Tenable Holdings Q3 2026 Earnings Call Transcript

Tenable Holdings (NASDAQ:TENB) reported third-quarter financial results on Wednesday. The transcript from the company’s third-quarter earnings call has been provided below.

This transcript is brought to you by Benzinga APIs. For real-time access to our entire catalog, please visit https://www.benzinga.com/apis/ for a consultation.

View the webcast at https://edge.media-server.com/mmc/p/e9yy484j/

Summary

Tenable Holdings reported Q3 2026 revenue of $276.4 million, up 9.5% year-over-year, driven by strong expansion within existing accounts and robust renewals.

The company saw a record quarter for Tenable One, which accounted for 59% of new business, and added 413 new enterprise customers along with 39 net new six-figure accounts.

Net dollar expansion rate increased to 107%, marking the second consecutive quarter of acceleration, attributed to strong customer adoption of Tenable One and Hexa AI solutions.

Tenable launched several AI-driven initiatives, including the integration of Anthropic Claude models and the expansion of Tenable Hexa AI, to enhance exposure management capabilities.

The company raised its full-year 2026 revenue guidance to $1.084 billion-$1.087 billion and non-GAAP operating income to $270 million-$273 million, reflecting continued business momentum.

Operational highlights include the introduction of the Cyber Agents Exchange and key customer wins against major endpoint security competitors, emphasizing the strategic value of Tenable’s comprehensive platform.

Tenable completed an $800 million convertible note offering to refinance debt, repurchase shares, and expand liquidity, with a focus on maintaining a strong capital allocation strategy.

Full Transcript

OPERATOR

Greetings and welcome to the Tenable Holdings Q3 2026 earnings conference call. At this time all participants are in a listen-only mode. A brief question-and-answer session will follow the formal presentation. Should anyone require operator assistance during the conference, please press star zero on your telephone keypad. As a reminder, this conference is being recorded. It is now my pleasure to introduce your host, Erin Carney, Vice President, Investor Relations.

Thank you. You may begin.

Erin Carney (Vice President, Investor Relations)

Thank you, Operator, and thank you all for joining us on today’s conference call to discuss Tenable Holdings’ third quarter financial results. With me on the call today are Co‑Chief Executive Officers Steve Vintz and Mark Thurmond, and Chief Financial Officer Matt Brown. Prior to this call we issued a press release announcing our financial results for the quarter. You can find the press release on our IR website at tenable.com. We will make forward‑looking statements during the course of this call, including statements relating to our guidance and expectations for the fourth quarter and full year 2026, growth and drivers in our business, changes in the threat landscape in the security industry, particularly regarding AI security, the expected impact of frontier AI models on accelerated vulnerability discovery and the shift to preemptive security, the expected size, durability and growth of the market opportunity created by the shift to AI‑driven exposure management, our competitive position in the market, growth in customer demand for and adoption of our solutions including the impact of new pricing and packaging models, the expansion of Tenable One including agentic AI security orchestration through Hexa AI and planned AI exposure coverage across third‑party models, the expected growth, adoption and role of our Cyber Agents Exchange in the agentic security ecosystem, the expected benefits of our strategic partnerships with frontier AI labs, our ongoing research and development investment, our capital allocation strategy including share repurchases, and our future results of operations and financial position.

These forward‑looking statements involve risks and uncertainties, some of which are beyond our control, which could cause actual results to differ materially from those anticipated by these statements. You should not rely upon forward‑looking statements as a prediction of future events. Forward‑looking statements represent our beliefs and assumptions only as of today and should not be considered representative of our views as of any subsequent date, and we disclaim any obligation to update any forward‑looking statements or outlook.

For a further discussion of the material risks and other important factors that could affect our actual results, please refer to those contained in our most recent Annual Report on Form 10‑K and subsequent reports that we file with the SEC. Today’s discussion includes non‑GAAP financial measures. These non‑GAAP financial measures are in addition to and not a substitute for, or superior to, measures of financial performance prepared in accordance with GAAP. There are a number of limitations related to the use of these non‑GAAP financial measures versus their closest GAAP equivalent. Additionally, please see our press release for reconciliations of GAAP to non‑GAAP financial measures that we discuss today.

I’ll now turn the call over to Steve.

Steve Vintz (Co-Chief Executive Officer)

Thanks, Erin. We delivered excellent results in the third quarter. On our last call we discussed the increasing momentum in our business, and this quarter we are very pleased to see that momentum start to translate into acceleration. What excites me most are the leading indicators which show inflection and signal durability of growth ahead. Our net dollar expansion rate accelerated to 107%, up from 106% in Q2, which is the first time in over four years we’ve seen acceleration in the expansion rate for two consecutive quarters.

Tenable One reached a record 59% of new business, up from 50% in Q2. Average Tenable One deal sizes year over year rose for the second straight quarter, driven by the pricing and packaging we introduced earlier this year, and CCB accelerated to 9% growth in the third quarter. These results demonstrate that we’re delivering what customers need most, which is the ability to see and act on risk across the entire environment at the speed this new era demands. And no force is shaping that more than AI. Before we dive into the product updates for the quarter, I want to touch upon PHP2Shell, the critical vulnerability disclosed last week. Earlier this year we said AI would surface more vulnerabilities and exposures faster. That’s playing out now.

PHP runs nearly everywhere in the enterprise, including web applications, cloud workloads, containers and legacy systems. The vulnerability is the headline, but the risk goes beyond the vulnerabilities themselves. Organizations need to find affected instances, including those they may not know about, and understand how they connect to misconfigurations, credentials and critical systems. Following PHP2Shell disclosure, customers turned to Hexa and we’ve seen prompt volume increase dramatically by as much as 5x.

