TENB - NASDAQ

Greetings, and welcome to the Tenable Q3 2025 Earnings Conference Call. [Operator Instructions] As a reminder, this conference is being recorded. It is now my pleasure to introduce your host, Erin Karney, Vice President, Investor Relations. Thank you. You may begin.

Thank you, operator, and thank you all for joining us on today's conference call to discuss Tenable's third quarter 2025 financial results. With me on the call today are Co-Chief Executive Officers, Steve Vintz and Mark Thurmond; and Chief Financial Officer, Matt Brown. Prior to this call, we issued a press release announcing our financial results for the quarter. You can find the press release on our IR website at tenable.com. We will make forward-looking statements during the course of this call, including statements relating to our guidance and expectations for the fourth quarter and full year of 2025, growth and drivers in our business, changes in the threat landscape in the security industry and anticipated shift towards preemptive security approaches, our competitive position in the market; growth in customer demand for and adoption of our solutions, including Tenable One, our exposure management platform, our ability to expand integrations with third-party tools and data sources and grow our ecosystem, planned innovation, research and development investments and new products, services and initiatives and our expectations regarding long-term profitability and free cash flow. These forward-looking statements involve risks and uncertainties, some of which are beyond our control, which could cause actual results to differ materially from those anticipated by these statements. You should not rely upon forward-looking statements as a prediction of future events. Forward-looking statements represent our beliefs and assumptions only as of today and should not be considered representative of our views as of any subsequent date, and we disclaim any obligation to update any forward-looking statements or outlook. For a further discussion of the material risks and other important factors that could affect our actual results, please refer to those contained in our most recent annual report on Form 10-K and subsequent reports that we file with the SEC. In addition, all of the financial results we'll discuss today are non-GAAP financial measures with the exception of revenue. These non-GAAP financial measures are in addition to and not a substitute for or superior to measures of financial performance prepared in accordance with GAAP. There are a number of limitations related to the use of these non-GAAP financial measures versus their closest GAAP equivalent. Our press release includes GAAP to non-GAAP reconciliations for these measures. I'll now turn the call over to Steve.

Thanks, Erin. Before we get started, I want to welcome Matt Brown to the Tenable team. Matt comes with tremendous experience and has hit the ground running since he joined us in August. With that, let's get into the quarter. In Q3, we exceeded all of our guided metrics, delivering 11% year-over-year revenue growth and 23% operating margin. We continue to see strong growth from Tenable One, our exposure management platform, which represented approximately 40% of new business during the quarter. We added 437 new enterprise platform customers in the quarter, a 13% increase compared to Q3 of 2024. Notably, half of all those customers are landing with exposure solutions with strong momentum globally. We believe our strong new platform traction reflects a fundamental shift in cybersecurity away from detection and response technologies and more toward a more preventative and preemptive approach. The reactive approach to cyber is where the tools, the budgets, compliance priorities have lived for many years, simply trying to detect breaches. In fact, more than 95% of all cybersecurity spend today is on post-breach technologies. So consequently, less than 5% is spent on preemptive security. Now the good news here is that, that mix is expected to change significantly over the ensuing years, and we're starting to see signs of that shift with Tenable One. The obvious question is, why is this happening now? The short answer is AI. AI is dramatically reshaping the threat landscape as attacks have become faster, more automated and more sophisticated, exposing the limits of traditional reactive defenses. The takeaway here is that it's no longer just about firefighting, it's about fireproofing and exposure management is helping customers make that shift. Market-leading exposure management starts with unified visibility, but it's more than just seeing assets, domains and systems across your environment. It demands intelligence, context and the ability to mobilize that insight into action. It's not just about knowing that a vulnerability exists, but understanding that it's on a critical asset that is actively exploited and sitting on a direct attack path to your crown jewels. It's also about using AI not simply to find flaws, but to anticipate how an adversary may move through your environment and to see your organization the way an attacker does and moreover, to mobilize before attackers do. We believe Tenable One is uniquely positioned to win in this next phase of security in this new AI world, given our roots in our strategic direction. Our foundation in vulnerability management gives us the data, the scale and credibility to lead the shift toward exposure management. And we're building on that strength with focused investment and innovation. Notably, R&D is up over 20% year-to-date, reflecting significant investments in Tenable One that unify visibility, insight and action across the full attack surface. In Q3, we launched Tenable AI Exposure, leveraging technology from Apex to give CISOs visibility into and control over the risk associated with generative AI. The solution helps organizations discover AI usage across their environments, understand how it impacts their attack surface and identify potential exposure stemming from AI-enabled applications, code and user behavior. It is a powerful example of how we continue to extend Tenable One to stay ahead of emerging threats. We also surpassed 300 validated integrations in the Tenable One platform, underscoring our progress in creating the most open and the most interconnected exposure management platform in the market. This open ecosystem is a key differentiator. These integrations go beyond technical connectivity to unified visibility and insight across tools and data and teams. By breaking down silos between vulnerability management, cloud security, identity, OT operations and the broader ecosystem of third-party tools, we are advancing how customers unify data, apply contacts and orchestrate faster in a more coordinated way. As we continue advancing this vision, we are building a platform where connectivity drives action, where customers don't just see risk, they can act on it. Finally, we advanced our vulnerability priority rating across different domains, allowing for higher levels of smarter orchestration and mobilization for exposure management. This gives organizations even sharper precision in determining which risks demand immediate action. Most enterprises are flooded with findings, and the challenge is not just seeing vulnerabilities, but knowing which ones matter. By combining real-world threat intelligence, contextualized asset data and AI-driven analytics, our enhanced VPR helps customers focus their remediation efforts on the exposures that matter most. We believe that these innovations across visibility, insight and action, combined with our growing open integration ecosystem and our focused investment on preemptive security and R&D are what differentiate Tenable among the many vendors now laying claim to the exposure management space and are core to why customers are turning to us. I'd now like to turn the call over to Mark to discuss how customers in the industry are responding to the shift to exposure management and how we are leading them through this change.

