Tenable Holdings, Inc.

Greetings and welcome to Tenable's third quarter 2024 earnings conference call. At this time, all participants are on a listen-only mode. A question and answer session will follow the formal presentation. At that time, we ask that you please limit to one question. If anyone should require operator assistance during the conference, please press star zero on your telephone keypad. As a reminder, this conference is being recorded. I would now like to turn the call over to your host, Aaron Carney. Thank you. You may begin.

Thank you, Operator, and thank you all for joining us on today's conference call to discuss Tenable's third quarter 2024 financial results. With me on the call today are Amit Yuran, our Chief Executive Officer, and Steve Vince, our Chief Financial Officer. Prior to this call, we issued a press release announcing our financial results for the quarter. You can find the press release on our IR website at tenable.com. We will make forward-looking statements during the course of this call, including statements related to our guidance and expectations for the fourth quarter and full year, 2024 and 2025, growth in drivers in our business, changes in the threat landscape in the security industry and our competitive position in the market, growth in our customer demand for and adoption of our solutions, including Tenable One, Cloud Security, and AI Aware. planned innovation, and new products and services, and our expectations regarding long-term profitability and free cash flow. These forward-looking statements involve risks and uncertainties, some of which are beyond our control, which could cause actual results to differ materially from those anticipated by these statements. You should not rely upon forward-looking statements as a prediction of future events. Forward-looking statements represent our beliefs and assumptions only as of today and should not be considered representative of our views of any subsequent date. and we disclaim any obligation to update any forward-looking statements or outlook. For further discussion of the material risks and other important factors that could affect our actual results, please refer to those contained in our most recent annual report on Form 10-K and subsequent reports that we file with the FTC. In addition, all of the financial results we discuss today are non-GAAP financial measures, with the exception of revenues. These non-GAAP financial measures are in addition to and not a substitute for or superior to measures of financial performance prepared in accordance with GAAP. There are a number of limitations related to the use of these non-GAAP financial measures versus their closest GAAP equivalents. Our press release includes GAAP to non-GAAP reconciliations for these measures. I'll now turn the call over to Amit.

Thank you, Erin. We delivered strong results for the quarter, surpassing expectations of both the top and bottom line, including a record quarter for unlevered free cash flow. Tenable One and cloud security continue to drive strong demand as customers increasingly adopt our exposure solutions and are laser focused on exposure management. Many of the trends we saw across our business in Q2 continue to play out in Q3. Tenable One, our exposure management platform, and cloud security were top spending priorities for customers in the quarter. We've closed many deals for both offerings across GOs and a wide range of industries. A healthy percentage of our customers are evolving onto Tenable One and embarking on the exposure management journey with us. We believe this adoption of our platform is a precursor to a follow-on sale and a broader, more strategic relationship with Tenable. Within Tenable One, identity and cloud security continue to be top areas of adoption for our customers as they look for analytics they can't find elsewhere. As a result, Tenable One is growing well in excess of our overall grade three and accounted for approximately 30% of new sales in Q3. Other areas of strength in the quarter included public sector and mid-market. We anticipated Q3 to be a stronger year end for Fed business on historical experience, and that played itself out as expected. In addition to a strong Fed quarter, we closed some cloud deals in the broader public sector. This speaks to both the diversification of product and customer base that we can leverage in this theater. As mentioned, another area of strength for the quarter was mid-market. We have a fairly broad definition of mid-market customers, and we're seeing meaningful traction in the higher end of that range, specifically companies approaching 5,000 employees. In fact, we closed our first seven-figure mid-market deal in Q3. This deal was primarily a tenable one with multiple asset types licensed, unlocking the power of the platform. Similar to our enterprise counterparts, these customers have complex environments that benefit from the visibility and actionable insights our products deliver. This