Tenable Holdings, Inc.

Greetings. Welcome to the Q1 2022 earnings conference call. At this time, all participants are in a listen-only mode. A question and answer session will follow the formal presentation. If anyone should require operator assistance during the conference, please press star zero on your telephone keypad. Please note this conference is being recorded. I will now turn the conference over to your host, Aaron Carney, Senior Director in Investor Relations. You may begin.

Thank you, Operator, and thank you all for joining us on today's conference call to discuss Tenable's first quarter 2022 financial results. With me on the call today are Amit Yuran, our Chief Executive Officer, and Steve Vince, our Chief Financial Officer. Prior to this call, we issued a press release announcing our financial results for the quarter. You can find the press release on the IR website at tenable.com. Before we begin, let me remind you that we will make forward-looking statements during the course of this call. including statements relating to our guidance and expectations for the second quarter of full year 2022, growth and drivers in our business, changes in the threat landscape in the security industry and our competitive position in the market, growth in our customer demand for and adoption of our solutions, the potential benefits and financial impact of our acquisitions, including our recent acquisition of Symptom and the expected acquisition of Fit Discovery. planned innovation and new products and services, our expectations regarding long-term profitability, and our ability to attract and retain employees and its impact on our business. These forward-looking statements involve risks and uncertainties, some of which are beyond our control, which could cause actual results to differ materially from those anticipated by these statements. You should not rely upon forward-looking statements as a prediction of future events. Forward-looking statements represent our management's beliefs and assumptions only as of today and should not be considered representative of our views as of any subsequent date. We disclaim any obligation to update any forward-looking statements or outlook. For further discussion of the material risks and other important factors that could affect our actual results, please refer to those contained in our most recent annual report on Form 10-K and subsequent reports that we file at the FTC. which are available on the FCC website at fcc.gov. In addition, during today's call, we will discuss non-GAAP financial measures. These non-GAAP financial measures are in addition to and not a substitute for or superior to measures of financial performance prepared in accordance with GAAP. There are a number of limitations related to the use of these non-GAAP financial measures versus their closest GAAP equivalent. Our earnings release that we issued today includes gap to non-gap reconciliations for these measures and is also available on the investor relations section of our website. I'll now turn the call over to Amit.