Thanks, Steve. We believe Tenable is leading the transformation to exposure management, and the industry is taking notice. We were recognized as a leader in exposure management by 2 of the industry's top analyst firms during Q3. In July, Tenable was named a leader in the Forrester Wave for Unified Vulnerability Management solutions. In August, we were recognized as a leader in the IDC MarketScape for exposure management platforms. And in September, IDC again reported Tenable ranked #1 in its latest market share report. As Steve mentioned, one of our defining strengths and what shines through in every customer story is Tenable One's ability to unify visibility, insight and action across the modern attack surface. We're now extending that power to include both Tenable native and third-party data, giving customers an even more complete view of risk. But exposure management is more than a technology. It's a journey that requires a new mindset. We're listening closely to our customers by helping them chart that path step by step. Our exposure management Leadership Council and our exposure management maturity model have become critical guides in that journey. The Leadership Council, which launched this quarter, brings together some of the most forward-thinking CISOs and security leaders to share insight and best practices from their own exposure management transformations. Their feedback helps shape our platform road map and ensures we're focused on solving the challenges that matter most. Our new exposure management maturity model gives organizations a framework to assess where they are today and what it will take to advance in their exposure management journey. It helps them measure progress, identify gaps and prioritize the investments that will have the greatest impact. Together, our exposure management Leadership Council and maturity model are helping customers turn exposure management from an abstract goal into a disciplined strategy for the future. Through these initiatives, we're helping customers evolve their approach from managing vulnerabilities to embracing a true preemptive security mindset. It's how they move from reacting to risk to staying ahead of it. That's what Tenable One is designed to deliver, the clarity, intelligence and context to see threats before they strike. As Steve highlighted, we're leading the way with the most comprehensive exposure management platform in the market, helping our customers build stronger, smarter defenses for the AI era. Let me give you some real-world examples from the quarter. First, we captured a major new logo with a global commercial real estate investment services firm, displacing the top cloud security provider and an incumbent vulnerability management player to consolidate onto the Tenable One platform. Like many large enterprises, this customer faced growing complexity of a hybrid environment with assets spread across on-prem infrastructure, multiple cloud providers and third-party systems. Tenable One was selected for its superior technical capabilities across cloud security and vulnerability management. It was also chosen for its ability to unify data and context across their entire ecosystem. This consolidation immediately filled critical visibility gaps, streamline operations and reduce the cost and complexity of managing risk across a fragmented landscape. We also had another major win this quarter with a national electric utility provider in EMEA to accelerate their critical infrastructure transformation. Like many in the energy sector, this organization is navigating the growing convergence of IT and OT environments with operational technology increasingly coming under the responsibility of the CISO. They selected Tenable as their exposure management partner for our ability to integrate complex technical requirements and deliver a cohesive, scalable OT security framework across their national distribution network. By unifying visibility and context across IT and OT assets, Tenable is helping them eliminate silos and protecting critical infrastructure at a national scale. We also secured a 6-figure expansion with a leading technology provider serving the public sector, converting them from our stand-alone crowd product onto the Tenable One platform. This is a strategic shift for the customer, driven by their need to unify visibility and control across a complex hybrid environment, supporting sensitive government workloads. This multiyear agreement enables them to consolidate on to Tenable One over time, simplifying operations, reducing vendor sprawl and strengthening compliance across both commercial and public sector deployments. These customer wins reinforce that our strategy is absolutely working. We are earning larger, longer-term commitments by delivering strategic value and deeper integration into our customer environments. At the same time, we believe these wins reflect the broader industry shift that is now underway from reactive post-breach defense to preemptive security. As this shift accelerates, we believe Tenable is exceptionally well positioned for sustainable growth with exposure management becoming the foundation of modern cybersecurity programs worldwide. With that, I'll turn the call back over to Matt to dive deeper into the results for the quarter.

