Tenable Holdings, Inc. (TENB) Earnings Call Transcript & Summary

I'll start with the disclosures. For important disclosures, please see the Morgan Stanley research disclosure website at morganstanley/researchdisclosures. If you have any questions, please reach out to your Morgan Stanley sales representative. I'm Meta Marshall. I cover cybersecurity here at Morgan Stanley. We're delighted to have Tenable here with us today, Steve Vintz and Matt Brown, Co-CEO and CFO.

You guys have done a great job over the last year or so of pivoting the business towards Tenable One and exposure management over the last couple of years. Just how did you guys put yourself in position to capitalize on this transition?

I would say it really comes down to three things. Number one, it's recognizing early on that exposure management is a larger expansionary opportunity to vulnerability management. So if you look at our roots over the years, we're really strong, historically have been in discovering and assessing network-based devices. But then over the years, we've applied that core use case into other domains and other areas and brought to market an OT capability. We also look at like cloud, both on the preproduction side, looking at misconfigurations, identity security as well as web app scanning. So over the years, we've expanded that core use case to other asset types. And now today, we also assess one of the largest threat vectors in security, which is the AI attack surface, which we can talk more about. So over the years, kind of going broader across the attack surface, a larger, more expansionary opportunity. The second thing I would say is understanding that to be a successful EM platform, yes, you have to do VM and you have to do much more, but you also have to have an open platform and allow yourself to ingest data from other security companies, which we do. We have over 300 connectors. And the real goal here is to be able to correlate risk to identify leaky S3 buckets that have misconfigurations with lots of entitlements and access and then go to a customer and say, "Hey, this is what you need to be able to prioritize. This is what you need to be able to focus on." So contextualization is really important. And AI will actually allow us to go even faster there. And I think the third thing would be our North Star here is not just helping customers understand risk, but helping them reduce it. And the orchestrated remediation, tying vulnerabilities and threats and entitlements and access to risk reduction on the back end is really critical. And that means we can do bulk configuration changes in multi-cloud environments. That means that we can spin up a fleet of agents that interact with a lot of the players on the tooling side to be able to reduce risk, whether it's applying virtual patches or taking other action. But helping customers reduce risk, remediating risk and driving higher levels of mobilization is one of our -- is a big endgame for exposure management.

Got it. So I mean that's a much broader value proposition to customers. How does that change either the sales cycle or like the proof points necessary to close?

Well, if you look over the years, we've become -- we've demonstrated ability to drive ASPs higher. So if you look at sales of our Tenable One platform, which is our flagship product, so we have a stand-alone VM offering that does traditional VM when it comes to looking at exposures on network-based devices. But over the years, we spent a lot of time integrating a lot of these capabilities across these different domains into a single unified platform. And so that's important because more often than not, customers recognize that security is very siloed. Most large organizations or enterprises today have 80-plus vendors in their supply chain. So to be able to develop a unified view to be able to take all the things that you assess all that data and correlate it with external third-party data and develop a single unified view of risk and your entire digital footprint is really important. So ASPs are higher when we sell the platform. They're anywhere from 30% to 80% higher, so higher ASPs, higher selling prices, higher close rates. And the platform is now roughly 40% of our new sales. And we've become more strategically relevant to customers, and it's also recognized as one of the biggest problems in all of security. Gartner has come on record and said, [ CTAM ] continuous threat and exposure management is one of the major spending opportunities. Today, 96% of all spend is on detect and respond. Exposure management is really about proactive security, helping customers reduce risk. So consequently, they expect outsized growth and spend in proactive security. This notion that I'm going to look for incidents and breaches and try to detect those and then respond to those, that thinking, those resources, that investment needs to shift to proactive security, and that's what's inflecting deal sizes.

And how does -- sorry.