is resulting in good demand for Tenable One as more of these companies look to a single vendor to consolidate their stack while remaining a sophisticated approach to security. Conversely, some of the headwinds we previously called out, including longer sales cycles with additional scrutiny in new business and large VM deals, persisted. However, we did see some stabilization in VM relative to Q2. Importantly, pipe build, particularly among large deals, continues to see solid traction, which we believe indicates a lot of opportunity. In addition to traction with Tenable One, we're seeing consistent demand for cloud security product. Tenable Cloud Security continues to be our fastest growing product and has ASPs coming in twice as high as in our other products. Customers need to monitor the health of cloud native applications as a whole rather than individually monitoring cloud infrastructure. Our unified cloud offering brings an overall view to our customers. Further, it identifies priority risks and provides immediate insights into where they should focus remediation efforts. We are winning landmark deals, often against some of the most predominant players in the space, which validates our ability to compete and win in the cloud market. As customers' cloud environments expand and get more complex, we continue to innovate at an aggressive pace, We recently released new data security posture management and artificial intelligence security posture management capabilities for Tenable Cloud Security. By extending exposure capabilities to cloud data and AI resources, Tenable's cloud security D-NAP offering expands into some of our customers' greatest areas of concern. With the rapid rise of AI adoption, many organizations have jumped on board without fully considering essential safeguards around cybersecurity, privacy, and compliance. To address that challenge, we've begun rolling out AI Aware in Q3. AI Aware detects misconfigurations and unauthorized AI software, libraries, and plugins, all without interrupting customers' daily operations. In the eight weeks since its launch, Many of our customers have already started using AI Aware. With AI Aware, our customers can confidently and securely use AI in their business, knowing they have a better handle on AI-related risks. AI Aware is another example of how Tenable One enables customers to quickly and easily assess new and evolving areas of the attack surface. Most organizations operate in a hybrid environment. with data and applications spread across multiple systems, both on-premise and in the cloud. When a customer wants to understand where an exposure might reside in their systems, they can turn to Tenable to determine areas that are at risk, and most importantly, uncover risks as they traverse between these environments. We believe this is a huge competitive advantage for us, Whether a customer is on-prem using private or public cloud, or in some cases, even looking to repatriate some of their workloads, they need to feel confident that they have solutions that both cut across silos and can track and mitigate risks across these heterogeneous environments. And we're not slowing down. We are continuing to lean in on the areas that matter most to our customers. Our focus on the entire hybrid threat differentiates Tenable and is key to how we win against large and formidable competitors across the business. I'd like to spend a few minutes talking about an underlying transformation as we move from a primarily VM-focused business to our broader exposure management offerings. Exposure solutions now constitute over 50% of new sales and over 35% of total sales. We also looked at our business in terms of total assets license to better understand how customers are deploying Tenable One and for what use cases. At this point, non-VM exposure solutions represent 20% of our total licensed assets. Non-VM exposure solutions are growing at nearly 30%, led by cloud security, which is growing at approximately 100%. There are two key takeaways that we believe validate our strategy and set us up for continued success going forward. First, Sunbullet has become our flagship product and is the primary way our customers want to consume licenses for all asset types, including VM with enhanced analytics. The second key takeaway is that cloud and identity are primary growth drivers, are growing at very healthy rates, and are increasingly meaningful portions of our business. We are effectively deploying capital by investing in key areas of innovation, to help our customers solve some of the toughest problems they're facing. We're doing this while also balancing growth with profitability and delivering strong cash flow. Given the efficiency of our model, we're happy to announce that our board has approved an additional $200 million to our share buyback program. We believe in the incredible opportunity in front of us and look forward to continue to execute on our vision. I'd now like to turn the call over to Steve.

