Tenable Holdings Inc (TENB) 2024 Q2 法說會逐字稿

Greetings, and welcome to Tenable Q2 2024 earnings conference call. (Operator Instructions) As a reminder, this conference is being recorded.

It is now my pleasure to introduce your host, Ms. Erin Karney, Senior Director, Investor Relations. Thank you, Ms. Karney, you may begin.

Thank you, operator, and thank you all for joining us on today's conference call to discuss Tenable's second-quarter 2024 financial results. With me on the call today are Amit Yoran, our Chief Executive Officer; and Steve Vintz, our Chief Financial Officer. Prior to this call, we issued a press release announcing our financial results for the quarter. You can find the press release on our IR website at tenable.com.

We will make forward-looking statements during the course of this call, including statements related to our guidance and expectations for the third quarter and full year 2024, growth and drivers in our business, changes in the threat landscape in the security industry, and our competitive position in the market; growth in our customer demand for an adoption of our solutions, including Tenable One; planned innovation and new products and services; the potential benefits and financial impact of our recent acquisition of Eureka; and our expectations regarding long-term profitability and free cash flow.

These forward-looking statements involve risks and uncertainties, some of which are beyond our control, which could cause actual results to differ materially from those anticipated by these statements. You should not rely upon forward-looking statements as a prediction of future events.

Forward-looking statements represent our beliefs and assumptions only as of today and should not be considered representative of our views as of any subsequent date, and we disclaim any obligation to update any forward-looking statements or outlook. For further discussion of the material risks and other important factors that could affect our actual results, please refer to those contained in our most recent annual report on Form 10-K and subsequent reports that we file with the SEC.

In addition, all of our financial results we will discuss today are non-GAAP financial measures, with the exception of revenue. These non-GAAP financial measures are in addition to and not a substitute for or superior to measures of financial performance prepared in accordance with GAAP. There are a number of limitations related to the use of these non-GAAP financial measures versus their closest GAAP equivalents. Our press release includes GAAP to non-GAAP reconciliations for these measures.

I'll now turn the call over to Amit.

Thank you, Erin. We delivered mixed results for the quarter with lower-than-expected CCB, but with outperformance in revenue and earnings. Exposure management continues to generate demand, particularly for Tenable One and cloud security as key priority areas for CISOs.

Before I get into the quarter, I'd like to first comment briefly on the recent CrowdStrike outage. This incident highlights the importance of independent cybersecurity assessments and the negative global consequences of creating single points of failure with any one vendor.

Excessive reliance on any one vendor reduces enterprise resilience just as deviating from best-of-breed platforms increases exposure to risk. Boards have fiduciary responsibility to oversee cyber hygiene, and we expect the regulators will play an increasingly critical role in promoting resiliency and requiring transparency. We believe the path forward for modern organizations lies in interoperable, best-of-breed platforms that empower enterprises to reduce risk and improve cyber hygiene.

Now on to the quarter. A few areas stood out as notable in Q2. First, customers continue to highly scrutinize their spend and rigorously prioritize their investments. Second -- and this is a positive trend for us -- is that exposure management is gaining increasing momentum in the industry among customers and analysts. Customers need and want to understand their level of risk across their attack surface, from their IT environment, to the cloud, to their critical infrastructure. And we believe that has resulted in strong traction for Tenable One.

And third, as customers increasingly rely on cloud, we are seeing strong momentum for our cloud exposure solution. In fact, one of our largest deals for the quarter was for our cloud security products with a major financial services company. I will talk more about that in a few minutes.

Let me dig deeper on that first point on spending patterns that we noticed in Q2. We continue to see a great deal of customer scrutiny around cyber spending. This makes it more difficult to transact and close new deals as new projects and procurements are getting the greatest scrutiny. This trend becomes more apparent as deal sizes get larger.

These two dynamics were more pronounced in our vulnerability management business in Q2 than what we had seen historically. And while our mix shift to our faster-growing exposure solutions is healthy, it is not enough to offset the cyclical impact of our traditional stand-alone VM business. While VM is becoming more cyclical, we remain the clear leader. VM continues to drive initial Tenable One adoption and leaves the groundwork for future upsell opportunities.

Our win rates continue to be very strong. Exposure management is becoming increasingly critical for customers. We pioneered this category knowing that point products leave customers with an incomplete view of actual risk in their environments. This is where Tenable shines.

Tenable One, our exposure management platform, provides a unified approach and consolidate visibility across asset types to deliver insights that individual products alone cannot provide. And there's also a compelling ROI to customers who consolidate spend and reduce complexity in their security stack.

We are expanding into budgets beyond VM and broadening our reach within enterprises. Tenable has become a trusted source of truth for Boards and executives needing to understand their businesses' exposure and risk. We're seeing this play out in our product mix as Tenable One represented 30% of new business in Q2.

We are also seeing increased utilization with different asset types, which allows customers to leverage features such as attack path to analytics, visualize the riskiest exposures and toxic combinations, and enables customers to quickly assess and safeguard their business.

