TENB - NASDAQ

Greetings, and welcome to Tenable Q2 2024 Earnings Conference Call. [Operator Instructions] As a reminder, this conference is being recorded. It is now my pleasure to introduce your host Ms. Erin Karney, Senior Director, Investor Relations. Thank you, Ms. Karney, you may begin.

Thank you, operator, and thank you all for joining us on today's conference call to discuss Tenable's second quarter 2024 financial results. With me on the call today are Amit Yoran, our Chief Executive Officer; and Steve Vintz, our Chief Financial Officer. Prior to this call, we issued a press release announcing our financial results for the quarter. You can find the press release on our IR website at tenable.com. We will make forward-looking statements during the course of this call, including statements related to our guidance and expectations for the third quarter and full year 2024, growth and drivers in our business changes threat landscape in the security industry and our competitive position in the market; growth in our customer demand for and adoption of our solutions, including Tenable One, planned innovation and new products and services the potential benefits and financial impact of our recent acquisition of Eureka and our expectations regarding long-term profitability and free cash flow. These forward-looking statements involve risks and uncertainties, some of which are beyond our control, which could cause actual results to differ materially from those anticipated by these statements. You should not rely upon forward-looking statements as a prediction of future events. Forward-looking statements represent our beliefs and assumptions only as of today and should not be considered representative of our views as of any subsequent date, and we disclaim any obligation to update any forward-looking statements or outlook. For further discussion of the material risks and other important factors that could affect our actual results, please refer to those contained in our most recent annual report on Form 10-K and subsequent reports that we file with the SEC. In addition, all of our financial results we will discuss today are non-GAAP financial measures with the exception of revenue. These non-GAAP financial measures are in addition to and not a substitute for or superior to measures of financial performance prepared in accordance with GAAP. There are a number of limitations related to the use of these non-GAAP financial measures versus their closest GAAP equivalents. Our press release includes GAAP to non-GAAP reconciliations for these measures. I'll now turn the call over to Amit.

Thank you, Erin. We delivered mixed results for the quarter with lower-than-expected CCB, but with outperformance in revenue and earnings. Exposure management continues to generate demand, particularly for Tenable One and cloud security as key priority areas for CISOs. Before I get into the quarter, I'd like to first comment briefly on the recent CrowdStrike outage. This incident highlights the importance of independent cybersecurity assessments and negative global consequences of creating single points of failure with any one vendor. Excessive reliance on any one vendor reduces enterprise resilience just as deviating from best-of-breed platforms increases exposure to risk. Boards have fiduciary responsibility to oversee cyber hygiene, and we expect the regulators will play an increasingly critical role in promoting resiliency and requiring transparency. We believe the path forward for modern organizations lies in interoperable best-of-breed platforms that empower enterprises to reduce risk and improve cyber hygiene. Now on to the quarter, a few areas stood out as notable in Q2. First, customers continue to highly scrutinize their spend and rigorously prioritize their investments. Second, and this is a positive trend for us is that exposure management is gaining increasing momentum in the industry among customers and analysts. Customers need and want to understand their level of risk across their attack surface, from their IT environment to the cloud to their critical infrastructure, and we believe that has resulted in strong traction for Tenable One. And third, as customers increasingly rely on cloud, we are seeing strong momentum for our cloud exposure solution. In fact, one of our largest deals for the quarter was for our cloud security products with a major financial services company. I will talk more about that in a few minutes. Let me dig deeper on the first point on spending patterns that we noticed in Q2. We continue to see a great deal of customer certainty around cyber spending. This makes it more difficult to transact and close new deals as new projects and procurements are getting the greatest scrutiny. This trend becomes more apparent as deal sizes get larger. These two dynamics were more pronounced in our Vulnerability Management business in Q2 than what we had seen historically. And while our mix shift to our faster-growing exposure solutions is healthy. It is not enough to offset the cyclical impact of our traditional stand-alone VM business. While VM is becoming more cyclical, we remain the clear leader. VM continues to drive initial Tenable One adoption and leaves the groundwork for future upsell opportunities. Our win rates continue to be very strong. Exposure management is becoming increasingly critical for customers. We pioneered this category knowing that point products leave customers with an incomplete view of actual risk in their environments. This is where Tenable shines. Tenable One, our exposure management platform provides a unified approach and consolidate visibility across asset types to deliver insights that individual products alone cannot provide. And there's also a compelling ROI to customers who consolidate spend and reduce complexity in their security stack. We are expanding into budgets beyond VM and broadening our reach within enterprises. Tenable has become a trusted source of truth for boards and executives needing to understand their businesses exposure and risk. We're seeing this play out in our product mix as Tenable One represented of 30% new business in Q2. We are also seeing increased utilization with different asset types, which allows customers to leverage features such as ATT&CK path analytics, visualize the riskiest exposures and toxic combinations and enables customers to quickly assess and safeguard their business. We're also seeing significant momentum in cloud security. Prioritization of cloud security spend, coupled with our CNAPP offering resulted in strong growth in our cloud security for the quarter. Tenable cloud security delivers immediate value as an exceptionally user-friendly multi-cloud solution. We're starting to land technical wins with large sophisticated enterprises. In fact, is in the second quarter in a row that one of our largest deals, including cloud security, as I mentioned, the Fortune 100 financial services company selected us this quarter for team, which is an integral piece to CNAPP. The other cloud security provider for CNAPP was not able to deliver visibility in identity for cloud, where we are the best provider to meet their needs. During the quarter, we acquired Eureka a leading data security posture management company, having discovering and securing data to Tenable cloud. We're excited to add enhanced DSPM to our CNAPP offering, which we expect to happen this year. We're also expanding our generative AI capabilities to maximize customer value. Along with integrating AI into our products, we're also seeing rapid adoption of our exposure management platform to identify where and how AI is operating in customer environments. We introduced two new capabilities in Q2. First, and AI security posture management capability within our cloud security offering that detects an misconfigurations in services like AWS Bedrock and Azure OpenAI and ensures compliance with their organization's security policies. Second, we now provide runtime detection to identify AI software libraries and browser plug-ins that may be in use within the enterprise. We believe this is an innovative capability to alert security teams where the unauthorized use of AI may be taking place in their environments. As we look ahead, we are going to focus on optimizing the business by investing in areas that matter most to our customers while continuing to drive profitability in the business. We will continue to enhance our CNAPP offering, add additional features to Tenable One and leverage AI to drive efficiency in our products and to solve problems for our customers. On that note, Steve will go into more detail, but we are introducing our 2025 unlevered free cash flow target of $280 million to $290 million today. We believe this is a strong initial target representing our commitment to deliver durable cash flow growth, and we look forward to updating you as we get through the second half of the year. We'll continue to evaluate the appropriate level of investment in resources going forward to strike the right balance of growth and profitability. This is an exciting time for Tenable. We are leveraging our leadership position in seeing major momentum in cloud and delivering broader exposure management platform. Despite challenges for this quarter, I am confident in our long-term strategy and our ability to grow over the ensuing years. I'll now turn the call over to Steve for further commentary on our financial results and outlook.

