Tenable - Q2 2024

Transcript

Operator (participant)

Greetings, and welcome to Tenable Q2 2024 Earnings Conference Call. At this time, all participants are in a listen-only mode. A brief question-and-answer session will follow the formal presentation. If anyone should require operator assistance during the conference, please press star zero on your telephone keypad. As a reminder, this conference is being recorded. It is now my pleasure to introduce your host, Ms. Erin Karney, Senior Director in Investor Relations. Thank you, Ms. Karney. You may begin.

Erin Karney (VP of Investor Relations)

Thank you, Operator, and thank you all for joining us on today's conference call to discuss Tenable's second quarter 2024 financial results. With me on the call today are Amit Yoran, our Chief Executive Officer, and Steve Vintz, our Chief Financial Officer. Prior to this call, we issued a press release announcing our financial results for the quarter. You can find the press release on our IR website at tenable.com.

We will make forward-looking statements during the course of this call, including statements related to our guidance and expectations for the third quarter and full year 2024, growth and drivers in our business, changes in the threat landscape in the security industry and our competitive position in the market, growth in our customer demand for and adoption of our solutions, including Tenable One, planned innovation and new products and services, the potential benefits and financial impact of our recent acquisition of Eureka, and our expectations regarding long-term profitability and free cash flow. These forward-looking statements involve risks and uncertainties, some of which are beyond our control, which could cause actual results to differ materially from those anticipated by these statements. You should not rely upon forward-looking statements as a prediction of future events.

Forward-looking statements represent our beliefs and assumptions only as of today and should not be considered representative of our views as of any subsequent date, and we disclaim any obligation to update any forward-looking statements or outlook. For further discussion of the material risks and other important factors that could affect our actual results, please refer to those contained in our most recent annual report on Form 10-K and subsequent reports that we file with the SEC. In addition, all of our financial results we will discuss today are non-GAAP financial measures, with the exception of revenue. These non-GAAP financial measures are in addition to and not a substitute for or superior to measures of financial performance prepared in accordance with GAAP. There are a number of limitations related to the use of these non-GAAP financial measures versus their closest GAAP equivalents.

Our press release includes GAAP to non-GAAP reconciliations for these measures. I'll now turn the call over to Amit.

Amit Yoran (Charman and CEO)

Thank you, Erin. We delivered mixed results for the quarter, with lower than expected CCB, but with outperformance in revenue and earnings. exposure management continues to generate demand, particularly for Tenable One and cloud security, as CIEM priority areas for CISOs. Before I get into the quarter, I'd like to first comment briefly on the recent CrowdStrike outage. This incident highlights the importance of independent cybersecurity assessments and the negative global consequences of creating single points of failure with any one vendor. Excessive reliance on any one vendor reduces enterprise resilience, just as deviating from best-of-breed platforms increases exposure to risk. Boards have fiduciary responsibility to oversee cyber hygiene, and we expect that regulators will play an increasingly critical role in promoting resiliency and requiring transparency. We believe the path forward for modern organizations lies in interoperable, best-of-breed platforms that empower enterprises to reduce risk and improve cyber hygiene.

Now, onto the quarter. A few areas stood out as notable in Q2. First, customers continued to highly scrutinize their spend and rigorously prioritize their investments. Second, and this is a positive trend for us, is that exposure management is gaining increasing momentum in the industry among customers and analysts. Customers need and want to understand their level of risk across their attack surface, from their IT environment to the cloud to their critical infrastructure, and we believe that has resulted in strong traction for Tenable One. And third, as customers increasingly rely on cloud, we are seeing strong momentum for our cloud exposure solution. In fact, one of our largest deals for the quarter was for our cloud security product with a major financial services company, and we'll talk more about that in a few minutes.

Let me dig deeper on that first point on spending patterns that we noticed in Q2. We continue to see a great deal of customer scrutiny around cyber spending. This makes it more difficult to transact and close new deals as new projects and procurements are getting the greatest scrutiny. This trend becomes more apparent as deal sizes get larger. These two dynamics were more pronounced in our vulnerability management business in Q2 than what we had seen historically. And while our mix shift to our faster-growing exposure solutions is healthy, it is not enough to offset the cyclical impact of our traditional standalone VM business. While VM is becoming more cyclical, we remain the clear leader. VM continues to drive initial Tenable One adoption and lays the groundwork for future upsell opportunities. Our win rates continue to be very strong. Exposure management is becoming increasingly critical for customers.

We pioneered this category. The point products leave customers with an incomplete view of actual risk in their environments. This is where Tenable shines. Tenable One, our exposure management platform, provides a unified approach and consolidates visibility across asset types to deliver insights that individual products alone cannot provide. And there's also a compelling ROI to customers who consolidate spend and reduce complexity in their security stack. We are expanding into budgets beyond VM and broadening our reach within enterprises. Tenable has become a trusted source of truth for boards and executives needing to understand their business's exposure and risk. We're seeing this play out in our product mix, as Tenable One represented 30% of new business in Q2.

We are also seeing increased utilization with different asset types, which allows customers to leverage features such as attack path analytics, visualize the riskiest exposures and toxic combinations, and enables customers to quickly assess and safeguard their business. We're also seeing significant momentum in cloud security. Prioritization of cloud security spend, coupled with our CNAPP offering, resulted in strong growth in our cloud security for the quarter. Tenable Cloud Security delivers immediate value as an exceptionally user-friendly, multi-cloud solution. We're starting to land technical wins with large, sophisticated enterprises. In fact, this is the second quarter in a row that one of our largest deals included cloud security. As I mentioned, a Fortune 100 financial services company selected us this quarter for CIEM, which is an integral piece to CNAPP.