Thanks, Mark. I want to thank everyone for the warm welcome, and I'm really excited to be here. I look forward to seeing new and familiar faces over the next couple of months. With that, I'll jump into the results for the quarter. We're encouraged by the strong third quarter exceeding the high end of the range on every metric we guided to for the quarter. Revenue was $252.4 million, representing growth of 11.2% year-over-year. The year-over-year growth in revenue for the quarter as well as outperformance relative to guidance was underpinned by a solid foundation of renewal business, strong Tenable One adoption and better-than-expected contribution from professional services. Our percentage of recurring revenue remained high at 95% this quarter. We're continuing to see solid momentum in Tenable One as customers are increasingly turning to our platform to bolster their preemptive security programs. The strength in new platform growth in the quarter drove calculated current billings, or CCB, to $267.5 million, a year-over-year increase of 7.7%, while short-term remaining purchase obligations, or CRPO, grew 12.9%. These measures are beginning to diverge due to changes in upfront billings patterns and increasing contract durations, which we expect to persist in the midterm. Net dollar expansion rate was in line with expectations at 106%. Non-GAAP gross margin was 81.6% for the quarter, an increase from 81.4% in Q3 2024. We're encouraged by our ability to slowly but steadily increase non-GAAP gross profit year-over-year, both on a quarter and year-to-date basis. Year-to-date non-GAAP gross margin was 81.8% compared to 81.3% for the 9 months ended in the prior year. Non-GAAP income from operations was $58.9 million or 23.3% of revenue compared to $45 million or 19.8% of revenue in Q3 2024. Although we continue to make targeted investments during the quarter, including growth of more than 18% in research and development-related expenses year-over-year, we were able to drive continued leverage in the business as a whole. Our investment in innovation is a result of our focus on delivering the most comprehensive exposure management platform to our customers. On a year-to-date basis, non-GAAP income from operations grew to $155.3 million or 21.0% of revenue compared to $124.8 million or 18.8% of revenue in the comparable period last year. Non-GAAP earnings per share for the quarter was $0.42 compared to $0.32 in Q3 2024, an increase of 31.3%, reflecting the increase in profitability combined with a decrease in diluted shares outstanding. Turning to the balance sheet. Cash and short-term investments totaled $383.6 million. We generated $58.5 million of unlevered free cash flow during the quarter compared to $60.8 million in Q3 2024. This brings the year-to-date unlevered free cash flow to $189.6 million, a year-over-year increase of 24.7%, putting our annual guide well within reach. During the third quarter, we repurchased 2 million shares for $60 million. In total, we have now repurchased 8.3 million shares for $300 million since November 2023 and have $250 million of repurchase authorization remaining. We intend to continue to repurchase shares, which we believe is an effective use of capital. Turning to the financial outlook for the remainder of the year. With the results of the third quarter behind us, we've gained incremental visibility into the full year. And as a result, we are raising our full year guidance at the midpoint across most of our guided metrics. Specifically, we are increasing our full year guidance at the midpoint for CCB and now expect a range of $1.040 billion to $1.048 billion, representing a year-over-year increase of 7.7% at the midpoint. We expect revenue for the fourth quarter to be in a range of $249.1 million to $253.1 million, representing a year-over-year increase of 6.5% at the midpoint. For full year 2025, we are raising our revenue guidance range to $988 million to $992 million, representing a year-over-year increase of 10.0% at the midpoint. We expect non-GAAP income from operations for the fourth quarter to be in the range of $55.7 million to $59.7 million or 23.0% of revenue at the midpoint. For full year 2025, we are raising our non-GAAP operating income guidance at the midpoint and now expect a range of $211 million to $215 million or 21.5% of revenue at the midpoint, representing a year-over-year increase of 100 basis points. We remain committed to balancing top line growth with a steady increase in profitability. We expect non-GAAP net income for the fourth quarter to be in the range of $47.9 million to $51.9 million, representing a year-over-year decrease of 1.6% at the midpoint. For full year 2025, we are raising our non-GAAP net income guidance at the midpoint and now expect a range of $185 million to $189 million, representing year-over-year growth of 17.9% at the midpoint. We expect non-GAAP earnings per share for the fourth quarter to be in the range of $0.39 to $0.43, flat at the midpoint compared to Q4 2024. For full year 2025, we are raising our non-GAAP earnings per share guidance to $1.51 to $1.54, representing year-over-year growth of 18.2% at the midpoint. In closing, we'd like to thank the entire Tenable team and our customers and partners for a great result. We're very pleased with the steady execution the team has delivered this quarter and our incremental optimism for the rest of the year as reflected in the increased guidance ranges we've provided. Mark, Steve and I thank you all for joining, and we look forward to seeing you at the UBS and Barclays conferences in the coming weeks. We are happy to open the call up for questions. Operator?