Thanks, Amit. Calculated current billings defined as revenue recognized in the quarter, plus the change in current deferred revenue grew 10% year-over-year to $221.1 million. While we only guide to CCB on an annual basis, I think it's fair to say CCB growth in the quarter fell short of our expectations. And accordingly, we are revising our outlook for the year to reflect a more challenging selling environment. Now let's get into the results for the quarter as it will provide context to our outlook for the full year. Overall, we went into the quarter with a healthy pipeline and a large number of six and seven figure opportunities. We closed fewer deals than expected as customers defer new projects in the face of a more challenging macro environment and tighter budgetary constraints. This shortfall was specific to VM, particularly with large opportunities in North America, where we experienced longer sales cycles and more modest growth in comparison to other geos. Other areas of new business continue to get traction despite the selling environment, Tenable One grew to 30% of total new enterprise sales and is up from 26% last quarter. Exposure solutions, which includes Tenable One stand-alone cloud identity and operational technology security solutions represented over 50% of our total new sales in the quarter. As a point of comparison, Exposure solutions was under 10% of total new enterprise as in Q2 of 2020. So we've made a lot of progress in this regard. This healthy mix of new business demonstrates our ability to broaden the product portfolio and expand into new markets over the years and reflect the growing demand for exposure management and the actionable insights we deliver to CISOs and their security teams. As Amit commented earlier, cloud security was also a major highlight for us with several sizable six figure wins in the large market, including a global financial services and payments firm a large defense contractor and a multinational enterprise software company. We believe our success here is a clear indication that we will continue to take and win share in one of the faster-growing areas of the cybersecurity market. Finally, I also want to note that current RPO growth in the quarter was 14%. Turning to other highlights, we added 408 new enterprise platform customers and 76 net new six figure customers during the quarter. Our net dollar expansion rate was 109% this quarter consistent with last quarter, our renewal rate remained strong. Now on to the P&L for the quarter, revenue was $221.2 million, which represents 13% year-over-year growth. Revenue in the quarter exceeded the midpoint of our guided range by $3.2 million. Our percentage of recurring revenue remains high at 96% this quarter. I'll now turn to expenses. I'll start with gross margin, which was 82% this quarter, up 70 basis points from last quarter. Gross margin was better than expected due to our continued ability to cost effectively scale our public cloud infrastructure for our exposure management platform and other cloud-based offerings. Sales and marketing expense was $84.8 million, up modestly from $84.5 million last quarter. And as a percentage of revenue, was 38% compared to 39% last quarter. Sales and marketing expense was higher sequentially on an absolute dollar basis, primarily due to greater marketing investments to promote our cloud security and exposure management offerings as well as to build our global brand, partially offset by cost in Q1 related to our annual sales kickoff conference. Overall, we are pleased with the improved efficiency in our go-to-market efforts this quarter and expect sales and marketing spend as a percentage of revenue to continue to trend lower over the remainder of the year and beyond. R&D expense was $33.4 million, which is up from $32.6 million last quarter. R&D expense as a percentage of revenue was 15% this quarter, flat compared to last quarter. Wages were higher in the quarter related to the acquisition of Eureka. G&A expense was $19.6 million, which was down from $20.6 million last quarter, primarily due to lower payroll taxes, primarily related to divesting of RSUs in Q1. G&A expense as a percent of revenue was 9% this quarter compared to 10% last quarter. Income from operations was $42.8 million and exceeded the midpoint of our guided range by $7.8 million. Operating margin for the quarter was 19%, which was approximately 325 basis points better than the midpoint of our guided range. The notable outperformance in earnings this quarter reflects our ability to continually drive leverage in our business while making investments to win