Yes, I was just going to add on. One of the ways that, that's showing up for us is that we are seeing this increase in the number of large multiyear strategic transactions with our customers. So we're being elevated within our customers' security environment where we're having those higher-level strategic conversations, which, of course, is driving more loyalty where we're seeing within the platform, churn rates are lower than they are for customers that are outside of the platform. And increasingly, we're seeing more customers moving on to the platform, which is very positive.

Okay. Perfect. Before we kind of dive more into that, obviously, there's been a lot of discussion over the past few weeks around cloud security and just impacts to cybersecurity. I'm sure you might have even had many of those conversations today. Most of this started kind of after your earnings. And so just wanted to hear from you what you see as competitive moats from AI natives. And just kind of how you think that this discussion is kind of disconnected from the reality that you're seeing?

Sure. I would say if you look at what [ Cloud Code ] does today, they announced capabilities that scans publicly available, open-source software on a preproduction basis. And if you look at where we play, so code scanning capabilities we have, a is small; and b, it's very different than what Anthropic announced. Where we're strong is really on the data side. So we are post-production infrastructure run time, which means we're behind the firewall. And so the relationship we have with our customers that's built over the last 20 years is based on trust. So we're able to, when we assess, detect things that others can't, no LLM can do. It's things like an inventory of all your software libraries, an inventory of the configurations of the device. It's understanding if your password is 6 digits and your policy says 9 digits. So it's built on a level of trust. It's based on assessment and real capability that others don't see. So it's certainly very deep. And that's a little different than certainly what Anthropic plays. Now I would say also the second thing here is the ability to be able to correlate things. That's really important based on the data that we do have and deliver insights to customers that, quite frankly, LLMs can't do. And I say that because right now, we see ourselves as the contextualized truth to be able to orchestrate fixes. Yes, can some of the AI labs deliver enhanced capabilities and security and allow us to assess risk faster to be able to correlate risk sooner? Absolutely. But taking action unilaterally without context creates risk. And so the big opportunity for us is doing that in a very deterministic way. A lot of the AI labs are probabilistic and they're undeterministic. And so the contextualized truth to have the confidence for customers to be able to take action to be able to reduce risk is really important. And so AI, we believe, creates incredible opportunity for us. But we're still in a world where customers, quite frankly, don't want to deploy patching automatically. They believe it creates too much risk. They want a human in the loop. But the capabilities that we have allows customers to take action based on their maturity where they can do things with a human still in the loop where they feel safe, they can also do it autonomously with guardrails, where it's safe, where they think the exposure is minimal. But over the course of time, more automated remediation is one of the big value props for us.

And so you kind of mentioned that seeing AI as an opportunity. How do you benefit from that kind of increased surface area? Is it what drives people to look for exposure management? Just how do you benefit from AI versus kind of what we've said is that it's not a headwind?

Well, a lot of the -- what's played out in the market over the last couple of weeks has really been on, "Okay, what risk does AI create for SaaS companies?" And certainly, there will be some levels of disruption, probably more for SaaS-based businesses that have seat-based license models or have workflow that's repeatable that possibly vibe coding can help solve or even things like businesses that are built on data models that it's publicly available. And we saw a good example of that with the scanning of open-source code. If you look at our opportunity here, we look -- we have the ability with AI to discover shadow AI applications. So the proliferation of AI applications has been dramatic. Most customers have no idea what applications they're using in their environment, whether they're downloaded, whether they build them internally, whether they're browser plug-ins. So there's a lot of talk about [ Claude ] bot. So discovering things like use of ChatGPT, Gemini, internally developed applications is really important. More importantly, we have the ability to monitor at the prompt level what information that's going into a lot of these LLMs. So is it sensitive customer information? Is it proprietary code? Is it financial information? And then more importantly, tie that back to use cases. So AI, we believe, is going to be a big opportunity for us. It will create tailwinds. We actually talked about closing a 7-figure deal with a customer last quarter for their use of AI exposure where we're helping them discover shadow AI and then tie it back to governance and policy. So it's questions that Boards are increasingly asking, which is how secure are we? What's our risk with AI? And obviously, these are questions that we're able to help our customers answer with clarity.

