Greetings, and welcome to the Tenable Q3 2026 earnings conference call. At this time, all participants are in a listen-only mode. A brief question-and-answer session will follow the formal presentation. Should anyone require operator assistance during the conference, please press star zero on your telephone keypad. As a reminder, this conference is being recorded. It is now my pleasure to introduce your host, Erin Karney, Vice President, Investor Relations. Thank you. You may begin.
Thank you, operator, and thank you all for joining us on today's conference call to discuss Tenable's third quarter financial results. With me on the call today are Co-Chief Executive Officers Steve Vintz and Mark Thurmond, and Chief Financial Officer Matt Brown. Prior to this call, we issued a press release announcing our financial results for the quarter. You can find the press release on our IR website at tenable.com.
We will make forward-looking statements during the course of this call, including statements relating to our guidance and expectations for the fourth quarter and full year 2026, growth and drivers in our business, changes in the threat landscape in the security industry, particularly regarding AI security, the expected impact of frontier AI models on accelerated vulnerability discovery, and the shift to preemptive security. The expected size, durability, and growth of the market opportunity created by the shift to AI-driven exposure management, our competitive position in the market, growth in customer demand for and adoption of our solutions, including the impact of new pricing and packaging models.
The expansion of Tenable One, including agentic AI security, orchestration through Hexa AI, and planned AI exposure coverage across third-party models, the expected growth, adoption, and role of our CyberAgents Exchange in the agentic security ecosystem, the expected benefits of our strategic partnerships with Frontier AI labs, our ongoing research and development investment, our capital allocation strategy, including share repurchases, and our future results of operations and financial position.
These forward-looking statements involve risks and uncertainties, some of which are beyond our control, which could cause actual results to differ materially from those anticipated by these statements. You should not rely upon forward-looking statements as a prediction of future events. Forward-looking statements represent our beliefs and assumptions only as of today and should not be considered representative of our views as of any subsequent date. We disclaim any obligation to update any forward-looking statements or outlook. For a further discussion of the material risks and other important factors that could affect our actual results, please refer to those contained in our most recent annual report on Form 10-K and subsequent reports that we file with the SEC. Today's discussion includes non-GAAP financial measures. These non-GAAP financial measures are in addition to and not a substitute for or superior to measures of financial performance prepared in accordance with GAAP.
There are a number of limitations related to the use of these non-GAAP financial measures versus their closest GAAP equivalent. Additionally, please see our press release for reconciliations of GAAP to non-GAAP financial measures that we discuss today. I'll now turn the call over to Steve.
Thanks, Erin. We delivered excellent results in the third quarter. On our last call, we discussed the increasing momentum in our business, and this quarter we are very pleased to see that momentum start to translate into acceleration. What excites me most are the leading indicators, which show inflection and signal durability of growth ahead. Our net dollar expansion rate accelerated to 107%, up from 106% in Q2, which is the first time in over four years we've seen acceleration in the expansion rate for two consecutive quarters. Tenable One reached a record 59% of new business, up from 50% in Q2. Average Tenable One deal sizes year-over-year rose for the second straight quarter, driven by the pricing and packaging we introduced earlier this year. CCB accelerated to 9% growth in the third quarter.
These results demonstrate that we're delivering what customers need most, which is the ability to see and act on risk across the entire environment at the speed this new era demands, and no force is shaping that more than AI. Before we dive into the product updates for the quarter, I want to touch upon PHP2Shell, the critical vulnerability disclosed last week. Earlier this year, we said AI would surface more vulnerabilities and exposures faster. That's playing out now. PHP runs nearly everywhere in the enterprise, including web applications, cloud workloads, containers, and legacy systems. The vulnerability is the headline, but the risk goes beyond the vulnerabilities themselves. Organizations need to find affected instances, including those they may not know about, and understand how they connect to misconfigurations, credentials, and critical systems.
Following PHP2Shell disclosure, customers turned to Hexa AI, and we've seen prompt volume increase dramatically by as much as 5X. Beyond Hexa AI, customers have been turning to Tenable as a trusted partner during this critical time, and we've been working closely with them to ensure they can leverage the full power of the platform to reduce their exposure. PHP is a real-time example of a broader shift in the market, and that is AI is reshaping the attack surface faster than most organizations can respond. This is more than a moment. It's a mandate and a structural shift for enterprises. As a result, every enterprise is adopting AI. Every model, every agent, every MCP server they deploy creates new exposures.
Meanwhile, attackers are using frontier AI to find weaknesses faster, and we are now witnessing the early automation of exploit development. The risk extends well beyond CVEs, and we believe this is a powerful demand catalyst for exposure management and a significant growth opportunity for Tenable. As I outlined last quarter, winning in exposure management requires three capabilities: understanding every exposure, prioritizing what matters most, and acting with speed and confidence to reduce risk.
As frontier models become widely available, intelligence itself becomes abundant. The differentiator is putting it to work safely. That is the Tenable advantage. Decades of exposure intelligence, deep visibility across the attack surface, and an AI harness that keeps agents acting safely with human oversight and an audit trail. In this quarter, we significantly expanded what that platform can do across all three. In September, we announced that we are bringing Anthropic's Claude Mythos into Tenable One.
