Tenable Holdings, Inc.

tenable Q2 2024 earnings conference call. At this time, all participants are in a listen-only mode. A brief question and answer session will follow the formal presentation. If anyone should require operator assistance during the conference, please press star zero on your telephone keypad. As a reminder, this conference is being recorded. It is now my pleasure to introduce your host, Ms. Erin Carney, Senior Director, Investor Relations. Thank you, Ms. Carney. You may begin.

Thank you, Operator, and thank you all for joining us on today's conference call to discuss Tenable's second quarter 2024 financial results. With me on the call today are Amin Yaran, our Chief Executive Officer, and Steve Vince, our Chief Financial Officer. Prior to this call, we issued a press release announcing our financial results for the quarter. You can find the press release on our IR website at tenable.com. We will make forward-looking statements during the course of this call, including statements related to our guidance and expectations for the third quarter and full year 2024, growth and drivers in our business, changes in the threat landscape in the security industry and our competitive position in the market, growth in our customer demand for and adoption of our solutions, including Tenable 1, planned innovation and new products and services, the potential benefits and financial impact of our recent acquisition of Eureka, and our expectations regarding long-term profitability and free cash flow. These forward-looking statements involve risks and uncertainties, some of which are beyond our control, which could cause actual results to differ materially from those anticipated by these statements. You should not rely upon forward-looking statements as a prediction of future events. Forward-looking statements represent our beliefs and assumptions only as of today and should not be considered representative of our views as of any subsequent date. And we disclaim any obligation to update any forward-looking statements or outlook. For further discussion of the material risks and other important factors that could affect our actual results, please refer to those contained in our most recent annual report on Form 10-K and subsequent reports that we file with the FCC. In addition, all of our financial results we will discuss today are non-GAAP financial measures, with the exception of revenue. These non-GAAP financial measures are in addition to and not a substitute for or superior to measures of financial performance prepared in accordance with GAAP. There are a number of limitations related to the use of these non-GAAP financial measures versus their closest GAAP equivalent. Our press release includes GAAP to non-GAAP reconciliations for these measures. I'll now turn the call over to Amin.

Thank you, Aaron. We delivered mixed results for the quarter with lower than expected CCB, but without performance in revenue and earnings. Exposure management continues to generate demand, particularly for Tenable One and cloud security as key priority areas for CISOs. Before I get into the quarter, I'd like to first comment briefly on the recent CrowdStrike outage. This incident highlights the importance of independent cybersecurity assessments and the negative global consequences of creating single points of failure with any one vendor. Excessive reliance on any one vendor reduces enterprise resilience, just as deviating from best-of-breed platforms increases exposure to risk. Boards have fiduciary responsibility to oversee cyber hygiene, and we expect that regulators will play an increasingly critical role in promoting resiliency and requiring transparency. We believe the path forward for modern organizations lies in interoperable, best-of-breed platforms that empower enterprises to reduce risk and improve cyber hygiene. Now, on to the quarter. A few areas stood out as notable in Q2. First, customers continued to highly scrutinize their spend and rigorously prioritize their investments. Second, and this is a positive trend for us, is that exposure management is gaining increasing momentum in the industry among customers and analysts. Customers need and want to understand their level of risk across their attack surface, from their IT environment, to the cloud, to their critical infrastructure. And we believe that has resulted in strong traction for Tenable One. And third, as customers increasingly rely on cloud, we are seeing strong momentum for our cloud exposure solution. In fact, one of our largest deals for the quarter was for a cloud security product with a major financial services company. And we'll talk more about that in a few minutes. Let me dig deeper on that first point on spending patterns that we noticed in Q2. We continue to see a great deal of customer scrutiny around cyber spending. This makes it more difficult to transact and close new deals as new projects and procurements are getting the greatest scrutiny. This trend becomes more apparent as deal sizes get larger. These two dynamics were more pronounced in our vulnerability management business in Q2 than what we had seen historically. And while our mid-shift to our faster-growing exposure solutions is healthy, it is not enough to offset the cyclical impact of our traditional standalone VM business. While VM is becoming more cyclical, we remain the clear leader. VM continues to drive initial Tenable One adoption and lays the groundwork for future upsell opportunities. Our win rates continue to be very strong. Exposure management is becoming increasingly critical for customers. We pioneered this category knowing that point products leave customers with an incomplete view of actual risk in their environments. This is where Tenable shines. Tenable One, our exposure management platform, provides a unified approach and consolidates visibility across asset types to deliver insights that individual products alone cannot provide. And there's also compelling ORI to customers who consolidate spend and reduce complexity in their security stack. We are expanding into budgets beyond VM and broadening our reach within enterprises. Tenable has become a trusted source of truth for boards, and executives needing to understand their businesses' exposure and risk. We're seeing this play out in our product mix as Tenable One represented 30% of new business in Q2. We are also seeing increased utilization with different asset types, which allows customers to leverage features such as attack path analytics, visualize the riskiest exposures and toxic combinations, and enables customers to quickly assess and safeguard their business. We're also seeing significant momentum in cloud security. Prioritization of cloud security spend coupled with our CNAP offering resulted in strong growth in our cloud security for the quarter. Tenable Cloud Security delivers immediate value as an exceptionally user-friendly multi-cloud solution. We're starting to land technical wins with large, sophisticated enterprises. In fact, this is the second quarter in a row that one of our largest deals included cloud security. As I mentioned, the Fortune 100 financial services company selected us this quarter for Keem, which is an integral piece to CNAP. Their other cloud security provider for CNAP was not able to deliver visibility in identity for cloud, but we are the best provider to meet their needs. During the quarter, we acquired Eureka, a leading data security posture management company, adding discovering and securing data to tenable clouds. We're excited to add enhanced DSPM to our CNAP offering, which we expect to happen this year. We're also expanding our generative AI capabilities to maximize customer value. Along with integrating AI into our products, we're also seeing rapid adoption of our exposure management platform to identify where and how AI is operating in customer environments. We introduced two new capabilities in Q2. First, an AI security posture management capability within our cloud security offering that detects AI misconfigurations in services like AWS Bedrock and Azure OpenAI and ensures compliance with their organization's security policies. Second, we now provide runtime detection to identify AI software libraries and browser plugins that may be in use within the enterprise. We believe this is an innovative capability to alert security teams where the unauthorized use of AI may be taking place in their environments. As we look ahead, we are going to focus on optimizing the business by investing in areas that matter most to our customers while continuing to drive profitability in the business. We will continue to enhance our CMAP offering, add additional features to Tenable One, and leverage AI to drive efficiency in our products and to solve problems for our customers. On that note, Steve will go into more detail, but we are introducing our 2025 unlevered free cash flow target of $280 to $290 million today. We believe this is a strong initial target representing our commitment to deliver durable cash flow growth, and we look forward to updating you as we get through the second half of the year. We'll continue to evaluate the appropriate level of investment and resources going forward to strike the right balance of growth and profitability. This is an exciting time for Tenable. We're leveraging our leadership position in VM, seeing major momentum in cloud, and delivering broader exposure management platforms. Despite challenges for this quarter, I am confident in our long-term strategy and our ability to grow over the ensuing years. I'll now turn the call over to Steve for further commentary on our financial results and outlook.