Yes. I think I look at it as a massive opportunity because it really plays to our strength, right? If you think about what we do in exposure management, it is about getting visibility, insights and actions. And every company out there is trying to adopt AI for lots of really good reasons, more efficient and effective, and you want to get all these different operational benefits out of it. But from a risk perspective, what companies need to understand is what models are in use? How are they being used? So the first step is visibility, and that's what Tenable One can provide. Next, okay, how do you contextualize that? How do you get insights into that visibility? And then last, of course, how do you take action? For us, it's an opportunity because you now have a new and emerging category that we just didn't have before. And increasingly, companies are looking at, of course, how do you adopt AI to make yourself more efficient and effective. But also, they have to understand how do we secure that. That's really, really, really important, and that plays to our strengths.

Got it. Okay. I want to jump back into just kind of Tenable One. You referenced kind of an 80% ASP uplift when customers translate -- or transition from stand-alone VM to Tenable One. Just where do you think we are on that migration cycle? And just what is that gating item to kind of converting the installed base?

Yes. We're, I would say, fairly early, but far enough along that we can see that it's working. So to give you some numbers, we closed out last year in Q4 with the highest percentage of new and expansion opportunities that were closed and won in Tenable One in the platform at 45%. That's the highest in a quarter that we've seen. And in terms of total, when you look at both new and renewal, it represents about 1/3 of our business today. And so we're seeing customers increasingly moving into the platform. And whether that's from stand-alone VM or other stand-alone EM solutions, what our customers are finding that is within the platform, they're able to have just a far more effective exposure management experience. And so the reason I say we're fairly early is because the opportunity out there is still massive. We've got 2/3 of our enterprise customers then that are not yet on the platform. And our expectation is as those customers move over, they're going to see, yes, the price uplift, but we also know already that these are customers that are expanding more, they're churning less. And so all of the good things that you would want to see are happening in the platform, and those are the types of things that we're seeing underneath the surface right now.

And so there's no intent to trying to force people the Tenable One or some sort of upgrade path incentive to kind of speed up that transition or...

So there's a couple of things that we're doing that are very customer-friendly. Number one, we'll very soon have pricing and packaging that makes it -- reduces quite a bit of friction for customers to go and adopt the platform. That's coming soon and is all good news for customers. The other thing we're doing is we're incentivizing our sales force to encourage platform adoption. So there's an incentive there for our -- all of our quota-carrying sales reps to go out and encourage sales of the platform. So that's all good. We are not penalizing customers. If customers want to continue to be on their stand-alone SKU, they may continue to do that, and we don't have plans to end that.

Okay. You highlighted 300 validated integrations earlier. Just how do those integrations kind of impact win rates, time to value? And where are we in terms of where do you want to get the number of integrations?

Well, sure. Well, security is a very fragmented market. And arguably, there's probably 20,000-plus cybersecurities in the world, offering a wide range of capabilities, and most of those companies are less than $20 million of revenue. Our view of the world is this, that if we look at the number of integrations, they pertain directly to a core customer use case. So customers may have a preference to use a certain provider for cloud, another provider for EDR. We're really strong at assessing devices across a wide range of domains, but we also recognize that we're not going to have core IP in all domains, no security company can. So the integration is really important. We acquired a company called Vulcan early last year that not only had those integration capabilities, but also the mobilization pieces that are really important because that's kind of the downstream benefit of ingesting data is that we're able to deliver higher levels of visibility to correlate things that we previously could not, but more importantly, to be able to take action to reduce risk. So we'll continue to add more integrations. Some of those integrations are bidirectional, and that's really important, too, because it creates a closed loop. And so depending on the level and the maturity of the customer, some customers may want us once we ingest data and correlate it, normalize it and [ redo ] it because that's really the hard part here. ingesting data is one thing, but to be able to understand that you're ingesting data from CrowdStrike or Prisma or some of the other players that are out there and then combine that with your own exposure data and then say this is a unique asset or a duplicate asset and then to normalize it so customers understand and have an inventory of their entire digital footprint and then more importantly, tie that back to devices that may have critical data that have lots of entitlements and access; that's really important. So it represents some of our largest deals. It's a big opportunity. It's one of the reasons why we think the expansion rate over time will continue to inflect up. And obviously, it's a more complicated sale. It's one of the reasons why customers are also making longer-term commitments to us. If you look at the growth in long-term RPO, I think it's up 35%, 40%. So customers are buying more upfront, resulting in higher selling prices, making longer-term contractual commitments, and you can see that in the RPO growth.