share in cloud security and the exposure management markets. The sizable beat in operating income resulted in significant EPS. Upside EPS for the quarter was $0.31, which was $0.08 better than the midpoint of our guided range. Let me briefly touch on the restructuring expense in the quarter, which is excluded from our non-GAAP results. You'll recall that in Q4 2023, we announced an optimization plan, including the potential sublease of a portion of our real estate. In Q2, we executed the sublease and recognized a $4.5 million impairment charge related to the leaseholds and furniture and fixtures. Now let's turn to the balance sheet. We finished the quarter with $487 million in cash and short-term investments, reflecting the $29.2 million of net cash used for the Eureka acquisition. Accounts receivable was $179.6 million and total deferred revenue was $725.8 million. Current deferred revenue was $562.6 million, which gives us a lot of visibility into expected revenue over the next 12 months. We generated $36.5 million of unlevered free cash flow during the quarter, which reflects the seasonal pattern of billings during the year. To date, unlevered free cash flow was $91.2 million and puts us well within reach to achieve our annual guide for the full year, which we are raising today. We feel confident that we can continue to expand our operating and free cash flow margin over the ensuing years as we have done so every year since our IPO. During the quarter, we repurchased 589,000 shares of common stock for an aggregate purchase price of $25 million. Thus far, we've repurchased almost 1.5 million shares and have $35.1 million of remaining authorization under our initial $100 million share repurchase program. With the results of the quarter behind us, I'd like to discuss our outlook for Q3 and the remainder of the year. For the third quarter, we currently expect revenue to be in the range of $222 million to $224 million, non-GAAP income from operations to be in the range of $42 million to $44 million, non-GAAP net income to be in the range of $35 million to $37 million, assuming interest expense of $8.3 million, interest income of $5.7 million and a provision for income taxes of $3.8 million. And non-GAAP diluted earnings per share to be in the range of $0.28 to $0.30 per share, assuming 123 million fully diluted weighted average shares outstanding. And for the full year, we currently expect calculated curve billings to be in the range of $957 million to $967 million, revenue to be in the range of $889 million to $895 million, non-GAAP income from operations to be in the range of $167 million to $171 million, non-GAAP net income to be in the range of $143 million to $147 million, assuming interest expense of $32.7 million, interest income was $23.5 million and a provision for income taxes of $12.8 million. Non-GAAP diluted earnings per share to be in the range of $1.16 to $1.19, assuming $123.5 million in fully diluted I would like to provide some commentary regarding our revised outlook today, which reflects lower CCB in revenue for the year. As we think about the second half of the year, we are taking a more cautious approach to new business, not only with large VM opportunities, but also with other pipeline opportunities. While demand generation remains healthy, the rate in which these opportunities are expected to progress through the funnel in the second half of the year is expected to be more moderate than previously anticipated, which will constrain our near-term results. Despite the reduction in our top line outlook, we remain committed to our margin targets and are pleased to be raising our operating income and unlevered free cash flow outlook for the year. We're also providing an unleveraged free cash flow target today of $280 million to $290 million for the full year 2025, which is 24% growth year-over-year at the midpoint, and a major milestone toward achieving our updated long-term target unlevered free cash flow margin of 35% plus. With over 95% recurring revenue, high gross margins and high renewal rates, we have a lot of confidence in our ability to drive continued leverage in our business. It's important to note that we are committed to delivering on this level of cash flow in 2025 based on a range of growth scenarios, and we'll continually evaluate the appropriate level of investment and resourcing to achieve this target. As a platform and cloud-first company, we will invest in areas where we see outsized growth and we'll reprioritize spend in other areas where appropriate. I will now turn the call back to Amit for some closing comments.

