and Vulcan actually for that matter, is we brought both of those technologies into the platform right away rather than trying to go to market with a separate product or module. That was really important because it becomes a really unique differentiator of Tenable One and the platform. So now customers can go in -- within Tenable One, have really effective AI exposure and view that in the context of their broader security environment, which we think is huge. So that's a really big deal for us. It continues to be a bright spot, and I think it's going to be a nice source of growth for us.

I want to talk about a couple of verticals here, but the first being U.S. federal. And I think 3Q, you had performed pretty well against expectations that had come down a little bit earlier in the year around some of the uncertainty there. What's been kind of the mood within those customers? And when you think about timing around the Fed shutdown we saw in early 4Q, to what degree did that kind of influence 3Q? And how are you thinking about kind of that opportunity going forward?

Yes. So Fed for us, to just put it in context, our public sector business is roughly 15% and Fed is half that, so 7-or-so percent. And for us, we took our pain a little bit in the beginning of the year when we took down the numbers because we're staring ahead at the opportunities and seeing some of the disruption with the new administration and DOGE and ultimately, the shutdown occurs. But by that time, we had already reset expectations, and I think that was really important. And since then, Fed performed in line or even slightly better with those renewed expectations. And so actually, as it -- we get to the back half of the year here, we're not expecting to have a significant negative impact from Fed, but Erin may have more on that.

I mean I think you called it really well. The only thing I would add, and there's not necessarily a time line around this, but the Fed has always been focused on cyber, and they've been a great customer for us and continue to be. And where we see opportunity is we are now FedRAMPed with Tenable One and with cloud security. So while it's pretty noisy right now, and we're navigating through that pretty successfully, we do see areas of opportunity as we look forward and some of the noise dissipates.

Cool. Okay. And then the other vertical is -- it sounds like it doesn't get as much attention as cloud or AI, but the OT space was called out last quarter as an area of an acceleration. And I think there's something to be said about the convergence of IT and OT and CISOs being more involved in those conversations. I know Steve called out the data center market around AI as a potential interesting opportunity. How do you feel about that vertical? And what -- can you frame that opportunity going forward? And what's the differentiation there between some of the specialists in the space?

Yes. I'm glad you asked about that one. That's been a bright spot for us and I think continues to represent a really nice opportunity as these data centers are being built. It's super important now that there is security around all of the OT assets that are associated. So it's a differentiator for us because it's yet another vulnerability that companies need to get their arms around. We're providing the ability for companies to get visibility into those vulnerabilities in a really effective way within Tenable One. And so we're seeing some really, really nice traction there.

I want to touch on margins a little bit. 3Q is, I think, a pretty good EPS beat, 23% operating margin. Free cash flow is continuing to look nice despite what you called out around on the billing side. Just maybe talk about kind of your visibility there. And then just broadly, how you're thinking about kind of the trade-off of continued margin expansion versus trying to invest in a lot of these pretty fast growth areas across cloud and AI and OT.

Yes. Our margin expansion is maybe the least appreciated part of our story actually. We had -- in Q3 '25, our op margin was up 350 basis points year-on-year. And that is with an 18% growth in R&D. So pretty incredible growth investment -- reinvestment into the product, but getting much more efficient on sales and marketing and a little bit so in G&A as well. That was just for the quarter. But even when you look year-to-date through Q3, still up more than 200 basis points. So pretty confident in our ability to continue to expand margins. The other thing I would add is that's on top of absorbing a couple of acquisitions that we saw that are going to be impacting OpEx, right? So overall, I feel really good about our ability to continue to expand margins, and that's something that we're focused on.

Maybe to double-click on the sales and marketing efficiency aspect of that. Are there -- is there more room there to eke out efficiency? Is it like you look out into next year and like there's a desire to kind of grow headcount and improve capacity? Like how do you think about that?