Got it. You reported 500-plus net new customers in Q4 and so the platform customer adds were the best in 2 years. What has specifically changed kind of in the execution to drive that improvement? And just how should we think about the sustainability in '26?

I would say it's around a couple of key things. Number one, we're leading with the platform -- a platform-first approach. And if you look at -- I talked about the evolution of Tenable over the years where we have brought new capabilities to market, taking that core exposure use case on the network and then applying that into different assets and different domain types and then more recently, integrating a lot of those data sets into the platform. So historically, if you kind of look at how we've gone to market, it's really with individual products. And then even in the platform, calculating different licenses for different asset types. So one is platform at the center of everything we do, and we pay higher remuneration for a platform sale because a platform sale means larger selling price, it means higher close rate. It also means higher renewal rate. Second thing is also moving away, if you look at the innovation, shifting that innovation, not so much at the sensor level, but at the platform level. And one of the big changes that we made last year early was we used to have GMs and individual products that had their own road map that was developing capabilities around individual sensors. It could be things like grouping and tagging or role-based access, it could be more enhanced reporting. So we want sensors to be able to assess and a lot of the capabilities. A lot of the correlation has to be at the platform level. So that was a big change that we made last year. So engineering has changed quite a bit in that regard. And number one, go-to-market has changed, and now there's focus on things more recently where we're removing friction instead of selling individual asset types as part of the platform, we're going to be selling tokenized access to the platform to allow higher levels of utilization and adoption.

Got it. On the federal side, this has been a kind of meaningful portion of your business over the years, you implied that the '26 growth rate would be in line with the overall company. Just what are you seeing in this market? And are there opportunities for you to kind of gain share in that environment?

Sure. Yes, I think there are. As you know, before 2025, Fed was a tailwind for our overall growth. And in 2025, it was a slight headwind. And as you mentioned, in 2026, we think it will grow more or less in line. As we look forward into the future, we expect Fed is going to continue to be a positive driver of our business. And I do think that there's opportunity where rather than being a headwind as it was in 2025, we can start to see a tailwind again. And I think that, that then, of course, improves our overall growth rate.

Got it. I mean you exited the year at 10.5% year-over-year growth. You guided to fiscal '27 to 7% at the midpoint, understanding we are very early in the year. But just how are you thinking about kind of '26 growth relative or the drivers of '26 and if they're any different than what you saw in '25?

I think the important things that we want to see that are not necessarily evident in that headline figure are things like Tenable One adoption and growth as well as expansion. And so some of the early indicators that I think we'll want to be looking for are an increasing percentage of adoption in Tenable One, which we talk about every quarter, and we'll continue to talk about. That's a very positive sign for us. And then also looking at our net expansion rate, which has been coming down pretty steadily over the last several years. We'll want to look to that rate as we get to the back half of 2026 as evidence that expansion is picking up because what we have seen most recently is an increasing growth rate in new and expansion, which is exactly what you want to see. Renewal rates remain intact. Churn is steady. And so when we can begin to see an increasing growth rate in new and expansion, that will ultimately show up in the top line measure. And probably the first place it will be evident to everybody else is in that net expansion rate.