Thanks, Amit. Calculated current billings defined as revenue recognized in the quarter plus the change in current deferred revenue grew 10% year-over-year to $221.1 million. While we only dive to CCB on an annual basis, I think it's fair to say CCB growth in the quarter fell short of our expectations, and accordingly, we are revising our outlook for the year to reflect a more challenging selling environment. Now let's get into the results for the quarter as it will provide context to our outlook for the full year. Recall we went into the quarter with a healthy pipeline and a large number of six- and seven-figure opportunities. We closed fewer deals than expected as customers deferred new projects in the face of a more challenging macro environment and tighter budgetary constraints. This shortfall was specific to VM, particularly with large opportunities in North America, where we experienced longer sales cycles and more modest growth in comparison to other geos. Other areas of new business continued to get traction despite the selling environment. Tenable One grew to 30% of total new enterprise sales, and is up from 26% last quarter. Exposure Solutions, which includes Tenable One, standalone cloud, identity, and operational technology security solutions, represented over 50% of our total new sales in the quarter. As a point of comparison, Exposure Solutions was under 10% of total new enterprise sales in Q2 of 2020. We've made a lot of progress in this regard. This healthy mix of new business demonstrates our ability to broaden the product portfolio and expand into new markets over the years and reflect the growing demand for exposure management and the actionable insights we deliver to CISOs and their security teams. As Amit commented earlier, cloud security was also a major highlight for us with several sizable six-figure wins in the large market, including the global financial services and payments firm, a large defense contractor, and a multinational enterprise software company. We believe our success here is a clear indication that we will continue to take and share in one of the faster-growing areas of the cybersecurity market. Finally, I also want to note that current RPO growth in the quarter was 14%. Turning to other highlights, we added 408 new enterprise platform customers and 76 net new six-figure customers during the quarter. Our net dollar expansion rate was 109% this quarter consistent with last quarter. Our renewal rates remain strong. Now onto the P&L for the quarter. Revenue was 221.2 million, which represents 13% year-over-year growth. Revenue in the quarter exceeded the midpoint of our guided range by 3.2 million. Our percentage of recurring revenue remains high at 96% this quarter. I'll now turn to expenses. I'll start with gross margin, which was 82% this quarter, up 70 basis points from last quarter. Gross margin was better than expected due to our continued ability to cost-effectively scale our public cloud infrastructure for our exposure management platform and other cloud-based offerings. Sales and marketing expense was $84.8 million, up modestly from $84.5 million last quarter, and as a percentage of revenue was 38% compared to 39% last quarter. Sales and marketing expense was higher sequentially on an absolute dollar basis, primarily due to greater marketing investments to promote our cloud security and exposure management offerings, as well as to build our global brand, partially offset by cost and Q1 related to our annual sales kickoff conference. Overall, we are pleased with the improved efficiency in our go-to-market efforts this quarter, and expect sales and marketing spend as a percentage of revenue to continue to trend lower over the remainder of the year and beyond. R&D expense was 33.4 million, which is up from 32.6 million last quarter. R&D expense as a percentage of revenue was 15% this quarter, flat compared to last quarter. Wages were higher in the quarter related to the acquisition of Eureka. G&A expense was 19.6 million, which was down from $20.6 million last quarter primarily due to lower payroll taxes, primarily related to the vesting of our issues in Q1. G&A expenses and percent of revenue was 9% this quarter compared to 10% last quarter. Income from operations was $42.8 million and exceeded the midpoint of our guided range by $7.8 million. Operating margin for the quarter was 19%. which was approximately 325 basis points better than the midpoint of our guided range. A notable outperformance in earnings this quarter reflects our ability to continually drive leverage in our business while making investments to ensure cloud security