We're also seeing significant momentum in cloud security. Prioritization of cloud security spend, coupled with our CNAPP offering, resulted in strong growth in our cloud security for the quarter. Tenable cloud security delivers immediate value as an exceptionally user-friendly, multi-cloud solution.

We're starting to land technical wins with large sophisticated enterprises. In fact, this is in the second quarter in a row that one of our largest deals included cloud security. As I mentioned, the Fortune 100 financial services company selected us this quarter for [team], which is an integral piece to CNAPP.

The other cloud security provider for CNAPP was not able to deliver visibility in identity for cloud. [Well], we are the best provider to meet their needs. During the quarter, we acquired Eureka, a leading data security posture management company, having discovering and securing data to Tenable cloud. We're excited to add enhanced DSPM to our CNAPP offering, which we expect to happen this year.

We're also expanding our generative AI capabilities to maximize customer value. Along with integrating AI into our products, we're also seeing rapid adoption of our exposure management platform to identify where and how AI is operating in customer environments.

We introduced two new capabilities in Q2. First, in AI security posture management capability within our cloud security offering that detects AI misconfigurations in services like AWS Bedrock and Azure OpenAI and ensures compliance with their organization's security policies. Second, we now provide runtime detection to identify AI software libraries and browser plug-ins that may be in use within the enterprise. We believe this is an innovative capability to alert security teams where the unauthorized use of AI may be taking place in their environments.

As we look ahead, we are going to focus on optimizing the business by investing in areas that matter most to our customers while continuing to drive profitability in the business. We will continue to enhance our CNAPP offering, add additional features to Tenable One, and leverage AI to drive efficiency in our products and to solve problems for our customers.

On that note, Steve will go into more detail, but we are introducing our 2025 unlevered free cash flow target of $280 million to $290 million today. We believe this is a strong initial target representing our commitment to deliver durable cash flow growth, and we look forward to updating you as we get through the second half of the year. We'll continue to evaluate the appropriate level of investment in resources going forward to strike the right balance of growth and profitability.

This is an exciting time for Tenable. We are leveraging our leadership position in VM, seeing major momentum in cloud, and delivering broader exposure management platform. Despite challenges for this quarter, I am confident in our long-term strategy and our ability to grow over the ensuing years.

I'll now turn the call over to Steve for further commentary on our financial results and outlook.

Thanks, Amit. Calculated current billings defined as revenue recognized in the quarter, plus the change in current deferred revenue, grew 10% year over year to $221.1 million. While we only guide to CCB on an annual basis, I think it's fair to say CCB growth in the quarter fell short of our expectation. And accordingly, we are revising our outlook for the year to reflect a more challenging selling environment.

Now let's get into the results for the quarter as it will provide context to our outlook for the full year. Recall we went into the quarter with a healthy pipeline and a large number of six- and seven-figure opportunities. We closed fewer deals than expected as customers deferred new projects in the face of a more challenging macro environment and tighter budgetary constraints. This shortfall was specific to VM, particularly with large opportunities in North America, where we experienced longer sales cycles and more modest growth in comparison to other geos.

Other areas of new business continue to get traction despite the selling environment. Tenable One grew to 30% of total new enterprise sales and is up from 26% last quarter. Exposure solutions, which includes Tenable One, stand-alone cloud, identity and operational technology security solutions represented over 50% of our total new sales in the quarter.

As a point of comparison, exposure solutions was under 10% of total new enterprise sales in Q2 of 2020. So we've made a lot of progress in this regard. This healthy mix of new business demonstrates our ability to broaden the product portfolio and expand into new markets over the years and reflect the growing demand for exposure management and the actionable insights we deliver to CISOs and their security teams.

As Amit commented earlier, cloud security was also a major highlight for us with several sizable six-figure wins in the large market, including a global financial services and payments firm, a large defense contractor, and a multinational enterprise software company. We believe our success here is a clear indication that we will continue to take in one share of one of the faster-growing areas of the cybersecurity market. Finally, I also want to note that current RPO growth in the quarter was 14%.

Turning to other highlights, we added 408 in new enterprise platform customers and 76 net new six-figure customers during the quarter. Our net dollar expansion rate was 109% this quarter consistent with last quarter. Our renewal rates remained strong.

Now on to the P&L for the quarter. Revenue was $221.2 million, which represents 13% year-over-year growth. Revenue in the quarter exceeded the midpoint of our guided range by $3.2 million. Our percentage of recurring revenue remains high at 96% this quarter.

I'll now turn to expenses. I'll start with gross margin, which was 82% this quarter, up 70 basis points from last quarter. Gross margin was better than expected due to our continued ability to cost effectively scale our public cloud and infrastructure for our exposure management platform and other cloud-based offerings.

Sales and marketing expense was $84.8 million, up modestly from $84.5 million last quarter, and as a percentage of revenue, was 38% compared to 39% last quarter. Sales and marketing expense was higher sequentially on an absolute dollar basis, primarily due to greater marketing investments to promote our cloud security and exposure management offerings as well as to build our global brand, partially offset by costs in Q1 related to our annual sales kickoff conference. Overall, we are pleased with the improved efficiency in our go-to-market efforts this quarter and expect sales and marketing spend as a percentage of revenue to continue to trend lower over the remainder of the year and beyond.