Beyond Hexa, customers have been turning to Tenable as a trusted partner during this critical time and we’ve been working closely with them to ensure they can leverage the full power of the platform to reduce their exposure. PHP is a real‑time example of a broader shift in the market, and that is AI is reshaping the attack surface faster than most organizations can respond. This is more than a moment, it’s a mandate and a structural shift for enterprises. As a result, every enterprise is adopting AI and every model, every agent, every MCP server they deploy creates new exposures. Meanwhile, attackers are using frontier AI to find weaknesses faster, and we’re now witnessing the early automation of exploit development.

The risk extends well beyond CVEs and we believe this is a powerful demand catalyst for exposure management and a significant growth opportunity for Tenable. As I outlined last quarter, winning in exposure management requires three capabilities: understanding every exposure, prioritizing what matters most, and acting with speed and confidence to reduce risk. As frontier models become widely available, intelligence itself becomes abundant. The differentiator is putting it to work safely. That’s the Tenable advantage: decades of exposure intelligence, deep visibility across the attack surface, and an AI harness that keeps agents acting safely with human oversight and an audit trail.

This quarter we significantly expanded what that platform can do across all three. In September we announced that we’re bringing Anthropic Claude models into Tenable One. This expands our partnership with Anthropic beyond Project Glasswing, our first capability powered by Claude. Tenable One Adversary View lets security teams see their environment through the eyes of an attacker. Every time Tenable assesses a system, we learn what’s running on it, how it’s configured, who can access it and what it connects to. Adversary View applies Claude to that telemetry to reason like an attacker.

It sees how low‑signal exposures can be chained together to reach critical systems, then recommends the specific fixes that break those chains. It’s a compelling example of how we’re turning frontier AI into differentiated capabilities designed to keep customers ahead of emerging threats. We also expanded Tenable Hexa AI, our agentic engine for Tenable One. Hexa now works as a coordinated fleet of agents that continuously identify critical exposures, orchestrate remediation and verify fixes even when security teams are offline. Since June, Hexa has evaluated more than 2 billion assets and findings, which enable Hexa users to resolve more critical and high‑severity vulnerability detections per month than matched peers and patch actively exploited vulnerabilities faster.

Tenable Hexa AI saves security practitioners time and resources, enabling them to reclaim analyst capacity, maintain always‑on defense and dramatically reduce mean time to remediation. Importantly, Hexa is model‑agnostic. It works with leading frontier and open‑weight models so customers benefit as those models improve, while our harness keeps every action grounded in validated exposure data. Finally, we launched the Cyber Agents Exchange, the industry’s first open‑source, vendor‑agnostic registry for cybersecurity AI agents and skills. Its AI Inspector pairs OpenAI’s ChatGPT cyber models with Tenable Research to vet community‑built components before enterprises deploy them, putting Tenable’s data and expertise at the center of trusted agentic security.

Cybersecurity used to be about detecting and triaging threats. Today, it determines how fast the world can adopt AI. As a result, security is no longer a line item inside IT, it’s becoming its own business function with a budget tied to business risk and growth. We believe Tenable is uniquely positioned to lead in this AI era, and the momentum we are seeing today gives us confidence in the durability of growth ahead. With that said, Mark will now walk you through how the momentum we are seeing is showing up with our customers.

Mark, thanks.

Mark Thurmond (Co-Chief Executive Officer)

Before I jump into the quarter, I want to touch on what we’re seeing in the field and how we’ve responded to PHP. Tenable Research closely tracked the situation as it evolved. We provided constant updates to help educate and prepare customers so they were ready to act. We shipped plugins overnight and kicked off a series of customer webinars. Attendance has been off the charts. Moving on to the quarter, the shift that Steve described is showing up in how customers are buying. Last quarter we said conversations were turning into action. This quarter, pipe build is turning to conversion. We saw clear signs that customers are adding incremental budget to their exposure management programs with Tenable One, both with new lands and existing customers. Q3 was our best quarter ever for Tenable One new logos, with more than half of the new logos landing on our Advanced package.

At the same time, existing customers are broadening their commitment to Tenable One, and many of our largest deals this quarter were vulnerability management customers converting to the full platform. Platform expansion was the primary driver of our acceleration in net dollar expansion rate and average deal size. When customers consolidate onto Tenable One, they bring more asset types and more of their attack surface with them. We see two primary factors behind the increased demand for Tenable One. First, customers need a comprehensive platform with a broad set of capabilities to manage risk in a post‑Claude environment, and those capabilities are only available in the new Tenable One packages. Second, our pricing and packaging continues to make the path to the platform easier. As a result, we ended the quarter with more than 5,000 customers on Tenable One. Both pricing tiers are doing what we designed them to do.

The Foundation tier gives customers a simple way to start on the platform and grow over time. The Advanced tier gives organizations facing the most acute AI‑era risk the broadest set of capabilities from day one. It is clear that AI capabilities are pulling customers deeper into the platform. We’re hearing directly from customers about how Tenable Hexa AI is changing the way their teams work. Tasks that used to take weeks are now getting done in hours. Analysis that once took days of exports and scripts now take minutes. Some customers are building their first automated routine on day one and others are connecting their own agents to Hexa to drive remediation.

Customers using Hexa resolve two to three times more critical exposures across all affected asset types in their environment than comparable customers. The common thread is that security teams are spending less time gathering information and more time reducing risk, essentially letting the same security team do the work of a much larger one. And the more they use it, the better the results, with our largest and most complex customers seeing the biggest gains.