and the exposure management markets. The sizable beat in off-income resulted in significant EPS upside. EPS for the quarter was 31 cents, which was 8 cents better than the midpoint of our guided range. Let me briefly touch on the restructuring expense in the quarter, which is excluded from our non-GAAP results. You recall that in Q4 2023, we announced an optimization plan, including the potential sublease of a portion of our real estate. In Q2, we executed the sublease and recognized a $4.5 million impairment charge related to the leaseholds and furniture and fixtures. Now, let's turn to the balance sheet. We finished the quarter. with $487 million in cash and short-term investments, reflecting the $29.2 million of net cash used for the ARECA acquisition. Accounts receivable was $179.6 million, and total deferred revenue was $725.8 million. Current deferred revenue was $562.6 million, which gives us a lot of visibility into expected revenue over the next 12 months. We generated $36.5 million of unlevered free cash flow during the quarter, which reflects the seasonal pattern of billings during the year. To date, unlevered free cash flow was $91.2 million and puts us well within reach to achieve our annual guide for the whole year, which we are raising today. We feel confident that we can continue to expand our operating and free cash flow margin over the ensuing years, as we have done so every year since our IPO. During the quarter, we repurchased 589,000 shares of common stock for an aggregate purchase price of $25 million. Thus far, we've repurchased almost 1.5 million shares and have $35.1 million of remaining authorization under our initial $100 million share repurchase program. With the results of the quarter behind us, I'd like to discuss our outlook for Q3 in the remainder of the year. For the third quarter, we currently expect revenue to be in the range of $222 million to $224 million. Non-GAAP income from operations to be in the range of $42 to $44 million. Non-GAAP net income to be in the range of $35 to $37 million, assuming interest expense of $8.3 million, interest income of $5.7 million, and a provision for income taxes of $3.8 million. And non-GAAP diluted earnings per share to be in the range of $0.28 to $0.30 per share, assuming 123 million fully diluted weighted average shares outstanding. And for the full year, we currently expect to calculate a current billing to be in the range of 957 to 967 million, revenue to be in the range of 889 to 895 million, non-GAAP income from operations to be in the range of 167 to 171 million, non-GAAP net income to be in the range of 143 to 147 million, assuming interest expense of 32.7 million, interest income of $23.5 million, and a provision for income taxes of $12.8 million. Non-GAAP diluted earnings per share to be in the range of $1.16 to $1.19, assuming $123.5 million in fully diluted weighted average shares outstanding. And unlevered free cash flow to be in the range of $225 to $235 million. I would like to provide some commentary regarding our revised outlook today, reflecting lower CCB and revenue for the year. As we think about the second half of the year, we are taking a more cautious approach to new business, not only with large VM opportunities, but also with other pipeline opportunities. While demand generation remains healthy, the rate at which these opportunities are expected to progress through the funnel in the second half of the year is expected to be more moderate than previously anticipated, which will constrain our near-term results. Despite the reduction in our top line outlook, we remain committed to our margin targets and are pleased to be raising our operating income and unlevered free cash flow outlook for the year. We're also providing an unlevered free cash flow target today of 280 to 290 million for the full year 2025, which is 24% growth year-over-year at the midpoint, and a major milestone toward achieving our updated long-term target unlevered free cash flow margin of 35% plus. With over 95% recurring revenue, high gross margins, and high renewal rates, we have a lot of confidence in our ability to drive continued leverage in our business. It's important to note that we are committed to delivering on this level of cash flow in 2025 based on a range of growth scenarios and will continually evaluate the appropriate level of investment and resourcing to achieve this target. As of platform and cloud-first company, we will invest in areas where we see outsized growth and we'll reprioritize spend into other areas where appropriate. I will now turn the call back to Amit for some closing comments.