Their other cloud security provider for CNAPP was not able to deliver visibility in identity for cloud, where we are the best provider to meet their needs. During the quarter, we acquired Eureka, a leading data security posture management company, adding, discovering, and securing data to Tenable Cloud. We're excited to add enhanced DSPM to our CNAPP offering, which we expect to happen this year. We're also expanding our generative AI capabilities to maximize customer value. Along with integrating AI into our products, we're also seeing rapid adoption of our exposure management platform to identify where and how AI is operating in customer environments. We introduced two new capabilities in Q2. First, an AI security posture management capability within our cloud security offering that detects AI risk configurations in services like AWS Bedrock and Azure OpenAI, and ensures compliance with their organization's security policies.

Second, we now provide runtime detection to identify AI software libraries and browser plugins that may be in use within the enterprise. We believe this is an innovative capability to alert security teams where the unauthorized use of AI may be taking place in their environments. As we look ahead, we are going to focus on optimizing the business by investing in areas that matter most to our customers, while continuing to drive profitability in the business. We will continue to enhance our CNAPP offering, add additional features to Tenable One, and leverage AI to drive efficiency in our products and to solve problems for our customers. On that note, Steve will go into more detail, but we are introducing our 2025 unlevered free cash flow target of $280 million-$290 million today.

We believe this is a strong initial target, representing our commitment to deliver durable cash flow growth, and we look forward to updating you as we get through the second half of the year. We'll continue to evaluate the appropriate level of investment in resources going forward to strike the right balance of growth and profitability. This is an exciting time for Tenable. We are leveraging our leadership position in VM, seeing major momentum in cloud, and delivering broader exposure management platform. Despite challenges for this quarter, I am confident in our long-term strategy and our ability to grow over the ensuing years. I'll now turn the call over to Steve for further commentary on our financial results and outlook.

Steve Vintz (Co-CEO and CFO)

Thanks, Amit. Calculated current billings, defined as revenue recognized in the quarter, plus the change in current deferred revenue, grew 10% year-over-year to $221.1 million. While we only guide to CCB on an annual basis, I think it's fair to say CCB growth in the quarter fell short of our expectations, and accordingly, we are revising our outlook for the year to reflect a more challenging selling environment. Now let's get into the results for the quarter, as it will provide context to our outlook for the full year. Recall, we went into the quarter with a healthy pipeline and a large number of six- and seven-figure opportunities. We closed fewer deals than expected as customers deferred new projects in the face of a more challenging macro environment and tighter budgetary constraints.

This shortfall was specific to VM, particularly with large opportunities in North America, where we experienced longer sales cycles and more modest growth in comparison to other geos. Other areas of new business continue to get traction despite the selling environment. Tenable One grew to 30% of total new enterprise sales and is up from 26% last quarter. Exposure Solutions, which includes Tenable One, standalone cloud, identity, and operational technology security solutions, represented over 50% of our total new sales in the quarter. As a point of comparison, Exposure Solutions was under 10% of total new enterprise sales in Q2 of 2020. We've made a lot of progress in this regard....

This healthy mix of new business demonstrates our ability to broaden the product portfolio and expand into new markets over the years and reflect the growing demand for exposure management and the actionable insights we deliver to CISOs and their security teams. As Amit commented earlier, cloud security was also a major highlight for us, with several sizable six-figure wins in the large market, including a global financial services and payments firm, a large defense contractor, and a multinational enterprise software company. We believe our success here is a clear indication that we will continue to take and win share in one of the faster-growing areas of the cybersecurity market. Finally, I also want to note that current RPO growth in the quarter was 14%. Turning to other highlights, we added 408 new enterprise platform customers and 76 net new six-figure customers during the quarter.

Our net dollar expansion rate was 109% this quarter, consistent with last quarter. Our renewal rates remained strong. Now on to the P&L for the quarter. Revenue was $221.2 million, which represents 13% year-over-year growth. Revenue in the quarter exceeded the midpoint of our guided range by $3.2 million. Our percentage of recurring revenue remains high at 96% this quarter. I'll now turn to expenses. I'll start with gross margin, which was 82% this quarter, up 70 basis points from last quarter. Gross margin was better than expected due to our continued ability to cost-effectively scale our public cloud infrastructure for our exposure management platform and other cloud-based offerings.

Sales and marketing expense was $84.8 million, up modestly from $84.5 million last quarter, and as a percentage of revenue, was 38% compared to 39% last quarter. Sales and marketing expense was higher sequentially on an absolute dollar basis, primarily due to greater marketing investments to promote our cloud security and exposure management offerings, as well as to build our global brand, partially offset by cost in Q1 related to our annual sales kickoff conference. Overall, we are pleased with the improved efficiency in our go-to-market efforts this quarter and expect sales and marketing spend as a percentage of revenue to continue to trend lower over the remainder of the year and beyond. R&D expense was $33.4 million, which is up from $32.6 million last quarter.

R&D expense as a percentage of revenue was 15% this quarter, flat compared to last quarter. Wages were higher in the quarter related to the acquisition of Eureka. G&A expense was $19.6 million, which was down from $20.6 million last quarter, primarily due to lower payroll taxes, primarily related to the vesting of our RSUs in Q1. G&A expense as a percent of revenue was 9% this quarter, compared to 10% last quarter. Income from operations was $42.8 million and exceeded the midpoint of our guided range by $7.8 million. Operating margin for the quarter was 19%, which was approximately 325 basis points better than the midpoint of our guided range.

The notable outperformance in earnings this quarter reflects our ability to continually drive leverage in our business while making investments to win share in cloud security and the exposure management markets. The sizable beat in operating income resulted in significant EPS upside. EPS for the quarter was $0.31, which was $0.08 better than the midpoint of our guided range. Let me briefly touch on the restructuring expense in the quarter, which is excluded from our non-GAAP results. You'll recall that in Q4 2023, we announced an optimization plan, including the potential sublease of a portion of our real estate. In Q2, we executed the sublease and recognized a $4.5 million impairment charge related to the leaseholds and furniture and fixtures. Now, let's turn to the balance sheet.