R&D expense was $33.4 million, which is up from $32.6 million last quarter. R&D expense as a percentage of revenue was 15% this quarter, flat compared to last quarter. Wages were higher in the quarter related to the acquisition of Eureka.

G&A expense was $19.6 million, which was down from $20.6 million last quarter, primarily due to lower payroll taxes, primarily related to divesting of RSUs in Q1. G&A expense as a percent of revenue was 9% this quarter compared to 10% last quarter.

Income from operations was $42.8 million and exceeded the midpoint of our guided range by $7.8 million. Operating margin for the quarter was 19%, which was approximately 325 basis points better than the midpoint of our guided range. The notable outperformance in earnings this quarter reflects our ability to continually drive leverage in our business while making investments to ensuring cloud security and the exposure management markets. The size will be -- [and often] kind of resulted in significant EPS upside. EPS for the quarter was $0.31, which was $0.08 better than the midpoint of our guided range.

Let me briefly touch on the restructuring expense in the quarter, which is excluded from our non-GAAP results. You'll recall that in Q4 2023, we announced an optimization plan, including the potential sublease of a portion of our real estate. In Q2, we executed the sublease and recognized a $4.5 million impairment charge related to the leaseholds and furniture and fixtures.

Now let's turn to the balance sheet. We finished the quarter with $487 million in cash and short-term investments, reflecting the $29.2 million of net cash used for the Eureka acquisition. Accounts receivable was $179.6 million and total deferred revenue was $725.8 million. Current deferred revenue was $562.6 million, which gives us a lot of visibility into expected revenue over the next 12 months.

We generated $36.5 million of unlevered free cash flow during the quarter, which reflects the seasonal pattern of billings during the year. To date, unlevered free cash flow was $91.2 million and puts us well within reach to achieve our annual guide for the full year, which we are raising today. We feel confident that we can continue to expand our operating and free cash flow margin over the ensuing years as we have done so every year since our IPO.

During the quarter, we repurchased 589,000 shares of common stock for an aggregate purchase price of $25 million. Thus far, we've repurchased almost 1.5 million shares and have $35.1 million of remaining authorization under our initial $100 million share repurchase program. With the results of the quarter behind us, I'd like to discuss our outlook for Q3 and the remainder of the year.

For the third quarter, we currently expect revenue to be in the range of $222 million to $224 million, non-GAAP income from operations to be in the range of $42 million to $44 million, non-GAAP net income to be in the range of $35 million to $37 million, assuming interest expense of $8.3 million, interest income of $5.7 million, and a provision for income taxes of $3.8 million. And non-GAAP diluted earnings per share to be in the range of $0.28 to $0.30 per share, assuming 123 million fully diluted weighted average shares outstanding.

And for the full year, we currently expect calculated curve billings to be in the range of $957 million to $967 million, revenue to be in the range of $889 million to $895 million, non-GAAP income from operations to be in the range of $167 million to $171 million, non-GAAP net income to be in the range of $143 million to $147 million. Assuming interest expense of $32.7 million, interest income was $23.5 million and a provision for income taxes of $12.8 million. Non-GAAP diluted earnings per share to be in the range of $1.16 to $1.19, assuming 123.5 million fully diluted weighted average shares outstanding, and unlevered free cash flow to be in the range of $225 million to $235 million.

I would like to provide some commentary regarding our revised outlook today, which reflects lower CCB in revenue for the year. As we think about the second half of the year, we are taking a more cautious approach to the new business, not only with large VM opportunities, but also with other pipeline opportunities. While demand generation remains healthy, the rate in which these opportunities are expected to progress through the funnel in the second half of the year is expected to be more moderate than previously anticipated, which will constrain our near-term results.

Despite the reduction in our top-line outlook, we remain committed to our margin target and are pleased to be raising our operating income and unlevered free cash flow outlook for the year. We're also providing an unleveraged free cash flow target today of $280 million to $290 million for the full year 2025, which is 24% growth year over year at the midpoint, and a major milestone toward achieving our updated long-term target unlevered free cash flow margin of 35%-plus.

With over 95% recurring revenue, high gross margins and high renewal rates, we have a lot of confidence in our ability to drive continued leverage in our business. It's important to note that we are committed to delivering on this level of cash flow in 2025 based on a range of growth scenarios, and we'll continually evaluate the appropriate level of investment and resourcing to achieve this target. As a platform and cloud-first company, we will invest in areas where we see outsized growth and we'll reprioritize spend in other areas where appropriate.

I will now turn the call back to Amit for some closing comments.

Thanks, Steve. In summary, this market is very fluid, and we are taking a more cautious approach to our CCB and revenue outlook today. We are very encouraged by the momentum in exposure management and cloud security, and we are excited about where we are as a company and the opportunity in front of us.

We hope to see you at the Canaccord, Stifel, and Piper Sandler conferences in the upcoming weeks. We'd now like to open the call for questions.