Thanks, Steve. In summary, this market is very fluid, and we are taking a more cautious approach to our CCB and revenue outlook today. We are very encouraged by the momentum in exposure management and cloud security, and we are excited about where we are as a company and the opportunity in front of us. We hope to see you at the Canaccord, Stifel and Piper Sandler conferences in the upcoming weeks. We'd now like to open the call for questions.

[Operator Instructions] The first question comes from the line of Saket Kalia with Barclays. Please go ahead

Okay, great. Hey guys, thanks for taking my questions here and good to hear from everyone. I mean maybe to start with you, I thought it was interesting in your prepared remarks that you talked about sort of traditional VM becoming more cyclical. Maybe to start us off, can you just talk about some of the market dynamics in VM. And maybe why you think the demand for Tenable One feels just decently stronger right now than traditional VM. Does that make sense?

It does. Saket, thank you for the question. With respect to VM, it's an established market. We're seeing some cyclical patterns in it, but we are the clear market leader. In Q2, we saw greater scrutiny of transactions, specifically in North America and in the large enterprise segment of the market. With respect to Tenable One, it's just a more modern infrastructure and a more strategic conversation that we're having with our customers. We continue to see strong demand for Tenable One, which accounted for 30% of our new sales in the quarter. And that's even more broadly than T1. We saw attractive growth for exposure solutions, including cloud and we're proving ourselves to be highly competitive with market leaders identity. And in Ottawa

Got it. Got it. That's helpful. Steve, for my follow-up, maybe for you. Despite the challenges in VM that we just spoke about, the focus on free cash flow definitely comes through and certainly appreciate the early look at how you're thinking about 2025. Just understanding that it's still very early. Can you just talk us through how you kind of think about the balance between growth and margins in setting that target, even anecdotally?

Sure. Thanks, Saket. Well, we're very pleased to be providing an initial unlevered free cash flow target today for 2025, $280 million to $290 million. That's for the full year next year. That's up 24% at the midpoint. And that's also a major milestone, by the way, towards achieving our updated long-term target for unlevered free cash flow of 35% plus. Previously, our long-term target for cash flow was 30%. So I have a lot of confidence in our ability to continue to drive margin leverage. In terms of growth for next year, look, I'm not going to comment about that. We're not through our planning process yet. And we have to see how the second half of the year plays out. But the one thing I will say is that we're firmly committed to delivering on our unlevered free cash flow targets. We're also raising our levered free cash flow outlook for the year. And we're going to continually evaluate the appropriate level of investment and resourcing to achieve these targets. Some areas will continue to lean in and invest and other areas will reprioritize where appropriate. So overall, we just have confidence in our ability to drive higher levels of cash flow.

Next question comes from the line of Brian Essex with JPMorgan. Please go ahead

Great, thank you.Thank yo u for taking the question. Amit, great to see you back in the seat. So congratulations to you. I guess I wanted to touch on Ermetic cloud security. Maybe if we can get an update on that, where are you integrating it? Is it only on the analytics portion of that business. Are you integrating with the rest of the company? And are you able to lead with cloud security? I know you talked about seen as a point of strength there, but I would love to get more detail on where you're seeing success and plans for integration longer term.

Thanks, Brian. It's great to be back. I'll start off talking a little bit about the strength we're seeing in our cloud security product. We're providing a full end-to-end full CNAPP solution, and that's resonated with customers. a majority of our cloud sales are for that full CNAPP capability. That said, in the very large enterprise side of the market, where they may already have a DSPM solution, they already have a CNAPP solution. We have market-leading capability in particular strength around identity and the keen functionality. So I think the large -- I think our largest single transaction for the quarter came as a key win from a Fortune 500 company in the financial services segment, a very sophisticated consumer of technology where they were doing bake-offs. In terms of our ability to generate leverage with our cloud security product. We have a lot of confidence the majority of our cloud security sales. In fact, our procurement cloud security through Tenable One licensing. So we're extremely excited with that that is resonating, VM customers choosing to move to the modern platform, modernly to assess exposures and then diversifying the asset types, and recognizing that we've got market-leading cloud security that they can procure and we can do that and get more leverage through an integrated Tenable One platform. So we think the strategy makes sense. We think we're really in. So we think it's resonating driving early results.

Great. And just maybe a quick follow-up for Steve. Steve, could you comment on the Fed business or just public sector in general? I know that I think last quarter, you felt really good about it and called out some strength there. And I think we've heard about federal spend trickling down to SLED. Maybe just a comment on mix strength of the business there? And is that reacting or behaving differently than the enterprise side of the business?

Our public sector business was good this quarter and in line with our expectations. There are some very large 7-figure agency-wide opportunities in our pipeline for the second half of the year. Some view it size involve coordination and budgetary I mean -- I'll say, across dozens of sub agencies for some deals, which can introduce some variability. But overall, we continue to see strength in the public sector and we're set up for a good second half of the year with U.S. Federal.

Next question comes from the line of Hamza Fodderwala with Morgan Stanley. Please go ahead.

Hey, good evening. Thank you for taking my question and good to hear from everybody as well. Amit or Steve, I wanted to follow up on the public sector question. You mentioned obviously good strength there for Q2. We have heard that there have been some delays on the Fed budget and perhaps some agencies who are a bit uncertain given the potential change in administration with the elections later this year. I'm wondering if you're seeing any of that impact elongate some of the sales cycles for you within that vertical and if that is reflected in your guidance?

Yes, I'll start and say we saw in line delivery with our expectations for product sector in Q2. Q3 obviously is a seasonally high quarter for public sector. It is an election cycle. And we have a significant number of six and seven figure opportunities in public sector. That said, I think we're taking a cautious approach for the remainder of the year and trying to understand that there's a certain amount of unpredictability around public sector and in the election cycle.