Let me bring these trends to life with three customer examples from the quarter, a couple of which we believe were Mythos-driven expansions. A global industrial leader selected Tenable One over a leading endpoint security platform provider in a competitive evaluation. Despite the competitor’s aggressive bundling strategy, the customer chose Tenable One for its superior asset discovery, broader exposure visibility, Hexa agentic AI capabilities, and being able to consolidate multiple security tools into a single platform.

This example reinforces our competitive advantage as customers look for a more comprehensive approach to exposure management in the post Mythos era. In another example, a Fortune 100 global technology leader significantly expanded its investment in Tenable One through a multimillion dollar agreement, extending its deployment to the full platform. The customer was one of our largest VM deployments with millions of assets across business units and geographies. They are expanding with Tenable One to consolidate security capabilities, simplify operations, and manage exposure at enterprise scale. We are deepening strategic relationships and driving substantial platform expansion within our install base.

And finally, a global software company expanded its Tenable contract by nearly $1 million with our cloud security offering providing differentiated capabilities over a leading endpoint security platform provider. The customer is also adopting Hexa AI capabilities with early indications of time savings. Our comprehensive platform and AI-driven innovation is driving larger deals with additional asset coverage. Together, these wins reflect the trends we saw throughout the quarter. These trends include AI-driven urgency for exposure management and meaningful expansion, specifically with our VM customers upgrading to Tenable One. There was also strong adoption of Tenable One within new customers along with major competitive wins.

Additionally, Steve mentioned our Cyber Agents Exchange. Beyond advancing the broader cybersecurity community, the Exchange is also demonstrating commercial value. We are already seeing a strong response, particularly considering it was introduced in August. A great example of what we’ve seen was a Tenable One win at a financial services company. The Cyber Agents Exchange helped influence this competitive deal where agentic AI was a key purchasing requirement.

We’re also seeing the Exchange become an important point of engagement with enterprise customers, reinforcing the differentiation of Hexa AI and Tenable One. We believe the Exchange positions Tenable to play a central role in the emerging agentic security ecosystem, creating new opportunities to drive platform adoption as this market develops. And finally, a word on why we’re winning. We compete with large platform vendors, with legacy vulnerability management providers, and with new entrants. What we are seeing in the field is that customers are selecting Tenable for the breadth and depth of our exposure data, our multiple asset types, advanced prioritization, and for a harness they can trust to act in their live environments. This is all showing up in our win-back reports and competitive displacement.

Now with that, I’ll turn the call over to Matt to discuss our financial results.

Matt Brown (Chief Financial Officer)

Thanks, Mark. The product innovations and competitive wins that Steve and Mark just spoke about translated to excellent results in the third quarter. Tenable One represented an all-time high percentage of new business, driving third quarter results above the high end of the range for every metric we guided to, and we are once again raising our full-year outlook, reflecting the growing momentum we’re seeing in the business. Let’s dive into the details.

Revenue for the quarter was $276.4 million, representing growth of 9.5% year over year. The year-over-year growth in revenue as well as outperformance relative to guidance was driven by strong expansion within existing accounts and underpinned by continued strength in renewals. Our percentage of recurring revenue remained high at 95% for the quarter. We had a record quarter for Tenable One with 59% of new business coming from the platform, a new milestone, up from 50% in the prior quarter and 39% in Q3 of last year. As Steve discussed, we continue to make platform enhancements in Q3, including equipping security teams with autonomous agentic capabilities with Hexa AI and bringing Anthropic’s Claude Mythos for Frontier Cyber Reasoning in Adversary View. Advancements like these are helping accelerate the adoption of Tenable One with new and existing customers.

We added 413 new enterprise customers in the quarter and added 39 net new six-figure accounts. With the continued shift towards Tenable One, average deal sizes are increasing, which helped drive new six-figure account annual contract value up 18% year over year. Our net dollar expansion rate increased for the second quarter in a row to 107%, up from 106% in the prior quarter. The continued acceleration reflects sustained demand in the business and was driven by strong expansion and renewal.

Non-GAAP gross margin was 81.5% for the quarter, compared to 81.6% in Q3 2025, and within our typical historical range of low 80s over the past couple of years. Non-GAAP income from operations for the quarter was $74.9 million, or 27.1% of revenue, compared to $58.9 million, or 23.3% of revenue in Q3 2025, an increase of 380 basis points. Growth in profitability in the quarter highlights our ability to steadily increase margins while investing significantly in product development and sales capacity.

Non-GAAP earnings per share for the quarter was $0.63 compared to $0.42 in Q3 2025, an increase of $0.21. The improvement year over year reflects the growth in profitability and also includes a one-time discrete tax benefit that increased earnings per share by $0.03. Turning to the balance sheet, we generated $69.4 million of unlevered free cash flow during the quarter, compared to $58.5 million in Q3 2025, an increase of 18.7%, and ended the quarter with cash and short-term investments of $495.3 million. During the quarter, we raised $800 million in a convertible note offering, using the proceeds to pay off our existing Term Loan B, enter into a capped call transaction with a capped price of $64.06 per share, and repurchase 5.3 million shares for $170.5 million.

In addition, on October 13th we closed a revolving line of credit, giving us access to $400 million in additional liquidity. The net result is overwhelmingly positive. We pushed out the maturity of our debt to September 2031, reduced our shares outstanding, expanded our liquidity capacity, and added $186 million in cash to our balance sheet, all at a significantly lower overall cost of capital. In addition to the shares we repurchased in connection with the convertible notes, we repurchased 1.5 million shares for $53 million during the quarter and have $54 million remaining on our current share repurchase authorization as of the end of the quarter. In total, so far this year we’ve repurchased 18.2 million shares for approximately $454 million, reflecting an average repurchase price of $24.93.