Thanks, Steve. In summary, this market is very fluid and we are taking a more cautious approach to our CCB and revenue outlook today. We are very encouraged by the momentum in exposure management and cloud security and we are excited to about where we are as a company and the opportunity in front of us. We hope to see you at the Canaan Accord, Stiefel, and Piper Sandler conferences in the upcoming weeks. We'd now like to open the call for questions.

Thank you. We will now be conducting a question and answer session. If you would like to ask a question, please press star one on your telephone keypad. A confirmation tone will indicate your line is in the question queue. You may press star two if you would like to remove your questions from the queue. For participants using speaker equipment, it may be necessary to pick up your handset before pressing the star key. As a reminder, please restrict yourself to one question and one follow-up. One moment, please, while we poll for questions. The first question comes from the line of Saket Kalia with Barclays. Please go ahead.

Okay, great. Hey, guys. Thanks for taking my questions here, and good to hear from everyone. I mean, maybe to start with you, you know, I thought it was interesting in your prepared remarks how you talked about sort of traditional VM becoming more cyclical. Maybe to start us off, can you just talk about some of the market dynamics in VM and maybe why you think the demand for Tenable One feels just decently stronger right now than traditional VM? Does that make sense?

It does, Saqib. Thank you for the question. With respect to VM, it's an established market. We're seeing some cyclical patterns in it, but we are the clear market leader. Q2, We saw greater scrutiny of transactions, specifically in North America and in the large enterprise segment of the market. With respect to Tenable One, it's just a more modern infrastructure and a more strategic conversation that we're having with our customers. We continue to see strong demand for Tenable One, which accounted for 30% of our new sales in the quarter, and that's an even more broadly the T1, we saw attractive growth for exposure solutions, including cloud, where we're proving ourselves to be highly competitive with market leaders, identity, and in OT.

Got it. Got it. That's helpful. Steve, for my follow-up, maybe for you, despite the challenges in VM that we just spoke about, the focus on free cash flow definitely comes through, and I certainly appreciate the early look at how you're thinking about about 2025, just understanding that it's still very early, can you just talk us through how you kind of think about the balance between growth and margins in setting that target, even anecdotally?

Sure. Thanks, Zach. Well, we're very pleased to be providing an initial unlevered free cash flow target today for 2025 of $280 to $290 million. That's for the full year next year. That's up 24% at the midpoint. And that's also a major milestone, by the way, towards achieving our updated long-term target for unlevered free cash flow of 35% plus. Previously, our long-term target for cash flow was 30%. So we have a lot of confidence in our ability to continue to drive margin leverage. You know, in terms of growth for next year, look, I'm not going to comment about that. We're not through our planning process yet. And we have to see how the second half of the year plays out. But the one thing I will say is that we're firmly committed to delivering on our unlevered free cash flow targets. We're also raising our unlevered free cash flow outlook for the year. And we're going to continually evaluate the appropriate level of investment and resourcing to achieve these targets. Some areas will continue to lean in and invest, and other areas will reprioritize where appropriate. So overall, we just have confidence in our ability to drive higher levels of cash flow.

Very helpful. Thanks, guys.

Thank you. Next question comes from the line of Brian Essex with JP Morgan. Please go ahead.

Great, thank you. Thank you for taking the question. And Amit, great to see you back in the seat. So congratulations to you. I guess I wanted to touch on our medic and cloud security. Maybe if we can get an update on that. Where are you integrating it? Is it only on the analytics portion of that business? Are you integrating with the rest of the company and are you able to lead with cloud security? I know you talked about seeing as a point of strength there, but would love to get more detail on where you're seeing success and plans for integration longer term. Thank you.

Thanks, Brian. It's great to be back. I'll start off talking a little bit about the strength we're seeing in our cloud security product. We're providing a full end-to-end full CNAP solution, and that's resonating with customers. A majority of our cloud sales are for that full CNAP capability. That said, in the very large enterprise side of the market where they may already have a CSPM solution, they already have a CNAP solution, we have market-leading capability and particular strength around identity and the key functionality. So I think the large win, I think it was our largest single transaction for the quarter, came as a key win from a Fortune 500 company in the financial services sector, a very astute, very sophisticated consumer of technology where they were doing bake-offs. In terms of our ability to generate leverage with our cloud security product, we have a lot of confidence. The majority of our cloud security sales in fact, are procuring cloud security through 10.01 licensing. So we're extremely excited that that is resonating. We have customers choosing to move to the modern platform, modern way to assess exposures, and then diversifying their asset types and recognizing that we've got market-leading cloud security that they can procure and they can do that and get more leverage through an integrated platform 10-level one platform. So we think the strategy makes sense. We think we're in the early innings, but we think it's resonating and driving early results.

Great. Thank you. And just maybe a quick follow-up for Steve. Steve, could you comment on the Fed business or just public sector in general? I know that, you know, I think last quarter you felt really good about it and called out some strength there. And I think we've heard about, you know, federal spend trickling down to SLED. Maybe just a comment on, you know, MIT's strength of the business there and is that you know, reacting or behaving differently than the enterprise side of the business. Thanks.

Our public sector business was good this quarter and in line with our expectations. You know, there are some very large seven-figure agency-wide opportunities in our pipeline for the second half of the year. Some, due to its size, involve coordination and budgetary alignment, I'll say, across a dozen of sub-agencies for some deals. which can introduce some variability. But overall, we continue to see strength in the public sector, and we're set up for a good second half of the year with U.S. Federal.

Great. Thank you so much.

Thank you. Next question comes from the line of Hamza Fordewala with Morgan Stanley. Please go ahead.

Hey, good evening. Thank you for taking my question and good to hear from everybody as well. Amit or Steve, I wanted to follow up on the public sector question. You mentioned obviously good strength there for Q2. We have heard that there have been some delays on the Fed budget and perhaps some agencies who are a bit uncertain given potential change in administration with the elections later this year. I'm wondering if you're seeing any of that impact elongate the sales cycles for you within that vertical and if that is reflected in your guidance? Thank you.

Yeah, I'll start off and say, you know, we saw in-line delivery with our expectations for public sector in Q2. Q2 obviously is a seasonally high quarter for public sector. It is an election cycle and we have a significant number of six- and seven-figure opportunities in public sector. That said, I think we're taking a cautious approach for the remainder of the year and trying to understand that there's a certain amount of unpredictability around public sector in the election cycle. Yeah, and the only thing I'd add there is, look, we're trying to take a more cautious approach here in new business, specifically with large deals the second half of the year. This is predominantly in VM, but we're also applying more broadly across our business, which is including public sector. And while demand generation remains healthy, the rate in which these opportunities are expected remain through the funnel. In the second half of the year, it's expected to be more moderate. So we're trying to factor that into the guidance and trying to be cautious.

