Thank you for joining us for our Growth Stock Conference and today's session with Tenable. My name is Jonathan Ho. I'm the analyst covering Tenable for William Blair. Our speakers today are CEO Steve Vintz and CFO Matt Brown, who will provide an overview presentation of the company, followed by a fireside chat. Before we begin, I'm required to inform you that a complete list of research disclosures or conflicts of interest is available at our website at www.williamblair.com. As a quick reminder, the breakout session will be held in the Jenny B room. With that, I'll hand it over to Steve and Matt.
Thank you, Jonathan. It's great to be here this morning, and great turnout. Tenable is the exposure management company, which means we help customers understand and reduce risk. That mandate has never been more important than in the agentic era. Safe harbor statement, quick overview of Tenable. We're roughly $1 billion in sales and top-line sales and revenue. 2,000 employees, over 40,000-plus customers, and nearly 20,000 enterprise customers. Over the last five years, we've doubled the top line, and we've tripled the cash flow. More importantly, the shape of our business has changed just as much as the size. 30% of our total sales is from our exposure management platform, which we'll talk about, Tenable One, and that's leading to larger, more strategic deals. Over the last few years, we have doubled the number of six-figure customers.
We've tripled the number of seven-figure customers, and the value we're delivering to customers is much more expansive. Quick backdrop about the threat landscape and the market dynamics here. Losses from cybercrime are absolutely staggering. Nearly $10 trillion this year. That number will grow to $16 trillion over the next three years. That's leading to and creating a bigger opportunity for cyber and Tenable in particular. If you look at spend, total spend in cyber over the next three years, that's expected to exceed $400 billion. That's software services and other solutions. More importantly is the shape and the quantum of those dollars and where they're going, which is towards AI and securing AI systems, applications, and models, which are now deeply tied to enterprise workflows. It's one of the biggest threat vectors in all of security.
That has created an incremental $35 billion a year opportunity for us, on top of the $30 billion TAM for core exposure management. One of the reasons why we're seeing more losses, more breaches, more spend in security is because over the years, we've become a very digital society, and it's expanded the attack surface. Today, organizations are managing about 2,000 cyber digital assets per employee. We're talking about servers, desktops, laptops. We're talking about APIs, containers, cloud workloads, identity stores, agents, and much, much more. All of that compute, all of that digital transformation is resulting in more vulnerabilities. Today, the number of CVEs, critical vulnerabilities and exploits, is over 300,000. Last year, according to the national database, there was 50,000 new vulnerabilities added alone. If you look at Mythos, a lot of talk about Mythos and the frontier model companies.
Since its preview, April seventh, there's been the discovery of 10,000 new vulnerabilities. Some are 27 years old. I think one of the big takeaways here is that we're living in a world where you're going to see the proliferation of vulnerabilities by 10, 20, or even 30X. It's coming, and it's overwhelming security practitioners. Here's the bigger problem. Number of vulnerabilities is increasing. The meantime from vulnerability disclosure to exploit is not months like it was a couple of years ago. It's one point six days. Attackers are moving fast to weaponize AI. Security practitioners, the average SLA time it takes to remediate a critical vulnerability, by the way, it's not one point six days, it's not 10 days, it's not 20 days, it's not even 30 days. Last year, according to the Verizon Data Breach Report, it was 40 days. This is a big problem.
Proliferation of vulnerabilities and exposures, threat actors have a decided advantage. As a result, we need a new security model, the demand for and the importance of exposure management has never been greater. This is a simple marketecture of where exposure management fits into the overall security continuum. The most important line here is breach, which is the middle of the slide. Sometimes you call that boom in the security market. Anything right of boom is detect and respond. It's where practitioners are actively triaging threats. It's where a threat or an attack is actively underway, and you're trying to minimize the blast radius, and you're often moving at human speed. When defenders lose that battle, the cost can be extraordinary. On average, it's $4 million to $5 million of direct costs. That does not include the reputational harm, lost customers, and other soft costs.