We finished the quarter with $487 million in cash and short-term investments, reflecting the $29.2 million of net cash used for the Eureka acquisition. Accounts receivable was $179.6 million, and total deferred revenue was $725.8 million. Current deferred revenue was $562.6 million, which gives us a lot of visibility into expected revenue over the next 12 months. We generated $36.5 million of unlevered free cash flow during the quarter, which reflects the seasonal pattern of billings during the year. To date, unlevered free cash flow was $91.2 million and puts us well within reach to achieve our annual guide for the full year, which we are raising today.

We feel confident that we can continue to expand our operating and free cash flow margin over the ensuing years, as we have done so every year since our IPO. During the quarter, we repurchased 589,000 shares of common stock for an aggregate purchase price of $25 million. Thus far, we've repurchased almost 1.5 million shares and have $35.1 million of remaining authorization under our initial $100 million share repurchase program. With the results of the quarter behind us, I'd like to discuss our outlook for Q3 and the remainder of the year.

For the third quarter, we currently expect revenue to be in the range of $222 million-$224 million, non-GAAP income from operations to be in the range of $42 million-$44 million, non-GAAP net income to be in the range of $35 million-$37 million, assuming interest expense of $8.3 million, interest income of $5.7 million, and a provision for income taxes of $3.8 million.

Non-GAAP diluted earnings per share to be in the range of $0.28-$0.30 per share, assuming 123 million fully diluted weighted average shares outstanding. For the full year, we currently expect calculated current billings to be in the range of $957 million-$967 million, revenue to be in the range of $889 million-$895 million, non-GAAP income from operations to be in the range of $167 million-$171 million. Non-GAAP net income to be in the range of $143 million-$147 million, assuming interest expense of $32.7 million, interest income of $23.5 million, and a provision for income taxes of $12.8 million.

Non-GAAP diluted earnings per share to be in the range of $1.16-$1.19, assuming 123.5 million fully diluted weighted average shares outstanding. Unlevered free cash flow to be in the range of $225 million-$235 million. I would like to provide some commentary regarding our revised outlook today, reflecting lower CCB and revenue for the year. As we think about the second half of the year, we are taking a more cautious approach to new business, not only with large VM opportunities, but also with other pipeline opportunities. While demand generation remains healthy, the rate at which these opportunities are expected to progress through the funnel in the second half of the year is expected to be more moderate than previously anticipated, which will constrain our near-term results.

Despite the reduction in our top-line outlook, we remain committed to our margin targets and are pleased to be raising our operating income and unlevered free cash flow outlook for the year. We're also providing an unlevered free cash flow target today of $280 million-$290 million for the full year 2025, which is 24% growth year-over-year at the midpoint, and a major milestone toward achieving our updated long-term target unlevered free cash flow margin of 35%+. With over 95% recurring revenue, high gross margin, and high renewal rates, we have a lot of confidence in our ability to drive continued leverage in our business.

It's important to note that we are committed to delivering on this level of cash flow in 2025, based on a range of growth scenarios, and will continually evaluate the appropriate level of investment and resourcing to achieve this target. As a platform and cloud-first company, we will invest in areas where we see outsized growth, and we'll reprioritize spend in other areas where appropriate. I will now turn the call back to Amit for some closing comments.

Amit Yoran (Charman and CEO)

Thanks, Steve. In summary, this market is very fluid, and we are taking a more cautious approach to our CCB and revenue outlook today. We are very encouraged by the momentum in exposure management and cloud security, and we are excited about where we are as a company and the opportunity in front of us. We hope to see you at the Canaccord, Stifel, and Piper Sandler conferences in the upcoming weeks. We'd now like to open the call for questions.

Operator (participant)

Thank you. We will now be conducting a question and answer session. If you would like to ask a question, please press star one on your telephone keypad. A confirmation tone will indicate your line is in the question queue. You may press star two if you would like to remove your questions from the queue. For participants using speaker equipment, it may be necessary to pick up your handset before pressing the star key. As a reminder, please restrict yourself to one question and one follow-up. One moment, please, while we poll for questions. The first question comes from the line of Saket Kalia with Barclays. Please go ahead.

Saket Kalia (Managing Director)

Okay, great. Hey, guys, thanks for taking my questions here and good to hear from everyone. Amit, maybe to start with you. You know, I thought it was interesting in your prepared remarks how you talked about sort of traditional VM becoming more cyclical. Maybe to start us off, can you just talk about some of the market dynamics in VM? And maybe why you think the demand for Tenable One feels just, you know, decently stronger right now than traditional VM. Does that make sense?

Amit Yoran (Charman and CEO)

It does, Saket, thank you for the question. With respect to VM, like, it's an established market. We're seeing some cyclical patterns in it, but we are, you know, the clear market leader. In Q2, we saw greater scrutiny of transactions, specifically in North America and in the large enterprise segments of the market. With respect to Tenable One, it's just a more modern infrastructure and a more strategic conversation that we're having with our customers. We continue to see strong demand for Tenable One, which accounted for 30% of our new sales in the quarter. And I'd say even more broadly than T1, we saw attractive growth for our exposure solutions, including cloud, where we're proving ourselves to be highly competitive with market leaders, identity and in OT.

Saket Kalia (Managing Director)

Got it. Got it, that's helpful. Steve, for my follow-up, maybe for you. You know, despite the challenges in VM that we just spoke about, the focus on free cash flow definitely, definitely comes through, and certainly appreciate the early look at how you're thinking about 2025. Just understanding that it's still very early, can you just can you just talk us through how you kind of think about the balance between growth and margins in setting that target, even anecdotally?

Steve Vintz (Co-CEO and CFO)

Sure. Thanks, Saket. While we're very pleased to be providing an initial unlevered free cash flow target today for 2025 of $280 million-$290 million, that's for the full year, next year. That's up 24% at the midpoint. And that's also a major milestone, by the way, towards achieving our updated long-term target for unlevered free cash flow of 35%+. Previously, our long-term target for, for cash flow was 30%. So, have a lot of confidence in our ability to continue to drive margin leverage. You know, in terms of growth for, for next year, look, I, I'm not going to comment about that. We're not through our planning process yet, and we have to see how the second half of the year plays out. But the one thing I will say is that we're firmly committed to delivering on our unlevered free cash flow targets.