This expands our partnership with Anthropic beyond Project Glasswing. Our first capability, powered by Claude Mythos, Tenable One Adversary View, lets security teams see their environment through the eyes of an attacker. Every time Tenable assesses a system, we learn what is running on it, how it is configured, who can access it, and what it connects to. Adversary View applies Mythos to that telemetry to reason like an attacker. It sees how low-signal exposures can be chained together to reach critical systems, then recommends the specific fixes that break those chains. It is a compelling example of how we are turning frontier AI into differentiated capabilities designed to keep customers ahead of emerging threats.
We also expanded Tenable Hexa AI, our agentic engine for Tenable One. Hexa now works as a coordinated fleet of agents that continuously identify critical exposures, orchestrate remediation, and verify fixes even when security teams are offline.
Since June, Hexa has evaluated more than 2 billion assets and findings, which enable Hexa users to resolve more critical and high-severity vulnerability detections per month than matched peers and patch actively exploited vulnerabilities faster. Tenable Hexa AI saves security practitioners time and resources, enabling them to reclaim analyst capacity, maintain always-on defense, and dramatically reduce mean time to remediation. Importantly, Hexa is model agnostic. It works with leading frontier and open-weight models so customers benefit as those models improve while our harness keeps every action grounded in validated exposure data. Finally, we launched the CyberAgents Exchange, the industry's first open-source, vendor-agnostic registry for cybersecurity AI agents and skills. Its AI Inspector pairs OpenAI's GPT cyber models with Tenable Research to vet community-built components before enterprises deploy them, putting Tenable's data and expertise at the center of trusted agentic security. Cybersecurity used to be about detecting and triaging threats.
Today, it determines how fast the world can adopt AI. As a result, security is no longer a line item inside IT. It is becoming its own business function with a budget tied to business risk and growth. We believe Tenable is uniquely positioned to lead in this AI era, and the momentum we are seeing today gives us confidence in the durability of growth ahead. With that said, Mark will now walk you through how the momentum we are seeing is showing up with our customers. Mark?
Thanks, Steve. Before I jump into the quarter, I want to touch on what we're seeing in the field and how we've responded to PHP. Tenable Research closely tracked the situation as it evolved. We provided constant updates to help educate and prepare customers so they were ready to act. We shipped plugins overnight and kicked off a series of customer webinars. Attendance has been off the charts. Moving on to the quarter. The shift that Steve described is showing up in how customers are buying. Last quarter, we said conversations were turning into action. This quarter, pipe build is turning to conversion. We saw clear signs that customers are adding incremental budget to their exposure management programs with Tenable One, both with new lands and existing customers.
Q3 was our best quarter ever for Tenable One new logos, with more than half of the new logos landing on our Advanced Package. At the same time, existing customers are broadening their commitment to Tenable One, and many of our largest deals this quarter were vulnerability management customers converting to the full platform. Platform expansion was the primary driver of our acceleration and net dollar expansion rate and average deal size. When customers consolidate onto Tenable One, they bring more asset types and more of their attack surface with them. We see two primary factors behind the increased demand for Tenable One. First, customers need a comprehensive platform with a broad set of capabilities to manage risk in a post-Mythos environment, and those capabilities are only available in the new Tenable One packages. Second, our pricing and packaging continues to make the path to the platform easier.
As a result, we ended the quarter with more than 5,000 customers on Tenable One. Both pricing tiers are doing what we designed them to do. The Foundation tier gives customers a simple way to start on the platform and grow over time. The Advanced tier gives organizations facing the most acute AI era risk the broadest set of capabilities from day one. And it is clear that AI capabilities are pulling customers deeper into the platform. We're hearing directly from customers about how Tenable Hexa AI is changing the way their teams work. Tasks that used to take weeks are now getting done in hours. Analysis that once took days of exports and scripts now take minutes. Some customers are building their first automated routine on day one, and others are connecting their own agents to Hexa to drive remediation.
Customers using Hexa resolve two to three times more critical exposures across all affected asset types in their environment than comparable customers. The common thread is that security teams are spending less time gathering information and more time reducing risk, essentially letting the same security team do the work of a much larger one. And the more they use it, the better the results, with our largest and most complex customers seeing the biggest gains. Let me bring these trends to life with three customer examples from the quarter, a couple of which we believe were Mythos-driven expansions. A global industrial leader selected Tenable One over a leading endpoint security platform provider in a competitive evaluation.
Despite the competitor's aggressive bundling strategy, the customer chose Tenable One for its superior asset discovery, broader exposure visibility, Hexa AI capabilities, and being able to consolidate multiple security tools into a single platform. This example reinforces our competitive advantage as customers look for a more comprehensive approach to exposure management in the post-Mythos era. In another example, a Fortune 100 global technology leader significantly expanded its investment in Tenable One through a multimillion-dollar agreement extending its deployment to the full platform. The customer was one of our largest VM deployments, with millions of assets across business units and geographies. They are expanding with Tenable One to consolidate security capabilities, simplify operations, and manage exposure at enterprise scale. We are deepening strategic relationships and driving substantial platform expansion within our install base.