Yes. And the only thing I'd add there is, look we're trying to take a more cautious approach here to new business, specifically with large deals in the second half of the year. This is predominantly in VM, but we're also applying that more broadly across our business, which is including public sector. And while demand generation remains healthy, when these opportunities are expected to remain through the funnel in the second half of the year is expecting more moderate. So we're trying to factor that into the guidance and trying to be cautious.

Next question comes from the line of Rob Owens with Piper Sandler. Please go ahead.

Yeah, thank you for taking my question. And Amit, I appreciate your comments around the VM business, but what can you say to assuage investor concerns that it's not secular that it is cyclical that you're seeing right here either in terms of pipelines or customer behavior?

Yes, I'll start off by saying I've got a lot of confidence in the market, in the VM business. It's a strategic market as you and others have been in the space for a long time, recognized. It's one of those foundational tools that CISO is needed and report regularly to auditors risk committees, sometimes cyber committees and to the Boards of Directors. So it's a foundational market requirement within cyber. It's not one that we anticipate going away or even having a more secular downward trend. It is cyclical, and I think we're going to see an improved outlook in the VM market with improved macro conditions. We saw this specifically in North America and with large enterprises, and we're trying to take a more cautious approach to our guidance and sure we're setting ourselves up for a successful remainder of the year. I do think that there's opportunity for outperformance in VM and growth over time.

Next question comes from the line of Mike Cikos with Needham & Co. And go, please. Go ahead.

Hey, guys, thanks for taking the question here. Wanted to go back, I think you guys had called out the Tenable One contributed 30% to new business in this quarter, if I had the metrics right. Can you just help us think about if it's contributing I guess that percentage, right, 30%, when can we start expecting Tenable One to start showing up in the revenue stream, just given the ASP uplift that management has historically spoken about for Tenable One.

Well, thanks, Mike, for the question. We have broadened our business over the years and expanded into adjacent markets. And the one thing I will say is that VM as Amit commented earlier is foundational, we're the clear leader, but growth here, as we mentioned earlier, has become more moderate. But that said, we have confidence in that business to be able to drive growth higher in the ensuing years. And of course, we have a portion of our business, most notably cloud security and platform that is growing at a very high rate, and we expect that to continue, and that will represent an increasing mix of our total business going forward. So our core market has seen slower growth right now in this macro. And then we have a portion of our business that's expected to represent a greater percentage of our total business going forward that's seen outsized growth. And obviously, we expect going forward that we'll be able to be able to drive higher levels of cash flow regardless of the growth outcomes even the second half of the year for next year.

And I also just wanted to circle up on the new business to the extent that customers are showing increased cyber scrutiny on these. Help us because I know Q1, you guys were the strength that you were seeing in new deals. In hindsight, is it fair to think that, that 1Q strength may have been more tied to the pause that we saw in March of last year with SVB and the easier comp? Or was there something that really showed up that was different in Q2? And can you maybe clarify when that showed up in Q2? Was it in April, May, June, really the last couple of days of the quarter, how did that progress?

Yes. by saying this, we are pleased with our Q1 results. We came in to Q2 with a strong pipe and a healthy number of six and seven figure deals. Obviously, a large portion of that comes in New North America. And as the quarter played itself out, we saw some of the softness in VM in North America, in the large enterprise, which has a disproportionately large impact on those larger transactions, which play a factor in our financials, the size of the company. So I think we've got a reputation for calling it like we see it and like we did saw strengthen businesses in Q1. So we felt good with ourselves for Q2. And obviously, the quarter just played out that way.

The next question comes from the line of Joel Fishbein with Truist Securities. Please go ahead, Joel.

Thanks for taking the question, Amit. Good to hear your voice. A question on Eureka. The DSPM market seems very crowded. Can you just help us how that's going to fit in the product portfolio, when we would likely see revenue from it? And what the target customer is there, that would be really helpful.

Thanks, Joel. Great to be back. We're excited about the Eureka acquisition. DSPM strategic component of the CNAPP platform. I anticipate that over time, most organizations will procure unified SAP solutions, and that will include a component or some licensing component of DSPM. We have the DSPM in our current CNAPP offering that's tightly integrated in a unified workflow and that's really one of the strengths that are met at brought to the table with table's cloud security capability. With the Eureka acquisition, we're able to introduce the next-generation features, the next-generation SPM capabilities into that CNAPP offering into our cloud security offering and feel like we can now be highly competitive with the absolute market leaders in DSPM. So we do compete on the DSPM too. I think we can lead the market when it comes to team and when it comes to Uniface workflow, I think some of the early innings here with our cloud security offering, are starting to bail that out and we're excited to prove that out over time.

Next question comes from the line of Andrew Nowinski with Wells Fargo. Please go ahead.