Thanks, Amit. Overall, we're very pleased with our execution this quarter, highlighted by better than expected CCB revenue and earnings. Calculated current billings defined as revenue recognized in the quarter, plus the changing current deferred revenue, grew 11% year-over-year to $248.4 million. CCB came in slightly better than expected in the quarter due to strength in our exposure management platform and the increased adoption in our cloud security offerings. Tenable One was approximately 30% of total new sales in the quarter, with many six- and seven-figure wins from large enterprises in the telecommunications, transportation, medical technology, and cloud infrastructure industries. These marquee wins are a clear indication of our ability to provide large and sophisticated customers with a trusted platform that unifies and assesses diverse aspects of exposure data and allows CISOs to make data-driven, risk-based decisions. We believe Tenable One provides a significant and compelling opportunity for us to continue to land new customers and expand relationships with existing customers at notably higher price points. Today, approximately a third of our total six-figure customers are Tenable One customers, and we are only 10% penetrated into our total enterprise platform customer base. So the takeaway is that we are seeing meaningful momentum with our exposure management platform, and we believe there's a lot of runway for continued growth. As Amit commented earlier, cloud security was also a major highlight for us with many notable wins from large organizations and public sector customers, both in the U.S. and abroad, as well as state and local government agencies. We attribute the approximately 100% year-over-year growth in this newer market to the strength of our integrated CNAP offering, and our ability to help customers of all sizes visualize exposures, misconfigurations, and access for workloads across hybrid environments. We are also pleased to see VM stabilize this quarter with outperformance in the mid-market and a maturing pipeline in the large market. Finally, I also want to note that current RPO growth was 12% year-over-year. Turning to other highlights, we added 386 new enterprise platform customers and 60 net new six-figure customers during the quarter. Our net dollar expansion rate was 108% this quarter. Our renewal rates remain strong. Now, on to the P&L for the quarter. Revenue was $227.1 million, which represents 13% year-over-year growth. Revenue in the quarter exceeded the midpoint of our guide by 4.1 million. Our percentage recurring revenue remained high at 96% this quarter. I'll now turn to expenses. I'll start with growth margin, which was 81% this quarter, down 20 basis points from last quarter and in line with our expectations. Our gross margin reflects the continued investment in our cloud infrastructure to officially scale our exposure platform and CNAP offerings. we would characterize these incremental investments in the quarter as semi-fixed cost versus variable, which should yield some leverage in gross margins over time. Sales and marketing expense was $83.1 million, down from $84.8 million last quarter, and as a percentage of revenue was 37% compared to 38% last quarter. Sales and marketing expense was lower sequentially on an absolute dollar basis, primarily due to the seasonality of of marketing program spending, Q2, and higher levels of sales productivity in the quarter, offset in part by higher commissions. Overall, we are driving greater efficiency in our go-to-market efforts this year as we successfully adapt to selling a broader product suite and close large deals. As a result, sales and marketing spend as a percentage of revenue has decreased significantly by 730 basis points since 2022. Looking ahead, we expect sales and marketing spend as a percentage of revenue will continue to trend lower over time. R&D expense was $35.6 million, which was up from $33.4 million last quarter. R&D expense was higher this quarter in comparison to last quarter due to a full quarter of engineering headcount costs related to the acquisition of Eureka and less capitalized software development costs related to our recently enhanced analytics for exposure management. R&D expense as a percentage of revenue was 16% this quarter, up 60 basis points compared to last quarter. G&A expense was $21.1 million, which was up from $19.6 million last quarter. G&A expense as a percentage of revenue was 9% this quarter, flat relative to last quarter. Income from operations was $45 million and exceeded the midpoint of our guided range by $2 million. Operating margin for the quarter was 20%. which was 50 basis points better than the midpoint of our guided range. We believe the notable outperformance in earnings this quarter reflects the strength of our recurring revenue model, resiliency of our customer base, and ability to balance growth with profitability. Overall, we are very pleased with our ability to continue driving leverage in the business as operating margins have increased from 10% for the full year 2022 to 15% for 2023 to 20 percent this quarter. EPS for the quarter was 32 cents, which was three cents better than the midpoint of our guided range. Now, let's turn to the balance sheet. We finished the quarter with $548 million in cash and short-term investments. Accounts receivable was $193 million, and total deferred revenue was $747 million. Current deferred revenue was $584 million, which gives us a lot of visibility into expected revenue over the next 12 months. We generated a record $60.8 million of unlevered free cash flow during the quarter, which is up compared to $36.5 million last quarter. On a year-to-date basis, we generated $152 million of unlevered free cash flow, which puts us well within reach to achieve the $225 to $235 million annual guide we provided last quarter. Recall, we do not guide to unlever free cash flow quarterly, but instead we do it at the beginning of the year and at the midpoint of the year, which was during our call in July. We feel confident we can continue to expand our operating and free cash flow margin over the ensuing years as we have done so every year since our IPO. With the results of the quarter behind us, I'd like to discuss our outlook for Q4 and the full year. For the fourth quarter, we currently expect Revenue to be in the range of $229 to $233 million. Non-GAAP income from operations to be in the range of $47 to $49 million. Non-GAAP net income to be in the range of $42 to $44 million, assuming interest expense of $7.8 million, interest income of $6 million, and a provision for income taxes of $3.1 million. Non-GAAP diluted earnings per share to be in the range of $0.33 to $0.35, assuming 125.5 million fully diluted weighted average shares outstanding. And for the full year, we currently expect calculated current billings to be in the range of 957 to 967 million, revenue to be in the range of 893.3 million to 897.3 million, non-GAAP income from operations to be in the range of 171.8 million, to 173.8 million. Non-GAAP net income to be in the range of 149.9 million to 151.9 million, assuming interest expense of 32.1 million, interest income of 23.5 million, and a provision for income taxes of 12.3 million. And finally, non-GAAP diluted earnings per share to be in the range of $1.21 to $1.23, assuming 123.5 million fully diluted weighted average shares outstanding. Earlier, Amit highlighted some of the underlying growth drivers of our business related to the accelerated adoption of our exposure solutions. The takeaway here is that we believe we have a very compelling opportunity in front of us to drive growth higher over time as exposure solutions become a larger part of our overall mix. Consistent with past practice, we will provide our guidance for 2025 during our call next February, but at a high level, it's fair to assume that our growth next year will be approaching the midpoint of our implied CCB growth for the fourth quarter of this year. It's also worth noting that we are on track to deliver the $280 to $290 million of unlevered free cash flow target in 2025 that we previously provided. Due to our strong operating leverage and increasing free cash flow generation, we're very pleased to announce today a $200 million increase to our share repurchase program, which demonstrates our commitment to effectively deploy and return capital to our shareholders. We have confidence in our ability to drive continued leverage in our business and deliver 35% plus unlevered free cash flow margins over time. I will now turn the call back to Amit for some closing comments.