We're also raising our levered free cash flow outlook for the year, and we're going to continually evaluate the appropriate level of investment and resourcing to achieve these targets. Some areas we'll continue to lean in and invest, in other areas, we'll reprioritize, where appropriate. Overall, we just have confidence in our ability to drive higher levels of cash flow.

Saket Kalia (Managing Director)

Very helpful. Thanks, guys.

Operator (participant)

Thank you. Next question comes from the line of Brian Essex with JPMorgan. Please go ahead.

Brian Essex (Executive Director)

Great. Thank you. Thank you for taking the question, and Amit, great to see you back in the seat, so congratulations to you. I guess I wanted to touch on, Ermetic and cloud security. You know, maybe if we can get an update on that, you know, where, where are you integrating it? Is only-- is it only on the analytic portion of that business? Are, are you integrating with the rest of the company, and are you able to lead with cloud security? I know you talked about, CIEM as, as a point of strength there, but would love to get more detail on where you're seeing success and plans for integration longer term. Thank you.

Amit Yoran (Charman and CEO)

Thanks, Brian. It's great to be back. I'll start off talking a little bit about the strength we're seeing in our cloud security product. We're providing a full end-to-end, full CNAPP solution, and that's resonating with customers. The majority of our cloud sales are for that full, CNAPP capability. That said, in the very large, enterprise side of the market, where they may already have a CSPM solution, or they already have a CNAPP solution, we have market-leading capability and particular strength around identity and the key functionality. So I think the, you know, the large, win, I think it was our largest single transaction for the quarter, came as a key win from a Fortune 500, company in the financial services segment, a very astute, very sophisticated consumer of technology, where they were doing bake-offs.

In terms of our ability to generate leverage with our cloud security product, we have a lot of confidence. The majority of our cloud security sales, in fact, are procuring cloud security through Tenable One licensing. So we're extremely excited that that is resonating. VM customers choosing to move to the modern platform, modern way to assess exposures, and then diversifying their asset types and recognizing that we've got market-leading cloud security that they can procure, and they can do that and get more leverage through an integrated Tenable One platform. So we think the strategy makes sense. We think we're in the early innings, but we think it's resonating and driving early results.

Brian Essex (Executive Director)

Great. Thank you. And just maybe a quick follow-up for Steve. Steve, could you comment on the federal business or just public sector in general? I know that, you know, I think last quarter you felt really good about it and called out some strength there, and I think we've heard about, you know, federal spend trickling down to SLED. Maybe just a comment on, you know, mixed strength of the business there, and is that, you know, reacting or behaving differently than the enterprise side of the business? Thanks.

Steve Vintz (Co-CEO and CFO)

Our public sector business was good this quarter and in line with our expectations. You know, there are some very large seven-figure, agency-wide opportunities in our pipeline for the second half of the year. Some, due to its size, involve coordination and budgetary alignment, I'll say, across dozens of sub-agencies for some deals, which can introduce some variability. But overall, we continue to see strength in the public sector, and we're set up for a good second half of the year with U.S. Federal.

Brian Essex (Executive Director)

Great. Thank you so much.

Operator (participant)

Thank you. Next question comes from the line of Hamza Fodderwala with Morgan Stanley. Please go ahead.

Hamza Fodderwala (Executive Director)

Hey, good evening. Thank you for taking my question, and good to hear from everybody as well. Amit or Steve, I wanted to follow up on the public sector question. You know, you mentioned obviously good strength there for Q2. We have heard that there have been some delays on the Fed budget and perhaps some agencies who are a bit uncertain, given potential change in administration with the elections later this year. I'm wondering if you're seeing any of that impact elongate some of the sales cycles for you within that vertical, and if that is reflected in your guidance. Thank you.

Amit Yoran (Charman and CEO)

Yeah. I'll start off and say, you know, we saw in line delivery with our expectations for the public sector in Q2. Q3 obviously is a seasonally high quarter for public sector. It is an election cycle, and we have a significant number of six and seven-figure opportunities in public sector. You know, that said, I think we're taking a cautious approach for the remainder of the year and trying to understand that there's a certain amount of unpredictability around public sector in the election cycle.

Steve Vintz (Co-CEO and CFO)

Yeah, and the only thing I'd add there is, look, we're trying to take a more cautious approach here in new business, specifically with large deals the second half of the year. This is predominantly in VM, but we're also applying it more broadly across our business, which is including public sector.and while demand generation remains healthy, the revenue these opportunities are expected to remain through the funnel, and the second half of the year is expected to be more, more moderate. So, we're trying to factor that into, you know, the guidance and trying to be cautious.

Hamza Fodderwala (Executive Director)

Thank you very much.

Operator (participant)

Thank you. Next question comes from the line of Rob Owens with Piper Sandler. Please go ahead.

Rob Owens (Managing Director and Senior Research Analyst)

Yeah, thank you for taking my question. And Amit, appreciate your, your comments around the, the VM business, but what can you say to assuage investor concerns that it's not secular, that it is cyclical, that you're seeing right here, either in terms of, of pipelines or customer behavior? Thanks.

Amit Yoran (Charman and CEO)

Yeah, I'll start off by saying I've got a lot of confidence in the VM market, in the VM business. It's a strategic market. You know, as you and others who have been in the space for a long time recognize, it's one of those foundational tools that CISOs need and report regularly to audit risk committees, sometimes cyber committees, and to the boards of directors. So it you know, it's a foundational market requirement within cyber. It's not one that we anticipate going away or even you know, having a more secular downward trend. It is cyclical, and I think we're gonna see an improved outlook in the VM market with improved macro conditions.

We saw this specifically in North America and with large enterprises, and we're trying to take a more cautious approach to our guidance, make sure we're setting ourselves up for success from the remainder of the year. I do think that there's opportunity for our performance in VM and growth over time.