Our repurchase program remains an active pillar of our capital allocation strategy, reflecting our view that returning capital to shareholders through buybacks represents an effective use of our free cash flow given the underlying strength of the business. Turning to the financial outlook for Q4 and full year 2026, given the continued strength we’ve seen through Q3, we are raising our full year 2026 guidance range for revenue to $1.084 billion to $1.087 billion, representing a year-over-year increase of 8.6% at the midpoint. For Q4 we expect revenue to be in the range of $277 to $280 million, representing a year-over-year increase of 6.9% at the midpoint. We are also raising our full year 2026 guidance range for non-GAAP operating income to $270 million to $273 million, or 25.0% of revenue at the midpoint, which is a year-over-year increase of 310 basis points.

We expect non-GAAP income from operations for Q4 to be in the range of $67.1 to $70.1 million, or 24.6% of revenue at the midpoint. The outperformance we drove in operating income so far this year, along with the favorable impact to interest income and expense in Q4 as a result of our debt refinancing, is driving significant incremental upside to net income and earnings per share for the year. In addition, the one-time tax benefit we realized in Q3 drove a benefit of $3.3 million to net income and $0.03 to earnings per share. As a result, we are raising our full year 2026 guidance range for non-GAAP net income to $250 to $253 million, representing a year-over-year increase of 29.4% at the midpoint.

We expect non-GAAP net income for Q4 to be in the range of $63.6 to $66.6 million, representing a year-over-year increase of 13.6% at the midpoint. Due to the increase in non-GAAP net income, we are raising our full year 2026 guidance range for non-GAAP diluted earnings per share to a range of $2.16 to $2.19, representing a year-over-year increase of $0.59 at the midpoint. We expect non-GAAP diluted earnings per share for Q4 to be in the range of $0.56 to $0.58 per share, representing a year-over-year increase of $0.09 at the midpoint.

Before I open it up to Q&A, I want to thank the entire Tenable team for another excellent quarter of steady execution. We’re looking forward to closing out the year strong. With that, we are happy to open the call up for questions. Operator.

OPERATOR

Thank you. We will now be conducting a question and answer session. If you would like to ask a question, please press star one on your telephone keypad. A confirmation tone will indicate your line is in the question queue. You may press star two if you would like to remove your question from the queue. For participants using speaker equipment, it may be necessary to pick up your handset before pressing the star keys. One moment, please, while we poll for questions.

The first question is from Mike Cikos from Needham & Company. Please go ahead.

Mike Cikos (Analyst)

Great. Thanks, team, and congratulations on the strong results here. Great to see the net dollar expansion and the nine handle on that TCB growth. First question for Steve, if I could, but I think the key metric to me that stood out in your prepared remarks was the 5,000 plus Tenable One customers you have today. And really I’m thinking it was probably a year ago where the company was citing just 3,000. So you’ve seen a meaningful uptick as far as that pool of Tenable One customers you’re touching.

I would just love to get a better sense. Can you help us segment Tenable One customers? Like how many are coming from existing customers adopting Tenable One versus new logos to the platform?

OPERATOR

Management, your line is open. Management, your line is open. One moment, please, while we reconnect the speakers. Thanks everyone for your patience. We’re just reconnecting the speakers. They’re going to dial back in. Thanks for your patience. Hi, this is the operator. Thanks for standing by. We’re still reconnecting the speakers. All right, you can go ahead. You are now reconnected.

Mark Thurmond (Co-Chief Executive Officer)

All right. Hopefully everyone can hear us. We have absolutely no idea. We got disconnected and not sure. Mike, are you there?

Mike Cikos (Analyst)

I am. Can you hear me okay?

Mark Thurmond (Co-Chief Executive Officer)

Yeah, I can hear you fine. I’ll kind of give you the answer to your question. We have literally no clue what happened. The line just dropped. So. But listen, in regards to the momentum that we saw in Tenable One, it was across multiple different aspects. So, we had an incredible quarter in regard to net new logos landing on Tenable One. So we had 1,413 new logos. A significant portion of those new logos were Tenable One. We also saw a huge conversion from our standalone VM install base. Hundreds of VM customers transitioned over to Tenable One, which was outstanding. And then we saw a conversion also from our legacy T1 onto the new SKU, so every measurement that we track to drive new logo in regards to Tenable One were record-setting quarters. So multiple fronts, multiple competitive wins. That was one of the key drivers of why we had such a successful quarter. Tenable One absolutely crushed it in Q3.

Mike Cikos (Analyst)

That’s great. That’s great to hear, Mark. And just a quick follow up here. I just wanted to tackle the customer examples that you had given as well. Great to hear how Hexa is winning out and Tenable One is really gaining momentum with these enterprise companies. I’m just curious, can you speak to the competition versus those endpoint vendors? And I’m just trying to get a better sense. Are they coming up more in these at bats or do you see them becoming more competitive with their bundling strategy?

It sounds like the win rates are unaffected, but I’m just curious to what degree they’re actually showing up in these bids.

Mark Thurmond (Co-Chief Executive Officer)

Yeah, no, listen, they’re out there. And we didn’t see any change whatsoever from a competitive dynamic in Q3. We did see our win rates improve and increase and I think it’s because our channel and our sellers are extremely efficient now on selling Tenable One. Right. So we will position a VM standalone if need be, but the majority of all of our seller interactions and reseller interactions are Tenable One and our compete level is extremely strong.

As you highlighted, one of the customer wins we talked about was against a very large endpoint player and we won based on the depth and breadth of the platform, all of the different asset types, which is a huge differentiator in Tenable One. Also our accuracy within finding and identifying vulnerabilities, not having false positives, and then you put on top of it, now Hexa has become a really big driver. It is a huge differentiator. We demo it, we position it on all of our new business, but also it’s a big driving force to get VM customers in our install base and our legacy T1 customers onto the new SKU.

