Alrighty, we will get going here. Thank you all for being here. I'm Roger Boyd. I cover cybersecurity here at UBS. Very happy to have the team from Tenable here. Matt Brown is the new CFO of the company, and Erin Karney is VP of Investor Relations. So thank you, thank you both for being here.
Thanks for having us.
Appreciate it.
Awesome.
I wanted to start high level and go back to a comment that Steve made on the earnings call last month. But he called out that the AI threat landscape is exposing the limits of a traditional kind of reactive approach to security. Can you just explain what that view means, this idea of more fireproofing versus firefighting? And how does that kind of align with what you've built in the exposure management category?
Sure. I'll start, and Erin can fill in on some of the details as well. So what we really talk about with respect to AI is it represents a significant amount of change, right? Everybody's talking about AI, and what every boardroom, you're gonna hear in every boardroom and every management team are three key questions. One, you know, how are you incorporating AI in your products to make them more competitive? Fine. How are you leveraging AI internally to be more productive and efficient? Great. Makes sense. The third is, how are you safeguarding your use of AI, right? And that last one is super important, and represents brand new opportunities for us. And so one of the ways that we are doing that is by providing visibility to our customers for what AI is being used in their environments.
Yep.
There are many companies that know that AI is being used in their environments, but they can't tell who's using it and which specific models are being used. And so our product, AI-Aware, which is incorporated into our VM products, gives companies the ability to see what models are being used, and then it informs them on how they can protect themselves. It can expand beyond that though, right? So with our most recent acquisition with Apex, they brought a tremendous amount of AI capabilities that we are now incorporating into Tenable One, which includes really our more broadly speaking AI exposure, which now not only allows companies to see the AI that's being used in their environments, but also how it's being used, the prompts that are being input.
How do you safeguard the models from jailbreak attempts and other types of prompts that can try to get the AI models to do things that are not intended? And then how do you make sure that what's being fed into those models is in compliance with your policies? All of that represents brand new opportunities now that we think Tenable is extremely well positioned to go capitalize on.
Yeah. I guess maybe to follow up there, how do you feel this kind of evolves as a demand environment? And I look at three key results, fairly strong. Do you feel like we're starting to see this? Do you need kind of an initial, additional lever to come from, like, the regulatory angle? Like, the pessimistic view would be we need to see something happen in a threat environment that kind of forces an enterprise's hands. Like, how do you see this kind of evolving from a budget perspective?
Yeah. I think the biggest piece is companies are realizing that only detecting and responding to threats is not sufficient.
Yeah.
And by the time there's an attack that takes place, it's, in many cases, it's too late. It's very costly, in the form of, of downtime and disruption, and in some cases, real, financial impact. And as a result, then companies are realizing that in order to have the best practice on their security posture, they really have to take a proactive approach. And that's what we, when we talk about fireproofing rather than firefighting, the most mature companies that have developed their exposure management programs are looking at vulnerabilities across the entire landscape and assessing where those risks are before they happen. There's various estimates out there from, from some third-party analysts that the amount of dollars that are being spent on detect and response going forward, some of that is going to shift into, into more preemptive, security measures, which is really what exposure management is all about.
Cool. Yeah, I wanted to dive a little bit into Q3 and again, fairly strong quarter. The net adds continue to stand out. You added almost 450 new enterprise customers. I wanted to dig a little bit deeper into what drove, what's driving some of the momentum on a customer adds perspective and how are you thinking about kind of sustainability of that going forward?
Yeah. We were really happy with Q3. Had nice new logo growth, as you mentioned. Most of that is being driven by Tenable One.
Mm-hmm.
We saw 40% of that new business growth was within Tenable One, which is our exposure management platform. And that's really important for us because Tenable One represents an important opportunity for our customers and also an important opportunity for us going forward where we're seeing more customers that are transitioning from point solutions, whether it's in VM or some of our other point exposure management solutions, into the platform where they can see now holistically across their environment, a much broader view into what the exposures are. Tenable One allows customers to see their vulnerabilities, but then really importantly, how do they assess those vulnerabilities from a risk ranking perspective? You can imagine a CISO that is overwhelmed with the number of vulnerabilities that are in their environment. They have to find some way to prioritize them.