Thank you, Erin. Today I'll discuss our outstanding financial performance in Q1, our accelerated momentum, exciting product enhancements, including our agreement to acquire BitDiscovery, and the continued progress of our cyber exposure management platform. With that, let me first touch on our Q1 results. We saw tremendous strength in the first quarter, driven by contributions from all products and theaters. Our CCB growth for the quarter was 31%, which we believe positions us well for a strong 2022. Additionally, the health of our market and the durability of our business provides us with the confidence to continue to invest in our products and our people. Momentum across cybersecurity is accelerating as increased threats are driving a healthy spending environment. The need for customers to understand their true exposure and risk is at an all-time high. We're seeing that momentum translate across our entire portfolio, core VM and exposure solutions, particularly in our identity and cloud security offerings. We're leveraging this momentum and have plans to add significant new capabilities to our cloud offerings, as well as create unique differentiation for our VM customers. These enhancements include expanding our exposure platform, Tenable EP, to include Tenable AD and Tenable CS. EP customers can deploy these new capabilities immediately and take advantage of our single unified licensing model to secure their cloud environments and active directory. Launching our cloud native application security platform, Tenable CS, to address cyber risks from build through run time. we delivered seamlessly integrated cloud-native web application and container exposure data into Tenable.io. This allows organizations to analyze cloud and web app exposures alongside other assets and take advantage of the rich platform's capabilities, such as advanced search, streamlined reporting, comprehensive role-based access controls, and a single sign-on for easy access, unified APIs, and other capabilities. We also delivered important updates to Tenable AD and Tenable OT to detect new indicators of attack used to escalate privileges in ransomware and nation state exploits and attempts to exploit OT devices. Our investments in product development over the last few years highlight our commitment to best in class security assessment across a customer's attack surface. We think our timing couldn't be better with increased threats, larger consequences for business, and a helping spending environment for cyber, we believe we're moving into the golden age of VM. More than ever, customers must understand every aspect of their digital footprint so they can reduce their cyber exposure, and this is reflected in a larger TAM that we discussed on our Investor Day. In conjunction with earnings, we announced that we've reached an agreement to acquire BitDiscovery, an external attack surface management leader with a differentiated internet-facing asset discovery, attribution, and monitoring capability. The problem for many organizations is that they're largely blind to the full and ever-changing scope of their internet-facing assets and services. These systems serve as high-priority exposure points for attackers and important starting points for attack paths into critical systems. Discovering and gaining insight into every part of a business's digital footprint are essential steps for any effective cybersecurity program. In concert with our attack pathway assessment technology, this new capability will allow us to tie the artificially fragmented parts of security into one view that shows how attackers from the Internet can ultimately gain access to any specific high-value system, regardless of where it sits. For CISOs, this analysis is a knockout punch of what is top priority. Once integrated, the automated discovery of external attack surface will be native in the new and upgraded version of Nessus. Automated attack surface discovery will also be included in many of our enterprise products, including Tenable SE, Tenable IO, Tenable EP, and our cloud security solution. This insight will drive great value for our customers and increase adoption of our cyber exposure solutions. Beyond this basic discovery offered to many of our existing customers, we will also have a new SKU with advanced attribution functionality that will help customers understand the broader set of contexts and exposure of these assets. We're incredibly excited about adding these new capabilities, and bit discovery is a very natural and tightly aligned motion for our go-to-market team. Attack surface management data is absolutely critical exposure data. ASM has the same buyer and the same go-to-market motion as the VM buyer with a highly compatible messaging, which will provide very fast time to value for our customers. Let me talk a little bit about Tenable EP. During the quarter, we extended Tenable EP beyond vulnerability management, web application security, and Lumen by adding assets and security findings across identity, and cloud via the inclusion of Tenable AD and Tenable CS. Cloud assets include systems and software vulnerabilities and cloud security posture management across workloads, but also Kubernetes clusters and containers. EP now offers customers a comprehensive cyber exposure management platform that assesses hybrid IT, the full lifecycle of cloud and cloud native environments, Active Directory, And following closing of the acquisition and integration of bit discovery and internet-facing assets such as web applications, cloud resources, open gateways, bringing these solutions into one unified platform enables us to identify, evaluate, and prioritize risk across the entire digital footprint for our customers. In addition, we saw continued traction in the quarter for Tenable EP and it's quickly becoming a rapidly growing portion of our new sales. We're leading with Tenable EP in the commercial sector where sales cycles are shorter and we're seeing dramatic adoption also occurring in large enterprises as they embrace EP as well. For years, we've been pioneering cyber exposure and the role Tenable plays and it's an incredibly important and emerging discipline. When we introduced this category, it was a new concept to many investors, despite its rather than mating with the CISOs. Since then, we've expanded exposure beyond traditional assets to include cloud assets, cloud infrastructures, and cloud-native architectures into identities and operational technologies and web applications. And more importantly, we've expanded analytic insights between these data sets in the form of attack pathways, benchmarking, and other methods to prioritize risk. We believe Gartner's recent recommendation that organizations need to look beyond vulnerability patching and to manage a wider set of security exposures is spot on. Further, we see Gartner's newly defined discipline of exposure management, which includes some mature markets, like vulnerability management, and emerging markets, such as cloud native security and attack surface management, as very well aligned with the definition of cyber exposure and the strategy that we have been pursuing and talking about for years. We believe strongly in this opportunity and that we are an early market leader as it continues to mature and grow. We'll continue to invest, including the planned acquisition of BitDiscovery, to deliver on our vision for an exposure management platform that enables our customers to better assess and manage risk. Now, before I hand the call over to Steve, I want to talk a bit about the people side of our business. As a software company, our greatest long-term asset is our people. It's an area that we spend a lot of time and effort on. Coming out of the pandemic, many investors asked about our ability to continue the hiring necessary to fuel growth, and candidly, how we will fare in the great resignation. We always strive to nurture a culture of innovation and transparency, while building a diverse, thriving workforce. Our investments in our people continue to pay off, and I'm happy to report that in Q1, we had exceptional results in our recruiting efforts, hiring and onboarding. We're also seeing strong retention levels this year. People want to work at Tenable. New talent and lower attrition will translate directly into increased efficiency and an increased pace of innovation. Tenable has become a market-recognized destination employer of choice with a great culture and compelling products in a very exciting market. I'll now turn the call over to Steve for further commentary on our financial results.