Thank you very much.

Thank you. Next question comes from the line of Rob Owens with Piper Sandler. Please go ahead.

Yeah, thank you for taking my question. And, Amit, appreciate your comments around the VM business, but what can you say to assuage investor concerns that it's not secular, that it is cyclical, that you're seeing right here, either in terms of pipelines or customer behavior? Thanks.

Yeah, I'll start off by saying I've got a lot of confidence in the VM market, in the VM business. It's a strategic market, you know, as you and others have been in this space for a long time recognize. It's one of those foundational tools that CISOs need and report regularly to audit and risk committees, sometimes cyber committees and to the boards of directors. So, you know, it's a foundational market requirement within cyber. It's not one that we anticipate going away or even you know, having a more secular downward trend. I think we're going to see an improved outlook in the VM market with improved macro conditions. We saw this specifically in North America and with large enterprises, and we're trying to take a more cautious approach to our guidance, make sure we're setting ourselves up for success from the range of the year. I do think that there's opportunity for outperformance in VM and growth over time.

Thanks for the color.

Thank you. Next question comes from the line of Mike Chikos with Needham & Co. Please go ahead.

Hey, guys. Thanks for taking the question here. I wanted to circle back. I think you guys had called out the tenable one contributed 30% to new business in this quarter if I had the metrics right. Can you just help us think about if it's contributing, I guess, that percentage, right, 30%, When can we start expecting tenable ones to start showing up in the revenue stream, just given the ASP uplift that management has historically spoken about for tenable ones?

Well, thanks, Mike, for the question. We have broadened our business over the years and expanded into adjacent markets. And the one thing I will say is that VM, as Amit commented earlier, is foundational. We're the clear leader. But growth there, as we mentioned earlier, has become fundamental. more moderate. But that said, we have confidence in that business to be able to drive growth higher in the ensuing years. And of course, we have a portion of our business, most notably cloud security and platform, that is growing at a very high rate. And we expect that to continue. And that will represent an increasing mix of our total business going forward. So our core market is seeing slower growth right now in this macro. And we have a portion of our business that's expected to represent a greater percentage of our total business going forward that's seen outsized growth. Obviously, we expect going forward that we'll be able to drive higher levels of cash flow regardless of the growth outcomes either the second half of the year or for next year.

Thanks for that, Steve. I also just wanted to circle up on the new business to the extent that customers are showing increased cyber scrutiny on these new deals. Can you just help us? Because I know Q1 was a very strong quarter for you guys. You guys were citing the strength that you were seeing in new deals. In hindsight, is it fair to think that that 1Q strength may have been more tied to the pause that we saw in March of last year with SVB and the easier comp? Or was there something that really... that showed up that was different in Q2, and can you maybe clarify when that showed up in Q2? Was it in April, May, June, really the last couple of days of the quarter? How did that progress? Thank you.

Yeah, I'll start off by saying, listen, we were pleased with our Q1 results. We came into Q2 with a strong pipe and a healthy number of six and seven-figure deals. Obviously, a large portion of that comes in North America. And as the quarter played itself out, we saw some of the softness in North America in the large enterprise, which has a disproportionately large impact on those larger transactions, which, you know, play a factor in our financials, you know, the size of the company. So, you know, I think we've got a reputation for calling it like we see it and, you know, saw strength in the business a few months ago. good with our setup for Q2, and obviously the quarter didn't play out that way.

This is here, Peter. Mr. Chikos, are you done with the question? Since there is no reply from the line of Mr. Chikos, we'll go for the next participant. The next question comes from the line of Joel Fishbein with TruViz Securities. Please go ahead.

Thanks for taking the question. Amit, good to hear your voice. Question on Eureka. DSPM market seems very crowded. Can you just help us through how that's going to fit in the product portfolio, when we would likely see revenue from it, and what the target customer is there? That would be really helpful. Thank you. Thanks, Phil. It's great to be back.

We're excited about the Eureka acquisition. DSPM is a strategic component of a CNAP platform. I anticipate that over time, most organizations will procure unified CNAP solutions, and that will include a component or some licensing component of DSPM. We have DSPM in our current CNAP offering. It's tightly integrated in a unified workflow, and that's really one of the strengths that Hermetic brought to the table with to have this cloud security capability. With the read acquisition, we're able to introduce the next generation features, the next generation DSPM capabilities into that CNAP offering and into our cloud security offering and feel like we can now be highly competitive with the absolute market leaders in DSPM. So we can compete on the DSPM, you know, toe for toe. I think we can lead the market when it comes to teams. And when it comes to unified CMAP workflow, I think some of the early innings here with our cloud security offering, they're starting to build that out, and we're excited to prove that out over time.

Great. Thank you so much.

Thank you. Next question comes from the line of Andrew Nowinski with Wells Fargo. Please go ahead.

Great. Thank you. And it is great to have you back, Amit. I wanted to ask about, I guess, really your guidance. The CrowdStrike outage obviously occurred after the quarter in July, but do you think this outage might have maybe exacerbated the scrutiny that you're seeing on some of these larger deals at your customers in that they're maybe just holding back spending now because of the outage? in Q3? Do you factor that in, I guess, is what I'm asking? Is that a factor as part of your guidance?