A global software company expanded its Tenable contract by nearly $1 million with our cloud security offering, providing differentiated capabilities over a leading endpoint security platform provider. The customer is also adopting Hexa AI capabilities, with early indications of time savings. Our comprehensive platform and AI-driven innovation is driving larger deals with additional asset coverage. Together, these wins reflect the trends we saw throughout the quarter. These trends include AI-driven urgency for exposure management and meaningful expansion, specifically with our VM customers upgrading to Tenable One. There was also strong adoption of Tenable One within new customers, along with major competitive wins. Additionally, Steve mentioned our CyberAgents Exchange. Beyond advancing the broader cybersecurity community, the exchange is also demonstrating commercial value. We are already seeing a strong response, particularly considering it was introduced in August.
A great example of what we've seen was a Tenable One win at a financial services company. The CyberAgents Exchange helped influence this competitive deal where agentic AI was a key purchasing requirement. We're also seeing the exchange become an important point of engagement with enterprise customers, reinforcing the differentiation of Hexa AI and Tenable One. We believe the exchange positions Tenable to play a central role in the emerging agentic security ecosystem, creating new opportunities to drive platform adoption as this market develops. A word on why we're winning. We compete with large platform vendors, with legacy vulnerability management providers, and with new entrants. What we are seeing in the field is that customers are selecting Tenable for the breadth and depth of our exposure data, our multiple asset types, advanced prioritization, and for a harness they can trust to act in their live environments.
This is all showing up in our win-back reports and competitive displacements. With that, I'll turn the call over to Matt to discuss our financial results.
Thanks, Mark. The product innovations and competitive wins that Steve and Mark just spoke about translated to excellent results in the third quarter. Tenable One represented an all-time high percentage of new business, driving third quarter results above the high end of the range for every metric we guided to. We are once again raising our full-year outlook, reflecting the growing momentum we are seeing in the business. Let's dive into the details. Revenue for the quarter was $276.4 million, representing growth of 9.5% year-over-year. The year-over-year growth in revenue, as well as outperformance relative to guidance, was driven by strong expansion within existing accounts and underpinned by continued strength in renewals. Our percentage of recurring revenue remains high at 95% for the quarter.
We had a record quarter for Tenable One, with 59% of new business coming from the platform, a new milestone, up from 50% in the prior quarter and 39% in Q3 of last year. As Steve discussed, we continued to make platform enhancements in Q3, including equipping security teams with autonomous agentic capabilities with Hexa AI and bringing Anthropic's Claude Mythos for frontier cyber reasoning in Adversary View. Advancements like these are helping accelerate the adoption of Tenable One with new and existing customers. We added 413 new enterprise customers in the quarter and added 39 net new six-figure accounts. With the continued shift towards Tenable One, average deal sizes are increasing, which helps drive new six-figure account annual contract value up 18% year-over-year. Our net dollar expansion rate increased for the second quarter in a row to 107%, up from 106% in the prior quarter.
The continued acceleration reflects the same demand in the business and was driven by strong expansion and renewal business. Non-GAAP gross margin was 81.5% for the quarter, compared to 81.6% in Q3 2025, and within our typical historical range of low 80s over the past couple of years. Non-GAAP income from operations for the quarter was $74.9 million, or 27.1% of revenue, compared to $58.9 million, or 23.3% of revenue in Q3 2025, an increase of 380 basis points. Growth and profitability in the quarter highlights our ability to steadily increase margins while investing significantly in product development and sales capacity. Non-GAAP earnings per share for the quarter was $0.63, compared to $0.42 in Q3 2025, an increase of $0.21. The improvement year-over-year reflects the growth in profitability and also includes a one-time discrete tax benefit that increased earnings per share by $0.03.
Turning to the balance sheet. We generated $69.4 million of unlevered free cash flow during the quarter, compared to $58.5 million in Q3 2025, an increase of 18.7%, and ended the quarter with cash and short-term investments of $495.3 million. During the quarter, we raised $800 million in a convertible note offering using the proceeds to pay off our existing term loan B, enter into a capped call transaction with a cap price of $64.06 per share, and repurchase 5.3 million shares for $170.5 million. In addition, on October 13th, we closed a revolving line of credit, giving us access to $400 million in additional liquidity. The net result is overwhelmingly positive. We pushed out the maturity of our debt to September 2031, reduced our shares outstanding, expanded our liquidity capacity, and added $186 million in cash to our balance sheet, all at a significantly lower overall cost of capital.
In addition to the shares we repurchased in connection with the convertible notes, we repurchased 1.5 million shares for $53 million during the quarter and have $54 million remaining on our current share repurchase authorization as of the end of the quarter. In total, so far this year, we have repurchased 18.2 million shares for approximately $454 million, reflecting an average repurchase price of $24.93. Our repurchase program remains an active pillar of our capital allocation strategy, reflecting our view that returning capital to shareholders through buybacks represents an effective use of our free cash flow, given the underlying strength of the business. Turning to the financial outlook for Q4 and full year 2026. Given the continued strength we have seen through Q3, we are raising our full year 2026 guidance range for revenue to $1.084 billion-$1.087 billion, representing a year-over-year increase of 8.6% at the midpoint.