Rob Owens (Managing Director and Senior Research Analyst)

Thanks for the color.

Operator (participant)

Thank you. Next question comes from the line of Mike Cikos with Needham & Co. Please go ahead.

Mike Cikos (Senior Analyst)

Hey, guys. Thanks for taking the question here. Wanted to circle back. I think you guys had called out that Tenable One contributed 30% to new business in this quarter, if I had the metrics right. Can you just help us think about if it's contributing, I guess, that percentage, right, 30%, when can we start expecting Tenable One to start showing up in the revenue stream, just given the ASP uplift that management has historically spoken about for Tenable One?

Steve Vintz (Co-CEO and CFO)

Well, thanks, Mike, for the question. You know, we have broadened our business over the years and expanded into adjacent markets. And the one thing I will say is that VM is, as Amit commented earlier, is foundational. We're the clear leader, but growth there, as we mentioned earlier, has become more moderate. But that said, we have confidence in our in that business to be able to drive growth higher in the ensuing years. And of course, we have a portion of our business, most notably cloud security and platform, that is growing at a very high rate, and we expect that to continue, and that will represent an increasing mix of our total business going forward. So, you know, our core market is seeing slower growth right now in this macro.

Then we have a portion of our business that that's expected to represent a greater percentage of our total business going forward that's seeing outsized growth. You know, obviously, we expect going forward that we'll be able to be able to drive higher levels of cash flow, regardless of the growth that comes either the second half of the year or for next year.

Mike Cikos (Senior Analyst)

Thanks for that, Steve. And I also just wanted to circle up on the new business to the extent that customers are showing increased cyber scrutiny on these new deals. Can you just help us? Because I know Q1 was a very strong quarter for you guys. You guys were citing the strength that you were seeing in new deals. In hindsight, is it fair to think that that one Q strength may have been more tied to the pause that we saw in March of last year with SVB and the easier comp? Or was there something that really showed up that was different in Q2, and can you maybe clarify when that showed up in Q2? Was it in April, May, June, really the last couple of days of the quarter? How did that progress? Thank you.

Amit Yoran (Charman and CEO)

Yeah. I'll start off by saying this, and we were pleased with our Q1 results. We came into Q2 with a strong pipe and a healthy number of 6- and 7-figure deals. Obviously, a large portion of that comes in North America, and as the quarter played itself out, we saw some of the softness in VM, in North America, in the large enterprise, which has a disproportionately large impact on those larger transactions, which, you know, play a factor in our financials, given, you know, the size of the company. So, you know, I think we've got a reputation for calling it like we see it and, you know, saw strength in the business in Q1 and felt good with ourselves for Q2, and obviously, the quarter didn't play out that way.

Operator (participant)

This is Peter. Mr. Cikos, are you done with your question? Since there is no reply from the line of Mr. Cikos, we'll go for the next participant. The next question comes from the line of Joel Fishbein with Truist Securities. Please go ahead.

Joel Fishbein (Senior Software and Equity Research Analyst)

Thanks for taking the question, Amit. Good to hear your voice. Question on Eureka. DSPM market seems very crowded. Can you just help us through, you know, how that's gonna fit in the product portfolio, when we would likely see revenue from it, and what the target customer is there? That would be really helpful. Thank you.

Amit Yoran (Charman and CEO)

Thanks, Joel. It's great, great to be back. You know, we're excited about the Eureka acquisition. DSPM is a strategic component of a CNAPP platform. I anticipate that over time, most organizations will procure unified CNAPP solutions, and that will include a component or some licensing component of DSPM. We have DSPM in our current CNAPP offering. It's tightly integrated in a unified workflow, and that's really one of the strengths that Ermetic brought to the table with cloud security capability. With the Eureka acquisition, we're able to introduce next-generation features and next-generation DSPM capabilities into that CNAPP offering and into our cloud security offering, and feel like we can now be highly competitive with the absolute market leaders in DSPM.

So we can compete on the DSPM, you know, toe-to-toe. I think we can lead the market when it comes to CIEM and when it comes to unified CNAPP workflow. You know, I think some of the early innings here with our cloud security offering are starting to bear that out, and we're excited to prove that out over time.

Joel Fishbein (Senior Software and Equity Research Analyst)

Great. Thank you so much.

Operator (participant)

Thank you. Next question comes from the line of Andrew Nowinski with Wells Fargo. Please go ahead.

Andrew Nowinski (Senior Research Analyst)

Great, thank you, and it is, great to have you back, Amit. I wanted to ask about, I guess, your, really your guidance. You know, the CrowdStrike outage obviously occurred after the quarter in July, but do you think this outage might have maybe exacerbated the scrutiny that you're seeing on some of these larger deals at your customers, in that they're maybe, just holding back spending now because of the outage, in Q3? Do you factor that in, I guess, is what I'm asking. Is that a factor in, as part of your guidance?

Amit Yoran (Charman and CEO)

Yeah, I think we're certainly factoring in increased scrutiny to from large enterprise transactions. And clearly we're seeing that in what I would characterize as, like, anecdotal instances at this point, where customers which have been burned and which experience significant audits, their procurement teams are very aware of that and asking very pointed questions. Luckily, we have great answers for them. We can operate in an agentless fashion. We've been doing so for decades. When we do operate with an agent, we can do it outside of kernel mode, which introduces a lot of safety valves for customers.

And we don't force customer upgrades, so customers can select whether they want to operate with the latest and greatest agent, or whether they want to operate with agent N minus one or N, N minus two releases and make sure that what is experienced out in the wild doesn't disrupt operations. So, you know, we are seeing increased scrutiny of procurement. I think that's baked into the guidance that we're putting out and the conservatism for the second half of the year. And we think that we've got a lot of great answers for procurement teams, as this CrowdStrike outage kind of plays itself out.