Thanks, Amit. As Amit mentioned earlier, we are delighted with our results for the first quarter, highlighted by 31% growth in calculated current billings, a beaten EPS, and continued investment in innovation and distribution. I will provide more commentary on each of these points momentarily. But first, please note that all financial results we discussed today are non-GAAP financial measures, with the exception of revenue. As Aaron mentioned at the start of this call, GAAP to non-GAAP reconciliations may be found in our earnings release issued earlier today, which is posted on our website. Now on to the results for the quarter. Revenue for the quarter was $159.4 million, which represents 29% year-over-year growth. which is up from 20% growth in Q1 last year and 26% growth last quarter. Revenue in the quarter exceeded the midpoint of our guided range by 6.4 million. We are delighted with the results for the quarter and the very sizable beat in revenue. Please note that approximately 1.4 million of revenue recognized in the quarter was due to the early termination of customer contracts in Russia and Belarus, as a result of sanctions and export restrictions imposed by the U.S. government. This is revenue that largely would have been recognized over the ensuing quarters this year, but had little impact on CCB this quarter, as the value of these contracts were already reflected in the current portion of deferred revenue. Visibility remains high, as our percentage of recurring revenue was 95%, which is primarily a result of our annual prepaid subscription model. The outperformance in revenue is a result of continued accelerating growth in calculated current billings. CCB, defined as the change in current portion of deferred revenue plus revenue recognized in the quarter, grew 31% year-over-year to $156.5 million. This is our fourth consecutive quarter of accelerating CCB growth, which started from a base of 20% CCB growth in Q1 last year. We attribute this inflection in growth to our market leadership in VM, expanded product portfolio, and increased innovation and go-to-market activities. More specifically, the heightened threat environment has highlighted the need for our customers to continuously map and measure their cyber exposure across the attack surface. This is evidenced by the strength in new business this quarter as new enterprise platform customers grew 39% year over year. In particular, demand was very strong in North America as well as internationally in both the large and mid-market. In terms of product mix, our exposure platform, Tenable.ep, which now includes cloud and identity security, benefited from customers seeking broader awareness of risk across their attack surface. Upsell from existing customers was also substantial in the quarter, which combined with robust renewals resulted in an LTM net dollar expansion rate that was notably above our historical rates over the last two years. This was aided in part by Log4j, although to a lesser extent than what we experienced in Q4. I'll now turn to expenses, which include incremental investments in growth and the additional operating expenses related to the symptom acquisition that we closed in February. I'll start with gross margin. which was 81% this quarter compared to 82% last quarter. Cost of sales increased sequentially due to higher public cloud costs associated with increased usage from our products and incremental investment in infrastructure to support new analytics for our exposure platform. As Amit mentioned earlier, we plan to launch a more expansive set of cyber exposure analytics, which we currently expect to be in the second half of the year. This will include attack path analysis via newly acquired symptom, enhanced and unified analytics, and improved benchmarking and contextualization of vulnerabilities, all of which will help customers better visualize and efficiently manage risk across their hybrid environments. As we've indicated in the past, we expect these investments, a portion of which are upfront costs, to modestly impact gross margin short-term, but provide increased scalability to support future growth. Long-term, we still expect gross margins to be in the high 70 to low 80% range. Sales and marketing expense for the quarter was $71.5 million, which was up from $69.5 million last quarter. Sales and marketing expense includes higher wages, draws, and benefits related to hiring more quarter-carrying sales reps and other headcount in the quarter, as well as higher commissions attributed to our strong sales performance in the quarter. Sales and marketing expense as a percent of revenue was 45% in Q1 compared to 47% last quarter. R&D expense for the quarter was $27.8 million, which is up from $24.9 million last quarter. It should be noted that we added a team of engineers in connection with the symptom acquisition and made incremental investments in engineering in support of our expanding product portfolio, which was all set in part by capitalized software development costs in the quarter. R&D expense as a percentage of revenue was 17% with Q1, which is consistent with last quarter. G&A expense was 16.6 million compared to 15.8 million last quarter. We continue to make investments in information technology and in resources, recruiting in particular, to support the growth and scale of our business. As a percent of revenue, G&A expense was 10% this quarter, compared to 11% last quarter as well as for the full year 2021. Income from operations was $12.5 million compared to $11.9 million last quarter, which reflects the items I just highlighted. Operating margin was 8% for Q1 and last quarter. EPS in the first quarter was $0.06, which is one penny better than the high end of our guided range and this is after absorbing approximately one penny of expense related to fx remeasurement which is included in other expense in the income statement now let's turn to the balance sheet we finished the quarter with 526.1 million in cash in short-term investments accounts receivable was 96.4 million and total deferred revenue was 527.5 million including $404.8 million of current deferred revenue, which gives us a lot of visibility headed into 2022. Now I would like to discuss cash flow. We paid $4.1 million of cash interest on our credit facility in the first quarter. Looking ahead, we are assuming a higher interest rate environment, which will increase the interest expense on our floating rate debt facility when it resets at the end of July. Consequently, our full year guidance reflects $15.7 million of interest expense. which is $1.7 million higher than our previously provided guidance. That said, our Term Loan B continues to provide a low cost of capital, which has allowed us to fund acquisitions without the equity dilution to our shareholders. In Q1, we generated $32.1 million of unlevered free cash flow. With 95% recurring revenue, attractive gross margins, and high renewal rates, we feel confident that we can continue to generate attractive levels of cash flow while continuing to invest in the business. Striking the right balance between growth and profitability has always been and will continue to be an area of focus for us. Last year, we became a Rule of 40 company, and we are well on our way to achieving the Rule of 50 target we outlined at our investor day in December. With the results of the quarter behind us, I'd like to discuss our outlook in the second quarter and the full year 2022. For the second quarter, we currently expect Revenue to be in the range of $162 to $164 million. Non-GAAP income from operations to be in the range of $6 to $7 million. Non-GAAP net income to be in the range of $1 to $2 million, assuming interest expense of $3.5 million and a provision for income taxes of $1.6 million. Non-GAAP diluted earnings per share to be in the range of $1 to $0.02 million. assuming 119.5 million fully diluted weighted average shares outstanding. And for the full year, we currently expect calculated current billings to be in the range of $764 million to $772 million. Revenue to be in the range of $673 million to $679 million. Non-GAAP income from operations to be in the range of $44 to $48 million. Non-GAAP net income to be in the range of $19.5 to $23.5 million, assuming interest expense of $15.7 million, and a provision for income taxes of $8 million. Non-GAAP diluted earnings per share to be in the range of $0.16 to $0.20, assuming $119.5 million fully diluted weighted average shares outstanding. I'd like to discuss a few remarks regarding our guidance today. In terms of top line growth, our guidance contemplates a more normalized spending environment, reflecting the reduced impact from tailwinds such as log4j. As a reminder, hiring and investment for us is typically weighted towards the first half of the year, which results in lower operating margins in Q2 and higher operating margins in the second half of the year. This seasonal expense flow is something we discussed on our last call and it's reflected in the outlook for the second quarter. Also, as announced today in a separate press release, we entered into a definitive agreement to acquire Bit Discovery, an attack surface management company. The acquisition is not expected to close until later in the quarter and is therefore not expected to have a significant impact on our financial outlook for Q2. For the second half of the year, revenue is not expected to be significant, but we expect Bit Discovery to add two to three million of CCB, most notably in the latter part of the year, and 2 million to 3 million of non-GAAP net loss. The impact of the acquisition of Bit Discovery is not reflected in our outlook today. In summary, we are delighted with the results for the quarter. We're off to a great start to the year, and we feel really good about the outlook we are providing today. I'll now turn the call back to Amit for some closing comments.