So you kind of combine all of that and we’re in just a very, very good compete level right now in regards to T1.

Mike Cikos (Analyst)

Great to hear. Thank you so much guys.

Mark Thurmond (Co-Chief Executive Officer)

Thank you.

OPERATOR

The next question is from Rudy Kessinger from DA Davidson. Please go ahead.

Rudy Kessinger (Analyst)

Hey guys, great. Thanks for taking my questions. And again, similar to Mike, congrats on the improvement in some of the metrics here. Firstly, I’m curious, let me take a step back. One of the questions I get from a lot of investors is, just with Mythos and increasing the number of vulnerabilities being discovered, wouldn’t customers be scanning more frequently? And how might that impact the results for a company like Tenable Holdings? You mentioned Hexa with 5x increase in usage in some instances. Historically you guys have priced on a per asset basis.

I guess as you look forward, as your customers are scanning more frequently, they’re patching more frequently, is there any opportunity to maybe evolve the pricing on some of your core VM scanning products in conjunction with Hexa to capture more of that usage in terms of revenue?

Steve Vintz (Co-Chief Executive Officer)

Hi, this is Steve. Yes, as we’ve talked about, our pricing and packaging has evolved considerably. One of the big highlights in the quarter was ASPs. So this quarter we saw the expansion rate tick up, the selling prices increased, and we also saw CCB consequently increase as well. And so we are having success expanding with our customers. Pricing and packaging plays a major role here. One of the big reasons why is because of Hexa and as a result of PHP, more customers turn to Hexa.

Prompt volume increased and we’re also selling Hexa packs back into our base. So we’ve seen the pricing evolve here. Yes, it’s an asset-based pricing model. We’ll continue to charge that way, but we’re also charging based on volume. We don’t want to do it based on the number of scans, we don’t want to discourage usage. But if you look at PHP for Shell, because that’s really where your question originated, it’s a clear signal of where the market’s going.

And it signals two things. First is scale. It took the industry 26 years to record over 300,000 CVEs. That’s the cumulative total to date since the number of CVEs has been initially recorded many, many years ago. And that’s the number of CVEs at the start of the year. This year alone there’s been 90,000 new CVEs. This month alone to date it’s been 15,000 new CVEs. So the velocity is clearly increasing here. And second, PHP for Shell clearly shows the challenge goes well beyond just the vulnerability itself. Yes, that’s the headline, but it’s more about the underlying exposure it creates in your environment. And PHP is everywhere, as we all know, and nearly every organization has exposure here. And reportedly, and this is recent, attackers are starting to chain PHP for Shell together with other flaws to now access and compromise identity systems.

So the threat’s evolving, it’s moving beyond remote code execution. And that’s where exposure management comes in. That’s why it’s more important now than ever before. We will see more events like this, not fewer. And that’s why customers are turning to Tenable Holdings, as Mark highlighted earlier.

Rudy Kessinger (Analyst)

Okay, got it. Super helpful. And then secondly, I appreciate the color and that key win versus one of the endpoint vendors and the competitive color. One of the questions I also get is you guys have said you see those endpoint vendors more so in tier 2 and 3 assets. Can you share any kind of figures when you evaluate your customer base, what percent of the assets that you guys are protecting are tier one versus tier two or tier three assets?

Steve Vintz (Co-Chief Executive Officer)

Yeah, most are tier one. I mean, to some degree there’s tier two and tier three. We have an asset-based pricing model. As we all know, the real risk here in the AI era is not a single CVE. It’s not a single misconfiguration or just access and entitlements. It’s the chaining together of all those things into a critical attack path that leads to your most important data. And that’s what exposure management is all about. So a lot of it is tier one assets.

So that’s why the selling prices are higher. That’s why we’re having success this year, is because we’re selling more assets. Customers are turning to us as they look to place more AI agents and models and applications in their environment. They’re turning to Tenable Holdings to help secure and assess more of that because it expands the attack surface. So we’ve seen no change in competitive dynamics, Mark mentioned, and our competitive positioning is very strong as our results would indicate.

Rudy Kessinger (Analyst)

Appreciate it. Congrats again on the quarter.

OPERATOR

The next question is from Jonathan Ho from William Blair. Please go ahead.

Jonathan Ho (Analyst)

Hi, good afternoon and congratulations on this strong quarter. One thing I wanted to better understand is as customers start to shift from planning to buying, can you help us understand how much of the growth that you saw this quarter was driven from asset expansion versus upsell of the product versus just completely buying new products? If you could give us maybe some type of breakdown that would help us understand the different drivers that are there.

Mark Thurmond (Co-Chief Executive Officer)

I’ll tell you, it really came from both. I mean this was one of the most balanced quarters that we have seen and really all the different fronts over executed and delivered. Right. So we saw significant expansion in the install base and one of the big trends we saw was some of our largest VM customers converting to Tenable One. So we’ve been working with some of these customers for close to nine months to get them to convert. And we saw that conversion happen in Q3 with a lot of big global Fortune 1000, Fortune 500 companies moving from VM to T1, so great expansion there.

We also saw it within the mid-range commercial space with customers wanting to leverage Hexa because they didn’t have as big of security teams and wanted to automate a bunch of use cases and be able to use GenAI to get more leverage and get more productivity out of the smaller teams they had. So we saw really good execution there. And then, as we hit on, our net new logo count was outstanding. And then, as I highlighted, the percentage of new logos that came in through T1 was outstanding.