[Operator Instructions] Our first question is from Saket Kalia from Barclays.

Welcome Matt.

Thanks Saket.

I'll just keep it to one question. Steve and Mark, maybe for you. U.S. federal is, of course, a really important vertical for Tenable. Can you just talk a little bit about how that performed this quarter? And given the current situation, maybe give us a little historical context of how the business has performed around prior shutdowns as we think about any potential impact going into Q4. Does that make sense?

It does, Saket, and thank you for your question. This is Steve. We have major market leadership in public sector and U.S. federal in particular, across a wide range of three-letter federal agencies spanning civilian, defense and intel. And CRs are not new and nor our government shutdowns. We have seen that before, and we've demonstrated an ability to execute in these environments. And we're particularly pleased with the results this quarter. Public sector and U.S. federal was in line expectations, which is very notable given the seasonally high mix of U.S. federal business. So overall, a good result for us for the quarter.

The next question is from Brian Essex from JPMorgan.

And Matt, congratulations on the new role from me as well. Looking forward to working with you again. And nice consistency out of the gates as well. So certainly appreciate that. I guess maybe to follow on Saket's question for you, Matt. I was down in D.C. last week and that was at CISA, and it was clear that things were going to get incrementally uglier this week as agencies run out of money, particularly for essential employees where CISA is focused. But would love to hear from your perspective, given that I guess, deceleration that's baked into the 4Q, like just basically what's implied by your full year guide, the deceleration of revenue in 4Q. What are you contemplating within guidance? And what kind of scenarios might lead for upside to your expectations for the quarter and for the year?

Yes. I think the first thing to note is just the steady execution that we had in Q3 under the current environment of uncertainty. And keeping in mind, Q3 is a higher proportion of Fed for us relative to other quarters in the year. So with that backdrop, we look ahead to Q4, which seasonally is a smaller Fed quarter for us and see relatively minimal exposure. Now of course, there's a couple of million dollars that could be at play here or there. But generally, we feel very positive about the pipeline that we see. Renewals continue to come in very strong. We think we've got good line of sight. So we think we're not especially exposed in this fourth quarter.

Got it. Maybe can I sneak in a quick follow-up for Mark? Just with regard to the impact of the expiration of CISA 2015 and what that might have on CVE reporting. Any impact that you might envision for the core VM portion of your business?

Yes. Right now, based on feedback with customers and talking to a bunch of partners and obviously, our employee base, we're not really projected to see any type of negative impact right now. As it plays out, we'll obviously be monitoring it closely. But right now, based on a lot of our conversations and contacts and relationships we've got going on in the federal government, we're not really anticipating any significant downside there.

The next question is from Mike Cikos from Needham & Co.

Congratulations to you, Matt. Looking forward to working together. Before I ask my second question, which is more tied to the billing, I just wanted to ask Matt, since this is your first earnings call here with the firm, can you help us think about if there were any changes to guidance philosophy or what you're bringing to the finance function here, now that you had a couple months in the seat?

Yes. I think generally no substantial changes to our approach to guidance. I will say I was just extremely pleased to come in and see a very high functioning team, not just within finance, but across the entire organization. I feel like we're really focused on the right things and the team is all growing together. So I would say, no major shifts in the way that we're approaching guidance.

Okay. And then the follow-up is again on that billings guide. Just trying to get a better sense of the different puts and takes here, right? If we have the, call it, $3 million-ish of upside this quarter versus where people were expected, we're nudging up the low-end of the guide by $2 million. You guys are talking about increased visibility into year-end. Can you just discuss how you guys thought about putting out this range and some of the different puts and takes there as it pertains to that visibility you're talking to?

Sure. I think the very brief takeaway is, as we sit here today, we're feeling incrementally more positive about the year than we were 3 months ago. That's as a result of a strong Q3, but also visibility into Q4. So it represents a small guidance increase at the midpoint for CCB of $1 million, but that flows down too. So taking up the guidance to revenue and taking up the guidance in op income, all those things are things that we're happy we're able to do, which is as a result of us feeling better about the year on balance.

The next question is from Rob Owens from Piper Sandler.

Steve, really enjoyed the discussion upfront on fireproofing versus firefighting in terms of where things are going. To that end, if I look at your enterprise adds versus your 100,000 ACV customers, maybe you can parse what's going on there. And are you just -- are you seeing more new customer additions upfront and you're starting to see just velocity increase on that front as some of these trends are changing? And if that's the case, maybe you could add some color around the 100,000 ACV customers.