Thanks, Steve. In summary, we're happy with where we are in our journey to becoming the exposure management company. We're very encouraged by the progress in cloud and look forward to long-term success. We hope to see you at the Wells Fargo and Barclays conferences in the coming weeks. We now like to open the call up for questions.

Thank you. At this time, we'll be conducting a question and answer session. If you'd like to ask a question, please press star 1 on your telephone keypad. As a reminder, we ask that you please limit it to one question. A confirmation tone will indicate your line is in the question queue. You may press star 2 if you'd like to remove your question from the queue. For participants using speaker equipment, it may be necessary to pick up your handset before pressing the star keys. One moment, please, while we poll for questions. Our first question comes from Saket Kalia with Barclays. Please proceed with your question.

Okay, great. Hey, guys, thanks for taking my questions here, and good to hear from everybody on the team. Steve, maybe for you, just to start with you, it was great to hear that exposure management makes up about 35% of total revenue. Could you just maybe touch on how fast that grew this quarter? and maybe how you think about that growth going forward, broad brush.

Hi, Sackett. This is Steve. Good question. A couple things. First, what we said was exposure solutions now constitute over 50% of new sales and over 35% of total sales. So that is based on sales of individual products used. When we mentioned exposure solutions as a whole, it includes Tenable One and sales of our standalone non-VM products. Additionally, we also look at our business in terms of assets license to better understand how customers are actually deploying Tenable One and for what use cases. Our non-VM solutions on an asset basis are growing 30% and represent 20% of our total sales. So this reflects that some total of all assets licensed by our customers for our exposure solutions, both on a standalone basis as well as through the platform. So just to be clear, it does not include any VM assets license within the platform.

Yeah, and I think that's helpful because it really helps us understand the traction that we're seeing within our solutions, both as a platform, but then also individually licensed assets, where we're seeing the growth, where we're seeing the adoption by the customers.

Yeah, absolutely. Much, much faster growth than those non-VMS, that's for sure. I mean, maybe that's a natural segue for you. You know, cloud security just feels like a very clear rising tide. Maybe the question for you is, how do you feel about the breadth of Tenable's offering here? And where do you think your cloud security portfolio goes in the future?

Yeah, we're very excited about our cloud security offering here. I know you characterized it as all things rising with the tide. I do think this is a large market. It's a rapidly growing market. I think there's tremendous opportunity. I think above and beyond that, we're seeing and demonstrating success in competitive situations where we now have a lot of confidence going toe-to-toe against market leaders and winning our fair share of those transactions. We don't have to do crazy things. I know there's a lot of concern. We don't have to do crazy things from a discounting or packaging perspective. I think the competitiveness of our offerings speaks for itself. We've brought in the offering to be a full CNAP capability. We've recently announced the addition of data security posture management. We've also added AI security posture management, things that we think make us highly competitive and on the leading edge of where this market is going. And we're seeing the adoption from our customers.

Very helpful. Thanks, guys.

Our next question comes from Hamza Fadawala with Morgan Stanley. Please proceed with your question.

Great. Thanks for taking my question. Good evening. Steve, I wanted to just understand a little bit related to your guidance philosophy around Q4 and 2025. So by my math, it sounds like you're you're guiding to about implied 8% to 9% CCV growth for Q4. Is that roughly how we should consider 2025? And related to that guidance, I'm just curious what you're assuming around budget flush in Q4, what you're seeing in your pipeline. Is it more or less conservatism or something that you're seeing in the business that makes you a bit more concerned? Thank you.

Sure. So our full-year CCB guide today is $957 million to $967 million. That does suggest that there's 8% to 9% growth, implied growth, in the fourth quarter. And just to unpack that a little bit, our guide assumes that exposure solutions continues to see outsized growth. Amit talked about how 20% of our business is, in terms of assets, is growing 30%. So we expect that level of growth going forward. It also reflects on moderation issues. in the growth of VM. We feel like these are good expectations to have, certainly in the short term. And as we talked about on the call earlier, we also feel like these are our exit velocity here in terms of growth and CCB. It's fair to have those expectations for the full year next year. We'll give our guidance in February, but obviously it's a fair expectation to have it Now, pipeline overall is healthy, and we continue to add lots of new opportunities in the top of the funnel for both exposure solutions and VM. Moreover, we're pleased with the size, but also the shape and the maturity of the pipe as we have many large late-stage opportunities. So overall, we're pleased with the results of the quarter. We feel like we have good expectations going forward with regard to growth of both exposure solutions and VM.

Makes sense. Thanks.

Our next question comes from Brian Essex with J.P. Morgan. Please proceed with your question.

Hi, good afternoon, and thank you for taking the question. Maybe for me, I think you previously noted that you may have changed some of the incentives that you had for the federal business. I know this time last year there was some revenue recognition kind of issues that played into that. Could you perhaps shed a little color on how those changes played out in regard to the you know, federal execution this quarter, and what should we expect, you know, over the next year or so?

Yeah, you know, we anticipated, you know, Q3 to be our seasonally strong quarter in U.S. federal, and I think it played out pretty much as expected, as you noted. You know, last year we had, you know, some unusual twists in the federal business. We didn't see anything of that nature this year.