Okay. Steve, you mentioned earlier the 7-figure AI exposure deal. Just what was the core use case that made it kind of AI exposure versus kind of a traditional exposure purchase? And just kind of any context around that deal?

Sure. Well, the core use case there was shadow AI. And it's back to this notion, which is like how secure am I and what's my level of risk? And that's -- these are foundational questions, one that we're really good at answering and we've demonstrated ability to do that over time. So AI is the new threat vector, one of the biggest blind spots in security. If you look at the use of AI, it's been obviously prolific. We've all read the data points, but 1.5 billion monthly users between Gemini and ChatGPT, yet, that's only -- what is it, arguably 20%, 15% of the world's population. Code today, depending on what you read, anywhere from 5% to 30% of all code is AI generated or AI assisted. And so without the ability to understand your risk, understand the applications, understand the deployment in your environment and then be able to tie it back to policy and use case and governance models, it's really important. So it really starts with visibility. And it was actually a sizable 7-figure deal. Sales cycle was very short, came in near the end of the quarter, and we're hard at work building pipeline, and we expect to continue to be successful there. So we're early in that journey. But we are monetizing capability. We have a real role to play here in the AI attack surface.

Got it. I mean with AI risk kind of being this Board-level discussion and you guys having a way to kind of give people actionable insights into those environments, just how do you determine like what KPIs are going to matter most internally? And then how do you -- just like how do you better kind of optimize deals or better capture deals like the ones you just spoke about?

Is it -- just to clarify your question, is it really, "Okay, what's our momentum and success in securing AI in this agentic world?" Or is it, "Hey, how are we using AI internally to go faster?"

It's more of the former. How do you capitalize on this large deal that you just signed and kind of the momentum that, that can bring in how to kind of more package thing to kind of be this like AI risk solution?

Well, in terms of how we measure that, I would say -- and there's different levels here of both qualitative and quantitative. Number one would be, okay, you have to look and think early at the top of the funnel, we're creating opportunities here, our sales reps having conversations with customers about not only our ability to secure AI. But also, are they helping -- do customers understand our ability to correlate data? So a, leading with the platform; b, with a particular focus on AI exposure. That's really important. Number two, I would say, closing deals, deals matter here. And the size of those deals matter, too. And so in software, companies can tout a lot of different capabilities, but the one thing that's undeniable are customers and referenceable customers and sizable customers. So obviously, we're going to see more momentum with customers, more close one opportunities. And then the third thing is really is like what's the impact on overall growth. I know it's hard for investors to try to figure out who's an AI winner and who's not, who will be disrupted and who's a beneficiary. But the easy way to cut the deck here is really on growth. And so we're focused on driving growth higher. We have the right product, right market, right strategy, and we have a big role here to play in this agentic world. And the ability to help customers not only understand risk, but reduce it is really important. So I think it's all the usual KPIs that you would see, which is traction with the platform, utilization and the assessment with AI exposure and then obviously, on the back end to be able to help drive expansion and higher renewal rates.

Got it. Matt, you mentioned the dollar net expansion earlier. You found some kind of stabilization in the first half or talked about stabilization in the first half. Just is it as simple as more Tenable One is going to lead to a reacceleration there? Or are there other levers that we should be thinking about?

It's specific to expansion and expansion is a huge part of the Tenable One platform. Reason for that is once the customer is in the platform, it becomes easy. And particularly with our new pricing and packaging, it becomes very easy to expand and begin scanning additional asset types. And the more that customers are scanning, the better overall picture they get of their exposure. And of course, that means for us, then we're able to increase the size of that deal. And so our expectation is with increased adoption of Tenable One, we will see increased rates of expansion, and that's obviously a big piece of that net expansion rate. The -- if you go back and just chart this rate over time, it has been coming down. But what we're beginning to see underneath the surface is increasing rates of expansion. And our expectation then is that as we get to the back half of 2026, that will start to show up in the overall rate.