Great, thank you. And it is great to have you back, Amit. I wanted to ask about, I guess, your -- really your guidance. The CrowdStrike outage obviously occurred after the quarter in July, but do you think this outage might have maybe exacerbated the scrutiny that you're seeing on some of these larger deals at your customers in that they're maybe just holding back spending now because of the outage in Q3? Do you factor that in, I guess, is what I'm asking? Is that a factor as part of your guidance?

Yes. I think we're certainly factoring in increased scrutiny from large enterprise transactions. And we're seeing that in what I would characterize as this point where customers which have been burned or which experienced significant outage, their security teams were very aware of that and asking very potent questions. Luckily, we have great answers for them. We can operate in an aimless fashion with we've been doing so for decades where we do operate with an agent, we can do it outside of kernel mode, which introduces a lot of safety valves for customers and we don't force customer upgrades. So customers can select when they want to operate with the agent or whether they want to operate with a [indiscernible] and minus two releases and make sure that what has experienced that in the wild doesn't disrupt operations. So we are seeing increased unit of procurement. I think that's baked into the guidance that we're putting out the conservatism for the second half of the year. And we think that we've got a lot of great answers for procurement teams as a CrowdStrike outage kind of plays itself out.

Okay. And congrats on putting out the fiscal '25 free cash flow guidance that was really impressive. I was just wondering, given the news that we've -- or the rumors that we've seen, can you confirm whether you hired advisers regarding a potential acquisition?

Yes. Obviously, good question, but obviously, we don't comment on rumors and speculation.

Next question comes from the line of Jonathan Ho with William Blair. Please go ahead.

Hi, good afternoon. With regards to your 2025 free cash flow guidance, can you give us a little bit more color on where you see the opportunity to drive this incremental leverage from -- do we see additional rationalization? Is there going to be -- like any commentary would be helpful in terms of just understanding where you'll see the opportunity to drive this run.

Yes. I would say, first, we had no wild performance in the quarter. And that reflects our ability to continue to drive leverage in our business while also making investments to continue to take in share in cloud security in the exposure management market. We're turn straight and part of our focus this year in Infinix is to be more efficient in our business and specifically with regard to sales and marketing is something we talked about at the beginning of the year. How it play out this year has proven to be true. Like, for example, sales and marketing as a percentage of our revenue was 42% last year, this year is 38% this quarter rather. And so we expect continued leverage in sales and marketing. Obviously, in terms of G&A, we'll -- as we can grow in scale, we'll be able to more fully absorb some of those costs which are some fixed. We're driving leverage in our gross margins as we scale our cloud security offerings and our unified exposure management platform, every year, since we've been public, we've expanded our free cash flows. And we've also increased our free cash flow lines -- unlevered free cash flow margin. So we expect the continuation of that trend. And just given the confidence in our business and what we've demonstrated to date, as I mentioned earlier, we're also raising our long-term target from level three cash flow from 30% previously to now 35% plus.

Excellent. And just very quickly, in terms of your ability to win on the CNAPP side, clearly, there's a lot of competition in this space. You've got a clear differentiation with your Kim product. Can you help us understand what percentage of the market you think you can take or how the competitive dynamics are really playing out in the space just given how many players are sort of targeting this market.

Yes, there's -- obviously, it's a crowded market. There's a lot of players in broadly cloud security. I think when you look at Tier 1 CNAPP solutions, I would consider us as a top five player today. And as we get into bake-offs with other top-tier products, I think that's proving itself out. whether we're one, two or three players this year, have a high degree of confidence. So we've got the gain to bet on and that we're putting ourselves to have in the field with the competitive win rates. And -- we'll see how it plays out over time. We've got a lot of confidence in the team. We have a market-leading team solution, which can put the door, I'd say, among the best CNAPP experiences in the market today.

Next question comes from the line of Shaul Eyal with TD Cowen. Please go ahead.

Thank you. Good afternoon, everybody. Great to hear Amit's voice on the call. Steve, actually, let me start with you. Some of the might have seen towards the end of the quarter. Has anything been booked back over the course of the past 30, 31 days now? .

The short answer is yes. But what I will say is this, is in our experience, when we see deals push out of the quarter, it would not be prudent to assume that for the upcoming quarter, in the second half of the year that will continue to close what we expected plus the deals that pushed overall, we're just seeing longer sales cycles, specifically with large deals. The good news is we are transacting those large deals, and we have lots of pipeline opportunities that are in the high 6 and 7-figure range. but we're just assuming a longer sales cycle. And longer sale cycle means it impacts not only the current quarter but also the outlook for the second half of the year. And so that's what we're factoring into the guidance as it needs to be more cautious.

Fair enough. And maybe for Amit, when you run a quick compare contrast with the softness you've observed back at the beginning of the 1Q '23, what would that compare contrast look like? Is it strictly geographic? Is it product? Is it category-driven. Just curious.