Andrew Nowinski (Senior Research Analyst)

Okay, thank you. And congrats on putting out the, you know, the fiscal 2025 free cash flow guidance. That was really impressive. I was just wondering, you know, given the news that we've or the rumors that we've seen, can you confirm whether you've hired advisors regarding a potential acquisition?

Amit Yoran (Charman and CEO)

Yeah, obviously, great question, but, obviously, we don't comment on rumors and speculation.

Andrew Nowinski (Senior Research Analyst)

All right. Thank you.

Operator (participant)

Thank you. Next question comes from the line of Jonathan Ho with William Blair. Please go ahead.

Jonathan Ho (Research Analyst of Technology, Media, and Communications)

Hi, good afternoon. With regards to your 2025 free cash flow guidance, can you give us a little bit more color on where you see the opportunity to drive this incremental leverage from? You know, do we see additional rationalization? Is there going to be like, any commentary would be helpful in terms of just understanding where you'll see the opportunity to drive this from.

Amit Yoran (Charman and CEO)

Yeah, I would say, you know, first, we had notable performance in the quarter, and that reflects our ability to continue to drive leverage in our business, while also making investments to continue to take and win share in the cloud security and the exposure management market. We are turning more efficient, and part of our focus this year and next is to be more efficient in our business and, you know, and specifically with regard to sales and marketing. It's something we talked about at the beginning of the year, and how it's played out this year has proven to be true. Like, for example, sales and marketing, as a percentage of our revenue, was 42% last year, and this year is 38%, and this quarter, rather. And so we expect, you know, continued leverage in sales and marketing.

Obviously, in terms of G&A, we'll, as we continue to grow and scale, we'll be able to full, more fully absorb some of those costs, which are semi-fixed. You know, we're driving, you know, leverage in, in our gross margins as we scale our, our cloud security offerings and our unified exposure management platform. Every year, since we've been public, we've expanded, in our free cash flows, and we've also increased our free, cash flow margins, unlevered free cash flow margins. So we expect a continuation of that trend. And just given the confidence in our business and what we've demonstrated to date, as I mentioned earlier, we're also raising our long-term target for unlevered free cash flow from 30% previously to now 35% plus.

Jonathan Ho (Research Analyst of Technology, Media, and Communications)

Excellent. And just very quickly, in terms of your ability to win on the CNAPP side, clearly, there's, you know, a lot of competition in this space. You've got, clear differentiation with your, CIEM product. Can you help us understand, you know, what percentage of the market you think you can take, or, you know, how the competitive dynamics are really playing out in this, in this space, just given, you know, how many players are, are sort of targeting this market? Thank you.

Amit Yoran (Charman and CEO)

Yeah, you know, there's obviously it's a crowded market. There's a lot of players in broadly cloud security. I think when you look at tier one CNAPP solutions, I would consider us a top five player today. And as we get into bake-offs with other, you know, top-tier products, I think that's proving itself out. Whether we're a one, two, or three player this year, I have a high degree of confidence that we've got the team to bet on, and that we're proving ourselves to have in the, in the field with competitive win rates, and we'll see how it plays out over time. We have a lot of confidence in the team.

We have a market-leading Tenable solution, which can get a foot in the door, and I'd say among the best CNAPP experiences in the market today.

Operator (participant)

Mr. Ho, are you done with your question?

Jonathan Ho (Research Analyst of Technology, Media, and Communications)

Yes, thank you.

Operator (participant)

Thank you. Next question comes from the line of Shaul Eyal with TD Cowen. Please go ahead.

Shaul Eyal (Managing Director)

Thank you. Good afternoon, everybody. Great to hear Amit's voice on the call. Steve, actually, let me start with you. Some of the slip that you might have seen towards the end of, you know, of the quarter, has anything been booked back over the course of the past 30, 31 days now?

Amit Yoran (Charman and CEO)

The short answer is yes. But, you know, what I will say is this, is in our experience, when we see deals pushed out of the quarter, it would not be prudent to assume that for the upcoming quarter or even the second half of the year, that we'll continue to close what we expected, plus the deals that pushed. Overall, we're just seeing longer sales cycles, specifically with large deals. The good news is we are transacting and closing large deals, and we have lots of pipeline opportunities that are in the high six and seven-figure range. But we're just assuming a longer sales cycle. And a longer sales cycle means it impacts not only the current quarter, but also the outlook, for the second half of the year.

And so that's what we're factoring into the guidance, as it means to be more cautious.

Shaul Eyal (Managing Director)

Fair enough. And maybe for Amit, when you run a quick compare-contrast with the softness you've observed back at the beginning of 1Q23, what would that compare-contrast look like? Is it strictly geographic? Is it product? Is it category-driven? Just curious.

Amit Yoran (Charman and CEO)

Yeah, well, it's certainly product and category-driven. So on the product side, we specifically saw it in our VM business in North America in the large enterprise segment. We in fact had reasonable performance in the commercial market, mid-market, with VM. No notable change. I think what we're trying to do in the outlook is apply that same level of scrutiny to our other theaters and make sure that we're taking a cautious approach for the remainder of the year and setting ourselves up for success.

What we are seeing is a healthy amount of engagement in strategic conversations with our customers, and that's what's really driving the impressive growth with Tenable One, where they're talking about exposure management and leveraging Tenable One as a exposure management platform, and where we're able to engage with them in our exposure solutions, you know, specifically strength in cloud, which we saw and expect to continue, and as that product is highly competitive, as well as with identity and OT.

Shaul Eyal (Managing Director)

Got it. Thank you very much.

Amit Yoran (Charman and CEO)

Thank you.

Operator (participant)

The next question comes from the line of Gray Powell with BTIG. Please go ahead.

Gray Powell (Managing Director and Security and Infrastructure Software Analyst)

Okay, great. Thanks for taking the questions. Just a couple of quick ones on my side. So in terms of the, I guess, we'll call them new disclosures, you've called out 50% plus of new sales from exposure solutions, and then 30% of new sales from Tenable One. So this might be a little basic, but does that mean that 20% of your new sales are standalone products, like cloud security, identity, and OT? And then I just wanna make sure that I'm correlating it correctly. Like, when you say new enterprise sales, like, what specifically is the definition there? Does that correlate more with something like current bookings, or should we think of something else?