Sure. Well, as you noted, our mix of business can change from quarter-to-quarter. This quarter has higher concentrations with U.S. Federal. And as we mentioned, we were very pleased with the results there. We're also very pleased with a strong quarter for new business for us. We added 437 new enterprise platform customers, which was one of our strongest quarters, I would say, to date. And look, on a year-to-date basis, too, new lands have been strong. We're also, as we've talked about on the prior quarters is that we've demonstrated an ability with our exposure management platform to transact larger deals. We're delivering incremental value to customers. Transaction sizes and deal sizes are getting larger and on average, anywhere from 50% to 90% plus in comparison to stand-alone VM. So overall, we're pleased with the velocity of lands this quarter. We're pleased with our ability to continue to do larger deals. And there's always some interplay from one quarter to the other. And I think it really speaks to the continued momentum of the platform and the ability to help customers sort through all of this fragmented visibility, this overwhelming noise and alerts and all this manual remediation to help them unify visibility, insights and action to reduce risk. And so it's certainly something that we're pleased to see with the continued traction of the platform.

The next question is from Meta Marshall from Morgan Stanley.

Maybe a couple for me. Just first, in terms of noted commentary on the OT market. Just wanted to know if there's efforts underway kind of either with R&D or go-to-market to kind of better take advantage of some of those opportunities? And then second, just kind of noting the 18% increase in R&D, just in terms of kind of the answer to the previous question of trying to simplify kind of environments for customers. Just what are some of the other investments, whether that's professional services or go-to-market? Are you making to kind of help simplify the offering for customers?

Yes. Great question. I'll take the first part on the OT market and what we're seeing, and then I'll pass it over to Steve to talk about some of the investments from a research perspective. So we are seeing a dynamic in the market, and it's been happening really all year, but it's happening, I think, at a bit of a faster pace where you're seeing this convergence of the OT market and the CISO getting a lot more responsibility and visibility over those OT assets. And one of the deals that we referenced in the earnings announcement was that consolidation story. So we're seeing a lot of not only our installed base customers wanting to look at and be able to ingest those OT assets into Tenable One, but also new customers where they're saying, we don't want to have two distinct products and technologies, one looking at traditional IT assets and then another one looking at OT assets. So you're seeing that convergence and it is speeding up. When you also look at some of the market dynamics around the AI data center build-out, that is a big area for us. We're seeing a lot of demand. When companies and organizations are building out data centers, they need operational technology to monitor all of those different asset types. And we're starting to see significant pipeline growth in closing deals in that area. So we were very pleased and have been pleased all year with our OT performance, and we will continue to focus in on it from a go-to-market perspective. I'll pass it over to Steve now to talk about some of the R&D question.

Yes. With regard to R&D and the investments we're making, they're paired with increased confidence in our ability to execute in this big market that we call exposure management, and it's really centered around three things. Number one is the ability to unify visibility and in particular, ingest data from other security providers so we can help customers see any asset, whether it's on their factory floor, in their network or even in their cloud environment. And then moreover is the ability to normalize and dedupe all of that to tie it to mobilization and orchestration on the back end, so we can help customers reduce risk. And that's -- and then last, I would say, and really important is helping customers secure their AI attack surface and leveraging AI in a way where we're able to deliver greater insights to customers. And AI adoption of applications has dramatically expanded the attack surface and certainly made us all more successful to exploit. And Tenable plays a really big role there as we're able to discover all AI applications, whether they're internally developed or even shadow AI. And then we're able to assess those for risk, including determining vulnerabilities and misconfigs. And now with AI exposure, we can go and inspect and control at the prompt level the AI applications that enterprise use the most. So we have a lot of traction with AI. Pleased with the innovation we've done to date, but there's certainly a lot more to do. And we believe principally, the real winners in this new AI world will be companies that can assess a wide range of domains, ingest data from other security providers and then really combine all that proprietary exposure data with AI to anticipate tax, not simply to respond to them. And that's a foundational change in the security market, shifting away from detect and respond more towards preactive and preventative approaches.

The next question is from Jonathan Ho from William Blair.

Congratulations on the strong results. Can you give us a sense of what percentage of your total base is now on Tenable One? And it seems to me like there would be some opportunity to upsell more into the base once they've adopted the platform. So can you also talk about maybe the potential for uplift going forward on the platform?

Yes. As you know, we have roughly 40,000 customers -- 40,000-plus, should I say, and approximately, we'll call it, 18,000 use one of our enterprise offerings. And of those, 3,000-plus are using Tenable One. So we've got good traction to date. It's 40% of our total new sales. And so there's a significant opportunity not only to expand within the existing customers who have adopted Tenable One, but moreover to continue to see further traction within our customer base.

The next question is from Joseph Gallo from Jefferies.

Matt, congrats on the new role. Looking forward to working together. It was great to hear the exposure management momentum. As we start to get ready for next year, in your combos with customers, where is the prioritization for exposure management in their budgets? And then historically, I think you gave some sense of following your billings in 3Q. Just any commentary on what billings can look like in '26 or confidence in sustaining the current levels would be helpful.