Thank you. We will now be conducting a question-and-answer session. (Operator Instructions) Saket Kalia, Barclays.

Amit, maybe to start with you, I thought it was interesting in your prepared remarks that you talked about sort of traditional VM becoming more cyclical. Maybe to start us off, can you just talk about some of the market dynamics in VM and maybe why you think the demand for Tenable One feels just decently stronger right now than traditional VM? Does that make sense?

It does, Saket. Thank you for the question. With respect to VM, it's an established market. We're seeing some cyclical patterns in it, but we are the clear market leader. In Q2, we saw greater scrutiny of transactions, specifically in North America and in the large enterprise segment of the market.

With respect to Tenable One, it's just a more modern infrastructure and a more strategic conversation that we're having with our customers. We continue to see strong demand for Tenable One, which accounted for 30% of our new sales in the quarter. And that's even more broadly than T1. We saw attractive growth for exposure solutions, including cloud, and we're proving ourselves to be highly competitive with market leaders, identity and in (inaudible).

Got it. Got it. That's helpful. Steve, for my follow-up, maybe for you. Despite the challenges in VM that we just spoke about, the focus on free cash flow definitely comes through, and certainly appreciate the early look at how you're thinking about 2025.

Just understanding that it's still very early, can you just talk us through how you kind of think about the balance between growth and margins in setting that target even anecdotally?

Sure. Thanks, Saket. Well, we're very pleased to be providing an initial unlevered free cash flow target today for 2025 of $280 million to $290 million. That's for the full year next year. That's up 24% at the midpoint. And that's also a major milestone, by the way, towards achieving our updated long-term target for unlevered free cash flow of 35% plus. Previously, our long-term target for cash flow was 30%. So I have a lot of confidence in our ability to continue to drive margin leverage.

In terms of growth for next year, look, I'm not going to comment about that. We're not through our planning process yet. And we have to see how the second half of the year plays out. But the one thing I will say is that we're firmly committed to delivering on our unlevered free cash flow targets. We're also raising our levered free cash flow outlook for the year.

And we're going to continually evaluate the appropriate level of investment and resourcing to achieve these targets. Some areas will continue to lean in and invest in other areas. We'll reprioritize where appropriate. So overall, we just have confidence in our ability to drive higher levels of cash flow.

Brian Essex, JPMorgan.

Great, thank you. Thank you for taking the question. And, Amit, great to see you back in the seat. So congratulations to you. I guess I wanted to touch on our [medic] and cloud security. Maybe if we can get an update on that, where are you integrating it? Is it only on the analytics portion of that business? Are you integrating with the rest of the company? And are you able to lead with cloud security?

I know you talked about -- seen as a point of strength there, but would love to get more detail on where you're seeing success and plans for integration longer term. Thank you.

Thanks, Brian. It's great to be back. I'll start off talking a little bit about the strength we're seeing in our cloud security product. We're providing a full, end-to-end, full CNAPP solution, and that's resonated with customers. A majority of our cloud sales are for that full CNAPP capability.

That said, in the very large enterprise side of the market, where they may already have a CSPM solution, they already have a CNAPP solution, we have market-leading capability, in particular, strength around identity and the keen functionality. So I think the large -- I think it was our largest single transaction for the quarter -- came as a key win from a Fortune 500 company in the financial services segment. It's a very sophisticated consumer of technology where they were doing bake-offs.

In terms of our ability to generate leverage with our cloud security product, we have a lot of confidence -- the majority of our cloud security sales. In fact, our procurement cloud security through Tenable One licensing. So we're extremely excited that that is resonating -- VM customers choosing to move to the modern platform, modernly to assess exposures, and then diversifying new asset types, and recognizing that we've got market-leading cloud security that they can procure and they can do that and get more leverage through an integrated Tenable One platform.

So we think the strategy makes sense. We think we're in the early innings. So we think it's resonating and driving early results.

Brian Essex

Great, thank you. And just maybe a quick follow-up for Steve. Steve, could you comment on the Fed business or just public sector in general? I know that I think last quarter, you felt really good about it and called out some strength there. And I think we've heard about federal spend trickling down to SLED.

Maybe just a comment on mix strength of the business there. And is that reacting or behaving differently than the enterprise side of the business? Thanks.

Our public sector business was good this quarter and in line with our expectations. There are some very large seven-figure agency-wide opportunities in our pipeline for the second half of the year. Some view it size involve coordination and budgetary alignment, I'll say, across dozen of sub-agencies for some deals, which can introduce some variability. But overall, we continue to see strength in the public sector, and we're set up for a good second half of the year with US federal.

Hamza Fodderwala, Morgan Stanley.

Amit or Steve, I wanted to follow up on the public sector question. You mentioned obviously good strength there for Q2. We have heard that there have been some delays on the Fed budget and perhaps some agencies who are a bit uncertain given potential change in administration with the elections later this year. I'm wondering if you're seeing any of that impact elongate some of the sales cycles for you within that vertical and if that is reflected in your guidance. Thank you.