Amit Yoran (Charman and CEO)

Hi, Gray. Yes, this is Steve. So when we said that 50% of our total sales in the quarter is exposure solutions, that is inclusive of Tenable One. It includes the 30%, just as a clarification. And then we often talk about enterprise sales, right? We have two really go-to-market motions. We have, you know, a direct sales organization that stands shoulder to shoulder with partners to transact deals, and they have quotas. And so, collectively, we refer to that business as our enterprise sales business. They're selling to either mid or large-sized customers, and then, also part of our go-to-market is an unaided sale, without the assistance of a sales rep, or we transact deals through DMRs or online via our e-commerce engine.

Collectively, in total, new business refers to our enterprise direct sales organization and also refers to our unaided sales motion, with kind of lower ASPs, high-velocity deals.

Gray Powell (Managing Director and Security and Infrastructure Software Analyst)

Okay, so the metric's more like a subset of total ACV. It's the total enterprise and does not include commercial. That—I just want to make sure I have it correct.

Amit Yoran (Charman and CEO)

That it does not include the Nessus lower ASP products.

Gray Powell (Managing Director and Security and Infrastructure Software Analyst)

Yeah.

Amit Yoran (Charman and CEO)

Correct.

Gray Powell (Managing Director and Security and Infrastructure Software Analyst)

Yeah. All right, got it. All right, great. I'll leave it there. Thank you very much.

Operator (participant)

Thank you. Next question comes from the line of Brad Reback with Stifel. Please go ahead.

Brad Reback (Managing Director)

Hi, this is Rob on for Brad. Thanks for taking the question. How does the federal fiscal year end next quarter? I was wondering if you've seen any uptick in federal and public sector customers adopting Tenable One, as opposed to the perpetual license VM and OT adoption trends from last Q3, and if we should expect the same CCB headwinds from last Q3 recurring next quarter? Thanks.

Amit Yoran (Charman and CEO)

Yeah, I think what we're seeing out of the federal market is, you know, similar in buying patterns and behaviors to other market segments. So we're seeing some adoption of Tenable One, but obviously, that's a multi-year, given the penetration and account base we have in the federal market. That's a gonna be a multi-year account effort to transition and grow them into Tenable One.

Brad Reback (Managing Director)

Great. Thank you.

Operator (participant)

Thank you. Next question comes from the line of Shrenik Kothari with Robert W. Baird. Please go ahead.

Shrenik Kothari (Senior Research Analyst)

Hey, yeah, thanks for taking my question. Welcome back, Amit. Just a follow-up to an earlier question and a commentary on the CrowdStrike outage-driven deal scrutiny impacted in the second half. At the very beginning, you highlighted the importance of best-of-breed solutions in promoting resilience and reducing risk associated with over-reliance on a single vendor. Can you elaborate on how you are positioning Tenable to address? And if you're already seeing some traction in the ongoing customer conversations, and just had a follow-up for Steve after that.

Amit Yoran (Charman and CEO)

Yeah, I think we're in the early innings of how customers are going to perceive this, and you hear different responses and different approaches from CISOs around the world who have been impacted. You know, for us, we look at it and say, hey, there are certainly some characteristics which could serve as tailwinds when you looked at vendor consolidation on higher risk agents, you know, things like kernel kernel-level usage or even operating system diversification. So we think that there is significant validation for having an independent audit, an independent exposure assessment from a vendor like Tenable. It's not also providing an operating system or other security functionality, and we think that message resonates. We think it makes great sense in a high-resiliency architecture. So there's good argument that we might see some tailwind from this.

Just as we spoke earlier on the call, there's good argument where we may see some headwind, where we see increased scrutiny or might see increased scrutiny on a more consistent basis from large enterprises, where the procurement teams have experienced outages and are being asked by their corporate leadership or by the security leadership for different levels of assurances and different terms around liabilities and assurances around failure. And I think we have great, you know, said earlier in the call, I think we've got great answers for those teams.

Shrenik Kothari (Senior Research Analyst)

Got it. Thanks for the call, Amit. And Steve, a quick follow-up on the net dollar expansion rate remaining steady at 109. So just can you provide more insights into kind of how does this stack up against billing softness? Is it just the lagging indicator, that dynamic versus kind of real-time billings dynamic or anything else that we're missing contributing to this deal?

Amit Yoran (Charman and CEO)

Well, obviously, there's, you know, a lot of interplay between new deals in the quarter, from new logos and then expansion within existing customers, and each quarter is different in its own right. And that mix between new business from new logos and expansion from existing customers can vary. As you mentioned earlier, our net dollar expansion rate in the quarter was 109, 109 last quarter. It's good to see that stabilize, and, you know, that reflects the customer's ability to expand and add Tenable One. But also, we're acknowledging here in this market, specifically with large deals, and in particular, VM, where you're seeing customers moderate the rate of expansion, you know, within that product set. So, overall, we have a big customer base.

We're confident in our ability to sell a broader product portfolio back into that base, and we would expect the net dollar expansion rates over time to trend up, over the course of years here.

Shrenik Kothari (Senior Research Analyst)

Got it. Thank you.

Operator (participant)

Thank you. Next question comes from the line of Joshua Tilton with Wolfe Research. Please go ahead.

Joshua Tilton (SVP and Analyst)

Hey, guys. This is Rich Magnuson for Josh Tilton. Coming back to the macro, some other software names who have reported are saying the macro is starting to stabilize, and your results and commentary suggests maybe some potential softness there. Can you guys give any other points on inputs that may be driving that, or some thoughts on the possible disconnect from others who have reported? So any additional color on things that changed quarter-over-quarter would be helpful. Thank you.