Got it. And maybe a quick follow-up for Steve. As you're pretty much at 20% operating margins, you've delivered certainly some pretty healthy operating margin expansion consistently over the past few years. In light of the growth outlook, can you maybe help us understand how you think about the guardrails of margin expansion versus growth and how we might expect margin expansion to progress going forward? given the growth outlook that you have?

Sure. Well, I think every quarter since we've been a public company, we've been able to increase the margins, or should I say every year as a public company, we've been able to drive margin leverage and expand the operating margins and free cash flow. Just as an example, I think the operating margins on a 99 basis were 10% in 2022, and then it was 15% last year in 23%. This quarter is roughly 20%. And on the last call, we talked about our free cash flow margins. By the way, free cash flow is following a similar trend line with the operating margins. And on the last call, we provided a new long-term target for our free cash flow margins, and we said we expect free cash flow margins to increase to 35% plus. So we have a lot of confidence to continue to drive leverage in the business. We are a balanced grower. We have 96% recurring revenue. We have 80% plus growth margins and healthy net and gross value renewal rates and certainly a broader product portfolio. We're getting great traction with some of the newer offerings here. But at the same time, we're also investing. You can see that growth in R&D spend this quarter is approaching 30%. We've become more efficient in sales and marketing. Sales and marketing's percent of revenue was 42% last year. It's roughly 36% this quarter, and it's tracking in line with the comments we made at the beginning of the year. So overall, we think we're managing, effectively deploying capital, managing the business in a very healthy way, leaning in and investing in innovation, and at the same time, walking the margins up in a very gradual manner. So I think the right way to think about us is that we'll expand the margins. Several hundred basis points a year, each year, sometimes more, depending on growth. But we'll obviously have to see how next year plays out. Got it.

Very helpful. Thank you. Our next question comes from Joel Fishbein with Truist Securities. Please proceed with your question.

Thanks for taking the question. You talked about early traction. I know it's early days with AI posture management. and AI Aware. Love to hear and understand how you're pricing these products and what the competition looks like in those markets. Thanks.

With AI Aware, we're seeing tremendous early, obviously we're in the early innings of it, but we're seeing tremendous adoption and enthusiasm for that. A large number of customers are now actively using that. Our monetization occurs primarily through just increased usage, increased asset counts. And the same is true with AI security posture management.

Thanks. And the competitive environment around that, if anything?

I think if you look at AI security posture management, you are seeing a small number of other market-leading companies Synapse coming to market with similar capability, but there's a pretty large trough between those of us leading the market and I think a large number of others just providing either traditional CSPM or a much lighter cloud capability, which don't include anything like AI security posture management.

Thank you.

Our next question comes from Mike Sikos with Needham & Company. Please proceed with your question.

Hey, guys. Thanks for taking the questions here. And I just wanted to continue on that thread that Joel was teasing at. But can we similarly talk about the pricing dynamics for Enclave Security? I know that's a newer piece of the portfolio here. I just wanted to make sure I was checking up on the pricing and competitive dynamics for that product as well.

Yeah, with Enclave Security, it's very similar to how we previously priced our other on-prem offerings. So, you know, we license them on a per IP address or per asset basis. In this case, I think it's per IP address. And customers would license the number of addresses that they're trying to cover.

Got it. And maybe another, maybe more for Steve here, but if I just cycle back to last quarter's guidance, one of the things that was implied is that You guys were seeing these headwinds specific to new business, particularly vulnerability management in North America. But the guidance cut was explained as being more cautious in its stance, i.e. that trend for the new business with VM was kind of painted across the board for new business across all of Tenable. And one of the things I'm trying to tease out is with where we stand today, how has the new business trended for Tenable? both for VM and then outside of VM, just to make sure that we're getting a sanity check on those two pieces there. Thank you.

Sure. Well, I think it's fair to say that new business is tougher to transact in this macro, but we're very pleased to be adding nearly 400 new logos this quarter. And, of course, the number of customers added in the quarter can be influenced by a number of factors, including the size of the deals, but we typically add between 300 and 500. a quarter and this quarter was no different. I think the word that Amit used earlier to describe VM this quarter was stable and stabilized. And so we're very pleased to see us execute this quarter. We're pleased with the results in the quarter as obviously CCB and revenue came in slightly better than expected. So overall, we're encouraged with what we see, but we also know that we have a lot of large opportunities in the funnel. We'll be working hard to close those. But overall, I would describe it as modestly better than what we experienced in the last quarter.

Thank you.

Our next question comes from Jonathan Ho with William Blair. Please proceed with your question.

Hi, good afternoon and congrats on the strong results. Just wanted to follow up a little bit on the Tenable One platform and can you help us understand Do you typically get a lot of the benefits from new asset types upfront, or does it take a little bit of time for that to translate? And maybe can you help us understand how Tenable One maybe affects your ASPs as well? Thank you.