And what Tenable One allows our customers to do is cast a very wide net, scan many assets across, you know, on-prem, cloud, OT, IT, AI, and on, and then risk rank them, giving them business context, you know, who has access, what type of access, what data is included, what are some predicted attack path analyses, how does that all factor in order to then prioritize risks and vulnerabilities that need to be addressed now. That's what's really, really value-add for our customers. And so that's what they get in Tenable One. So a lot of that optimism that we're seeing, the new customer growth came from Tenable One, but that's what gives us a lot of optimism, as we look out into the future as well.
Yeah. When you talk about the strengths of Tenable One, how do you think about new logos from a greenfield, brownfield perspective? And I know all of your competitors have been moving towards this vision of exposure management for you at Tenable One. Competitively, have you seen any big shifts in the landscape? And what have you seen specifically on kind of the brownfield side of new logos?
Yeah. I mean, it's one of the most exciting areas, actually. And I want Erin to weigh in on this too. I don't want her getting lonely over there. So I'll kick it to you in one second. The greenfield, some of the greenfield opportunities that is what we touched on a minute ago with AI.
Yeah.
I mean, that's clearly greenfield. We think that's really interesting, has an opportunity then to grow, so with some of the cloud opportunities that we have. But when we think about brownfield, there's an enormous opportunity that we have to transition our existing VM customers over to Tenable One. So yeah, Erin, you can touch on that a little bit as well.
Yeah. Yeah, definitely. So we're seeing really strong win rates, pretty consistently across the board against all the competitors. What I think when you drill in, what's really interesting is the progress we're seeing within Tenable One.
Yeah.
So that broadens the competitors because you're dealing with cloud, OT, these other areas, but it gives us an opportunity to displace them and then be able to expand within that into those greenfield areas. So even when you're looking at the brownfield, there's a huge amount of opportunity to displace some of those competitors. And third-party data helps with that, which is a recent company we acquired, that allows us to ingest that data, maybe displace down the road. So really all starts with Tenable One, and then within that you have brownfield and greenfield.
Makes sense. And then the other side of the growth formula, net retention, it's been somewhat stable in kind of the single digits, 105%-107% range. I recognize that's a trailing 12-month metric, but how do you think about kind of the trajectory there? And given the strength you've seen in Tenable One, 40% of new business last quarter, what's the pathway to getting that to reaccelerate here?
Yeah. Eventually it stabilizes and even inflects higher. But we know in the near term, it's gonna tick down. So for example, it was at 106 this last quarter, as you mentioned. It's a trailing 12-month metric. That was as expected.
Yeah.
And next quarter's very likely to be 105%, right? It's gonna go down another percentage point. Well, why is that? Well, you're looking back 12 months, and when you have a look at Q4 of 2024, that growth rate was significantly higher than what we're projecting Q4 of 2025 to be. And so that quarter rolls off, the new quarter rolls on, it's just gonna end up being math. So that's not gonna surprise us either. But it does stabilize from there, and it starts with, it really kind of starts and ends with Tenable One and Tenable One adoption. I mean, that really is where our focus is internally on the product development side, as well as go-to-market. We think that that has an opportunity to really inflect higher.
Importantly, we're pretty early there, and there's quite a bit of runway given the percentage of our customers and our overall book of business that is currently in Tenable One. We've got a lot of room to ramp.
Yeah. That's a good segue. I think that number's close to 17% today in the high teens. Is there kind of a target you think about internally about how far Tenable One can go in the install base?
I think it can go really far. We haven't talked about a specific target. You know, are we ever gonna get to 100%? I, you know, doubt it. But it can certainly grow from there. 17% is the number of our enterprise customers.
Mm-hmm.
So we think of something like 3,000 out of 18,000 is that math. But some of those customers are our larger customers. So it skews slightly higher when you think about total amount of bookings or revenue today. But we expect that number to grow, and it's gonna grow in a couple of different ways. Number one, we're gonna get our traditional either core VM or other point exposure management customers into the platform. That's the first way. And then the other is that once those customers are in the platform, they're actually growing faster.
Mm-hmm.