Yes. Well, certainly product and category driven. So on the product side, we specifically saw it in our VM business in North America and the large enterprise segment. We in fact, had reasonable performance in the commercial market, mid-market with no notable change. I think what we're trying to do in the outlook is apply that same level of scrutiny to our other theaters and make sure that we're taking a cautious approach to the remainder of the year, setting ourselves up for success. What we are seeing is a healthy amount of engagement in strategic conversations with our customers. And that's what's really driving the impressive growth with Tenable One where they're talking about exposure management and leveraging Tenable One as an exposure management platform and where we're able to engage with them with our exposure solutions, strengthen cloud which we saw and expect to continue and as that product is highly competitive as well as with identity and OT.

Our next question comes from the line of Gray Powell with BTIG. Please go ahead.

Okay, great. Thanks for taking the questions. Just a couple of quick ones on my side. So in terms of the, I guess, we'll call it new disclosures, you've called out 50% plus of new sales from exposure solutions and then 30% of new sales from Tenable One. So this might be a little basic, but does that mean that 20% of your new sales are stand-alone products like cloud security, identity and OT? And then I just want to make sure that I'm correlating it correctly. Like when you say new enterprise sales. Like what specifically is the definition there? Does that correlate more with something like current bookings? Or should we think of something else?

Gray, yes, this is Steve. So when we said that 50% of our total sales in the quarter is exposure solutions. That is inclusive of Tenable One and inclusive of 30%, just as a clarification. And then we often talk about enterprise sales, right? We have two really go-to-market motions. We have a direct sales organization that stand shoulder to shoulder with partners that transact deals. And they have quotas. And so collectively, you refer to that business as our enterprise sales business. They're going to either mid- or large-sized customers and then also part of our go-to-market is an unaided sale without the assistance of a sales rep or we transact deals through DMRs or online via our e-commerce engine. So collectively, in total new business refers to our enterprise direct sales organization and also refers to our unaided sales motion with kind of lower ASPs, high-velocity yields.

Okay. So the metric is more like a subset of total ACV. It's the total enterprise and does not include commercial. Is that -- I just want to make sure I have that correct.

That does not include the Nessus lower ASP products.

Next question comes from the line of Brad Reback with Stifel.

This is Rob on for Brad. Ahead of the federal fiscal year and next quarter. I was wondering if you've seen any uptick in federal and public sector customers adopting Tenable One as opposed to the perpetual license [indiscernible] adoption trends in last Q3 and if we should expect the same CCB headwinds from last Q3 recurring next quarter?

Yes. I think what we're seeing out of the federal market is similar in volume patterns and behaviors to other market segments. So we're seeing some adoption of Tenable One. But obviously, as a multiyear, given the penetration in the account base we have in the federal market, that's a is going to be a multiyear account effort to transition when we go down into Tenable One.

Next question comes from the line of Shrenik Kotari with Robert W. Baird. Please go ahead.

Thanks for taking my question. Welcome back, Amit. Just a follow-up to an earlier question and your commentary on the CrowdStrike outage-driven deal scrutiny being factored in the second half. At the very beginning, you highlighted the importance of best-of-breed solutions and promoting resilience and reducing risk associated with over reliance on a single vendor. Can you elaborate on how you are positioning accountable to address? And if they're already seeing some traction in the ongoing customer conversations and just had a follow-up with it after that.

Yes. I think we're in the early innings of how customers are going to proceed this and you hear different responses and different approaches from CISOs around the world that have been impacted for us, we look at it and say, hey, there are certainly some characteristics, which could serve as tailwinds. When you look at vendor consolidation on higher-risk agents, things like kernel, kernel-level usage, or even operating system diversification. So we think that there is significant validation for having an independent audit, an independent exposure assessment from a vendor like Tenable it's not also providing an operating system or other security functionality. And we think that message resonates. We think it makes great sense in a high resiliency architecture. So there's good arguments that we might see some tailwind from this. Just as we spoke earlier on the call, there's good arguments when they see some headwind. But we see prescutiny or might see increased scrutiny on a more consistent basis from large enterprises, whether procurement teams have experienced outages and are being asked by their corporate leadership or by the security leadership for different levels of assurances and different terms around liabilities and assurances around failure. And I think we said earlier in the call, I think they've got great answers for those teams.

Got it. And Steve, a quick follow-up on the net dollar expansion rate. remaining steady at 109. So just can you provide more insights into kind of how does this stack up against building softness? Is it just the lagging indicator, that dynamic versus kind of real-time billing standard out that we're missing contributing to this.

Well, obviously, there's a lot of an employee between new deals in the quarter from new logos and then expansion within existing customers. And each quarter is different in its own right. And that mix between new business from new logos and expansion from existing customers can vary. As you mentioned earlier, our net dollar expansion rate in the quarter was 109 -- 109 last quarter. It was good to see that stabilize. And that reflects the customer's ability to expand and add Tenable One. But also, we're acknowledging here in this market, specifically with large deals, and in particular, VM, where you're seeing customers moderate the rate of expansion within that product set. So overall, we have a big customer base. We are confident our go sell a broader product portfolio back into that base, and we would expect the net our expense range over time to trend up over the course of years here.

Next question comes from the line of Joshua Shilton with Wolf Research.