Amit Yoran (Charman and CEO)

Well, we reported a good Q1 and raised our outlook for the year, and that was due to strength specifically in new logos, new dollars from new logos. As I mentioned earlier, every quarter is different in its own right, and I think in Q1, that was at a time when others were reporting a tougher macro and softness. You know, this quarter, we saw certainly you know, more levels of review and budgetary constraints with respect to large deals, and reflecting that in our outlook for the year. So again, each quarter is different in its own right. We're trying to be cautious in our outlook, and we're reflecting what we saw in Q2 for the second half of the year.

Speaker 19

Thank you.

Operator (participant)

Thank you. Next question comes from the line of Patrick Colville with Scotiabank. Please go ahead.

Patrick Colville (US Software Equity Research)

All right. Thank you so, so much to take my question. Steve, this one's for you, please. So current billings rose 10% this quarter, which, I mean, given the tough comp is, you know, pretty respectable. But the guidance implies quite a big falloff in the back half. I mean, I model an exit billings growth rate in Q4 of about 7%. So, I guess, am I thinking about it the right way? And then is it these trends you've been talking about, shortfall in VM because of the cyclicality, North America softness and large enterprise softness, are those trends gonna get worse and worse through the year? You know, like what we see in 2Q worsens.

Amit Yoran (Charman and CEO)

Yes. So I would say if unpacking our CCB guide a little bit, if you look at the second half of the year, you know, that suggests that we're expecting to grow, call it 9%-10%, you know, given the range that we provided. So yes, we are expecting more moderate growth the second half of the year relative to what we experienced in the first half. What we said, you know, specifically in Q2 is that we saw, you know, a challenge getting deals across the finish line, specifically with VM in North America.

And so that's reflected in our outlook the second half of the year, which for large deals as a whole, it's, you know, more notably in our VM business, but we're also trying to hedge all, you know, large deals across our theaters, whether it's public sector or otherwise. And we think that's, you know, the right thing to do. Overall, we're trying to take a cautious approach the second half of the year, and good news is that pipelines are full, and top of the funnel remains strong, and our focus will be on executing and closing a lot of those large opportunities.

Patrick Colville (US Software Equity Research)

Very helpful. And in an earlier question, you know, you highlighted the criticality of VM, that, you know, it's a core discipline in every enterprise CISO's arsenal. Totally agree with that. The commentary, you know, you've given is that, you know, we're going through a cyclical trough. When you know, given prior cycles and you know, given what you're seeing right now, you know, when do you think this cycle might pass here in VM?

Amit Yoran (Charman and CEO)

Yeah, I think it's, you know, we obviously quite speculative to throw out a particular quarter. It's more just a recognition that the importance of the market, and that at some point, both from a macro perspective, but more specifically from a VM perspective, that, you know, it will come back in favor and have an increasing share of budget over time, the way, you know, it has in years past. And it has been cyclical in years past as well. And we saw it a couple of years ago, it was the number one priority in some CIO, CISO surveys, and then a few years before that, it was a number, you know, five, number six priority. So you know, these things are cyclical, and we believe that it'll come back, but difficult to project when.

We're certainly not factoring that into our outlook for the year. Certainly our expectation is that we would see relative highs over the coming years for VM.

Patrick Colville (US Software Equity Research)

Crystal clear. Thank you so much.

Operator (participant)

Thank you. Next question comes from the line of Roger Boyd with UBS. Please go ahead.

Roger Boyd (Executive Director)

Great, thanks for taking the question. Steve, I'm wondering if you could help bridge the CCB performance versus the CRPO performance, and anything you're seeing from a billings duration or payment terms perspective, given the relatively better CRPO and current, bookings growth.

Amit Yoran (Charman and CEO)

Yeah. So, RPO, current RPO growth grew 14%. And look, we talk about CCB as a proxy of what we sell. And some quarters, CCB can closely correlate to the underlying health and sales of the business. In other quarters, I think we talked about this in Q3 of last year, RPO is a better approximation. And I think it's fair to say, regardless of what metric, you know, well, top line came in lighter than expected, which we talked about. But you know, there's not a perfect metric, and CCB here is also influenced by deal timing, early renewals, a number of other factors. But you know, overall, it's a corollary to our performance in the quarter, which we've discussed.

Roger Boyd (Executive Director)

Got it. And then maybe a quick follow-up for Amit. Just approaching the cloud competition, debate from another perspective, any color on the contract durations or strategic nature of the deals you're seeing in cloud security? It seems like you're having a lot of success. With the key function in particular, winning alongside, existing CNAPP solutions, can you just talk to your confidence in winning that broader cloud security budget over time and not the other way around as other CNAPP vendors expand their own, key offerings? Thanks.

Amit Yoran (Charman and CEO)

Yeah, sure. I'll start by saying most, you know, a vast super majority of the transactions that we, that we're pulling in on the cloud security side are for cloud security and the broader CNAPP solution. A lot of customers begin their CNAPP journey with CSPM. We think we have highly competitive CSPM functionality, but really, that unified CNAPP approach is an area where we really shine, especially vis-à-vis competition. And again, you know, I think some of our early win rates are starting to prove themselves out, especially in large enterprises where they're doing bake-offs and doing testing. You know, that said, for organizations which have already deployed a CNAPP or just deployed a CSPM, we don't have to go in and displace and do a rip and replace in order to pull down budget.

I think the great example we called out was a sophisticated customer, which was able to differentiate our key functionality from what they were able to get with their existing vendor. It also enabled us to attractively tap into identity and access management budget. It wasn't even coming from the cloud security budget. So again, that opens up additional TAM to us, and one that I feel great we'll be able to continue expanding over time.

Operator (participant)

Thank you. Next question comes from the line of Rudy Kessinger with D.A. Davidson. Please go ahead. Mr. Kessinger, please go ahead with the question.

Amit Yoran (Charman and CEO)

Yep.

Operator (participant)

Since there's no questions at this point of time, this concludes today's teleconference. You may disconnect your lines.