Than customers that are outside of the platform, there's higher retention rates and higher upsell and cross-sell opportunities. So both of those ways are gonna grow that number higher. And we expect as that becomes a higher and larger proportion of our business while that's growing higher, that's gonna help the overall growth rate as well.
Yeah. Okay. The other kind of impact I think we've seen is customers making bigger commitments to Tenable.
Yeah.
And I'm sure part of that is around Tenable One. I think last quarter you mentioned a discrepancy between CCB and RPO and.
Yeah.
Certainly, I think seeing longer deals show up, but can you elaborate on that dynamic and, as you see more of these big commitments, what does that mean for some of those metrics?
Yeah. The first thing to point out is we really like that trend.
Yeah.
So we want our customers to be engaging with us on larger, more strategic, longer-term deals, but we're no longer requiring that they pay upfront.
Yeah.
For those transactions, right? So, what that means is that we end up seeing our contract duration moving up significantly 'cause they've committed, right? But because we're no longer requiring these companies to pay upfront, we're actually allowing for annual installment billings. Our billings duration has gone down.
Mm-hmm.
And what's interesting then is you end up with this distortion effect on CRPO, which in Q3 was 13% year-over-year. That was distorted somewhat positively. Conversely, but for the same reasons, CCB was actually impacted negatively because billings duration went down. So then the question becomes, okay, well, you know, what's the right metric? Revenue grew at 11%.
Mm-hmm.
I think revenue's a great metric, and so it could just be that CCB and CRPO are both distorted, and they're gonna be distorted for some period of time, and that revenue is the best metric.
Yeah. Makes sense. I wanted to talk a little bit about cloud security. And I think there's an investor perception out there that that's been a difficult competitive environment. We've obviously seen some transactions in that space. To what degree have you seen that change, the environment for those deals? And you called it out as an area of strength with Tenable One. And what sort of momentum have you seen with specific deals around cloud security?
I'm gonna let Erin answer 'cause I've got something going on in my throat, and then it can come back to me.
Yeah.
Go ahead.
I'm happy to jump on that one. So I would say the cloud space has been somewhat competitive, but I don't think anybody would be surprised that there's one competitor in particular that's been pretty strong. We see two things. One, you know, we have a really strong cloud product, and we can stack it up against most, and we feel really positive about that. But we weren't necessarily getting all of the opportunities. So either there wasn't a broad RFP out there or they didn't realize Tenable had cloud. So we've really made a big effort to make sure customers know what we have to offer, that we have a strong product. And you know, M&A, recent M&A.
Mm-hmm.
has definitely helped customers to want to cast a wider net. So I would say it's really all of those things that are allowing us to have these opportunities where we're displacing competitors. And it isn't necessarily just one of those things, but definitely all of them is helping to contribute. And we're really, we're really happy with how cloud is growing. And then within Tenable One, it's, it's even more compelling for our customers.
Yeah.
Yeah, it's a strong spot for us. We highlighted a competitive win in the last earnings call that we were really proud of. You know, a good thing about the cloud space is it's a pretty big space.
Mm-hmm.
We think there's room for a couple of strong competitors there, and we're one of them. We're gonna win our fair share, and it continues to be a good source of strength for us.
Yeah. Same, similar question around AI security and exposure. And, I'd be curious to get your perspective. I mean, in, in some ways, it feels like the first place enterprises are gonna turn to try to enforce AI security is gonna be around risk assessment and, and posture management and just getting visibility into what they have. That should set you guys up in a, in a pretty, pretty good spot. But how do you think about that, that demand, showing up over time? And, and how do you think about your right to win? We've seen a lot of companies in the space acquire into like the AI visibility, AI posture management space. What, what gives Tenable the right to win with kind of this broader Tenable One exposure?
Yeah. I mean, it's a huge opportunity for us. One of the things that we did differently with APEX, and Vulcan actually for that matter, is we brought both of those technologies into the platform right away rather than trying to go to market with a separate product or module. That was really important because it becomes a really unique differentiator of Tenable One and the platform. So now customers can go in, within Tenable One, have really effective AI exposure, and view that in the context of their broader security environment, which we think is huge. So that's a really big deal for us. It continues to be a bright spot, and I think it's gonna be a nice source of growth for us.