As a result, we need a new model. What Tenable does and what exposure management is about is unified visibility, unified insight, and unified action. It's about shifting the security paradigm from reacting, from fighting fires, and looking for plumes of smoke, to fireproofing. Exposure management, Gartner says that when companies do it, they're three times less likely to be susceptible to exploit. It's one of the biggest spending priorities in all of cyber. Let's talk a little more about that. Before we do, we're the recognized leader in exposure management. Don't take our word for it, look at Gartner. We're in the top right in the Exposure Assessment Platform MQ. Forrester has a UVM report. IDC has their version of it, which, Exposure Management, we're top right there. Leadership is clear. What is exposure management? What is it, and what is it not?
It's not vulnerability discovery. We're not in the vulnerability discovery business. The frontier model companies are, they're doing it quite well. They're racing to build the world's leading intelligence layer, the best correlation engine that the world has ever seen. We're big fans of that. That's why we partner with them, and that's why we're working together, doing joint research. That's why we have access to non-public models, and that's why we're deeply embedding them into our exposure management platform. Discovering new vulnerabilities is not what we do. Yes, we've discovered 500 new vulnerabilities since our IPO in 2018, but here's what exposure management is. It starts with discovering your entire digital footprint, all of your systems, your workloads, whether it's on the network, whether it's in the cloud, whether it's on the factory floor.
We discover all of that, all your devices and systems, and we inventory it, and then we enrich it with ownership data. If there is a breach, we can tell you what vulnerability and what device and who owns and who's responsible for that data. More importantly, we assess all those devices and systems, network, cloud, manufacturing facilities, for vulnerabilities and exposures. To be clear, a vulnerability and exposure for us is not just a CVE, a critical vulnerability, a finding, or a bug in a code. Matter of fact, much of the data we collect is not that. It's misconfigurations. It's compromised credentials. It's over privilege, entitlement, and access. It's often operational errors in the race to deploy new technology, in the race to innovate. More importantly, it's the prioritization of those. You can't triage and remediate and patch everything, not in the agentic era.
We're able to identify a critical vulnerability, determine if it's been recently or frequently exploited, and we can tell you if that vulnerability is on a device or system that has sensitive data. We determine the context and the criticality of that data. Moreover, we're able to chain all those things together in a way to identify critical attack paths. Critical attack paths that threat actors are likely to take to exploit your most sensitive data. Then it's the remediation piece of it. That's our North Star. It's the aggregation of all the data that we collect to be able to provide the context so security practitioners can take action to reduce risk in an automated way and do it deterministically with confidence. Then we can validate if that action was taken, did indeed secure or reduce the exposure.
Our platform is built on three critical layers here. The first layer is basically our surface and signals. Over the last 20 years, we've earned the trust to be placed, have sensors, on a data center and an enterprise network. We've earned the trust from Fortune 500 companies to do passive network monitoring in telecommunication systems and oil refineries and manufacturing facilities. We also have agents that are deployed on endpoints and cloud workloads. We also have identity telemetry that's both on-prem and in the cloud. In aggregate, it creates major moat for us. It's infrastructure, it's sticky, it's hard won, and it's an important part of what we do, and the rest of the platform is built on that. Which takes us to our Exposure Data Fabric. We, over the years, have one point seven, nearly two trillion of findings.
These findings allows us to take raw telemetry data and turn it into a unified model so we can help customers assess risk across a wide range of domains. We're able to correlate it, decorate it, score it. We also ingest data from other security companies. By the way, we're leveraging the frontier models to help us explain risk better, to help us do reasoning better, and correlate better. More importantly, what all that provides is the third layer, which is Hexa, our agentic engine that we released a couple of weeks ago, and we announced at our exposure conference in our investor day. Hexa is our agentic engine that sits on top of our data fabric, and it comes with a fleet of agents. Customers can build their own, but we also have a lot of agents that are in Hexa.