Yeah, I think we're certainly factoring in increased scrutiny from large enterprise transactions. And again, we're seeing that in what I would characterize as anecdotal instances at this point, where customers which have been burned and which experienced significant outage, their procurement teams are very aware of that and asking Very important questions. Luckily, we have great answers for them. We can operate in an agentless fashion. We've been doing this for decades. When we do operate with an agent, we can do it outside of kernel mode, which introduces a lot of safety valves for customers. And we don't force customer upgrades. So customers can select whether they want to operate with the latest and greatest agent or whether they want to operate with... agent N-1 or N-2 releases and make sure that what is experienced out in the wild doesn't disrupt operations. So, you know, we are seeing increased scrutiny of procurement. I think that's baked into the guidance that we're putting out in the conservatism for the second half of the year. And we think that we've got a lot of great answers for procurement teams as the crowd strike outage kind of plays itself out.

Okay, thank you. And congrats on putting out the, you know, the fiscal 25 free cash flow guidance. That was really impressive. I was just wondering, you know, given the news that we've, or the rumors that we've seen, can you confirm whether you hired advisors regarding a potential acquisition?

Yeah, obviously. Good question, but obviously we don't comment on rumors and speculation.

All right, thank you.

Thank you. Next question comes from the line of Jonathan Ho with William Blair. Please go ahead.

Hi, good afternoon. With regards to your 2025 free cash flow guidance, can you give us a little bit more color on where you see the opportunity to drive this incremental leverage from? Do we see additional rationalization? Is there going to be Yeah, like any commentary would be helpful in terms of just understanding where you'll see the opportunity to drive this from.

Yeah, I would say, you know, first, we had notable outperformance in the quarter, and that reflects our ability to continue to drive leverage in our business while also making investments to continue to take and win share in cloud security in the exposure management market. We're turning straighter. And part of our focus this year in Infinex is to be more efficient in our business. And specifically with regard to sales and marketing, it's something we talked about at the beginning of the year. And how it's played out this year has proven to be true. Like, for example, sales and marketing as a percentage of our revenue was 42% last year. This year it's 38% this quarter, rather. And so we expect continued leverage in sales and marketing Obviously, in terms of GNA, as we continue to grow and scale, we'll be able to more fully absorb some of those costs, which are semi-fixed. We're driving leverage in our gross margins as we scale our cloud security offerings and our unified exposure management platform. Every year, since we've been public, we've expanded our free cash flows. And we've also increased our free cash flow margins, unlevel free cash flow margins. So we expect a continuation of that trend. And just given the confidence in our business and what we've demonstrated today, as I mentioned earlier, we're also raising our long-term target for unlevel free cash flow from 30% previously to now 35% plus.

Excellent. And just very quickly, in terms of your ability to win on the CNAP side, clearly there's a lot of competition in this space. You've got clear differentiation with your KIM product. Can you help us understand what percentage of the market you think you can take or how the competitive dynamics are really playing out in this space, just given how many players are sort of targeting this market? Thank you.

Yeah. Obviously, it's a crowded market. There's a lot of players in broadly cloud security. I think when you look at Tier 1 CMAP solutions, I would consider us a top-five player today. And as we get into bank-offs with other top-tier products, I think that's proving itself out. Whether we're a one-, two-, or three-player this year, I have a high degree of confidence that we've got the team to bet on and that we're proving ourselves out in the field with competitive win rates, and we'll see how it plays out over time. We have a lot of confidence in the team. We have a market leading team solution which can set a foot in the door and I'd say among the best CNAP experiences in the market today.

Mr. Ho, are you done with the question?

Yes, thank you.

Thank you. Next question comes from the line of Shaul Eel with TD Cohen. Please go ahead.

Thank you. Good afternoon, everybody. Great to hear Amit's voice on the call. Steve, actually, let me start with you. Some of the slip that you might have seen towards the end of the quarter, has anything been booked back over the course of the past 30, 31 days now?

The short answer is yes. But what I will say is this, is in our experience, when we see deals push out of the quarter, it would not be prudent to assume that for the upcoming quarter or even the second half of the year that we'll continue to close what we expected plus the deals that push. Overall, we're just seeing longer sales cycles, specifically with large deals. The good news is we are transacting and closing large deals, and we have lots of pipeline opportunities that are in the high six and seven-figure range. But we're just assuming a longer sales cycle. And a longer sales cycle means it impacts not only the current quarter, but also the outlook for the second half of the year. And so that's what we're factoring into the guidance as it means to be more cautious.

Fair enough. And maybe for Amit, when you run a quick compare-contrast with the softness you've observed back at the beginning of the 1Q23, what would that compare-contrast look like? Is it strictly geographic? Is it product? Is it category-driven? Just curious.

Yeah, well, it's certainly product and category driven. So on the product side, we specifically saw it in our VM business in North America in the large enterprise segment.

We, in fact, had reasonable performance in the commercial market, mid-market with VM. No notable change. I think what we're trying to do in the outlook is apply that same level of scrutiny to our other theaters. and make sure that we're taking a cautious approach to the main of the year and setting ourselves up for success. What we are seeing is a healthy amount of engagement in strategic conversations with our customers, and that's what's really driving the impressive growth with Tenable One, where they're talking about exposure management and leveraging Tenable One as an exposure management platform, and where we're able to engage with them in our exposure solutions, specifically Strengthen Cloud, which we saw and expect to continue because that product is highly competitive, as well as with Identity and OT.