Yes. I'll take down on the budget question from the customer perspective, from exposure management. I think one of the bright spots that we're really starting to see is we talked about all of the different analysts that are starting to cover the exposure management category. And coming out as the leader and the #1 player in that category has given us lots of visibility, especially at the CISO level. And so now when we're sitting down with customers, we're not actually having to educate a lot of the CISOs what exposure management is and how it is so different from vulnerability management. They're hearing about it, they're seeing it. And so you're starting to see budgets being allocated that way. You're starting to see budgets in regard to consolidation, which is really one of the biggest motions we have in regard to going after and talking about exposure management and justifying it is really looking at that consolidation play. So that momentum is there, and it's gaining traction, and that continues to play out in the market, not just with customers, but we're also seeing our resellers and our partner community around the globe start to build out exposure management practices and gain visibility there, too.

Yes. And I can answer your second question. So what we're really happy about is that there is this move, in particular, to Tenable One, roughly 1/3 of our business now is in Tenable One. Increasingly, we're seeing new customers adopting Tenable One. That's exactly what we're focused on. And we think that sets us up well for the long term in going and really capitalizing on this exposure management environment. With respect to 2026, we're really focused on 2025 and closing out and continuing to execute there. And it's just too early to talk about 2026 at this point. But importantly, we feel like we're doing all the right things to put us in the right spot.

The next question is from Patrick Colville from Scotiabank.

This is Joe Vandrick on for Patrick Colville. Steve, I think you mentioned earlier that there's a lot more to do on AI innovation. I was hoping you could expand a bit more on that. Maybe talk about how you're thinking about the road map, how you're planning -- and how you're planning to add these new AI security products or solutions? Would it be organically or through M&A?

I think we would certainly consider both and successful companies pull both levers here. And I think it's centered around the fact that the threat environment that we're experiencing today is unlike anything we've seen before. Adversaries are moving with incredible speed, scale and sophistication. And leveraging LLMs and AI to create flawless hyperrealistic phishing e-mails that bypass both human suspicion and traditional e-mail filters. We're also seeing executive cloning -- cloning of executive faces and voices for socially engineered attacks. So certainly, bad actors are moving with incredible speed. We're seeing the weaponization of AI, which is resulting in the discovery of more vulnerabilities. And perhaps more concerning is not just more vulnerabilities in this all new digital world of AI, but it's the exploitation of those have become much faster. Meantime from vulnerability, discovery to vulnerability exploitation has compressed dramatically. So this necessitates a completely new approach to security. Today, $0.96 on every dollar in cybersecurity is spent on detect and respond technologies. Consequently, 4% is on proactive security. Gartner estimates over the next 5 years that, that mix will change dramatically. And so we'll see a disproportionate amount of spend more towards proactive security. And the goal here is to move Tenable. Our role in this world is to evolve from not just providing visibility, but to be able to correlate vulnerabilities with threats and exploit chatter with criticality of those assets. So we can highlight likely path of exploit. So organizations can look at their enterprise through the lens of adversaries, and they can identify attack paths that are most meaningful to them. So exposure management is really at the epicenter of all of that. And it's a category that continues to grow. And we've received recognition from IDC and some of the others that Mark talked about earlier, given our traction with exposure management, and we're super excited about what's ahead for us.

The next question is from Roger Boyd from UBS.

You talked about the longer and more strategic deals, and it seems like that's been a consistent trend over the past couple of quarters and clearly evident in the nice acceleration on RPO and bookings this quarter. Can you just further quantify what you're seeing there, what you're doing there from a sales perspective? And with these longer contracts, just what's the overlap with customers adopting Tenable One Exposure Management?

Yes, you bet. I mean it's a really phenomenal dynamic that we're seeing, right? The great part of this, and you see it in the RPO numbers is we have customers not only new customers, but our installed base that want to get longer-term 3-year commitments, right? They're seeing the road map. They're seeing how we're evolving exposure management, right, how we're building this technology and building Tenable One on the platform. And when we are able to articulate that and explain to them where we're headed, the customers are buying in and they're buying it aggressively, and they're making long-term commitments. And so we're very, very focused on the installed base that Steve identified going after those 18,000 to 20,000 commercial and enterprise customers. Anyone that's on VM, getting them upsold to Tenable One, that is our motion. We are driving that aggressively. And then for the new logos, one of the very cool things when we identified, which is an extremely high number, 437 new logos in the quarter, a very significant portion of those customers were Tenable One, right? So that is a pretty cool trend. And we'll be able to then upsell those customers over time. And so I think that when you see customers willing to sign up for long-term contracts when they understand where you're headed and you're truly building an enterprise scale platform, that's an extremely positive sign for us.

The next question is from Joshua Tilton from Wolfe Research.