Yeah. I wanna talk about a couple verticals here, but the first being U.S. Federal, and I think 3Q you'd performed pretty well against expectations that had come down a little bit earlier in the year around some of the uncertainty there. What's been kind of the mood within those customers? And when you think about timing around the Fed shutdown we saw in early 4Q, to what degree did that kind of influence 3Q? And how are you thinking about kind of that opportunity going forward?
Yeah, so Fed for us, to just put it in context, our public sector business is roughly 15%, and Fed is half that.
Mm-hmm.
So, you know, 7% or so. And, for us, you know, we took our pain a little bit in the beginning of the year when we took down the numbers 'cause, you know, we're staring ahead at the opportunities and seeing, you know, some of the disruption with the new administration and DOGE. And, ultimately the shutdown occurs, but by that time we had already reached that expectations.
Yep.
I think that was really important. And since then FedRAMP performed in line or even slightly better with those renewed expectations. And so actually as it, you know, we get to the back half of the year here, we're not expecting to have a significant negative impact from FedRAMP, but.
Yeah.
Erin may have more on that.
I mean, I think you called it really well. The only thing I would add, and there's not necessarily a timeline around this, but the Fed has always been focused on cyber, and they've been a great customer for us and continue to be, and where we see opportunity is we are now FedRAMPed with Tenable One and with cloud security. So while it's pretty noisy right now, and we're navigating through that pretty successfully, we do see areas of opportunity as we look forward and some of the noise dissipates.
Cool. Okay. And then the other vertical is, I feel like it doesn't get as much attention as cloud or AI, but the OT space was called out last quarter as an area of acceleration. And I think there's something to be said about the convergence of IT and OT and CISOs being more involved in those conversations. I know Steve called out the data center market around AI as a potential interesting opportunity. How do you feel about that vertical? And what can you frame that opportunity going forward? What's the differentiation there between some of the specialists in the space?
Yeah. I'm glad you asked about that one. That's been a bright spot for us and I think continues to represent a really nice opportunity as these data centers are being built. It's super important now that there's security around all of the OT assets that are associated. So, it's a differentiator for us because it's yet another vulnerability that companies need to get their arms around. We're providing the ability for companies to get visibility into those vulnerabilities in a really effective way within Tenable One. And so we're seeing some really, really nice traction there.
Yeah. I wanna touch on margins a little bit. 3Q is, I think, a pretty, pretty good EPS, beat 23% operating margin, free cash flows continuing to look nice despite what you called out around on the billing side. Just maybe talk about kind of your visibility there, and then just broadly how you're thinking about kind of the trade-off of continued margin expansion versus trying to invest in a lot of these pretty, pretty fast growth areas across cloud and AI and OT.
Yeah. Our margin expansion is maybe the least appreciated part of our story, actually. We had in Q3 2025, our operating margin was up 350 basis points year on year.
Mm-hmm.
and that is with an 18% growth in R&D.
Yeah.
So pretty incredible growth, investment, reinvestment into the product, but getting much more efficient on sales and marketing and a little bit so in G&A as well. That was just for the quarter, but even when you look year to date, through Q3, still up more than 200 basis points. So pretty confident in our ability to continue to expand margins. The other thing I would add is that's on top of absorbing a couple of acquisitions that we saw that are gonna be impacting OpEx, right? So overall feel really good about our ability to continue to expand margins, and that's something that we're focused on.
Yeah. Maybe to double-click on the sales and marketing efficiency aspect of that, is there more room there to eke out efficiency? Is it like you look out into next year and like there's desire to kind of grow headcount, improve capacity? Like.
Yeah.
How do you think about that? Yeah.
Yeah. So, when you sort of double-click on where are we gonna get more margin, the place we know we're gonna continue to invest is in product development with and in particular in the platform. So we're doing a lot of that now. What we're able to do though is because we switched from what had historically been a GM sort of a model with respect to acquisitions that we had and product categories, we've moved now to flatten that.
Mm-hmm.