Got it. We've also seen kind of some shift in the billing terms. Just how are contract duration and renewal billing behavior changing? And just anything that we should be noting there?

Yes. We talked a lot about this last quarter and even the quarter before a little bit where the push into the platform is driving larger, more strategic multiyear deals. But in many cases, customers just don't want to pay 100% upfront. They would prefer to pay in installment billings annually. which for us, we're okay with. And so as a result, while we have been seeing contract durations increasing, the billings duration has been decreasing, which is driving this difference in CCB, which is being impacted by billings duration and CRPO, which is being impacted by contract duration. My expectation is that we're going to continue to see contract duration continuing to expand. But where we saw a 5 percentage point difference at the end of Q4 between CCB and CRPO, my expectation is that as we make our way through 2026 and certainly into 2027, those rates will begin to normalize and converge somewhat. And all the while, we will continue to drive larger and more strategic deals in the platform.

Got it. In terms of operating margin guidance, you guided to 150 basis points kind of approximately of expansion into 2026. Where are you investing? Where are you seeing as the highest ROI investments? And then maybe that kind of circles back to the latter part of that AI question, Steve, are there ways in which you guys are using AI internally to find efficiencies?

Yes. I'll answer the first part and then kick it over to Steve for the second. One of the things I'm proudest of is our ability to continue to expand operating margin while at the same time, investing very heavily in R&D. And you saw that in 2025, where our R&D expense grew 23%. And in that same period of time, year-over-year, we grew our non-GAAP operating margin by 140 basis points. That formula is the same formula we're going to be taking forward into 2026, which is we're going to continue to invest very heavily in product development. We think there's just massive opportunities that are in front of us, and it's very important that we develop and invest heavily in the product, so -- where we're pouring those investments into is exactly where you'd expect. It's within the platform in Tenable One, and it's around AI exposure. And so where we're going to find the margin is basically everywhere else on the P&L, a little bit out of gross margin, more out of sales and marketing and more out of G&A.

I would say with regard to the latter part of that question, we look at AI as a horizontal enabling function that makes every area better. So for example, in engineering, as you can imagine, where the focus is on greater adoption of AI through the use of a series of tools. So we want to see more AI generated or assisted code. We want to see AI deeply embedded into the workflows. That's really important. And then in terms of things like on the sales side, understanding the opportunities and looking at data and say, okay, what opportunities have a higher likelihood of close? Is it large or small customers, U.S. or outside, what products? And then we're also leveraging AI to better support customers where only a smaller percentage of calls and escalations actually will go to a technical support engineer, the frontline defense is that we feel like AI. We're leveraging AI to be able to get information in the hands of customers depending on their specific need -- one, in need. So it's all the things that you would think. I would say moreover, I think the margins in this business can -- and for a lot of companies like Tenable can go much higher than even anticipated. The fact that we're over $1 billion in sales, we have 40,000-plus customers, we have massive distribution and more importantly, we're able to leverage AI to be able to make our business more efficient to more productive; and I think the operating margins over the course of time will be very, very attractive, perhaps even above and beyond what we've committed to previously.

Got it. And then maybe just last question for me on capital allocation. You guys obviously increased the share repurchase authorization. But just how are you kind of balancing buybacks, M&A, organic investment as you look forward?

Yes. So as we announced in the last earnings call, our share repurchase authorization now stands at almost $340 million. And our intention is to lean heavily into that and accelerate that, the repurchase of shares because we believe fundamentally, shares are undervalued. And so we believe that's a good use of capital. We will also continue to be opportunistic and look at M&A where it makes sense. We have plenty of capacity should we choose to do that. And so we'll continue to look at those opportunities. But right now, we're focused on going and building organically. We think we've got most of the right pieces in place. And in the meantime, at these levels, we can buy back shares.

Perfect. Well, Steve, Matt, this has been super helpful. Thanks so much.

Thank you. Appreciate it.