For Q4, we expect revenue to be in the range of $277 million-$280 million, representing a year-over-year increase of 6.9% at the midpoint. We are also raising our full year 2026 guidance range for non-GAAP operating income to $270 million-$273 million, or 25.0% of revenue at the midpoint, which is a year-over-year increase of 310 basis points. We expect non-GAAP income from operations for Q4 to be in the range of $67.1 million-$70.1 million, or 24.6% of revenue at the midpoint. The outperformance we drove in operating income so far this year, along with the favorable impact to interest income and expense in Q4 as a result of our debt refinancing, is driving significant incremental upside to net income and earnings per share for the year.
In addition, the one-time tax benefit we realized in Q3 drove a benefit of $3.3 million to net income and $0.03 to earnings per share. As a result, we are raising our full year 2026 guidance range for non-GAAP net income to $250 million-$253 million, representing a year-over-year increase of 29.4% at the midpoint. We expect non-GAAP net income for Q4 to be in the range of $63.6 million-$66.6 million, representing a year-over-year increase of 13.6% at the midpoint. Due to the increase in non-GAAP net income, we are raising our full year 2026 guidance range for non-GAAP diluted earnings per share to a range of $2.16-$2.19, representing a year-over-year increase of $0.59 at the midpoint.
We expect non-GAAP diluted earnings per share for Q4 to be in the range of $0.56-$0.58 per share, representing a year-over-year increase of $0.09 at the midpoint. Before I open it up to Q&A, I want to thank the entire Tenable team for another excellent quarter of steady execution. We are looking forward to closing out the year strong. With that, we are happy to open the call up for questions. Operator?
Thank you. We will now be conducting a question-and-answer session. If you would like to ask a question, please press star one on your telephone keypad. A confirmation tone will indicate your line is in the question queue. You may press star two if you would like to remove your question from the queue. For participants using speaker equipment, it may be necessary to pick up your handset before pressing the star keys. One moment please while we poll for questions. The first question is from Mike Cikos from Needham & Company. Please go ahead.
Great. Thanks team, and congratulations on the strong results here. Great to see the net dollar expansion and the nine handle on that CCB growth. First question for Steve, if I could, but I think the key metric to me that stood out in your prepared remarks was the 5,000+ Tenable One customers you have today. I mean, I'm thinking it was probably a year ago where the company was citing just 3,000. So you've seen a meaningful uptick as far as that pool of Tenable One customers you're touching. I would just love to get a better sense. Can you help us segment Tenable One customers? How many are coming from existing customers adopting Tenable One versus new logos to the platform?
Management, your line is open. Management, your line is open. One moment, please, while we reconnect the speakers. Thanks, everyone, for your patience. We're just reconnecting the speakers. They're going to dial back in. Thanks for your patience. Hi, this is the operator. Thanks for standing by. We're still reconnecting the speakers. Thanks for your patience. All right. You can go ahead. You are now reconnected.
All right. Hopefully everyone can hear us. We have absolutely no idea. We got disconnected. I'm not sure. Mike, are you there?
I am. Can you hear me okay?
Yeah, I can hear you fine. I will give you the answer to your question. We have literally no clue what happened. The line just dropped. But listen, in regards to the momentum that we saw in Tenable One, it was across multiple different aspects. So A, we had an incredible quarter in regard to net new logos landing on Tenable One. So we had 413 new logos. A significant portion of those new logos were Tenable One. We also saw a huge conversion from our standalone VM install base. Hundreds of VM customers transitioned over to Tenable One, which was outstanding. And then we saw a conversion also from our legacy Tenable One onto the new SKU. Every measurement that we track to drive new logo in regard to Tenable One were record-setting quarters. So multiple fronts, multiple competitive wins.
That was one of the key drivers of why we had such a successful quarter. Tenable One absolutely crushed it in Q3.
That is great. That is great to hear, Mark. And just a quick follow-up here. I just wanted to tackle the customer examples that you had given as well. Great to hear how Hexa AI is winning out and Tenable One is really gaining momentum with these enterprise companies. I am just curious, can you speak to the competition versus those endpoint vendors? I am just trying to get a better sense, are they coming up more in these at-bats, or do you see them becoming more competitive with their bundling strategy? It sounds like the win rates are unaffected, but I am just curious to what degree they are actually showing up in these bids.
Yeah. No, listen, they're out there, and we didn't see any change whatsoever from a competitive dynamic in Q3. We did see our win rates improve and increase, and I think it's because our channel and our sellers are extremely efficient now on selling Tenable One, right? So we will position a VM standalone if need be, but the majority of all of our seller interactions and reseller interactions are Tenable One, and our compete level is extremely strong. As you highlighted, one of the customer wins we talked about was against a very large endpoint player, and we won based on the depth and breadth of the platform, all of the different asset types, which is a huge differentiator in Tenable One. Also, our accuracy within finding and identifying vulnerabilities, not having false positives.
Then you put on top of it now, Mike, Hexa AI has become a really big driver. It is a huge differentiator. We demo it, we position it on all of our new business, but also it's a big driving force to get VM customers in our install base and our legacy T-One customers onto the new SKU. You kind of combine all of that, and we're in just a very good compete level right now in regards to T-One.
Great to hear. Thank you so much, guys.
Thank you.