Thanks, Steve. We continue to see increasing levels of differentiation in our core capabilities across our solutions. This is particularly exciting given the strategic role that many organizations are increasingly placing on VM. We're thrilled about the momentum we have in our business enabled by strategic investment that we've made and continue to make. We believe that bringing our invaluable solutions and data sets into a unified cyber exposure management platform with differentiated analytics such as attack path analysis and others positions us incredibly well for the long term. We delivered strong results in Q1 and are excited about the road ahead. We hope to see many of you at the JP Morgan, William Blair, and RSA conferences in the coming weeks. We'd now like to open the call up for questions.

Thank you. At this time, we will be conducting a question and answer session. If you would like to ask a question, please press star 1 on your telephone keypad. A confirmation tone will indicate your line is in the question queue. You may press star 2 if you would like to remove your question from the queue. For participants using speaker equipment, it may be necessary to pick up your handset before pressing the star keys. One moment please while we poll for questions. And our first question comes from the line of Hamza Fardawalla with Morgan Stanley. Please proceed with your question.

Hey, guys, thanks for taking my question. And, Steve, it's good to know that the $2 million to $3 million from BitDiscovery is not included in your CCP guidance. Just want to clarify that?

Correct.

Great. Okay. Just making sure. So just maybe one question for me. There's been a lot of talk about securing critical infrastructure these days. I know you've been talking more about it. Can you give us an update on what you're seeing on the OT security side? Because I know in the past that's been a fairly long sales cycle product, and it's been more of an evangelical sale. Are you seeing those sales cycles start to shorten, and are you starting to see it contribute to the top line at this point?

We are. We're seeing – great question. We are seeing, and over the last couple of quarters we've seen – increased adoption of the OT platform. And I think just as importantly, we're starting to see greater level of confidence in the sales team engaging with customers on OT and understanding that customers have OT requirements. We believe very strongly in the long-term potential of this market. And as you said all along, this is just a market that moves very deliberately and doesn't move at the speed of cloud. So the indications are good. and certainly the momentum has been building in recent quarters.

Thank you.

Our next question comes from the line of Brian Essex with Goldman Sachs. Please proceed with your question.

Hi, good afternoon. Thank you for taking the question, and great to see the acceleration in CCBN revenue. I will continue the trend with one question. Maybe, Steve, can you help us understand, you know, With regard to sales and marketing in R&D and what to expect for spending for the year, if we take the prior commentary that you had, I think last quarter expected sales and marketing to be about the same rate as a percentage of revenue in R&D expected to ramp. How should we think about where that investment is coming from, where potential upside might be plowed back into the business, and how much of that spend is expected momentum driven versus other items like wage inflation, how that might impact?