Yeah, I'll start and say we saw in line delivery with our expectations for product sector in Q2, Q3 obviously is a seasonally high quarter for public sector. It is an election cycle. And we have a significant number of six- and seven-figure opportunities in public sector. That said, I think we're taking a cautious approach for the remainder of the year and trying to understand that there's a certain amount of unpredictability around public sector and in the election cycle.

Yeah. And the only thing I'd add there is, look, we're trying to take a more cautious approach here to new business, specifically with large deals the second half of the year. This is predominantly in VM, but we're also applying more broadly across our business, which is including public sector.

And while demand generation remains healthy, the (inaudible) opportunities are expected to remain through the funnel in the second half of the year and is expected to be more moderate. So we're trying to factor that into the guidance and trying to be cautious.

Rob Owens, Piper Sandler.

And Amit, appreciate your comments around the VM business, but what can you say to assuage investor concerns that it's not secular that it is cyclical that you're seeing right here either in terms of pipelines or customer behavior? Thanks.

Yeah, I'll start off by saying I've got a lot of confidence in the VM market, in the VM business. It's a strategic market as you and others have been in the space for a long time recognized. It's one of those foundational tools that CISOs need and report regularly to audit risk committees, sometimes cyber committees and to the Boards of Directors.

So it's a foundational market requirement within cyber. It's not one that we anticipate going away or even having a more secular downward trend. It is cyclical, and I think we're going to see an improved outlook in the VM market with improved macro conditions. We saw this specifically in North America and with large enterprises, and we're trying to take a more cautious approach to our guidance, make sure we're setting ourselves up for a successful remainder of the year. I do think that there's opportunity for outperformance in VM and growth over time.

Mike Cikos, Needham & Co.

Wanted to circle back, I think you guys had called out that Tenable One contributed 30% to new business in this quarter, if I had the metrics right. Can you just help us think about if it's contributing, I guess, that percentage, right, 30%? When can we start expecting Tenable One to start showing up in the revenue stream, just given the ASP uplift that management has historically spoken about for Tenable One?

Well, thanks, Mike, for the question. We have broadened our business over the years and expanded into adjacent markets. And one thing I will say is that VM, as Amit commented earlier, is foundational. We're the clear leader, but growth here, as we mentioned earlier, has become more moderate. But that said, we have confidence in that business to be able to drive growth higher in the ensuing years.

And of course, we have a portion of our business, most notably cloud security and platform. That is growing at a very high rate, and we expect that to continue, and that will represent an increasing mix of our total business going forward. So our core market has seen slower growth right now in this macro. And then we have a portion of our business that's expected to represent a greater percentage of our total business going forward that's seen outsized growth. And obviously, we expect going forward that we'll be able to -- to be able to drive higher levels of cash flow regardless of the growth outcomes even the second half of the year up for next year.

Thanks for that, Steve. And I also just wanted to circle up on the new business to the extent that customers are showing increased cyber scrutiny on these new deals. Can you just help us -- because I know Q1 was a very strong quarter for you guys. You guys were citing the strength that you were seeing in new deals.

In hindsight, is it fair to think that that 1Q strength may have been more tied to the pause that we saw in March of last year with SVB and the easier comp? Or was there something that really showed up that was different in Q2? And can you maybe clarify when that showed up in Q2? Was it in April, May, June, really the last couple of days of the quarter, how did that progress? Thank you.

Yeah. I'll start by saying this. We are pleased with our Q1 results. We came in to Q2 with a strong pipe and a healthy number of six- and seven-figure deals. Obviously, a large portion of that comes in New North America. And as the quarter played itself out, we saw some of the softness in VM in North America, in the large enterprise, which has a disproportionately large impact on those larger transactions, which play a factor in our financials, the size of the company.

So I think we've got a reputation for [cloud] like we see it and saw strength in the business in Q1 and felt good with ourselves for Q2. And obviously, the quarter did play out that way.

Joel Fishbein, Truist Securities.

A question on Eureka. The DSPM market seems very crowded. Can you just help us through how that's going to fit in the product portfolio? When we would likely see revenue from it and what the target customer is there? That would be really helpful. Thank you.

Thanks, Joel. It's great to be back. We're excited about the Eureka acquisition. DSPM is a strategic component of the CNAPP platform. I anticipate that over time, most organizations will procure unified CNAPP solutions, and that will include a component or some licensing component of DSPM.

We have DSPM in our current CNAPP offering that's tightly integrated in a unified workflow. And that's really one of the strengths that [our medic] brought to the table with the [SaaS] security capability. With the Eureka acquisition, we're able to introduce the next-generation features, the next-generation DSPM capabilities into that CNAPP offering into our cloud security offering and feel like we can now be highly competitive with the absolute market leaders in DSPM.

So we do compete on the DSPM [tote for tote]. I think we can lead the market when it comes to team. And when it comes to unified CNAPP workflow, I think some of the early innings here with our cloud security offering are starting to bail that out and we're excited to prove that out over time.

Andrew Nowinski, Wells Fargo.