Got it. Thank you very much.

Thank you. The next question comes from the line of Clay Powell with PTIG. Please go ahead.

Okay, great. Thanks for taking the questions. Just a couple of quick ones on my side. So in terms of, I guess, we'll call them new disclosures, you've called out 50% plus of new sales from exposure solutions and then 30% of new sales from tenable one. So this might be a little basic, but does that mean that 20% of your new sales are standalone products like cloud security, identity, and OT? Yes. And then I just want to make sure that I'm correlating it correctly. Like when you say new enterprise sales, like what specifically is the definition there? Does that correlate more with something like current bookings or should we think of something else?

Hi, Greg. Yes, this is Steve. So when we said that 50% of our total sales in the quarter is exposure solutions, that is inclusive of Tenable One. It includes the 30%, just as a clarification. And then we often talk about enterprise sales, right? We have two really go-to-market motions. We have, you know, direct sales organization that stands shoulder-to-shoulder with partners to transact deals, and they have quotas, and so collectively we refer to that business as our enterprise sales business. They're selling to either mid- or large-sized customers, and then also part of our go-to-market is an unaided sale without the assistance of a sales rep or we transact deals through DMRs or online via our e-commerce engine. So collectively, in total, new business refers to our enterprise, direct sales organization, and also refers to our unaided sales motion with kind of lower ASPs, high-velocity deals.

Okay, so the metric's more... like a subset of total ACV. It's the total enterprise and does not include commercial. We just want to make sure I have it correct.

That it does not include the Nessus lower ASP products.

Yeah. Yeah.

All right. Got it.

All right. Great. I'll leave it there. Thank you very much.

Thank you. Next question comes from the line of Brad Reback with Stiefel. Please go ahead.

Hi. This is Rob on for Brad. Thanks for taking the question. Ahead of the federal fiscal year-end next quarter, I was wondering if you've seen any uptick in federal and public sector customers adopting tenable one as opposed to the perpetual license, VM, and OT adoption trends from last Q3, and if we should expect the same CCB headwinds from last Q3 recurring next quarter. Thanks.

Yeah, I think what we're seeing out of the federal market is similar in buying patterns and behaviors to other market segments. So we're seeing some adoption of tenable one, But obviously, that's a multi-year given the penetration and the account base we have in the federal market. That's going to be a multi-year account effort to transition and go down into 10.01. Great. Thank you.

Thank you. Next question comes from the line of Sreenik Kothari with Robert W. Baird. Please go ahead.

Thanks for taking my question. Welcome back, Ahmed. Just a follow-up to an earlier question and a commentary on the CrowdStrike outage-driven deal scrutiny impacted in the second half. At the very beginning, you highlighted the importance of best-of-breed solutions in promoting resilience and reducing risk associated with over-reliance on a single vendor. Can you elaborate on how you are positioning a cannibal to address And if they're already seeing some traction in the ongoing customer conversations, then just have a follow-up for Steve.

Yeah, I think we're in the early innings of how customers are going to perceive this, and you hear different responses and different approaches from CISOs around the world who have been impacted. For us, we look at it and say, hey, there are certainly some characteristics which could serve as tailwinds. When you look at vendor consolidation, on higher risk agents, things like kernel level usage or even operating system diversification. So we think that there is significant validation for having an independent audit, an independent exposure assessment from a vendor like Tenable. It's not also providing an operating system or other security functionality. And we think that message resonates. We think it makes great sense in a high-resiliency architecture. So there's good argument that we might see some tail end from this. Just as we spoke earlier on the call, there's good argument that we may see some headland. We see increased scrutiny or might see increased scrutiny on a more consistent basis from large enterprises where the procurement teams have experienced outages and are being asked by their corporate leadership or by the security leadership for different levels of assurances and different terms around liabilities and assurances around failure. And I think we've got great answers for those teams.

Got it. Thanks for the call, Ramit. And Steve, a quick follow-up on the net dollar expansion rate. remaining steady at 109. So just can you provide more insights into kind of how does this stack up against billing softness? Is it just the lagging indicator, that dynamic versus kind of real-time billing dynamic or anything else that we're missing contributing to this?

Well, obviously there's a lot of interplay between new deals in the quarter from new logos and then expansion within existing customers. And each quarter is different in its own right. And that mix between New business from new logos and expansion from existing customers can vary. As you mentioned earlier, our net dollar expansion rate in the quarter was 109. It was 109 last quarter. It was good to see that stabilize. And, you know, that reflects the customer's ability to expand and add tenable one. But also we're acknowledging here in this market, specifically the large deals and in particular VM, we're seeing customers moderate the rate of expansion. within that product set. So overall, we have a big customer base. We have confidence in our ability to sell a broader product portfolio back into that base, and we would expect the net dollar expansion rate over time to trend up over the course of years here.

Got it. Thank you.

Thank you. Next question comes from the line of Joshua Tilton with Wolf Research. Please go ahead.

Hey, guys. This is Rich Magnuson for Josh Stilton. Coming back to the macro, some other software names you've reported are saying the macro is starting to stabilize, and your results and commentary suggests maybe some potential softness there. Can you guys give any other points on inputs that may be driving that or some thoughts on the possible disconnect from others who have reported? So any additional color on things that changed quarter over quarter would be helpful. Thank you.