Yeah, so great question, Jonathan. So the short answer is that that can play itself out over time. What we'll initially see is a higher price per asset, and it's typically 20% to 25% higher price per asset when purchasing coverage through Tenable One than purchasing standalone VM, for instance. And part of the value driver there are the enhanced analytics, the limited exposure views, the attack path analytics, and some of the things that aren't available in traditional or in competitive VM products and offerings. From there, we see the remainder of Uplift coming from the expansion of asset types or greater coverage of assets. So someone who might initially begin their exposure management journey with us, stepping from VM to Tenable One, will then frequently be able to seamlessly expand to cover identity and look at the identities within their environment and who has access to what that means and what that looks like from a blast radius perspective or from a potential compromised account indicators of attack perspective. So the short answer is we see uplift initially through the higher price per asset, but then through greater asset coverage and greater types of assets, we'll see that broader coverage, which gets us to a 70% realized higher ASP.

It makes a ton of sense. And then just in terms of your stabilization comments, can you talk to maybe the pricing environment and the competitive environment and whether you've seen some of these newer competitors start to gain any traction or whether things are relatively stable. Just want to get a sense around that stabilization from these angles. Thank you.

Yeah, things have been exceptionally stable and consistent from our perspective when it comes to the VM market. We'll see and we'll hear much more noise, certainly more marketing coming from newer entrants into the market, but we'll infrequently see them in competitive situations where someone is looking for an enterprise VM product and where they do show up, I think our sales team is fully enabled in terms of understanding the key differentiator. I think enterprise customers which test products very quickly look at them and say, okay, there's a very different quality of the experience and quantitative difference when looking at coverage in Tenable vis-a-vis our traditional competitors and certainly even much more pronounced against newer competitors. So we think that competitive environment is stable and enjoy exceptionally strong win rates against both legacy and newer entrants into the market.

Great. Thank you.

Our next question comes from Patrick Colville with Scotiabank. Please proceed with your question.

Hey, Armin and Chris. Thank you so much for taking my question. I guess I just want to ask one about stock repurchase. I don't think there was any stock repurchase this quarter, but you guys announced an expansion of the repurchase authorization. So just, I guess, talk me through why no repurchase this quarter and then, you know, what's the philosophy around buybacks?

Yeah, we did not repurchase stock this quarter, but we do plan to do so going forward. And, of course, we're very pleased to announce a $200 million increase in the authorization for our share buyback program, which we think reflects our ongoing commitment to reduce share count and return capital to shareholders. There's no exploration to the increase in the authorization. but we do plan to do so opportunistically. So the amount that we buy back each and every quarter can vary, and obviously very pleased to increase our commitment today on the buyback.

Okay, thanks so much. And then I guess my second question, if I may, thank you for providing that kind of early look into 2025 of 8% to 9% current billings growth. I mean, there's a lot of kind of wind and tenable sails with explosion management, with cloud, with kind of ITDR, OT security. I guess when will these tailwinds be more reflected in numbers? If you could throw any color there, that would be super helpful. Thank you.

Yeah, I think a number of things. First, obviously, we'll provide guidance in the upcoming call. But more importantly, one of the things that I wanted to call out earlier was provide a little bit more transparency into our exposure solutions that are becoming an increasingly important strategic part of our business and the increasing percentage of our revenue and they're growing at very healthy rates and we think we're highly competitive in those win rates and growth rates I think are things that we'll be able to build upon and ideally expand going forward.

And just to be clear, we feel very confident that growth won't fluctuate over the course of time. We're not setting those expectations today. But over the years, we have broadened the product suite and evolved and diversified our business. And so 20% of our business today is growing 30%. It's very notable, and we have confidence that we'll be able to sustain that and compete in some of these really large market opportunities.

Terrific. Thank you so much, and congrats.

Thank you. Our next question comes from Gray Powell with BTIG. Please proceed with your question.

Okay, great. Thanks for taking the question and congrats on the results. It's good to see the stabilization. So maybe just to start off high level, have you seen any uncertainty around the elections in the U.S. cause any just impact on deal discussions or just have any impact on how customers are thinking about their security budgets? It doesn't look like it just from the results, but I'm curious if that came up at all this past quarter.

We have not had a lot of discussion with commercial clients or international clients about potential impact of U.S. elections on security budget. Obviously, there's a lot of uncertainty in the federal space, and so we're taking that sort of cautious approach to to our guides in the fourth quarter.

Okay, great. And then just more of like a housekeeping question for Steve. I just want to make sure I understand the disclosures correctly. When you call it exposure management at 35% of total sales, is that a revenue number or is that more related to something like billings or bookings? I guess, you know, there's sort of a loose definition of sales when disclosing these metrics. I just want to make sure I'm thinking of it correctly.

Yes, in terms of sales, so we call that bookings internally.

Okay. All right, perfect.

Thank you very much.

Thank you.

Our next question comes from Shaul Yao with TD Callen. Please proceed with your question.