Great, thank you. And it is great to have you back, Amit. I wanted to ask about, I guess, your -- really your guidance. The CrowdStrike outage obviously occurred after the quarter in July. But do you think this outage might have maybe exacerbated the scrutiny that you're seeing on some of these larger deals that your customers in that, they're maybe just holding back spending now because of the outage in Q3? Do you factor that in, I guess, is what I'm asking? Is that a factor and as part of your guidance?

Yeah. I think we're certainly factoring in increased scrutiny from large enterprise transactions. And again, we were seeing that in what I would characterize as anecdotal instances at this point, where customers, which have been [borrowed] and which experienced significant outage, their procurement teams are very aware of that and asking very pointed questions.

Luckily, we have great answers for them. We can operate in an agentless fashion. We have been doing so for decades. Where we do operate with an agent, we can do it outside of kernel mode, which introduces a lot of safety valves for customers. And we don't force customer upgrades. So customers can select whether they want to operate with the latest agent or whether they want to operate with agent -- and minus one or minus two releases and make sure that what is experienced out in the wild doesn't disrupt operations.

So we are seeing increased unit of procurement. I think that's baked into the guidance that we're putting out, the conservatism for the second half of the year. And we think that we've got a lot of great answers for procurement teams as this CrowdStrike outage kind of plays itself out.

Okay, thank you. And congrats on putting out the fiscal '25 free cash flow guidance. That was really impressive. I was just wondering, given the news that we've -- or the rumors that we've seen, can you confirm whether you hired advisers regarding a potential acquisition?

Yeah. Obviously, good question, but obviously, we don't comment on rumors and speculation.

Jonathan Ho, William Blair.

With regards to your 2025 free cash flow guidance, can you give us a little bit more color on where you see the opportunity to drive this incremental leverage from -- do we see additional rationalization? Is there going to be -- like any commentary would be helpful in terms of just understanding where you'll see the opportunity to drive this from.

Yeah. I would say, first, we had another wild performance in the quarter. And that reflects our ability to continue to drive leverage in our business while also making investments to continue to take in and one share in cloud security in the exposure management market.

We are (inaudible). And part of our focus this year (inaudible) to be more efficient in our business. And specifically with regard to sales and marketing, it is something we talked about at the beginning of the year How it play out this year has proven to be true. Like, for example, sales and marketing as a percentage of our revenue was 42% last year; this year is 38% and -- this quarter rather.

And so we expect continued leverage in sales and marketing. Obviously, in terms of G&A, we'll -- as we continue to grow in scale, we'll be able to more fully absorb some of those costs which are some fixed. We're driving leverage in our gross margins as we scale our cloud security offerings and our unified exposure management platform.

Every year, since we've been public, we've expanded our free cash flows. And we've also increased our free cash flow lines -- unlevered free cash flow margin. So we expect the continuation of that trend. And just given the confidence in our business and what we've demonstrated to date, as I mentioned earlier, we're also raising our long-term target from level three cash flow from 30% previously to now 35% plus.

Excellent. And just very quickly, in terms of your ability to win on the CNAPP side, clearly, there's a lot of competition in this space. You've got clear differentiation with your (inaudible) product. Can you help us understand what percentage of the market you think you can take or how the competitive dynamics are really playing out in the space just given how many players are sort of targeting this market? Thank you.

Yes, there's -- obviously, it's a crowded market. There's a lot of players in broadly cloud security. I think when you look at Tier 1 CNAPP solutions, I would consider us as a top five player today. And as we get into bake-offs with other top-tier products, I think that's proving itself out whether we're one, two or three players this year, have a high degree of confidence.

So we've got the team to bet on and then we're putting ourselves out in the field with the competitive win rates. And we'll see how it plays out over time. We've got a lot of confidence in the team. We have a market-leading team solution, which can get to put on the door, and I'd say, among the best CNAPP experiences in the market today.

Shaul Eyal, TD Cowen.

Steve, actually, let me start with you. Some of this slip that you might have seen towards the end of the quarter -- has anything been booked back over the course of the past 30, 31 days now?

The short answer is yes. But what I will say is this, is in our experience, when we see deals push out of the quarter, it would not be prudent to assume that for the upcoming quarter, in the second half of the year, that we'll continue to close what we expected plus the deals that pushed. Overall, we're just seeing longer sales cycles, specifically with large deals.

The good news is we are transacting mostly large deals, and we have lots of pipeline opportunities that are in the high six- and seven-figure range. but we're just assuming a longer sales cycle. And longer sale cycle means it impacts not only the current quarter, but also the outlook for the second half of the year. And so that's what we're factoring into the guidance as it needs to be more cautious.

Fair enough. And maybe for Amit, when you run a quick compare/contrast with the softness you've observed back at the beginning of the 1Q '23, what would that compare/contrast look like? Is it strictly geographic? Is it product? Is it category-driven? Just curious.

Yeah. Well, certainly product and category driven. So on the product side, we specifically saw it in our VM business in North America and the large enterprise segment. We in fact, had reasonable performance in the commercial market, mid-market, with VM, no notable change. I think what we're trying to do in the outlook is apply that same level of a scrutiny to our other theaters and make sure that we're taking a cautious approach to the remainder of the year and setting ourselves up for success.