Well, we reported a good Q1 and raised our outlook for the year, and that was due to strength specifically in new logos, new dollars from new logos. As I mentioned earlier, every quarter is different in its own right, and I think in Q1 that was at a time when others were reporting a tougher macro and softness. This quarter, we saw certainly more levels of review and budgetary constraints with respect to large deals. And we're reflecting that in our outlook for the year. So, again, each quarter is different in its own right. We're trying to be cautious in our outlook, and we're reflecting what we saw in Q2 for the second half of the year.

Thank you.

Thank you. Next question comes from the line of Patrick Colville with Scotia Bank. Please go ahead.

All right, thank you so much for taking my question. Steve, this one's for you, please. So current billings rose 10% this quarter, which, I mean, given the tough comp, is pretty respectable. But the guidance implies quite a big fall-off in the back half. I mean, I model an exit billings growth rate in 4Q of about 7%. So I guess, am I thinking about it the right way? And then, is it these trends you've been talking about, shortfall in VM because of the stick locality, North America softness, and large enterprise softness, those trends going to get worse and worse through the year? You know, like what we see in TUKU worsens.

Yes, so I'll take it, impacting our CCB guide a little bit. If you look at the second half of the year, You know, that suggests that we're expecting to grow, call it 9%, 10%, you know, given the range that we provided. So, yes, we are expecting more moderate growth the second half of the year relative to what we experienced in the first half. What we said, you know, specifically in Q2 is that we saw, you know, a challenge getting deals across the finish line, specifically with VM and North America. And so that's reflected in our outlook the second half of the year. which for large deals as a whole. It's more notably in our VM business, but we're also trying to hedge large deals across our feeders, whether it's public sector or otherwise. And we think that's the right thing to do. And so overall, we're trying to take a cautious approach the second half of the year. And the good news is that pipelines are full and the funnel remains strong, and our focus will be on executing and closing a lot of those large opportunities.

Very helpful. And in an earlier question, you highlighted the criticality of the AMP. It's a core discipline in every enterprise CISOs arsenal. Totally agree with that. The commentary you're giving is that we're going through a cyclical trough. Given prior cycles and given what you're seeing right now, when do you think the cycle might pass here in VM.

Yeah, I think it's, you know, obviously quite speculative to throw out a particular quarter. It's more just a recognition of the importance of the market and that at some point, both from the macro perspective, but more specifically from a VM perspective, that, you know, it's... will come back in favor and have an increasing share of budget over time the way it has in years past. And it has been cyclical in years past as well. We saw it a couple of years ago. It was the number one priority in some CIO, CISO surveys. And then a few years before that, it was a number five, number six priority. So these things are cyclical. We believe that it will come back, but difficult to project when. And we're certainly not factoring that into our outlook for the year. Certainly our expectation is that we would see relative higher over the soon years.

Thank you so much.

Thank you. Next question comes from the line of Roger Boyd with UBS. Please go ahead.

Great. Thanks for taking the question. Steve, I'm wondering if you could help bridge the CCB performance versus the CRPO performance and anything you're seeing from

Billings duration or payment terms perspective given the relatively better CRPO and current bookings growth Yeah, so RPO current RPO growth grew 14% and Look, we we talk about CCB as a proxy of what we sell and and some quarter CCB can closely correlate to the underlying health and sales and of the business. In other quarters, I think we talked about this in Q3 of last year, RPO is a better approximation. I think it's fair to say, regardless of what metric, you know, top line came in lighter than expected, which we talked about. But, you know, there's not a perfect metric, and CCB here is also influenced by deal timing, early renewals, a number of other factors. But, you know, overall, it's a corollary to our performance in the quarter, which we discussed.

Got it. And then maybe a quick follow-up for Amit. Just approaching the cloud competition debate from another perspective, any color on the contract durations or strategic nature of the deals you're seeing in cloud security? It seems like you're having a lot of success With the Keem function in particular winning alongside existing Synapse solutions, can you just talk to your confidence in winning that broader cloud security budget over time and not the other way around as other Synapse vendors expand their own Keem offerings? Thanks.

Yeah, sure. I'll start by saying most, you know, a vast super majority of the transactions that we're pulling in on the cloud security side are for cloud security and the broader Synapse solution. A lot of customers begin their CNAP journey with CSPM. We think we have highly competitive CSPM functionality, but really that unified CNAP approach is an area where we really shine, especially vis-a-vis competition. And again, I think some of our early win rates are starting to prove themselves out, and especially in large enterprises where they're doing bake-offs and doing testing. That said, for organizations which have already deployed a CNAP or just deployed a CSPM, we don't have to go in and displace and do a rip and replace in order to pull down budget. I think the great example we called out was a sophisticated customer which was able to differentiate our team functionality from what they were able to get with their existing vendor. It also enabled us to attractively tap into identity and access management budgets It wasn't even coming from the cloud security budget. So again, that opens up additional TAM to us and one that I feel great we'll be able to continue expanding over time.

Thank you. Next question comes from the line of Rudy Kissinger with DA Davidson. Please go ahead. Mr. Kissinger, please go ahead with your question.

Yep.

Since there is no questions at this point of time, this concludes today's teleconference. You may disconnect your lines at this time. Thank you for your participation.