Thank you. Good afternoon, everybody. My question, Amit or Steve, I know maybe it's a little too early given where we stand in the fourth quarter, but from where you sit, when you compare the seasonal budget flush, how would you characterize sports due to this current time?

I'm sorry, you are inaudible for part of your question. Can you repeat that?

Sure. I was asking about seasonality in the fourth quarter. Again, a little too early at this point, given we're in the... end of the first month of the quarter. But how would you characterize the seasonal budget flush this year versus last year?

Well, I think it's fair to say that we're not expecting any significant seasonal budget flush. Obviously, if that comes, there would be upside. And in terms of the linearity within the quarter, we're off to a good start in October. I would characterize the flow that we've experienced so far as unremarkable. and inconsistent, should I say, more so with what we've experienced with prior quarters this year.

Understood. And maybe as a follow-up from a graphic perspective, anything outstanding this quarter, one way or the other?

We say outstanding. I'm sorry. We're having a tough time hearing you on this end. I'm sorry.

I know, I apologize, it's pretty much on my mind, but anything unusual or pretty much a consistent quarter from a geographic performance perspective?

No, we talked about on the last call a little bit of the disparity in the growth rates among some of the geos, but this quarter, as we discussed, it was more stable and man was more consistent, really, across geos. The one thing... that I mentioned earlier that's probably worth noting now is just really the strength in the mid-market. This year has been an area of outperformance for us. We closed a million dollar deal there and we see a ton of opportunity there. Keep in mind the mid-market, when we say mid-market, It's employees, anywhere from 500 employees up to 5,000. So these are big companies. We're having great success there, selling the broader offering. We're getting great traction there, and we have high expectations going forward.

Thank you so much, Steve.

Our next question comes from Rankin Kothari with Robert Baird. Please proceed with your question.

Hey, this is Shranik from Baird. Good afternoon. Thanks for taking my question. So starting with Steve, just following from what you mentioned on the outperforming mid-market and closing the first seven-figure deal in the segment, you touched upon the net dollar expansion rates. I just wanted to, if you can help us get a sense of how to unpack that. It came in at 108%, which was I'll take just like a point lower than last quarter. If we can help elaborate and provide some color on factors there in the context of new low expansion within these cohorts that you highlighted, mid-market, which, of course, are larger organizations and enterprise. If that is a factor and any color on product segments with exposure and cloud security offerings also growing strongly, and then I'll follow up.

Okay, I think there's a question here about the net dollar expansion rate. We provide a lot of transparency about our business on a quarterly basis. We disclose the number of new customers, the number of net new six-figure deals, large deals, the rate of expansion within the customer base in a given quarter. And we do not optimize our business around a single metric. And these metrics, of course, can fluctuate naturally from quarter to quarter. That said... We did see a modestly lower rate of expansion this quarter, which we largely attributed to timing and budgets on some large deals here. We did see strength in new businesses we've discussed. It was roughly 400 in the quarter, but what was remarkable about that is just some of the larger opportunities within that. So I think we're doing a good job. landing at higher price points, obviously giving the broader offering, giving the momentum in cloud. And we talked about the ASPs in cloud. Heather notably higher this year in comparison to last year and in comparison to some of our other products. So obviously bigger lands is going to be a big area of focus for us. And, of course, we still have the expansion opportunity going forward here. But any given quarter, the expansion rates, the number of new logos, and net new six-figure deals can vary within one another.

Got it. Super helpful, Steve. And just a follow-up, and Amit, feel free to chime in. On this traction in the mid-market, right, as you highlighted, these are big opportunities. And considering perhaps all the dynamics around their purchasing behaviors and just curious in terms of any trends that you observe with these customers in terms of how they're looking to consolidate the security vendors and how you guys are positioned to be perhaps the one-stop shop there. And anyways, how you might be adapting your sales motions, the pricing or customer success. Just wanted to understand how you approach mid-market. Yeah.

Yeah, I think we are seeing some benefit from consolidation with our T1 platform. Folks are including VM as a more strategic approach to understanding exposure management. I think if you talk to Gartner, if you look at some of the language they're using, VM is foundational to understanding exposure management risk. And as such, we're seeing adoption of VM licenses with the enhanced analytics and as part of a T1 product purchase, which we think is very applicable and we're seeing great traction in the mid-market, which again for us can go up to fairly large organizations, up to 5,000 employees. So we're seeing meaningful traction there. And I'd say also with our cloud security solution where the sort of elegance of how the various aspects of our cloud security product are integrated into a unified platform are really appreciated, perhaps especially in the mid-market where they don't have all of the cloud security expertise and all the cloud security staffing that they're looking for. So I think both 10.1 and cloud security become natural areas for outperformance for us in the mid-market.

Great. Thanks a lot, Thomas.

Our next question comes from Kingsley Crane with Canaccord Genuity. Please proceed with your question.