The next question is from Rudy Kessinger from D.A. Davidson. Please go ahead.
Hey, guys. Great. Thanks for taking my questions in. Again, similar to Mike, congrats on the improvement in some of the metrics here. Firstly, I am curious as let me take a step back. One of the questions I get from a lot of investors is just, with Mythos and increase in the number of vulnerabilities being discovered, wouldn't customers be scanning more frequently, and how might that impact the results for a company like Tenable? You mentioned Hexa with PHP, 5x increase in usage in some instances. Historically, you guys have priced on a per asset basis. I guess as you look forward, as your customers are scanning more frequently, they are patching more frequently, is there any opportunity to maybe evolve the pricing on some of your core VM scanning products in conjunction with Hexa to capture more of that usage, in terms of revenue growth?
Hi, this is Steve. Yes, as we have talked about-
Our pricing and packaging has evolved considerably. So one of the big highlights in the quarter was ASPs. So this quarter we saw the expansion rate tick up, the selling prices increased, and we also saw CCB consequently increase as well. We are having success expanding with our customers. Pricing and packaging plays a major role here. One of the big reasons why is because of Hexa. As a result of PHP, more customers turn to Hexa, prompt volume increased. We are also selling Hexa packs back into our base. So we have seen the pricing evolve here. Yes, it is an asset-based pricing model. We will continue to charge that way, but we are also charging based on volume. We do not want to do it based on the number of scans. We do not want to discourage usage.
But if you look at PHP2Shell, because that's really where your question originated, it's a clear signal of where the market's going. It signals two things. First, the scale. It took the industry 26 years to record over 300,000 CVEs. That's the cumulative total to date since the number of CVEs has been initially recorded many years ago. That's the number of CVEs at the start of the year. This year alone, there's been 90,000 new CVEs that's been published. This month alone, to date, it's been 15,000 new CVEs. So the velocity is clearly increasing here. Second, PHP2Shell clearly shows the challenge goes well beyond just the vulnerability itself. Yes, that's the headline, but it's more about the underlying exposure it creates in your environment.
PHP is everywhere, as we all know, and nearly every organization has exposure here. Reportedly, and this is recently, attackers are starting to chain PHP2Shell together with other flaws to now access and compromise identity systems. So the threat's evolving, it's moving beyond remote code execution, and that's where exposure management comes in. That's why it's more important now than ever before. We will see more events like this, not fewer, and that's why customers are turning to Tenable, as Mark highlighted earlier.
Okay, got it. Super helpful. Secondly, I appreciate the color and that key win versus one of the endpoint vendors and the competitive color. One of the questions I also get is, you guys have said you see those endpoint vendors more so in Tier 2 Tier 3 assets. Can you share any kind of figures when you evaluate your customer base? What percent of the assets that you guys are protecting are Tier 1 versus Tier 2 or Tier 3 assets?
Yeah, most are Tier 1. To some degree, there's Tier 2 and Tier 3. We have an asset-based pricing model. As we all know, the real risk here in the AI era is not a single CVE, it's not a single misconfiguration or just access and entitlements. It's the chaining together of all those things into a critical attack path that leads to your most important data. That's what exposure management is all about. So a lot of it is Tier 1 assets. So that's why the selling prices are higher. That's why we're having success this year, is because we're selling more assets. Customers are turning to us as they look and place more AI agents and models and applications in their environment. They're turning to Tenable to help secure, and assess more of that because it expands the attack surface.
We see no change in competitive dynamics, Mark mentioned, and our competitive positioning is very strong as our results would indicate.
Appreciate it. Congrats again on the quarter.
The next question is from Jonathan Ho from William Blair. Please go ahead.
Hi, good afternoon and congratulations on the strong quarter. One thing I wanted to better understand is, as customers start to shift from planning to buying, can you help us understand how much of the growth that you saw this quarter was driven from asset expansion versus upsell of the product versus just completely buying new products? If you could give us maybe some type of breakdown that would help us understand the different drivers that are there.
Yeah, I'll tell you, it really came from both. This was one of the most balanced quarters that we have seen, and really all the different fronts over-executed and delivered. We saw significant expansion in the install base. One of the big trends we saw was some of our largest VM customers converting to Tenable One. We've been working with some of these customers for close to nine months to get them to convert, and we saw that conversion happen in Q3 with a lot of big global Fortune 1000, Fortune 500 companies moving from VM to T1. So great expansion there.
We also saw it within the mid-range commercial space with customers wanting to leverage Hexa because they didn't have as big of security teams and wanted to automate a bunch of use cases and be able to use agentic AI to get more leverage and get more productivity out of the smaller teams they had. So we saw really good execution there. As we hit on, our net new logo count was outstanding. As I highlighted, the percentage of new logos that came in through T1 was outstanding. So really, it was across the board.
Fantastic. Just as a quick follow-up, with Tenable One adoption, can you help us understand this can serve as potentially a stepping stone for broader adoption of the more Advanced versions of Tenable One as well as Hexa. Does it also expand the types of assets that you can cover for customers? Just want to see what you've seen with customers as they've adopted Tenable One and what that roadmap looks like once you've gotten them onto the platform. Thank you.