Yes. So when you sort of double-click on where are we going to get more margin, the place we know we're going to continue to invest is in product development with -- and in particular, in the platform. So we're doing a lot of that now. What we're able to do, though, is because we switched from what had historically been a GM sort of a model with respect to acquisitions that we had in product categories. We've moved now to flatten that and have folks that are focused on the platform, still within their expertise and the domains that are within the platform, but within the platform, importantly, which has allowed us to reduce and get more efficient while still pouring investment into development. So that's really important. All that really means is a lot of the investment in R&D, we're going to be able to self-fund. And so R&D will continue to grow. But underneath the surface, it's growing even more than you would imagine. So that's important. Every other line, we're going to be able to get some efficiency from. So gross margin is going to tick up a little bit. Sales and marketing, we can continue to get more efficient on. G&A, we can get more efficient on. When we think about sales and marketing, we're a very channel-focused company, and we will continue to be. We can leverage the channel more to become even more efficient. And so what that means is you're basically going to be able to get more out of your [ quota-carrying ] sales reps. And the efficiency essentially goes up and the effectiveness of each sales rep is going to go up. And the sales and marketing as a percentage of revenue is going to continue to tick down a little bit.

Yes. Makes sense. And then maybe you mentioned R&D and product. Maybe talk about kind of the principles behind that. I mean you have all these different growth areas. How do you think about kind of dividing your R&D resources? And where does kind of continued M&A fit into that category? You've been fairly acquisitive over the past couple of years, tucking pieces into the platform. Are you at a point now where you feel like there's enough breadth of Tenable One? Or are there potential future areas where you can continue to expand?

Yes. I mean -- so we have been pretty acquisitive in the past. And I think we continue to be open-minded, right? So if we saw a company that had a particular piece of technology that we thought filled the gap and it made sense, then sure, we would do that. Having said that, I think we have what we need for the most part here. And at this point, we're concentrating on executing. So let's take what we've got, make sure that we can make it super effective. We've got a relatively new Chief Product Officer, who's come on board, is doing a lot of really great things. We're going to lean into that. And again, sure, something came along that we thought we needed to have, great, we have it. But I think the chances for some type of a large transformational M&A is probably fairly low.

Yes. maybe 2 last ones. Just any broad level thoughts about the demand environment? I think there's -- on one side of the page, a pretty healthy view that concerns around the AI threat landscape are going to continue to fund cybersecurity budgets. But you also hear about budget tightness and procurement still being difficult. How do you think about kind of customer budget, security budgets into 2026 at a high level?

Yes. I'll answer and then I want Erin to answer, too. But we're seeing really positive signs from pipeline. That's the way that I think about it is, what's our level of opportunity and pipeline look like, and we're still -- we're seeing really, really healthy pipeline. Cybersecurity continues to be a focus for companies and rightfully so. So overall, feeling pretty good.

Yes. I think it's key to be able to take advantage of the opportunities that are in front of you or those that you know are pain points for your customers, which is why we've really innovated on the AI side, the cloud side, Tenable One, exposure management as a whole to be able to take our own share of that exposure management market as it starts to accelerate. And I think beyond that, one of the things that we had seen over the past couple of years is new business was harder to transact. And one of the things that we're really focused on, as we talked about a couple of times, is getting our existing base on to Tenable One. So not only landing new there, but also getting our current customers on there and being able to expand with them. it can be pretty sticky once you get a customer there. So we also see a really good expansion opportunity moving forward with the same product.

Yes. Cool. Last question for you, Matt, because you're relatively new to the story, what was one thing that attracted you to Tenable? And now being in the seat for a little bit, what's one thing that surprised you?

Yes. What attracted me initially is still what attracts me today, which is good. I get -- I'm now I'm mindful of 30 seconds. I get super excited about exposure management as a space. I believe in it. I think it's the best way to do cybersecurity. And I think companies are moving in that direction. Once you're there, there's no doubt in my mind that Tenable is best positioned to capitalize on that market. And it's not just us saying that, it's IDC and Forrester and Gartner, all of them have us upper right. That, to me, gives me a ton of confidence and excitement about the future. So I love that. That's kind of piece number one. Piece number 2 is, we've got a super competitive management team that is focused on executing. And I love being part of that. So yes, very excited.

Cool. Well, thank you for joining for a great conversation. And thank you all for listening in.

Thank you.