Have folks that are focused on the platform still within their expertise and the domains that are within the platform, but within the platform importantly, which has allowed us to reduce and get more efficient, while still pouring investment into development. That's really important. All that really means is a lot of the investment in R&D we're gonna be able to self-fund.
Mm-hmm.
And so R&D will continue to grow, but underneath the surface it's growing even more than you would imagine. So that's important. Every other line we're gonna be able to get some efficiency from. So gross margin's gonna tick up a little bit. Sales and marketing we can continue to get more efficient on. G&A we can get more efficient on. When we think about sales and marketing, we're a very channel-focused company and we will continue to be. We can leverage the channel more to become even more efficient. And so what that means is, you're basically gonna be able to get more out of your quota carrying sales reps. And the efficiency essentially goes up and the effectiveness of each sales rep is gonna go up. And the sales and marketing as a percentage of revenue is gonna continue to tick down a little bit.
Yeah. Makes sense. And then maybe you mentioned R&D and product. Maybe talk about kind of the principles behind that. I mean, you have all these different growth areas. How do you think about kind of dividing your R&D resources and where does kind of continued M&A fit into that category? You've been fairly acquisitive over the past couple of years, tucking pieces into the platform. Are you at a point now where you feel like there's enough breadth to Tenable One or are there potential future areas where you continue to expand?
Yeah. I mean, so we have been pretty acquisitive in the past, and I think, we continue to be open-minded.
Mm-hmm.
Right? So if we saw a company that had a particular, you know, piece of technology that we thought filled a gap, and it made sense, then sure, we would do that. Having said that, I think we have what we need for the most part here. And at this point we're concentrating on executing. So let's take what we've got, make sure that we can make it super effective. We've got a relatively new Chief Product Officer, who's come on board is doing a lot of really great things. We're gonna lean into that. And again, sure, if something came along that we thought we needed to have, great, we would have it. But I think the chances for some type of a large transformational M&A is probably fairly low.
Yeah. Maybe two last ones. Just any broad level thoughts about the demand environment? I think there's, on one side of the page, a pretty healthy view that concerns around the AI threat landscape are gonna continue to fund cybersecurity budgets. But you also hear about budget tightness and procurement still being difficult. How do you think about kind of customer budgets, security budgets into 2026 at a high level?
Yeah. I'll answer, and then I want Erin to answer too. But we're seeing really positive signs from pipeline. That's how, that's the way that I think about it is.
Yeah.
What's our level of opportunity and pipeline look like? And we're still, we're seeing really, really healthy pipeline. Cybersecurity continues to be a focus for companies and, rightfully so. Overall feeling, feeling pretty good.
Yeah. I think it's key to be able to take advantage of the opportunities that are in front of you or those that you know are pain points for your customers, which is why, you know, we've really innovated on the AI side, the cloud side, Tenable One, exposure management as a whole to be able to, you know, take our own share of that exposure management market as it starts to accelerate. And I think, you know, beyond that, one of the things that we had seen over the past couple of years is new business was harder to transact. And one of the things that we're really focused on, as we talked about a couple of times, is getting our existing base onto Tenable One.
Mm-hmm.
So not only landing new there, but also getting our current customers on there and being able to expand with them. It can be pretty sticky once you get a customer there. So we also see a really good expansion opportunity moving forward with the same products.
Yeah. Cool. Last question for you, Matt. 'cause you're relatively newer to the story. What was one thing that attracted you to Tenable? And now being in the seat for a little bit, what's one thing that surprised you?
Yeah. What attracted me initially is still what attracts me today, which is good. I'm now mindful of 30 seconds. I get super excited about exposure management as a space.
Yeah.
I believe in it. I think it's the best way to do cybersecurity. I think companies are moving in that direction. Once you're there, there's no doubt in my mind that Tenable is best positioned to capitalize on that market. And it's not just us saying that. It's IDC and Forrester and Gartner. All of them have us upper right. That to me gives me a ton of confidence and excitement about the future. So I love that. That's kind of piece number one. Piece number two is we've got a super competitive management team.
Mm-hmm.
That is focused on executing. And I love being part of that. So yeah, very excited.
Cool. Well, thank you for joining for.
Yeah.
Great conversation.
Appreciate it.
And thank you all for listening in.
Thank you.