Yeah, you bet. What we see, and Matt covers this quite a bit in regard to the expansion, in regard to the margin and the ASPs we see on our deals. When you move up to especially Advanced, you're usually looking at two, three, sometimes four different asset types. You're also leveraging a much more Advanced attack path analysis capability, which a lot of the customers want now. Obviously you're getting significantly more tokens to run Hexa AI. Our prioritization is extremely clean when you look at what we're doing from an Advanced Package. So it's multiple layers in regard to what we're doing, but we're landing the majority of our Tenable One, when you look at the new logos and you look at the expansion, is significantly coming in on Advanced compared to Foundation.
Thank you.
The next question is from Roger Boyd from UBS. Please go ahead.
Great. Thanks for taking the questions and congrats on the nice results. Good to see pipeline conversion starting to tick up. For Steve or Mark, just on PHP2Shell, can you remind us what impact Log4j had on your business? I know it's a little hard to parse out, but what was in some way a tailwind, and how do you see that situation maybe comparable to what's going on with PHP2Shell in terms of that driving interest and very clearly helping the Hexa volumes?
Well, over the years, we've seen a number of threats and breaches, and some have had an impact and others have not. With regard to Log4j, I think it first surfaced in Q4 of 2021. We saw the expansion rate inflect higher than I think in the subsequent quarter, and that was Q4 of 2021. Then Q1 of 2022, we also saw the growth rate expand and new business strength. As we look at PHP2Shell here, our first area of focus is really supporting our customers in time of need. It's too early to quantify right now, the impact it'll have on our business. Clearly, we're spending a lot of time with customers. Engagement with customers has never been better.
We're seeing a record impact on the number of attendees for webinars, and web traffic is all up, and all the early signals are there. But look, security teams are buried right now trying to figure out what this means for them internally, and that takes time. Our focus is making sure that we're providing the support and the resourcing necessary to help them assess risk. I think what it also signals is that exposure management is center stage here in the midst of all these AI-enabled threats and AI-enabled attacks and AI-driven exposures. So we see a good durable tailwind of growth for Tenable in the quarters and weeks to come, and I think the results from the quarter are an early sign of this.
PHP had little impact on the quarter, just given the timing, of course, but what's driving the momentum and the inflection of the business today is what we've talked about since the early part of the year, which is Mythos is creating not a moment, but is creating certainly a mandate for us to go out and expand with customers, transact new business, close larger deals, and as a result, exposure management is becoming more strategically relevant to our customers.
Got it. Makes total sense. Then, maybe just a follow-up for Matt. Really strong margin performance in the quarter, as well as the increase to the guide for the full year. Any considerations you can give us just around gross margin as you move forward? I know Steve mentioned that you're including a lot of Hexa AI capacity into Tenable One packages, but when you see prompt volume go up 5x, to what degree does that maybe impact your gross margin visibility? Thanks.
Yeah, thanks for the question. So gross margins were 81.5% or so. That's in line with our historical range of the low 80s. I expect that it'll probably remain about there. Hexa AI's not putting pressure on our gross margins because in order to get access to Hexa AI, customers need to upgrade into the platform, which is a huge pull then for customers to upgrade. You've heard us say it many times now on this call, Tenable One was a record for us this quarter. Hexa AI was a big part of that. Once customers are into the platform, their upgrade and the price increase and the value that they get, along with the value that we receive, sort of pays for that Hexa AI usage. Once customers have run out of their allotment within the platform, there is an add-on SKU that protects us from a margin perspective.
While we are encouraging more and more usage in Hexa because we think it provides very valuable insights, customers ultimately pay for that once they run out of their allocated amounts within their package.
Really helpful. Thank you.
Yeah. Thank you.
The next question is from Adam Borg from Stifel Financial. Please go ahead.
Hey, guys, this is Ben Goldberg on for Adam Borg over at Stifel. Thanks for taking the question. Just double-clicking on that add-on SKU you just mentioned. I know you mentioned it last quarter. Did you kind of see that increase this quarter given the stronger Hexa volumes? And is that recognized ratably or on a consumption basis?
Yeah. We did see it tick up this quarter. But for us, the main draw really is in moving folks into the platform and specifically into Advanced, where they're allowed a pretty significant volume for Hexa usage. We think that's a large reason why three-quarters of customers are opting to go of our new business are opting to go into Tenable One Advanced. So in terms of being a sort of a revenue growth driver for us, which I think is probably what you're getting to, the revenue growth driver really comes in the form of the platform, which is we're really happy to see come through this quarter, and we expect that trend to continue.
That's great to hear. Thanks, guys.
Yeah, thank you.
The next question is from Joseph Gallo from Jefferies. Please go ahead.
Hi, this is Liam Bellamy on for Joe Gallo. Thanks for taking the questions. You described OT security as very strong globally last quarter, particularly in Fed. We have seen several attacks on critical infrastructure in recent months. Is OT gaining further momentum within Fed, and is it becoming a repeatable cross-sell motion across the broader commercial installed base?