Great. Congrats on the quarter. And this is sort of similar to Jonathan's question earlier. You talked about Tenable One garnering 20% to 25% premium per asset, but also a much higher ASP on the back of more pervasive deployments. So the question is, as you add in more asset types like OT and more functionality through Remedix, How should we think about the growth in both price per asset as well as asset counting? Is there room for that premium per asset to increase, or is this really an asset growth play? Thanks.

Yeah, the short answer is that I believe there's room to expand along both of those dimensions. Certainly, when it comes to price per asset, we want to be sensitive to that. We're trying to move customers from procuring a standalone VM product or procuring any standalone product to be willing to pay a premium. In order to do that, we've enhanced and released enhanced analytics as part of T1 as a platform. The attack path analytics, the lumen exposure views, the benchmarking, some of the functionality and capability there. We think that there's lots of room to continue to add additional analytic types and generate more pricing leverage for Tenable One within the existing customer base and within the existing asset count. That said, we are still in the early days of penetrating a massive customer base with a broader set of asset types. So when you pull CISOs out there, when you talk to many of our customers, many of them aren't even aware in ways that our offering has broadened. So I think we have to continue to do a more aggressive job marketing and bringing some of these new products to market and having, I think, the expansion of asset types and asset count growth is probably also a very natural way for T1 prices to continue or realized ASPs to continue to grow.

Thanks, really helpful. That's it for me.

Our next question comes from Roger Boyd with UBS. Please proceed with your question.

Great. Thanks for taking the question. Amit, you talked last quarter about VM being cyclically challenged, and it seems like you're still expecting to see that in the fourth quarter, and presumably a broader cyclical recovery is not embedded into your initial counter-25 outlook. But with that in mind, what would give you more confidence that those cyclical headwinds are lifting? Is it really just a continuation of macro uncertainty in sales cycles, or is it more specifically tied to some of the license capacity dynamics you've talked about in the past? Thanks.

Yeah, well, I think we're trying to take an approach here that sets us up for success going forward. The first comment I'll make is that as you may poll and ask CISOs out there and security programs, what you will hear is that VM is absolutely foundational to what they do. Nobody is getting rid of the VM program. Nobody is reducing their VM program. What we have heard in recent periods is that they aren't as rapidly expanding their VMs program as they have in previous periods. One of the things that would give me confidence that we're seeing improvement there is seeing improvement there. So seeing customers expand the asset count of their VM program. What we are seeing is customers with VM requirements coming to us and saying, hey, I'm willing to pay a higher ASP to procure VM through Tenable One as a platform because understanding exposure management is more strategic to me. I want these enhanced analytics. And so now 20% plus of our VM customers are coming to us and saying, hey, we want to procure our VM program through Tenable One as a platform with these enhanced analytics. So what we're trying to do is provide, one, visibility into the continued confidence in the VM market, but two, the size and scope and growth rate of our exposure solutions, which are obviously, you know, we've been talking about a long time as the, you know, foundational stake that, you know, we're laying for our future as a company and the real momentum that we're seeing there.

Our next question comes from Rudy Kessinger with DA Davidson. Please proceed with your question.

Hey, this is Andres for Rudy. Thank you for taking my question. First of all, congrats on a fantastic quarter. I just wanted to ask a quick question. Last quarter, you said that you had longer sales cycles. Is there any update data you can give us? Do you think that was partially affected by the cross-strike audits? Any comment would be helpful. Thank you.

Yeah, and I'll start off and then turn it over to Steve. I think we're basically seeing more of the same Sales cycles continue to operate as we saw them in the previous quarter. I don't know that I would attribute it to CrowdStrike and only CrowdStrike, but we do also see continued contract negotiations and procurement officers and procurement offices pushing aggressively on terms and things which have introduced in the sort of expansion of sales cycle. But I think what we've seen this quarter and last quarter, we're anticipating will continue to play itself out and bake that into our guidance going forward and our expectations.

Yeah, and there's no notable change in our sales cycles really from one quarter to the next. The one thing that's probably worth highlighting is the sales cycles for Tenable One. Yes, Tenable One has higher selling prices. We talked about this 60% to 70% uplift. actually the range in which that happens can vary anywhere from 50 up to over 90%. So when customers move from a standalone product into the platform, we're obviously getting higher selling prices, we're delivering incremental value on an asset basis and covering more assets across their attack service through different asset types. So despite having those higher selling prices, we're actually seeing notably shorter sales cycles with the integrated offering. So I think it speaks to the fact that customers certainly want to understand risk more broadly across their attack surface. They want companies to deliver greater insights. And exposure management is resonating, and obviously industry analysts and others are taking note as well.

Sounds good. Thank you.

Our next question comes from Joshua Tilton with Wolf Research. Please proceed with your question.

Joshua, are you muted? Joshua Tilton, are you there? Does not sound like there's a question.

Yeah, he's in the queue, but he may be muted. So there's no other questions, so I'm going to close the call, okay?

Sounds good. Thank you.

This concludes today's conference. You may disconnect your lines at this time, and we thank you for your participation.