What we are seeing is a healthy amount of engagement in strategic conversations with our customers. And that's what's really driving the impressive growth with Tenable One where they're talking about exposure management and leveraging Tenable One as an exposure management platform and where we're able to engage with them in our exposure solutions, specifically strengthen cloud, which we saw and expect to continue and as that product is highly competitive as well as with identity and OT.

Gray Powell, BTIG.

Just a couple of quick ones on my side. So in terms of the -- I guess, we'll call it new disclosures, you've called out 50% plus of new sales from exposure solutions and then 30% of new sales from Tenable One. So this might be a little basic, but does that mean that 20% of your new sales are stand-alone products like cloud security, identity, and OT?

And then I just want to make sure that I'm correlating it correctly. Like when you say new enterprise sales, like what specifically is the definition there? Does that correlate more with something like current bookings? Or should we think of something else?

Hi, Gray, yes, this is Steve. So when we said that 50% of our total sales in the quarter is exposure solutions, that is inclusive of Tenable One and inclusive of 30%, just as a clarification. And then we often talk about enterprise sales, right? We have two really go-to-market motions. We have a direct sales organization that stand shoulder-to-shoulder with partners that transact deals. And they have quotas.

And so collectively, you refer to that business as our enterprise sales business. They're selling to either mid- or large-sized customers. And then also part of our go-to-market is an unaided sale without the assistance of a sales rep or we transact deals through DMRs or online via our e-commerce engine. So collectively, in total, new business refers to our enterprise, direct sales organization, and also refers to our unaided sales motion with kind of lower ASPs, high-velocity deals.

Okay. So the metric is more like a subset of total ACV. It's the total enterprise and does not include commercial. Is that -- I just want to make sure I have that correct.

That does not include the Nessus lower ASP products.

Brad Reback, Stifel.

Hi, this is Rob on for Brad. Thanks for taking the question. Ahead of the federal fiscal year and next quarter, I was wondering if you've seen any uptick in federal and public sector customers adopting Tenable One as opposed to the perpetual license VM and OT adoption trends in last Q3, and if we should expect the same CCB headwinds from last Q3 recurring next quarter. Thanks.

Yeah. I think what we're seeing out of the federal market is similar in volume patterns and behaviors to other market segments. So we're seeing some adoption of Tenable One. But obviously, as a multiyear, given the penetration in the account base we have in the federal market, that's going to be a multiyear account effort to transition when we go down into Tenable One.

Shrenik Kotari, Robert W. Baird.

Just a follow-up to an earlier question and your commentary on the CrowdStrike outage-driven deal scrutiny being factored in the second half. At the very beginning, you highlighted the importance of best-of-breed solutions and promoting resilience and reducing risk associated with over reliance on a single vendor. Can you elaborate on how you are positioning accountable to address? And if they're already seeing some traction in the ongoing customer conversations and just had a follow-up for Steve after that.

Yeah. I think we're in the early innings of how customers are going to proceed this and you hear different responses and different approaches from CISOs around the world that have been impacted. For us, we look at it and say, hey, there are certainly some characteristics, which could serve as tailwinds when you look at vendor consolidation on higher-risk agents, things like kernel, kernel-level usage, or even operating system diversification. So we think that there is significant validation for having an independent audit, an independent exposure assessment from a vendor like Tenable. It's not also providing an operating system or other security functionality. And we think that message resonates. We think it makes great sense in a high resiliency architecture.

So there's good arguments that we might see some tailwind from this. Just as we spoke earlier on the call, there's good arguments when they see some headwind. But we see increased scrutiny or might see increased scrutiny on a more consistent basis from large enterprises, whether procurement teams have experienced the outages and are being asked by their corporate leadership or by the security leadership for different levels of assurances and different terms around liabilities and assurances around failure. And I think we said earlier in the call, I think they've got great answers for those teams.

Got it. Thanks for the color, Amit. And Steve, a quick follow-up on the net dollar expansion rate remaining steady at 109%. So just can you provide more insights into kind of how does this stack up against building softness? Is it just the lagging indicator, that dynamic versus kind of real-time billing standard or anything else that we're missing contributing to this deal?

Well, obviously, there's a lot of interplay between new deals in the quarter from new logos and then expansion within existing customers. And each quarter is different in its own right. And that mix between new business from new logos and expansion from existing customers can vary. As you mentioned earlier, our net dollar expansion rate in the quarter was 109%, 109% last quarter.

It was good to see that stabilize. And that reflects the customer's ability to expand and add Tenable One. But also, we're acknowledging here in this market, specifically with large deals, and in particular, VM, where you're seeing customers moderate the rate of expansion within that product set.

So overall, we have a big customer base. We are confident in our ability to sell a broader product portfolio back into that base, and we would expect the net dollar expense range over time to trend up over the course of years here.

Joshua Tilton, Wolfe Research.