Yeah, hey, it is. We were very happy with the results we saw in Q3 for OT globally. It is continuing to gain momentum. Specifically in federal, it was an outstanding quarter for OT, not only within the federal government, which played a very large role, but also in the state and local business. When you look at, for instance, like Watershed in Texas and all of the different critical infrastructure and water treatment plant issues, we saw really good adoption of OT in state and local. Yeah, happy with the adoption, not just here in the U.S., but globally for OT, and definitely was a highlight of our federal business in Q3.
That is great to hear. Just a quick follow-up. I think it is becoming clear that patching is the most important aspect and the competitive differentiator in EM. Can you talk through where you are in that product journey? I know the ambition is fully autonomous patching, but when can that come to fruition?
Sure. First, just a reminder of what exposure management is, because it is very different than vulnerability management. Vulnerability management is the discovery of CVEs, and the output of which is a report, and it is often sold to a frontline security manager or maybe even a pen tester. Exposure management is very different. It is the outgrowth of vulnerability management and assessment into solving a much bigger problem, and it is really predicated on three things.
Number one, identify all your exposures across a wide range of domains. Number two, prioritize what is truly at risk, and then three, remediate and confirm the fix actually reached the production environment. That is exposure management and some capabilities we have natively in the platform to be able to address the fix. Others, we integrate with third parties to help orchestrate the fix. We want to do that in a very seamless way with our customers.
Sometimes we are leveraging APIs and MCP, other times we are doing it natively ourselves. The key takeaway here is we will continue to go deeper and wider on remediation, number one. Number two, the mandate for us has evolved. It is no longer about finding problems. We are about fixing problems. That is what exposure management is about. That is why Hexa AI, which is part of our agentic harness, is so important because it sits on top of our vast exposure data fabric.
Data fabric that has been built over the last 20 years, and data fabric that a lot of this exposure data sits behind the guarded firewall. It is not publicly available, and it is tied to our vast sensor network that feeds it raw telemetry data. That is differentiation. That is what gives us the ability to help our customers address AI threats, and move at machine speed, because that is what this environment demands.
Remediation and orchestration is a big part of it. We are happy with how we are serving customers today and look for deeper and wider capabilities there.
That is really helpful. Thanks so much.
The next question is from Patrick Colville from Scotiabank. Please go ahead.
Hi, this is Conner Weed on for Patrick Colville. Congrats on the quarter. It was nice to see that 9.5% revenue growth. In terms of the full-year guide, I was wondering if you could provide more color on what you are seeing in the business and the pipeline to give the confidence for the magnitude of that raise there. Thanks.
Yeah. Hi, this is Matt. We were really happy with the quarter and our ability to raise the full-year guide. Not just for revenue, but really across the board. Part of what gives us that confidence in order to do that was the performance that we saw in Q3, but also the pipeline growth that we are seeing in Q4. You mentioned the revenue growth that we saw in Q3. We also talked about CCB growth at 9%. We think that probably ticks up slightly in Q4, and that is giving us confidence to be able to raise the guide for revenue in Q4 as well. We are happy with what we are seeing in momentum in the business and our ability to take up the numbers from the top line all the way down to the bottom.
Great. Thank you.
The next question is from Meta Marshall from Morgan Stanley. Please go ahead.
Hi, this is Abhishek Murli on for Meta Marshall. Thanks for taking the question, and congrats on a great quarter. I'm just curious if we could follow up a little bit on the federal aspect. Any sort of quantification or commentary on how much that contributed to the upside, outside of the OT piece? Then any sort of broader feedback or commentary on what you're seeing in terms of the federal landscape overall?
Yes. As you know, we have major market leadership in federal across a wide range of three-letter federal agencies. We're pleased with the results of our federal business this quarter. It was strong. The one thing I will say here is that, we've seen, if you look more broadly at the U.S. federal space, we've seen a wave of new security policy drop over the last six months. We believe that policy will ultimately be a tailwind for Tenable. The federal government is moving towards a preemptive risk-based security model. So we believe Tenable's in the right category at the right time. We're working directly with CISA. We're a part of the JCDC with regard to a response for PHP2Shell. We're participating in Gold Eagle, which is the AI security vulnerability clearinghouse.
We participated in the launch event for Project Watershed 250, which is what Mark talked about earlier, working directly with the ONCD, National Cybersecurity Director, Texas governor, and other dignitaries along those lines. So we expect big things in the U.S. federal space. We know we have an election coming up. Cybersecurity is a bipartisan issue. It will have bipartisan support. We expect budgets to be strong here. Perhaps with a divided government, depending on the election, we'll see a CR, but we're in one now that could likely extend into January. That's nothing new to cyber, nothing new to Tenable. We expect to continue to take and win share in the U.S. public sector space. That would also separately include state and locals Mark mentioned.
Super helpful. Thank you.
The next question is from Rob Owens from Piper Sandler. Please go ahead.
Great. Good afternoon. Thanks for taking my question. Maybe you could help me a little bit parse the delta between your net enterprise adds as I look at that year-over-year, versus these record new logo Tenable One quarter that you just had. Thanks, guys.
Yeah. Rob, I can take that. One of the dynamics, and I mentioned it in my prepared remarks, that we are seeing is we are happy that we added 413 new enterprise customers. But the dynamic that I think is driving value even more, is actually the value that the larger customers are bringing. So we saw new six-figure annual account contract value go up 18% year-on-year, which is really showing that customers are not only moving to the platform, they are moving to the platform spending more and expanding once they are there, too. So our larger customers are spending more, which is great. In addition to that, you could sort of take your pick on the top-line metrics that we saw for the quarter. It was not just the revenue growth. It was the expansion in our net dollar retention rate, moving from 106 to 107.