So really it was across the board,

Jonathan Ho (Analyst)

Fantastic. And then just as a quick follow up with Tenable One adoption, can you help us understand this can serve as potentially a stepping stone for broader adoption of the more advanced versions of Tenable One as well as Hexa, but does it also expand the types of assets that you can cover for customers? Just want to see what you’ve seen with customers as they’ve adopted Tenable One and what that roadmap looks like once you’ve gotten them onto the platform.

Mark Thurmond (Co-Chief Executive Officer)

Thank you. Yeah, you bet. I mean, what we see, and Matt covers this quite a bit in regard to the expansion, in regard to the margin and the ASPs we see in our deals, when you move up to especially Advanced, you’re usually looking at two, three, sometimes four different asset types. You’re also leveraging a much more advanced attack path analysis capability, which a lot of the customers want now. And obviously you’re getting significantly more tokens to run Hexa AI.

And then our prioritization is extremely clean when you look at what we’re doing from an Advanced package. So it’s multiple layers in regard to what we’re doing, but we’re landing the majority of our Tenable One. When you look at the new logos and you look at the expansion, it’s significantly coming in in Advanced compared to Foundation.

OPERATOR

Thank you. The next question is from Roger Boyd from UBS. Please go ahead.

Roger Boyd (Analyst at UBS)

Great. Thanks for taking the questions and congrats on the nice results. Good to see pipeline conversion starting to tick up. For Steve or Mark, just on PHP for Shell, can you remind us what impact Log4j had on your business? I know it’s a little hard to parse out, but was it in some way a tailwind? How do you see that situation maybe comparable to what’s going on with PHP for Shell in terms of that driving interest and very clearly helping the Hexa volumes?

Steve Vintz (Co-Chief Executive Officer)

Well, over the years we’ve seen a Number of threats and breaches, and some have had an impact and others have not. And with regard to Log4j, I think it first surfaced in Q4 of 20. We saw the expansion rate inflect higher than I think in the subsequent quarter that was Q4 of 2021. And then in Q1 of 22 we also saw the growth rate expand and new business strength. And look, as we look at PHP T here, our first area of focus is really supporting our customers in time of need. It’s too early to quantify right now the impact it will have on our business. But clearly we’re spending a lot of time with customers. Engagement with customers has never been better. We’re seeing record impact on the number of attendees for webinars, and web traffic is all up, and all the early signals are there. But look, security teams are buried right now trying to figure out what this means for them internally, and that takes time.

So our focus is making sure that we’re providing the support and the resources necessary to help them assess risk. I think what it also signals is that exposure management is center stage here in the midst of all these AI-enabled threats and AI-enabled attacks and AI-driven exposures. So we see a good, durable tailwind of growth for Tenable in the quarters and weeks to come. And I think the results in the quarter are an early sign of this. So PHP had little impact in the quarter just given the timing, of course.

But what’s driving the momentum and the inflection of the business today is what we’ve talked about since the early part of the year, which is Mythos is creating not a moment, but it’s creating certainly a mandate for us to go out and expand with customers, transact new business, close larger deals, and as a result exposure management is becoming more strategically relevant to our customers.

Matt Brown (Chief Financial Officer)

Yeah, thanks for the question. So gross margins were 81.5% or so. That’s in line with our historical range of the low 80s. I expect that it’ll probably remain about there. Hexa is not putting pressure on our gross margins because in order to get access to Hexa, customers need to upgrade into the platform, which is a huge pull then for customers to upgrade. And you’ve heard us say it many times now on this call. Tenable One was a record for us this quarter. Hexa was a big part of that. And so once customers are into the platform, their upgrade and the price increase and the value that they get along with the value that we receive sort of pays for that Hexa usage.

Once customers have run out of their allotment within the platform, there’s an add-on SKU that protects us from a margin perspective while we’re encouraging more and more usage in Hexa because we think it provides very, very valuable insights. Customers ultimately pay for that once they run out of their allocated amounts within their package. Thank you.

OPERATOR

Thank you. The next question is from Adam Borg from Stifel Financial. Please go ahead.

Ben Goldberg (Analyst at Stifel)

Hey guys, this is Ben Goldberg on for Adam Borg over at Stifel. Thanks for taking the question. Just double-clicking on that add-on SKU you just mentioned. So I know you mentioned it last quarter. Did you kind of see that increase this quarter given the stronger Hexa volumes? Is that recognized ratably or on a consumption basis?

Matt Brown (Chief Financial Officer)

Yes, we did see a tick up this quarter, but for us the main draw really is in moving folks into the platform and specifically into Advanced where they’re allowed a pretty significant volume for Hexa usage. We think that’s a large reason why three-quarters of customers of our new business are opting to go into Tenable One Advanced. So in terms of being a sort of a revenue growth driver for us, which I think is probably what you’re getting to, the revenue growth driver really comes in the form of the platform, which we’re really happy to see come through this quarter, and we expect that trend to continue.

Ben Goldberg (Analyst at Stifel)

That’s great to hear. Thanks guys.

OPERATOR

Thank you. The next question is from Joseph Gallo from Jefferies. Please go ahead.

Liam Bellamy (Analyst)

Hi, this is Liam Bellamy on for Joe Gallo. Thanks for taking the questions. You described OT security as very strong globally last quarter, particularly in Fed, and we’ve seen several attacks on critical infrastructure in recent months. Is OT gaining further momentum within Fed and is it becoming a repeatable cross-sell motion across the broader commercial installed base?

Mark Thurmond (Co-Chief Executive Officer)

Yes, it is. And we were very, very happy with the results we saw in Q3 for OT globally. So it is continuing to gain momentum and specifically in Federal was an outstanding quarter for OT, not only within the federal government which played a very large role, but also in the state and local business. When you look at, for instance, like Watershed in Texas and all of the different critical infrastructure, water treatment plant issues, we saw really good adoption of OT in state and local.

