Tenable Holdings, Inc. 2026 Q3 Earnings Call

Thank you, operator, and thank you all for joining us on today's conference call to discuss Tenable's third quarter financial results. With me on the call today are Co-Chief Executive Officers Steve Vintz and Mark Thurmond, and Chief Financial Officer Matt Brown. Prior to this call, we issued a press release announcing our financial results for the quarter. You can find the press release on our IR website at tenable.com.

We will make forward-looking statements during the course of this call, including statements relating to our guidance and expectations for the fourth quarter and full year 2026, growth and drivers in our business, changes in the threat landscape in the security industry, particularly regarding AI security, the expected impact of frontier AI models on accelerated vulnerability discovery, and the shift to preemptive security, the expected size, durability, and growth of the market opportunity created by the shift to AI-driven exposure management, our competitive position in the market, growth in customer demand for and adoption of our solutions, including the impact of new pricing and packaging models, the expansion of Tenable One, including agentic AI security, orchestration through Hexa AI, and planned AI exposure coverage across third-party models, the expected growth, adoption, and role of our CyberAgents Exchange in the agentic security ecosystem, the expected benefits of our strategic partnerships with Frontier AI labs, our ongoing research and development investment, our capital allocation strategy, including share repurchases, and our future results of operations and financial position.

These forward-looking statements involve risks and uncertainties, some of which are beyond our control, which could cause actual results to differ materially from those anticipated by these statements. You should not rely upon forward-looking statements as a prediction of future events. Forward-looking statements represent our beliefs and assumptions only as of today and should not be considered representative of our views as of any subsequent date. We disclaim any obligation to update any forward-looking statements or outlook. For a further discussion of the material risks and other important factors that could affect our actual results, please refer to those contained in our most recent annual report on Form 10-K and subsequent reports that we file with the SEC. Today's discussion includes non-GAAP financial measures. These non-GAAP financial measures are in addition to and not a substitute for or superior to measures of financial performance prepared in accordance with GAAP.

There are a number of limitations related to the use of these non-GAAP financial measures versus their closest GAAP equivalent. Additionally, please see our press release for reconciliations of GAAP to non-GAAP financial measures that we discuss today. I'll now turn the call over to Erin.

Thanks, Erin. We delivered excellent results in the third quarter. On our last call, we discussed the increasing momentum in our business, and this quarter we are very pleased to see that momentum start to translate into acceleration. What excites me most are the leading indicators, which show inflection and signal durability of growth ahead. Our net dollar expansion rate accelerated to 107%, up from 106% in Q2, which is the first time in over four years we've seen acceleration in the expansion rate for two consecutive quarters. Tenable One reached a record 59% of new business, up from 50% in Q2. Average Tenable One deal sizes year-over-year rose for the second straight quarter, driven by the pricing and packaging we introduced earlier this year. CCB accelerated to 9% growth in the third quarter.

These results demonstrate that we're delivering what customers need most, which is the ability to see and act on risk across the entire environment at the speed this new era demands, and no force is shaping that more than AI. Before we dive into the product updates for the quarter, I want to touch upon PHP2Shell, the critical vulnerability disclosed last week. Earlier this year, we said AI would surface more vulnerabilities and exposures faster. That's playing out now. PHP runs nearly everywhere in the enterprise, including web applications, cloud workloads, containers, and legacy systems. The vulnerability is the headline, but the risk goes beyond the vulnerabilities themselves. Organizations need to find affected instances, including those they may not know about, and understand how they connect to misconfigurations, credentials, and critical systems.

Following PHP2Shell disclosure, customers turned to Hexa AI, and we've seen prompt volume increase dramatically by as much as 5X. Beyond Hexa AI, customers have been turning to Tenable as a trusted partner during this critical time, and we've been working closely with them to ensure they can leverage the full power of the platform to reduce their exposure. PHP is a real-time example of a broader shift in the market, and that is AI is reshaping the attack surface faster than most organizations can respond. This is more than a moment. It's a mandate and a structural shift for enterprises. As a result, every enterprise is adopting AI. Every model, every agent, every MCP server they deploy creates new exposures.

Meanwhile, attackers are using frontier AI to find weaknesses faster, and we are now witnessing the early automation of exploit development. The risk extends well beyond CVEs, and we believe this is a powerful demand catalyst for exposure management and a significant growth opportunity for Tenable. As I outlined last quarter, winning in exposure management requires three capabilities: understanding every exposure, prioritizing what matters most, and acting with speed and confidence to reduce risk. As frontier models become widely available, intelligence itself becomes abundant. The differentiator is putting it to work safely. That is the Tenable advantage. Decades of exposure intelligence, deep visibility across the attack surface, and an AI harness that keeps agents acting safely with human oversight and an audit trail. In this quarter, we significantly expanded what that platform can do across all three. In September, we announced that we are bringing Anthropic's Claude Mythos into Tenable One.

This expands our partnership with Anthropic beyond Project Glasswing. Our first capability, powered by Claude Mythos, Tenable One Adversary View, lets security teams see their environment through the eyes of an attacker. Every time Tenable assesses a system, we learn what is running on it, how it is configured, who can access it, and what it connects to. Adversary View applies Mythos to that telemetry to reason like an attacker. It sees how low-signal exposures can be chained together to reach critical systems, then recommends the specific fixes that break those chains. It is a compelling example of how we are turning frontier AI into differentiated capabilities designed to keep customers ahead of emerging threats. We also expanded Tenable Hexa AI, our agentic engine for Tenable One. Hexa now works as a coordinated fleet of agents that continuously identify critical exposures, orchestrate remediation, and verify fixes even when security teams are offline.

Since June, Hexa has evaluated more than 2 billion assets and findings, which enable Hexa users to resolve more critical and high-severity vulnerability detections per month than matched peers and patch actively exploited vulnerabilities faster. Tenable Hexa AI saves security practitioners time and resources, enabling them to reclaim analyst capacity, maintain always-on defense, and dramatically reduce mean time to remediation. Importantly, Hexa is model agnostic. It works with leading frontier and open-weight models so customers benefit as those models improve while our harness keeps every action grounded in validated exposure data. Finally, we launched the CyberAgents Exchange, the industry's first open-source, vendor-agnostic registry for cybersecurity AI agents and skills. Its AI Inspector pairs OpenAI's GPT cyber models with Tenable Research to vet community-built components before enterprises deploy them, putting Tenable's data and expertise at the center of trusted agentic security. Cybersecurity used to be about detecting and triaging threats.

Today, it determines how fast the world can adopt AI. As a result, security is no longer a line item inside IT. It is becoming its own business function with a budget tied to business risk and growth. We believe Tenable is uniquely positioned to lead in this AI era, and the momentum we are seeing today gives us confidence in the durability of growth ahead. With that said, Mark will now walk you through how the momentum we are seeing is showing up with our customers.

Mark? Thanks, Steve. Before I jump into the quarter, I want to touch on what we're seeing in the field and how we've responded to PHP.

Tenable Research closely tracked the situation as it evolved. We provided constant updates to help educate and prepare customers so they were ready to act. We shipped plugins overnight and kicked off a series of customer webinars. Attendance has been off the charts. Moving on to the quarter. The shift that Steve described is showing up in how customers are buying. Last quarter, we said conversations were turning into action. This quarter, pipe build is turning to conversion. We saw clear signs that customers are adding incremental budget to their exposure management programs with Tenable One, both with new lands and existing customers.