Matt, it's good to hear your voice again. Two for me. First one, hopefully, kind of easy, more of a clarification. Is there any way you can just help us understand what the inorganic contribution to billings was in the quarter and how we should think about the inorganic contribution to billings for the full year? And then I have a follow-up.

Yes. Very insignificant, Josh, for both the quarter and the year.

Okay. Very helpful. And then maybe just a follow-up, and I preface the question with not here to hold you to any numbers, but I think part of what was great about you in your previous role is you had a pretty predictable playbook on how you want the financial profile of the business to kind of unfold on an annual basis. And I think investors really appreciated that. So again, not here looking for numbers, but maybe how do you think about your ability to leverage some of the playbook from your previous role to kind of deliver or help deliver a more consistent message around the durability of the financial profile for Tenable going forward?

Oh man, that is quite a setup. So I mean, here's the way that I look at it. Tenable has a really incredible business and is getting only better and more strategic with our move to exposure management. So when you look at the underlying fundamentals and the fact that 95% of revenue is subscription and recurring. There is an opportunity to make sure that we can continue to grow top line while also continue to add profitability. And I think there are some spots in the P&L where we've done that already over the past couple of years, but we'll continue to do that going forward into the future where we can continue to get more leverage out of the business. So I think there's a lot of opportunity to do some of the same things that I've done before.

The next question is from Adam Borg from Stifel.

Of course, welcome and congrats to Matt. Maybe just on the macro, we talked a lot about the Fed is great to see in line with expectations. Any other color you could share just demand environment overall, be it at the upper end of the market, the mid-market, geography vertical? Any other color would be really great.

No, I think demand was pretty even really across the board. We talked about seasonally high mix in U.S. Federal, and we were pleased with the results there. I talked about strength in new lands and new logos, 437. And obviously, the continued traction with the platform. And I think that's really the highlight of the quarter here. The one takeaway is that the ability to close platform sales, the ability to assess a wide range of domains, the ability to unify action, unify insight and deliver increased visibility from both the things that we assess -- assets that we assess as well as ingest data from others is resonating. It's a big market opportunity. We believe we're the clear leader there, and it's good to see the validation and recognition from our customers.

The next question is from Jonathan Ruykhaver from Cantor.

I'm curious to hear how conversations might be changing with the pending with Google deal? How much of a concern is multi-cloud support? And then just broadly looking at Tenable Cloud Security, how is it performing? I mean it does look like a market that is increasingly competitive. But when you look at your positioning relative to the broader exposure management opportunity, it seems like that could be a differentiating factor. So maybe you could just elaborate on those two questions.

Yes, you bet. No, absolutely. And yes, it is definitely an active conversation without a doubt, right? So a lot of CISOs are really looking at it. And we mentioned this on a couple of previous calls once the announcement was first out there, but you're really starting to see it pick up because now it's becoming a reality. Now customers are getting a true sense of how they're going to come together within Google. And we are doing a significant amount of presentations, demonstrations and POVs in Wiz accounts. When we look at Q3, we had a bunch of deals that we were able to go in and actually do displacements. One of the deals we highlighted on the call was a displacement of not just a Wiz account, but also an incumbent VM player. So to the point that you brought up in the question, this consolidation story around a platform that centers around exposure management, right, being able to ingest multiple different assets into a hybrid platform, so both on-prem and in the cloud and in OT and in identity and other areas, that absolutely resonates. And so we are -- I use the term getting invited to a significant amount of more dances, and we continue -- and we will continue to expect that to happen throughout Q4 and going into next year. So we are very, very optimistic about our cloud business centered around Tenable One.

The next question is from Todd Weller from Stephens.

In the past, we've talked about kind of the growth equation to drive top line acceleration. I wanted to see if you could just kind of revisit that and give us an update. Continued momentum with Tenable One and exposure management is great, and that's much higher growth and then you have like the traditional VM piece. So how are you thinking about those components? How are you thinking about the VM kind of sustainable growth? And is it really just a math equation and time of the exposure piece continuing to get bigger? Or is there anything that can happen on the VM side that could drive kind of improved growth there?

Yes. I think you've hit on the main components there. So we're 100% focused on Tenable One and driving customers to Tenable One. And our belief is that once they're there, they will continue to expand. So whether they're doing pretty much as core VM there today, we're seeing opportunities where they then expand within Tenable One to take on more EM-type activities. So that's encouraging. When you zoom out from Tenable One and you look just at VM versus EM, EM is obviously today a smaller part of our business, but it is growing much faster. So our expectation is that over time, while VM is a stable grower, EM is growing much faster, and that helps drive that growth algorithm overall.

The next question is from Junaid Siddiqui from Truist.

You highlighted now supporting over 300 validated integrations. How are these integrations contributing to deal velocity and deal sizes?