So yep, happy with the adoption not just here in the U.S. but globally for OT and definitely was a highlight of our federal business in Q3.

Liam Bellamy (Analyst)

That’s great to hear. Just a quick follow up. I think it’s becoming clear that patching is the most important aspect and the competitive differentiator in EM. Can you talk through where you are in that product journey? I know the ambition is fully autonomous patching, but when can that come to fruition?

Steve Vintz (Co-Chief Executive Officer)

Sure. So first just a reminder of what exposure management is because it’s very different than vulnerability management. Vulnerability management is the discovery of CVEs, and the output of which is a report, and it’s often sold to a frontline security manager or maybe even a pen tester. Exposure management is very different. It’s the outgrowth of vulnerability management and assessment into solving a much bigger problem. And it’s really predicated on three things.

Number one, identify all your exposures across a wide range of domains. Number two, prioritize what’s truly at risk. And then three, remediate and confirm the fix actually reached the production environment. I mean that’s exposure management, and some capabilities we have natively in the platform to be able to address the fix. Others we integrate with third parties to help orchestrate the fix. And we want to do that in a very seamless way with our customers. So sometimes we’re leveraging APIs and MCP, other times we’re doing it natively ourselves. But the key takeaway here is we’ll continue to go deeper and wider on remediation, number one. Number two, the mandate for us has evolved.

It’s no longer about finding problems, we’re about fixing problems. That’s what exposure management is about. And that’s why Hexa, which is part of our agentic harness, is so important, because it sits on top of our best exposure data fabric and data fabric that’s been built over the last 20 years. And data fabric that a lot of this exposure data sits behind the garden firewall. It’s not publicly available, and it’s also tied to our vast sensor network that feeds it raw telemetry data.

So that differentiation, that’s what gives us the ability to help our customers address AI threats and move at machine speed. Because that’s what this environment demands. And remediation and orchestration is a big part of it. And so we’re happy with how we’re serving customers today and look for deeper and wider capabilities there.

Liam Bellamy (Analyst)

That’s really helpful. Thanks so much.

OPERATOR

The next question is from Patrick Colville from Scotiabank. Please go ahead.

Connor Weed (Analyst)

Hi, this is Connor Weed on for Patrick Colville. Congrats on the quarter. It’s nice to see that 9.5% revenue growth and in terms of the full year guide, I was wondering if you could provide more color on what you were seeing in the business and the pipeline to give the confidence for the magnitude of that raise there. Thanks.

Matt Brown (Chief Financial Officer)

Yeah, hi, this is Matt. So we were really happy with the quarter and our ability to raise the full year guide and not just for revenue but really across the board. And part of what gives us that confidence in order to do that was the performance that we saw in Q3 but also the pipeline growth that we’re seeing in Q4. You mentioned the revenue growth that we saw in Q3. We also talked about TCP growth at 9%. We think that probably ticks up slightly in Q4 and that’s giving us confidence to be able to raise the guide for revenue in Q4 as well.

So yes, we’re happy with what we’re seeing in momentum in the business and our ability to take up the numbers from the top line all the way down to the bottom.

Connor Weed (Analyst)

Great, thank you.

OPERATOR

The next question is from Mehta Marshall from Morgan Stanley. Please go ahead.

Abhishek Murli (Analyst)

Hi, this is Abhishek Murli on for Mehta Marshall. Thanks for taking the question and congrats on a great quarter. Just curious if we could follow up a little bit on the federal aspect. Any sort of quantification or commentary on how much that contributed to the upside outside of the OT piece and then any sort of broader sort of feedback or commentary on what you’re seeing in terms of the federal landscape overall?

Steve Vintz (Co-Chief Executive Officer)

Yes, as you know, we have major market leadership in Federal across a wide range of three-letter federal agencies. We’re pleased with the results of our federal business this quarter. It was strong. And the one thing I will say here is that we’ve seen, if you look more broadly at the U.S. Federal space, we’ve seen a wave of new security policy drop over the last six months. We believe that policy will ultimately be a tailwind for Tenable. The federal government is moving towards a preemptive, risk-based security model.

So we believe Tenable is in the right category at the right time. We’re working directly with CISA, we’re a part of the JCDC. With regard to a response for PHP2 Shell, we’re participating in Gold Eagle, which is the AI security vulnerability clearinghouse. We participated in the launch event for Project Watershed250, which is what Mark talked about earlier, working directly with the NCD, National Cybersecurity Director, Texas Governor, other dignitaries along those lines.

So we expect big things in the U.S. Federal space. We know we have an election coming up. Cybersecurity is a bipartisan issue. It will have bipartisan support. We expect budgets to be strong here, perhaps with a divided government. Depending on the election, we’ll see a CR, but we’re in one now that could likely extend into January. That’s nothing new to cyber, nothing new to Tenable. And so we expect to continue to take in one share in the U.S. public sector space.

And that would also separately include state and local, as Mark mentioned.

Abhishek Murli (Analyst)

Super helpful. Thank you.

OPERATOR

The next question is from Rob Owens from Piper Sandler. Please go ahead.

Rob Owens (Analyst)

Great. Good afternoon. Thanks for taking my question. Maybe you could help me a little bit parse the delta between your net enterprise adds as I look at that year over year versus these record new logo Tenable One quarter that you just had. Thanks guys.

Matt Brown (Chief Financial Officer)

Yeah Rob, I can take that. One of the dynamics, and I mentioned it in my prepared remarks, that we’re seeing is we’re happy that we added 413 new enterprise customers. But the dynamic that I think is driving value even more is actually the value that the larger customers are bringing. So we saw new six-figure annual account value, contract value, go up 18% year on year, which is really showing that customers are not only moving to the platform, they are moving to the platform, spending more, and expanding once they are there too.