This is Rich Magnus on for Josh Shilton. Coming back to the macro. Some other software names you've reported are saying the macro is starting to stabilize and your results and commentary suggests maybe some potential softness there. Can you guys give any other points on inputs that may be driving that or some thoughts on the possible disconnect from others who have reported. So any additional color on things that changed quarter-over-quarter would be helpful.

Well, we reported a good Q1 and raised our outlook for the year, and that was due to strength specifically in new logos -- new dollars from new logos. As I mentioned earlier, every quarter is different in its own right. And I think in Q1, that was at a time when others were reporting a tougher macro and softness. This quarter, we saw certainly more levels of review and budgetary constraints with respect to large deals, and reflecting our outlook for the year. So again, each quarter is different in its own right. We try to be cautious in our outlook and we're reflecting what we saw in Q2 for the second half of the year.

Next question comes from the line of Patrick Colville with Scotiabank. Please go ahead.

All right. Thank you so much to take my question. Steve, this one for you, please. So current billings rose 10% this quarter, which, I mean, given the tough comp is pretty respectable. But the guidance implies quite a big fall off in the back half. I mean, I model an exit billings growth rate in 4Q of about 7%. So I guess, am I thinking about it the right way? And then is it these trends you've been talking about shortfall in VM because of the cyclicality, North America softness and large entire softness those trends going to get worse and worse through the year, like what we see in 2Q kind of worsens?

Yes. So I would say it's impacting our CCB guide a little bit. If you look at the second half of the year, that suggests that we're expecting to grow, call it, 9%, 10%, given the range that we provided. So yes, we are expecting more moderate growth in the second half of the year relative to what we experienced in the first half. What we said specifically in Q2 is that we saw a challenge getting deals across the inline specifically the VM and North America. And so that's reflected in our outlook for the second half of the year. For large sales as a whole. It's more notably in our VM business, but we're also trying to hedge large deals across our theaters, whether it's public sector or otherwise. And we think that's the right thing to do. And so overall, we're going to take the cautious approach for the second half of the year and -- good news is that pipelines are full and the funnel remains strong and our focus will be on any closing a lot of those large opportunities.

That's very helpful. And in an earlier question, you highlighted the criticality of VM, it's a core discipline in every enterprise CISOs arsenal grew that the commentary you've given is that we're going through a cyclical trough. When -- given prior cycles, given what you're seeing right now, when do you think the cycle might pass here in VM.

Yes, I think it's obviously quite speculative to throw out a particular quarter. It's more just a recognition of the importance of the market. And that at some point, both from a macro perspective, but more specifically from a VM perspective that it will come back in favor and have an increasing share of budget over time the way it has in years passed. And it has been cyclical in years past as well. We saw it a couple of years ago, it was the #1 priority in some CIO, CISO surveys. And then if you do it before that, it was a number five, number six priorities. So these things are cyclical. We believe that it will come back quite difficult to project one.

And we're certainly not factoring that into our outlook for the year. And certainly, our expectation is that we would see growth in fact higher over the recent years with VM. .

Next question comes from the line of Roger Boyd with UBS. Please go ahead.

Great. Thanks for taking the question. Steve, I wonder if you could help bridge the CCB performance versus the CRPO performance. And anything you're seeing from billings duration or payment terms perspective, given the relatively better CRPO and current bookings growth?

Yes. So RPO -- current RPO growth grew 14%. And look, we talked about CCB as a proxy of what we sell. And some quarters, CCB can close to correlate to the underlying health and sales of the business. In other quarters, I think we talked about this in Q3 of last year. RPO is a better approximation. I think it's fair to say regardless of what metric top line came in lighter than expected, which we talked about. But there's not a perfect metric. And CCB here is also influenced by deal timing, early renewals, a number of other factors. But overall, it's a corollary to our performance in the quarter, which we've discussed.

Got it. And then maybe a quick follow-up for me, just approaching the cloud competition debate from another perspective, any color on the contract durations or strategic nature of the deals you're seeing in cloud security. It seems like you're having a lot of success with the keen function in particular, winning alongside existing CNAPP solutions. Can you just talk to your confidence in winning that broader cloud security budget over time and not the other way around as other CNAPP vendors expand their own key offerings.

Yes, sure. I'll start by saying most a vast super majority of the transactions that we're pulling in on the cloud security side are for cloud security and the broader CNAPP solution. A lot of customers begin their CNAPP journey with CSPM. We think we have a highly competitive CSPM functionality, but really, that unified SNAP approach is an area where we really shine, especially usage competition. And again, I think some of our early win rates are starting to prove themselves out in the specialty and large enterprises where they're doing big of and doing testing. That said, for organizations, which have already deployed a CNAPP or just the deployed CSPM, we don't have to go in and displace an replace in order to pull down budget. I think the great example we called out was a sophisticated customer, which was able to differentiate our team functionalities from what they were able to get with their existing vendor. It also enabled us to attractively tap into identity and access management budget. It wasn't even coming from the cloud security budget. So again, that opens up additional TAM to us and one that I feel great, we're able to continue expanding over time.