Hey, guys. This is [Rich Magnus] on for Josh Tilton. Coming back to the macro. Some other software names you've reported are saying the macro is starting to stabilize, and your results and commentary suggests maybe some potential softness there. Can you guys give any other points on inputs that may be driving that or some thoughts on the possible disconnect from others who have reported? So any additional color on things that changed quarter over quarter would be helpful. Thank you.

Well, we reported a good Q1 and raised our outlook for the year. And that was due to strength specifically in new logos -- new dollars from new logos. As I mentioned earlier, every quarter is different in its own right. And I think in Q1, that was at a time when others were reporting a tougher macro and softness. This quarter, we saw certainly more levels of review and budgetary constraints with respect to large deals, and reflecting our outlook for the year.

So again, each quarter is different in its own right. We try to be cautious in our outlook and we're reflecting what we saw in Q2 for the second half of the year.

Patrick Colville, Scotiabank.

Steve, this one for you, please. So current billings rose 10% this quarter, which, I mean, given the tough comp is pretty respectable. But the guidance implies quite a big fall off in the back half. I mean, I model an exit billings growth rate in 4Q of about 7%. So, I guess, am I thinking about it the right way?

And then is it these trends you've been talking about -- shortfall in VM because of the cyclicality, North America softness and large enterprise softness, those trends going to get worse and worse through the year, like what we see in 2Q kind of worsens.

Yes. So I would say it's impacting our CCB guide a little bit. If you look at the second half of the year, that suggests that we're expecting to grow, call it, 9%, 10%, given the range that we provided. So yes, we are expecting more moderate growth the second half of the year relative to what we experienced in the first half. What we said specifically in Q2 is that we saw a challenge getting deals across the finish line specifically the VM and North America.

And so that's reflected in our outlook the second half of the year, which for large sales as a whole -- it's more notably in our VM business, but we're also trying to hedge large deals across our theaters, whether it's public sector or otherwise. And we think that's the right thing to do. And so overall, we're going to take the cautious approach for the second half of the year and good news is that pipelines are full and top of the funnel remains strong and our focus will be on executing and closing a lot of those large opportunities.

Very helpful. And in an earlier question, you highlighted the criticality of VM, that it's a core discipline in every enterprise CISOs' arsenal, certainly grew that. The commentary you've given is that we're going through a cyclical trough. Given prior cycles, given what you're seeing right now, when do you think the cycle might pass here in VM?

Yeah, I think it's obviously quite speculative to throw out a particular quarter. It's more just a recognition, the importance in the market. And that at some point, both from a macro perspective, but more specifically from a VM perspective, that it will come back in favor and have an increasing share of budget over time the way it has in years passed.

And it has been cyclical in years past as well. We saw it a couple of years ago, it was the number one 1 priority in some CIO, CISO surveys. And then a few years before that, it was a number 5, number 6 priority. So these things are cyclical. We believe that it will come back quite difficult to project one.

And we're certainly not factoring that into our outlook for the year. And certainly, our expectation is that we would see growth in fact higher over the recent years with VM.

Roger Boyd, UBS.

Steve, I wonder if you could help bridge the CCB performance versus the CRPO performance. And anything you're seeing from a billings duration or payment terms perspective, given the relatively better CRPO and current bookings growth?

Yes. So RPO -- current RPO growth grew 14%. And look, we talked about CCB as a proxy of what we sell. And some quarters, CCB can closely correlate to the underlying health and sales of the business. In other quarters, I think we talked about this in Q3 of last year. RPO is a better approximation.

I think it's fair to say regardless of what metric, top line came in lighter than expected, which we talked about. But there's not a perfect metric. And CCB here is also influenced by deal timing, early renewals, a number of other factors. But overall, it's a corollary to our performance in the quarter, which we've discussed.

Got it. And then maybe a quick follow-up for Amit. Approaching the cloud competition debate from another perspective, any color on the contract durations or strategic nature of the deals you're seeing in cloud security? It seems like you're having a lot of success with the keen function in particular, winning alongside existing CNAPP solutions. Can you just talk to your confidence in winning that broader cloud security budget over time and not the other way around as other CNAPP vendors expand their own [key] offerings? Thanks.

Yeah, sure. I'll start by saying most -- a vast super majority of the transactions that we're pulling in on the cloud security side are for cloud security and the broader CNAPP solution. A lot of customers begin their CNAPP journey with CSPM. We think we have highly competitive CSPM functionality. But really, that unified CNAAP approach is an area where we really shine, especially vis-à-vis competition. And again, I think some of our early win rates are starting to prove themselves out in the specialty, in large enterprises where they're doing bake-offs and doing testing.

That said, for organizations which have already deployed a CNAPP or just the deployed in a CSPM, we don't have to go in and displace and do a rip and replace in order to pull down budget. I think the great example we called out was a sophisticated customer, which was able to differentiate our team functionalities from what they were able to get with their existing vendor. It also enabled us to attractively tap into identity and access management budget. It wasn't even coming from the cloud security budget. So again, that opens up additional TAM to us and one that I feel great we'd be able to continue expanding over time.

Rudy Kessinger, D.A. Davidson. Since there's no questions at this point of time, this concludes today's teleconference. You may disconnect your lines at this time. Thank you for your participation.