So another quarter of expansion there. Of course, there was the record, 59% of new business to Tenable One. That was a big deal, too. But it is also things like CRPO. That grew 12%. CCB growth was 9%. So, 95% recurring revenue. Kind of across the board when you look at the top-line metrics, it was just a really, really strong quarter.
Great. And last quarter you spoke to that expansion rate potentially being flat to up, and it is great that it improved another point quarter-over-quarter. How are you thinking about the fourth quarter from here? And was there any dynamic that helped that from the Fed here in the third quarter? Are you seeing that kind of across the board in terms of expansion? Thanks again.
Yeah. I expect that the 107 probably stays, remains intact, in Q4. And Fed helped contribute in Q3. And I think Fed will do well again in Q4. But we are expecting that rate to hold steady at 107.
Great. Thanks for the color.
Thank you.
The next question is from Josh Tilton from Wolfe Research. Please go ahead.
Hey, guys. Can you hear me?
Yep.
Yes, we can.
Awesome. Thanks for sneaking me in. I have two questions. I have been bounced around on a bunch of calls, so I apologize if people asked this already. My first question is just, I believe in the quarter, there was a point where you guys made a flip or a switch to the Hexa product that kind of enabled customers to do more of these continuous autonomous workflows, like basically really get real value from the product. I guess my question is, what have you seen from a usage perspective within Hexa in the customer base since you made this switch? If there are any customers that have really been using it, how are they addressing their token limits, and what are they doing with tokens if they have reached their limit?
My second follow-up question, probably more for Matt, is just, we have these long-term targets out there. I think they call for an improvement in the revenue growth back to the double-digit range at some point. Not asking for guidance here, but we are going to get an outlook for next year and I am trying to understand, are we going to start to see the trajectory of revenue growth trend toward that double-digit range next year? Or is this more that inflection happens as we get closer to the long-term target year? Thanks.
Hi, Josh. This is Steve. I will take the first part of the question with regard to Hexa adoption and use cases. Something we talked about, something we launched recently was Hexa now has a coordinated fleet of AI agents that continuously identify critical exposures and orchestrate fixes, so you do not have to come in and prompt every time that you want to be able to take an action and you want to be able to remediate and take effects. So that is a huge productivity boost for security teams who are trying to do more, perhaps with less, in a heightened threat environment where there is more applications and agents and the attack surface is expanding. Customers are using Hexa to resolve their most critical vulns.
We saw a dramatic increase in the number of usage, the number of customers that are using Hexa, and the number of customers and the usage within those customer cohorts. So that is what is exciting about Hexa. What used to take hours, or should I say days, now gets done in hours and sometimes even minutes, and customers can build automated routines. The right way to think about Hexa is really twofold. Number one is helping solve the drudgery, automating workflow and major pain points for customers and security teams, and reducing the amount of cycle time that it takes to help understand, assess, and analyze an environment. More importantly, go out and just get stuff done. That is a big part of the value prop for Hexa.
These are things that we can do natively within the platform to reduce risk, but also integrating with other security providers because no security company can fix everything.
Yeah. Josh, I will answer your second question. We feel really good about our long-term targets. What we feel good about in particular, though, is the leading indicators, and you saw a lot of those in the quarter. I think we are going to continue to see those. New business growth is performing really, really well. Bookings are fantastic and revenue follows, and we know that revenue lags a little bit. As we look out a couple of years, of course, we feel good about the midterm targets that we put out there. But right now we are focusing on some of the underlying leading indicators in the business.
Hello. The next question is from Rich Poland from Wells Fargo. Please go ahead.
Hey, thanks for taking my question. I guess just one quick one around the Tenable One uplift. It is great to see the continued success there, and I am curious if you mentioned a lot of the ACV expansion related to Tenable One and just the shift over to the platform there. I guess if we put a finer point on it, I think the like for like uplift you have talked about in the past is somewhere in the realm of 25%+ when it is on the Advanced side. I am curious, is that something that you think you guys are starting to see realized now, or would you say the focus is more on getting people over to the platform first, and then you could worry about the potential uplift over time?
Yeah. It's actually a little bit of both, because we see increasingly brand new customers are coming directly into the platform, and they're spending more. Average customer value is double in the platform what it is versus standalone SKUs. If you look at, you forget about our Nessus product, but Nessus actually serves as an on-ramp to the platform as well. We're seeing Nessus customers not only upgrading into some other standalone SKUs, but also directly to the platform. Those platform customers are paying 15 times what Nessus customers are paying. There is a meaningful on-ramp when you're going from Nessus into standalone SKUs or from standalone SKUs into the platform. Once they're there, they're also expanding usage, which is another way that they can increase value. Yeah, we're really happy with the motion of moving folks into the platform, and then once they're there, expanding.
Awesome. Thank you.
This concludes the question-and-answer session as well as the teleconference today. You may disconnect your lines at this time. Thank you for your participation.