Sure, Brian. Well, first and foremost, you know, we are, you know, we are investing this year. And as a reminder, our hiring investment plan for us typically is weighted towards the first half of the year. And so there's some seasonal plugs to the business, which will result in You know, more modest margins in Q2 and then higher operating margins the second half of the year. As Amit commented earlier on the call, we are seeing great success adding headcount and competing in this market. So hiring certainly is ahead of our expectation and retention is trending lower. So we've added sales capacity the first, you know, the early part of the year. We're also adding engineers as well, and I think that's boding well for our ability to continue to add new products and continue our pace of innovation. So going forward, I think the leverage will come from the second half of the year, the fact that we're doing the early onset of the hiring the first half of the year. That'll drive marginal leverage throughout the year, and then obviously we expect continued growth in revenue and CCB. So overall, very confident in the outlook. Please put the print for Q1 and feel good about the investments that we're making to sustain long-term growth.

Great. Helpful color.

Thank you.

Our next question comes from the line of Rob Owens with Piper Sandler. Please proceed with your question.

Great. And thank you. Sticking to the one question thing, kind of liking this. Can you guys speak to the composition of the quarter overall? It seemed like there was strong velocity and low days billings outstanding. Just curious how things played out, you know, your velocity business versus large deals, because it's one of your smaller net ad quarters in terms of over 100,000 ACV customers. So just the composition and what you're seeing in the pipeline. Thanks.

Well, it's important to note, as you mentioned earlier, we're very pleased with the results of the quarter. This is our fourth consecutive quarter in which we accelerated CCB growth. We grew over 31%. We added over 400 new enterprise platform customers. And we added, I think, 17 new six-figure customers. The one comment that I will make is that we don't optimize the company for any one metric, and pipeline opportunities can vary from quarter to quarter, between large and mid-market deals, and between new and upsell opportunities. So overall, we're pleased with the results for the quarter. We're adding lots of customers, and we even have over 1,000 six-figure customers that are actively expanding their subscriptions as well.

It's safe to say, though, from the metrics, Steve, it was a very linear quarter.

Yes, we got off to a really strong start for the year. Like any software company, the last month of the quarter can represent over 50% of our total sales. So I would characterize it as our typical flow for the quarter.

Thank you. Our next question comes from the line of Mike Seacost with Needham. Please proceed with your question.

Hey, guys. Thanks for taking the questions here. And just coming back to a couple of comments here in the Q&A regarding these customer ads, one of the things that struck me when we were talking about the velocity just now, but These new enterprise platform customers you added historically have declined quarter to quarter from Q4 to Q1 by about 140, 130 customers. So good to see that it only declined by about 100. I think that's one of the things that struck me as far as customer additions this quarter. I did separately want to ask you guys about the macro environment you're seeing today. There's been a lot made about Europe. I know that you guys have about 25% of your revenue base there. Just curious what you are seeing on the front lines today. Obviously, we have some good guidance coming from you, but just curious on your thoughts, anything incremental, especially as we're now a month into Q2.

Yeah, Mike, great to hear from you. We certainly have a high degree of confidence in the quarter and continued progress. We're seeing very strong demand. We're not taking any fundamentally different approach, but Again, you look at the headlines today, whether it's super high-profile breaches, whether it's a number of proposed legislative initiatives, whether it's alerts and warnings coming out of Department of Homeland Security, GCHQ, and other governments around the world, there's just a tremendous amount happening around cyber. There's a heightened demand environment. And in Almost every one of these news happenings, there is the inclusion of very specific information highlighting which vulnerabilities are being exploited, what organizations need to do to protect and defend themselves. So we're super confident in the market and feel like we're very well positioned for continued growth going forward.

Terrific. And if I could just cycle back, I know that you guys have spoken about the hiring, especially on the quota-carrying reps. Can you give us a sense, at least directionally, how have hires progressed for the quota-carrying reps? If we're comparing Q1 of this year versus Q1 of last year, are we still accelerating that? And then the follow-up would be, I think your sales reps typically mature over a 10-month process or a time frame. But how has the maturation of those sales hires progressed? And I guess with EP, does that in any way streamline how quickly your sales reps can mature on the platform and get out there and start producing for you? Thank you.

Yes. So with regard to ramp, our expectation is that when we hire a sales rep, that they would be fully ramped in month 10. So that is correct. And I think it's also fair to say the rate in which we're hiring is notably faster than the levels of hiring that we saw in the first half of last year. And that coincides obviously with, or important to note, with the acceleration of growth. Last year, CCB growth was 20%. Today we're reporting 31% CCB growth. We're seeing acceleration throughout the year. The product portfolio has expanded as well. So that gives us the confidence to invest and it gives us the confidence to expect continuing increases in productivity as well.

Great, thank you.

Our next question comes from the line with Barclays. Please proceed with your question. Okay, great.