Yes. Well, the -- it's centered around this belief that no one security company can secure all domains, all assets across the attack surface. We have today's attack surface is a sprawling ecosystem of traditional IT devices, cloud environments, identities, both human and machine as well as OT industrial control systems that power a lot of our critical infrastructure. So over the years, the attack surface has expanded, right? No longer about securing servers in a data center or laptops in an office. And so we think exposure management is really centered around this belief of assessing things that are foundational, like traditional IT devices, like cloud environments, both pre and post production, like OT assets and even looking at the important context around the identities of those, but also the ability to ingest data from others. We believe -- in an open platform, we believe we should be able to partner for this kind of data to deliver this kind of insight to customers, all centered around this notion of unified visibility and insight and action. So it's foundational to what we do. We think the connections matter. We think it gives us certainly more breadth, the ability to deliver more insights and more importantly, the ability to help our customers mobilize and orchestrate fixes on the back end, and correlate vulnerabilities with exploit chatter, with asset criticality. That's really important to do that in a very cohesive way.

The next question is from Shrenik Kothari from Robert Baird.

Congrats and welcome, Matt. So Mark, Steve, you cited Tenable One at 40% of new business, of course, improving ASPs and deal sizes. And it seems like the platform growth as a percent of new business is growing near that 40% mix. Just what do you think are going to be the biggest unlocks to further accelerate this platform mix as a percentage of new business? Are you thinking something along the lines of like pricing packaging, exploring something like Flex? Are you also thinking more sort of field enablement and increased S&M investments? Just curious and then a follow-up for Matt.

Yes. So you highlighted a couple of great areas right there, right? And so those are areas we're looking at. But I think one of the best things we've got in front of us is we've got the opportunity to expand in that installed base, right? So as Steve kind of highlighted the numbers, we've got phenomenal opportunity to go expand within our huge massive installed base. So that is like the #1 focus for us is getting that expansion. When you then look at the innovation that we've done around third-party ingest, right, we're now seeing here in Q4, a bunch of quotes going out to Tenable One deals that have third-party asset types, right? So we'll be able to monetize that third-party asset type. So that will start taking off. We talked about our AI strategy and what we did with Apex and how we'll be able to start monetizing that in Q4 and especially going into 2026. Now that is on the back of some of the things you highlighted, right? So obviously, evaluating pricing and packaging strategies and marketing strategies. Those are all things that we're very much on top of. But there is very tangible specific things that we're doing today that to get the growth and the expansion within Tenable One, and we're going to continue to march down that road.

Great. Very helpful. And Matt, just very quickly from your perspective in terms of what you have seen so far. Like, how do you plan to now kind of balance all the priorities that just laid out versus incremental operating leverage just in terms of your strategy, your priorities, how should we expect 2026?

Yes. I think we expect to continue to both grow top line and add incremental margin. And so when we look at places on the P&L where we can expect to go get that margin, it's a little bit like what you should have seen in this quarter's results actually, where you're going to get a little bit out of gross margin, you're going to get a little bit out of sales and marketing and G&A, and we are going to probably give a little bit back in R&D because we're continuing to invest in the platform. So -- and we're going to -- there's going to be, obviously, one quarter is going to be exactly like the next. We're going to continue to invest in sales capacity as well. But the point is as you grow revenue, you're able to just get a little bit more leverage.

The last question is from Gray Powell from BTIG.

Okay. Great. A lot of good questions have been asked. Maybe I just had one on my list that has not. What kind of traction are you seeing with the Apex acquisition and AI exposure? And I'm not sure if you said this, but how should we think about it impacting ASPs with Tenable One or potentially driving just incremental adoption of the platform?

Sure. And so that's an acquisition that we announced, I think, the last quarter, several months ago. And really the plan from an integration perspective was to natively build those capabilities in the platform. And then come to market with a more expansive AI offering, which we're pleased to see us do at Black Hat. So we did that over the summer, we brought to market AI exposure. AI exposure gives us the ability to not only discover AI applications and shadow AI, but now gives us to -- the ability to inspect at the prompt level usage of AI. It is a foundational piece in our broader AI strategy, and the AI strategy is really centered around a couple of things. Number one, contextualize risk with AI, which we've been doing for some time, and we continue to do, and that's generate risk-based prioritization. That is really dynamic and constantly updated. So AI really is this risk copilot. The second thing is really a journey that we've been on, which is autonomous remediation agents. And right now, we're able to integrate bidirectionally with the CMDBs and the ticking systems. And the focus is really on generating tickets with precise remediation steps to orchestrate patch deployments and enforce configuration baselines. But really the goal here over the course of time is this continuous learning and adaptation and use AI as a means not only to deliver greater insight, but have customers benefit from this network effect of 40,000-plus customers, the global telemetry that we've collected over the last 20 years to do safer auto remediation. And so we can not only just -- not just respond to threats, but also anticipate them. So we're super excited about our place in this world with AI, EM. Exposure management is taking on greater importance. Obviously, we expect continued growth there and continued traction with the offering itself.