That allows you to automate critical workflows, that allows you to take action, whether it's isolate an asset on a network, whether it's apply a patch, whether it's changing a configuration, and even over the course of time, adding and compensating controls. It is our North Star. It takes vulnerabilities and turns them into fixes. It takes manual workloads and automates them. It also takes lots of manual systems into a single unified platform. Super excited about where we're going. AI, it creates certainly major tailwinds for us. The right way to think about us in the context of AI is number one, securing the attack surface that AI creates, AI applications, systems, models, workloads. That's proliferating. All of that needs to be secure.
All of that is important to discover and assess, be able to monitor prompts and tie it back to your policy. The second thing is the force multiplier on the insights that we can deliver, and more importantly, the action we can take, not only to help customers understand risk, but to reduce it in an automated way, so defenders can fight AI with AI, move at machine speed, which is what this threat environment demands. With that, I'll turn it over to Matt Brown, our CFO.
All right. Thank you, Steve. Okay. I'm going to jump into some of the numbers. What Steve just laid out was super important to understand the opportunity that's in front of us, but I think it's also important to understand where we've come from and the foundation that we're starting from. One of our strengths is the depth and breadth of our customer base. We've got over 40,000 customers spread out over 160 countries. We've got over 8,000 channel partners, and our revenue is highly recurring. You can see here, these numbers are as of Q1, which ended in March, but 96% of our quarterly revenue was recurring in nature. Over the past several years, this is revenue on a trailing 12 months basis, we've grown revenue 13%.
As of the end of Q1, on a trailing 12 months basis, we've now exceeded $1 billion in revenue for the first time. I give some of that context because the opportunity in front of us is massive, but it matters where we've come from. We're coming from a really, really stable base of consistent growth and a vast customer base. All of these customers are becoming increasingly concerned about the threat that AI poses, and they're looking to Tenable to help them address those very specific concerns. While we've been growing our top-line revenue, we've also been growing our profit, which is a really important thing for us to balance both revenue growth with profitability growth. You can see that's increased tremendously over time.
On a TTM basis in Q1, we're now at 22.7% op margin, which is up from just over 10% several years ago. That's translating to additional cash as well. Cash flow generation's super strong, which is increasingly an important part of our story. One of the things that we've been doing with that cash is we've been buying back a lot of shares. We believe that our stock is trading at a price that doesn't represent the true value, and as a result, we've been leaning in heavily on share repurchases. At the beginning of the year, we asked and the board authorized an incremental authorization to our share repurchase program of $150 million, bringing that authorization over $300 million.
We've leaned heavily into that, spending $130 million in the first quarter, and we're going to continue to do that throughout the year, again, because we think that's a really good use of capital right now. I want to talk a little bit about Tenable One. Steve laid out why Tenable One is so important for our customers. For our customers being able to use Tenable One for identification and to gain insights, and then finally for action with Hexa, the benefits to our customers are clear. The benefits to Tenable for our customers being on the platform are also clear. We know that customers that are in the platform have longer contract durations. Tenable One customers have contract durations that are more than 10% longer than our non-platform customers. We know that Tenable One customers spend more money with us.
They have much higher ACVs. In fact, Tenable One customers, ACV there is two to three times our non-platform customers. Those customers also expand more. Average expansion, when our customers do expand, is more than double in the platform versus not on the platform. We know that there's a competitive differentiation. When we're in head-to-head bake-off situations with our competitors, when we lead with Tenable One with the platform, our win rates are significantly higher than when we lead outside of the platform. Finally, moving customers from being not on the platform to in Tenable One, we see a significant price increase. We have two Tenable One platforms now. We have Tenable One Foundation and we have Tenable One Advanced, and this is relatively new for us.
Standalone customers that are doing standalone VM today, moving from standalone into Tenable One Foundation, they see a modest price increase of about six percent. For us, that's important. That's a nice on-ramp for those customers to get into the platform, and then they can expand from there and move on to Tenable One Advanced. The Tenable One Advanced price uplift is 60%, so quite significant. The idea is for us to get them into the platform, ideally expand, and then move upward, and we're meeting our customers where they are on their exposure management journey. We're already seeing early success with this. There's new pricing, new flexible pricing that goes with it that we've been able to see some real benefits from already as well. What this translates to is that within the platform, we're seeing growth in the mid-teens. All right. The non-platform growth is about mid-single digits.