Hey guys, thanks for taking my questions here. Maybe for you, I'd love to talk about Tenable EP just a little bit more deeply. Can you just talk about how EP is being received by customers and what additional products? Obviously, customers have a lot of products to choose from within EP, within that sort of easier licensing model. What are you sort of finding are the most commonly attached or additional products that customers are using beyond VM?

Well, Saki, great to hear from you. We are extremely excited about the momentum that we're seeing with, uh, with EP, uh, EP is a, a, uh, a platform offering that only came out, I think April of, of last year. And, and we noted, uh, you know, right out of the gate, there was the, both the, the Salesforce as well as our customer base were very rapidly gravitating toward, uh, EP as the preferred path for, for procuring product. There's people a lot more flexibility, uh, it gives people really buy into the, to the vision and the, the broader capability that we're bringing to the table. So in its earlier iterations, EP included core Tenable.io capability, the vulnerability management capability, as well as web application scanning, some container security capability, and Lumen from an analytics perspective. And we saw a pretty broad uptake across those product lines, probably most notably, between VM and Lumen, but overall adoption was strong. In February, we added or announced that we've added the Active Directory capability to Lumen, the full cloud security offering capability to Lumen, and we announced the acquisition of Symptom and APA attack path analysis would be added to Tenable EP. I'd say right now the sales team is even more enthusiastic. We're seeing continued traction certainly in the mid-market, but we're seeing notable wins for Tenable EP in the enterprise. How the usage will break down with the newer platforms or the newer exposure solutions being added to EP will keep a close eye on that over the next couple of quarters.

Got it. That's very helpful. Steve, maybe for my follow-up for you, staying on the topic of VP, again, to Amit's point, it's still early days, but can you just talk about Just broad brush, I guess, how much of the new business is coming from EP? And more importantly, what sort of run rate increases are you seeing from EP customers and what they spend versus non-EP customers, if that makes sense?

Yes, absolutely, Sackett. We launched EP in Q1 of last year. That's important to note. And today, just 12 months later, represents a double-digit percentage of our total new enterprise sales. So it's exceeded our expectations here out of the gate. And our expectation is that percentage will continue to grow over time. EP, as Amit mentioned earlier, is a unified risk platform, and that includes coverage of multiple asset types. So customers are able to assess more areas of their attack surface. As a result, we're also seeing notably higher selling prices for EP versus our standalone VM offering, actually 60% higher selling prices to be specific. And that could go higher, and our expectations that will go higher as we continue to include more capabilities, more offerings in EP.

Very helpful. Thanks, guys.

And our next question comes from the line of Brad Reback with Stiefel. Please proceed with your question.

Great. Thanks a lot. I'm not sure who the question is for, but Steve, you had mentioned in the prepared remarks again about the analytics. investment that you guys are making this year. As we look forward, should we expect the opportunity? Is there an opportunity there to directly monetize that? Or is it just going to be bundled with the platform and should help retention rates going forward? Thanks.

Yeah, I'll jump in there. And the answer is both. We certainly are including a lot of analytic capability in the platform itself. We think this is a key differentiator. So having core Lumen functionality being part of EP, we think, is a strategic differentiator. Unified reporting, dashboarding, role-based access control functionality, all those types of things. We are also adding new capability to the platform, which may be sold Separately or maybe sold as an add-on analytic form and charged for separately Specifically the much more in-depth attack path analytic is something that we anticipate charging separately for And then you know as we look at how we monetize and bring The attack surface management capabilities to market and we think that there's room for both discovery of externally facing assets probably enable that to be a embedded into our enterprise platforms on a sort of quarterly basis, and then to do it on a more real-time basis and to have much more context and much richer context around every asset that is externally facing. We think that that is something that we'll be charging for separately.

That's great. Thanks very much.

Our next question comes from the line of Andrew Nowinski with Wells Fargo. Please proceed with your question.

All right. Thank you and congrats on a good quarter. You know, this looks like one of the largest beats you've had relative to the high end of your guidance in the last two plus years that you said that Log4J aided less than it did in Q4, which I'd say is pretty consistent with the feedback you received from our reseller community. You know, and now you have Spring4Shell, which seems pretty similar to the Log4J vulnerability. I'm just wondering, you know, if these vulnerabilities are not necessarily contributing to the inflection you're seeing in your growth, do you think your competitive advantages over the competition may have widened given that you have a much broader portfolio than all the other competitors that are out there?

I think that's fair. You know, we certainly think that each one of these higher profile vulnerabilities does incrementally add to or raise awareness around the requirement for professional VM capability, but that we're pursuing a much broader opportunity. And so we see our continued investment in R&D, our continued ability to differentiate our product capabilities, both in core VM as well as a broader understanding of what's happening with the customer's attack surface, specifically helping them around cloud native assets and workloads, the protection of identities and Active Directory infrastructures and helping them assess and understand risk more holistically. So as understanding cyber exposure and risk becomes a more urgent practice for enterprises, we feel like we're going to be able to continue to differentiate ourselves and distance ourselves.