So our larger customers are spending more, which is great. In addition to that, you can sort of take your pick on the top-line metrics that we saw for the quarter. It wasn’t just the revenue growth; it was the expansion in our net dollar retention rate moving from 106 to 107. So another quarter of expansion there. Of course there was the record 59% of new business into Tenable One. That was a big deal too. But it’s also things like CRPO that grew 12%. CCB growth was 9%, so 95% recurring revenue kind of across the board.

When you look at the top-line metrics, it was just a really, really strong quarter.

Rob Owens (Analyst)

Great. And last quarter you spoke to that expansion rate potentially being flat to up, and it’s great that it improved another point quarter over quarter. How are you thinking about the fourth quarter from here, and was there any dynamic that helped that from the Fed here in the third quarter? Are you seeing that kind of across the board in terms of expansion? Thanks again.

Matt Brown (Chief Financial Officer)

Yeah, I expect that the 107 probably remains intact in Q4, and Fed helped contribute in Q3, and I think Fed will do well again in Q4, but we’re expecting that rate to hold steady at 107.

Rob Owens (Analyst)

Great. Thanks for the color.

Matt Brown (Chief Financial Officer)

Thank you.

OPERATOR

The next question is from Josh Tilton from Wolfe Research. Please go ahead.

Josh Tilton (Analyst)

Hey guys, can you hear me?

OPERATOR

Yes, yes we can.

Josh Tilton (Analyst)

Awesome. Thanks for sneaking me in. I have two questions and I’ve been bouncing around on a bunch of calls, so I apologize if people asked this already. But my first question is just I believe in the quarter there was a point where you guys made a flip or a switch to the Hexa product that kind of enabled customers to do more of these continuous autonomous workflows, like basically really get real value from the product. And I guess my question is what have you seen from a usage perspective within Hexa in the customer base since you made this switch?

And if there are any customers that have really been using it, like how are they addressing their token limits and what are they doing with tokens if they’ve reached their limit? And then my second follow up question, probably more for Matt, is just we have these long-term targets out there. I think they call for an improvement in the revenue growth back to the double-digit range at some point. Not asking for guidance here, but we’re going to get an outlook for next year and I’m trying to understand, are we going to start to see the trajectory of revenue growth trend toward that double-digit range next year, or is this more that inflection happens as we get closer to the long-term target year?

Steve Vintz (Co-Chief Executive Officer)

Hi Josh, this is Steve. I’ll take the first part of the question with regard to Hexa adopting new use cases. Something we talked about, something we launched recently, was Hexa now has a coordinated fleet of AI agents that continuously identify critical exposures and orchestrate fixes, so you don’t have to come in and prompt every time that you want to be able to take an action and you want to be able to remediate and take effects. So that’s a huge productivity boost for security teams who are trying to do more, perhaps with less.

In a heightened threat environment where there’s more applications and agents and the attack surface is expanding, customers are using Hexa to resolve their most critical vulnerabilities. I mean we saw a dramatic increase in the number of usage, the number of customers that are using Hexa, and the number of customers and the usage within those customer cohorts. So that’s what’s exciting about Hexa. What used to take hours, or should I say days, now gets done in hours and sometimes even minutes.

And customers can build automated routines. And the right way to think about Hexa is really twofold. Number one is helping solve the drudgery, automating workflow and major pain points for customers and security teams, and reducing the amount of cycle time that it takes to help understand, assess and analyze an environment and then, more importantly, go out and just get stuff done. That’s a big part of the value prop for Hexa. And again, these are things that we can do natively within the platform to reduce risk, but also integrating with other security providers because no security company can fix everything.

Matt Brown (Chief Financial Officer)

Yeah. And Josh, I’ll answer your second question. So we feel really good about our long-term targets. What we feel good about in particular though is the leading indicators. And you saw a lot of those in the quarter and I think we’re going to continue to see those. New business growth is performing really, really well. Bookings are fantastic and revenue follows and we know that revenue lags a little bit. So as we look at a couple of years, of course we feel good about the midterm targets that we put out there.

But right now we’re focusing on some of the underlying leading indicators in the business.

OPERATOR

Hello, the next question is from Rich Poland from Wells Fargo. Please go ahead.

Rich Poland (Analyst)

Hey, thanks for taking my question. I guess just one quick one around the Tenable One uplift. It’s great to see the continued success there. And I’m curious if you mentioned a lot of the ACV expansion related to Tenable One and just kind of the shift over to the platform there. I guess if we put a finer point on it, I think the like-for-like uplift you’ve talked about in the past is somewhere in the realm of 25% plus when it’s on the advanced side.

I’m curious, is that something that you think you guys are starting to see realized now, or would you say the focus is more on getting people over to the platform first and then you could worry about the potential uplift over time?

Steve Vintz (Co-Chief Executive Officer)

Yeah, it’s actually a little bit of both because we see increasingly brand new customers are coming directly into the platform and they’re spending more. Average customer value is double in the platform what it is versus standalone SKUs. And if you look at—you forget about our Nessus product, but Nessus actually serves as an on-ramp to the platform as well. We are seeing Nessus customers not only upgrading into some other standalone SKUs, but also directly to the platform.

And those customers are platform customers are paying 15 times what Nessus customers are paying. So there is a meaningful on-ramp when you are going from Nessus into standalone SKUs or from standalone SKUs into the platform. Once they are there, they are also expanding usage, which is another way that they can increase value. So yeah, we are really happy with the motion of moving folks into the platform and then once they’re there, expanding. Thank you.

OPERATOR

This concludes the question and answer session as well as the teleconference today. You may disconnect your lines at this time. Thank you for your participation.