You can think of that as sort of our legacy business. That's important because it matters for what our growth algorithm is today, and then also as we look ahead. This is what the growth algorithm looks like. Today, platform customers represent about a third of our business, and again, growing at about the mid-teens. Non-platform is the remainder, and growing in mid-single digits. That's translating to high single-digit revenue growth today. What we expect, though, over the next several years, is that Tenable One will continue to occupy a larger portion of our overall business and will continue to grow in mid-teens. When I talk about that growth rate, that's adjusted for platform change. Right?
If a customer was spending $100,000 with us not in the platform before they convert to the platform, and maybe now they're spending $115,000, that's 15% growth in the platform, not 115% growth. All right? This is all normalized for platform change. The composition now of the revenue as we look ahead to 2029 is that more than half of our business is going to be on the platform while continuing to grow mid-teens, and the rest is continuing to grow in mid-single. That translates to increasing revenue growth in the high single digit to low double digit revenue growth range.
What we really are trying to do is get roughly a 20 percentage point shift in the composition of the business moved over and growing in mid-teens, and that's how you get that two to three percentage point growth in the revenue growth rate that we expect to see over the next several years. What does it translate to in terms of midterm targets? We had an investor day a few weeks ago, put these midterm targets out. I wanted to share them again with you all here. You can see the FY 2026 guidance there at the midpoint, where we're growing high single digits in revenue, and that's translating to about 24% margin for op income and unleveled free cash flow margin at 27%.
We expect again, by leveraging the growth that we're seeing in the platform, that by the time we get to exit 2029, that revenue growth is going to begin to inflect higher. We'll see accelerating growth in the high single digits to low double digit revenue growth, while at the same time, we'll continue to add profitability. Getting from op margin, adding roughly 150 basis points per year from the end of 2025, coming a little bit from gross margin. We expect to basically maintain that level at 82% or so, most of it coming from sales and marketing and a little bit of G&A to get about four percentage points over the next three years. That sort of lays out the foundation from a financial perspective and what we see as we look ahead to exiting 2029.
I know we want to leave at least a few minutes for some Q&A, so I'll just advance to the next slide and we can take it from there. Yeah.
Thank you so much for the presentation. Why don't I kick it off in terms of the questions, and then we'll turn it over. We probably have time for one question from the audience as well. I think the primary question I have for you is, when we think about Mythos and we think about this potential gain in function from the next generation of models that's coming out there, not only is it more capable in terms of discovering far more vulnerabilities and far more quickly, but there's also a chain capability that allows you to put together multiple exploits that's far more dangerous than what existed in prior versions of these models as well.
I can imagine the day that Mythos becomes generally available, then suddenly, all of the bad actors that are out there, all of the threat actors, they're going to have a field day initially putting this to work, identifying all these vulnerabilities, and suddenly, your customers who are already overwhelmed in terms of the number of vulnerabilities they're dealing with pre-Mythos are going to have a very difficult time. Now, in a lot of our conversations with these types of customers, they're asking us what they should do. Can you help us understand when they come to you, what does that conversation look like? What can you do to help them, and what does that do ultimately in terms of the ability to translate to revenue?
Sure. It's a great point, and as Jonathan just laid out, there's something called the defender's dilemma in cybersecurity, which is the threat actors just need to exploit one thing to be successful, whereas defenders need to secure everything. If you look at the defender's dilemma today, there's a proliferation of vulnerabilities. The attack surface has expanded. There's the adoption of new technology. By the way, we haven't even talked about agents. On average, I think you're going to see hundreds of thousands of agents from companies over the course of the next couple of years. All of that needs to be discovered and secured. When it comes to how we can help our customers, number one, I think we talked about this on the last earnings call at Investor Day, but the level of engagement with our customers has been absolutely overwhelming.