And have you seen actually, or do you have examples of improvements in your win rates versus the competition relative to maybe where they were last year?

Hi, this is Steve.

The short answer is yes. And when we, we know when we're first in on an opportunity, our close rates and our wins rates go dramatically higher. So some of the investments that you're seeing today and go to market, includes not only added quota capacity, but increased marketing efforts to continue to generate higher levels of demand and create new opportunities for us. So overall, we're very pleased. I think this is playing out in the story over the past couple of quarters, and it's also playing a role in our growth and our revised outlook for the year.

Great. Thanks, guys.

Our next question comes from the line of Gray Powell with BTIG. Please proceed with your question.

Great. Thanks for taking the questions and congratulations on the quarter. Just a couple on my side. So one of the trends that we've been hearing about is just developer security or shift left or whatever you want to call it. It just seems like a bigger theme this year than last. Now that you have infrastructure as code and CSPM within CS, How should we think about demand there? And are you seeing an inflection in that product set?

Well, I guess, first of all, we're early in that market and early in bringing our product to market. We did the QX acquisition in Q4. We launched the product integrated to Tenable as Tenable Cloud Security in Q1. So caveat everything by saying, early in the product's life cycle. That's how we continue to see great momentum with it in terms of pipeline growth, in terms of customer engagement, in terms of growth and usage of Terrascan, which is the open source piece of software that Acurex operates and brings to the table. So all indicators are that the product line is on the right track. And that as that market matures, we have high expectations.

All right. Makes sense. And then just the other question would be, what are your expectations for the U.S. Fed over the next six months? And just how do you feel about the opportunity today versus this time last year?

I think we feel really good about our public sector opportunity.

As you know, we're the market leader. Approximately 15% of our revenue comes from public sector, which is predominantly U.S. federal. The spending environment is very healthy, and we're making a lot of investments this year to sustain and even increase our footprint there. And then we also have some newly authorized products that we can sell back into the Fed, you know, IO specifically, and then OT is also on the list of products that we can sell. This quarter, we didn't We didn't benefit this quarter from closing a really large, sizable deal. Sometimes the business and public sector can be very chunky. This quarter, we didn't see that, but there's a lot of opportunities in the pipeline. We'll be working hard to close those over the ensuing quarter.

All right. Thank you very much. Our next question comes from the line of Jonathan Ho with William Blair. Please proceed with your questions.

Hi, good afternoon. I just wanted to understand a little bit more about how you're thinking about the ASM area. I mean, clearly this is a hot space with a number of private companies that are doing quite well and a few acquisitions as well. Can you talk a little bit about maybe what this could mean from a differentiation standpoint, as well as how you intend to differentiate from the rest of the competitive group? Thank you.

Yeah, great question, Jonathan. Great to hear from you. attack surface management market is very tightly intertwined with VM and cyber exposure management as a discipline. And so we think the types of folks that use VM and the types of folks that are interested in attack surface management are very closely intertwined. We see a tremendous alignment of messaging, positioning, go-to-market resources, as well as technology leverage. If you're looking at high priority vulnerability and exposure, whether or not a particular asset is exposed to the internet is obviously one critical factor. We also believe that it fits very well and very tightly with our attack path analysis capability that we announced last quarter. So not only looking at high value asset, but then looking at what are the possible entryway exposure points which could lead you to that high value asset. So we think it's tightly aligned. We're particularly excited about BitDiscovery for a number of reasons, including the accuracy of their attribution capability. So looking at all internet assets and being able to accurately ascribe particular assets to particular organizations, as you might imagine, is quite a complex task. We really believe strongly in what the discovery team have done and their ability to achieve scale as we bring this type of capability to 40,000 customers and still have the ability to upsell a much deeper context around those assets beyond just their discovery. We think this is the right asset. We think it's the right asset for us. We think we're extremely well positioned to radically disrupt the dynamic that exists today in the ASM space.

Thank you. Just as a follow-up, just given the new capabilities that you are adding to the EP portfolio, do you see this as a potential to add maybe some new tips of the spear to help you break into maybe some incumbent accounts or to maybe go at it from a different direction as you start to leverage these new capabilities that maybe your competitors don't have?

We definitely think about it that way, and we definitely see early indicators, you know, lighthouse accounts, if you will, which have come to us from some of our newer exposure solution areas. Specifically, OT and AD have been able, and Active Directory have been able to achieve this in recent periods. And, you know, we believe that that over time will be able to lead with cloud or lead with, uh, ASM or, or, or other functionality, uh, and, and generate pull through for, uh, other product lines or, or for, uh, our, our VM capability. That said, you know, the broadest swath of our customers and, and the, you know, the fastest time for monetization would be to bring some of these newer capabilities to the existing, you know, 40,000 plus customers. And so we're looking at as the primary track for the near future, but certainly believe that these other product lines can be tips of the spear for us.