They're turning to asking us, "What can we do?" Our advice is this: Because we've partnered with Anthropic. We're a tier 1 partner. We've partnered with OpenAI. We are part of the ONCD, the Office of the National Cyber Director Task Force, helping the federal government, who arguably is the most sophisticated consumer of cyber technology in the world, helping them identify best practices
Working to help reduce their risk in state and local matters, critical infrastructure, and federal systems. It's really simple in a post-Mythos world. Number one, first of all, know what you have. Discover your entire digital footprint. It starts there. What systems do you have? Is it on the network, workloads in the cloud, devices on the factory floor? Enrich that with ownership data, so if you understand there is an attack or a risk, like who's responsible, and you can move fast in hours, minutes, not in terms of days and weeks. The most important thing is assess and prioritize. There will be a proliferation of vulnerabilities. It's not just a one-time thing. It'll continue to play out here over the course of quarters and even years. Prioritization is not optional. It's critical. What are your most critical exposures?
In exposure management, it's the fewest actions that have the biggest impact to reduce risk and to do that in a very automated way. That's what we're all about here. In order to do that, and to do that deterministically and to allow defenders to have the confidence to do that, it takes our exposure data, the context, the Data Fabric. Know what you own, ruthlessly prioritize, and then move at machine speed, those three simple things.
I'll connect to how that generates revenue growth. Exposure management has never been more important, and there are now greenfield opportunities for companies that have not taken exposure management seriously in the past, or perhaps early on in their exposure management life cycle. Those companies are now faced with a reality where prioritization is absolutely critical. Understanding what's in your environment and what are you going to do about it is necessary now. There's brand-new opportunities that are happening. In addition to that, you brought up a great point, which is these models are not only good at discovering new vulnerabilities, they're also really good at chaining together what could've been low criticality vulnerabilities and chaining those together to form an advanced attack. Well, what that means then is that our customers are going to need to scan more of their environment.
It's not good enough to focus just on a subset of their environment. They're going to need to scan more. For us, that means within the platform, that's an expansion opportunity. We have both new opportunities, we have expansion opportunities, and as we hopefully laid out a little bit in the slides, we're coming from an incredibly strong position, having our roots in VM and having established this category of exposure management, really ourselves, leading the way. Again, not just us, it's Gartner and it's Forrester and it's IDC saying it. We believe this opportunity is ours for the taking.
Absolutely. Go ahead.
You've outlined 2029 targets for free cash flow. How much would that be if, 31%, how would that go down if you include stock comp out of that?
Can you take the question?
Sure. Yeah. The question really is talking about stock-based comp and how that's impacting those numbers and if we had adjusted for stock-based comp, what the cash flow would look like. I can't tell you the exact numbers. You're saying if stock-based comp was cash instead, is that sort of?
Your question really is just, hey, take the stock-based comp as a percentage of revenue and just deduct that from the margin. We're basically at high teens right now, down actually year-on-year from stock-based comp as a percentage of revenue, and that's something that we're going to continue to manage and look at. The reality for us of stock-based comp is we're in a really competitive environment, and when you look at our peer companies, we're in pretty good company with how our stock-based comp as a percentage of revenue ranks relative to our peers. It's a competitive environment to go higher.
Sure. Sorry. Depending on your view.
We generate meaningful cash flow even when you include stock-based comp as a cash charge.
Yes. I just want to be very clear about that.
Yeah.
Yeah. Is there a question or?
My question is, what is stock-based comp going to be per quarter, let's say? You're running at $44 million per quarter now.
If you get to 2029, you've got a projection, I'm just saying.
Yeah.
How much of that projection of 31% is stock-based comp?
Yeah
think is compensation.
Yeah. We think of it as compensation as well. We expect that as a percentage of revenue is going to improve somewhat as well as we get from now until 2029. We'll continue to make progress.
Do you think it'll be flat or show up?
Flat as a % of revenue?
No, flat as in total.
No, it's not going to be flat in total.
The growth in cash flow will far exceed the growth in stock-based comp. We feel really good about the cash flow.
Folks, I think we've reached the end of our time, so thank you very much-
Yes. Thank you
We'll continue in the breakout session.
Awesome
up in Jenny B. Thank you