Great. Thank you.

Our next question comes from the line of Joshua Tilton with Wolf Research. Please proceed with your question.

Hey, guys, and thanks for taking my questions. I understand that we're kind of playing for a bit of a different tenable business here, given the recent acquisitions. And you also mentioned that the log4 shell vulnerability was a benefit this quarter, but that the benefit should kind of subside throughout the rest of the year. So is there any way you can maybe just help us understand how we should think about the quarterly CCB seasonality throughout the rest of the year, maybe versus a previous typical tenable year?

Yes. So with regard to Log4J, that is correct. We did see some benefit in Q1, although to a lesser extent than what we saw in the fourth quarter. So acceleration and growth, obviously, this quarter is due to the strength of our overall market. And I think our execution is giving us the confidence to raise our outlook for CCB this year as well. And our expectation is that we'll follow the normal seasonal patterns of our business, right? The fourth quarter tends to be seasonally our strongest quarter in terms of the level of business that we transact both new and rental. And so our expectation is that it'll follow a typical seasonal flow that we've seen in prior years. And so if you look at the guidance this year, on the last call, we guided to 22 to 23% CCB growth. On this call, we're guiding to 24 to 25% growth. I think it's an increase of 13 million in CCB. 10 of that we delivered in Q1. 3 million is with regard to the raise. That excludes any contributions from bid discovery, which we specifically called out in the press release today. So overall, we feel really good about the business. And there's nothing unusual with regard to the seasonal patterns of our business that we want to comment on. on the call now.

Great. And when we think about the CCB guidance for the year, I know it's still early in the exposure solution story, but given we are almost five months into this year, are you guys thinking any differently about what those businesses will contribute to the full year CCB number relative to when you maybe first gave guidance at the end of 4Q?

Yeah, I think it's... Some of these things it's important to know if you look at in the case of... like Acurex and even Symptom, they're still in ramp mode. In the case of Acurex, we're just starting to sell the infrastructure as code capability. And then Symptom, which is the attack path analysis, we haven't even launched the product. That will happen the second half of the year. So our expectation is that some of those products will contribute to growth the second half of the year, more towards the latter part of the year. It is factored into our guidance and our outlook this year. And then, obviously, our hope is that that will continue to grow going forward. And we feel really good about our ability to monetize some of the new tech and also bring new products to market organically and sell that as well. So I think you're seeing that in the top line today and the continued acceleration of growth.

Thanks, guys, and congrats on the quarter.

Thank you. Our next question comes from the line of Rudy Kessinger with DA Davidson. Please proceed with your question.

Hey, guys. Thanks for taking my questions. I want to ask on the guide, you know, $6.4 million ahead of revenue in the quarter. I know you had $1.4 million to pull forward from the Russian Belarus contracts, but even if you exclude that, still a $5 million revenue beat in the quarter, which is one of your largest, again, looking back over the last couple years. but you only raised the revenue outlook by $10 million for the year. You did raise CCB by $13 million, a bit more, but it seems like the flow through of the beat a bit less than in past Q1s. Is there any additional color or puts and takes you can give on what went into the revenue guidance?

No, and as you did mention, we had a beaten race, and we raised our outlook for CCB by $13 million. and we raised revenue back to the tune of 10 million. So most of what we saw, we are flowing through. Keep in mind, there is sometimes a delay in terms of deals that you close and the commencement of revenue. And so that can be a little bit of a timing difference there. But overall, we feel really good about the beat and the race. We're flowing a lot of that through on the revenue side. It's still very early in the year, and we feel good about the outlook we're giving today as well.

Got it. And just to follow up, is there any way you can quantify the incremental sales capacity that you added, I guess, both last year and plan to add this year?

We don't disclose the number of quarter carrying sales reps, but what we do say is that our hiring plans are more weighted towards the front of the year. We feel good about the investments we've made in go-to-market over the past couple of quarters. We do think it's having an impact on our growth, and obviously it's also driving higher levels of productivity. And that happens to coincide with a much broader product portfolio, and that's the success of our exposure platform. So expectations going forward is that we're going to continue to hire. We're hiring at levels that are even exceeded our expectations. A lot of that is weighted towards the front half of the year, as I discussed, and that will moderate to second half, and then we'll look to 2023 to make decisions about levels of hiring as we get closer towards the latter part of the year.

Sounds like we're done. Hello?

This concludes our call.

I don't know where the operator went, but I think we're... We're done on time anyway. Look forward to seeing folks at any of the upcoming events. Appreciate your time and look forward to continuing