Greetings and welcome to the Tenable Third Quarter Earnings Call. [Operator Instructions]. As a reminder, this conference is being recorded. It is now my pleasure to introduce your host, Andrea DiMarco, Vice President Investor Relations and Strategy. Thank you, you may now begin.

Thank you, operator, and thank you all for joining us on today's conference call to discuss Tenable's third quarter financial results. With me on the call today are Amit Yoran, Tenable's Chief Executive Officer; and Steve Vintz, Chief Financial Officer. Prior to this call, we issued our earnings release for the third quarter financial results, which is available on the Investor Relations section of our website. Let me remind you that we will make forward-looking statements during the course of this call, including statements relating to Tenable's guidance and expectations for the fourth quarter and full year 2019, growth and drivers in Tenable's business, changes in the threat landscape in the security industry and our competitive position in the market, growth in our customer demand for and adoption of our solutions and planned innovation in new products and services. These forward-looking statements involve risks and uncertainties, some of, which are beyond our control, which could cause actual results to differ materially from those anticipated by these statements. You should not rely upon forward-looking statements as a prediction of future events. Forward-looking statements represent our management's belief and assumptions only as of today and should not be considered representative of our views as of any subsequent date. We disclaim any obligation to update any forward-looking statements or outlook. For a further discussion of the material risks and other important factors that could affect our actual results, please refer to those contained in our most recent quarterly report on Form 10-Q filed with the SEC and subsequent reports that we will file with the SEC, which are available on the SEC website at sec.gov. In addition, during today's call, we will discuss non-GAAP financial measures. Our earnings release that we issued today includes GAAP to non-GAAP reconciliations for these measures. Before I turn the call over to Amit, we'd like to note a few upcoming IR events. We'll be participating in Stifel's Midwest, One-on-One Conference in Chicago, November 7, and Barclay's Annual Tech Conference in San Francisco on December 11. We hope to see many of you in person and appreciate your interest in Tenable. Now let me turn the call over to Amit.

Thank you, Andrea, and thank you for joining us on the call today. I'm pleased to report that we delivered strong financial results in the quarter and achieved a number of significant milestones that demonstrate our innovation and leadership in the market. Steve will discuss our financial performance in greater detail but year-over-year calculated current billings grew 28% to $110.6 million, and the revenue grew 32% to $91.9 million in the quarter. Also, EPS was notably better than expected. We believe this indicates a favorable trend on the topline and bottom line results that positions us well for continued success. In terms of customer momentum, we added 387 new enterprise platform customers this quarter, a record for us, and 51 net new 6 figure customers. This momentum demonstrates increased traction in landing customers at scale in the enterprise market. Underpinning this success is our innovation in 3 key areas. For Vulnerability Management capabilities, the expansion into additional and modern asset types and delivering prioritization and differentiated analytics. Together, these deliver a strong approach to managing cyber exposure. To put it simply, accuracy and coverage matter in Vulnerability Management, and Tenable remains deeply committed to being the best VM solution available. Our investments in vulnerability research and product development have earned us a number of #1 positions in vulnerability coverage, 20% more CVEs covered than our next closest competitor. Our investment in vulnerability coverage also translates into better accuracy, delivering a lower falls positive rate with six-sigma accuracy, according to our own benchmarking. Tenable research also leads the industry in zero-day discoveries with more than 90 zero-days in 2019 to date, dramatically more than our competitors have announced. Tangible is the number one platform in the market for vulnerability and security configuration coverage according to testing and analysis performed by principal…

Thank you, Amit. I will discuss our Q4 and full year guidance momentarily, but we'll start with a review of our Q3 results. I'll begin by reminding you that except for revenue, all financial results we will discuss today are non-GAAP financial measures, unless stated otherwise. As Andrea mentioned at the start of this call, GAAP to non-GAAP reconciliations may be found in our earnings release issued earlier today and posted on our website. Now onto the results for the third quarter. Revenue for the quarter was $91.9 million, representing 32% growth over the same quarter last year. Revenue in the quarter exceeded the midpoint of our guided range by $3.4 million, aided by strong execution globally and approximately, $1 million of revenue from nonrecurring sources. Worth noting that approximately 92% of our revenue recognized in the quarter was recurring, which is the benefit of our subscription model. Calculated current billings, defined as the change in current deferred revenue plus total revenue recognized in the quarter, grew 28% year-over-year to $110.6 million. We are pleased with our growth in the quarter, which is up from 27% in Q2 and 25% growth in Q1. One of the highlights in the quarter is our continued strength in the enterprise, and our ability to transact larger deals, both in terms of lands and expands. We added 51 new six figure customers in Q3, bringing the total number of customers, spending in excess of $100,000 annually, to 589. Our continued success here is a result of our investments in nailing the account reps and the ability of our products to scale and serve some of the largest and most sophisticated organizations in the world across a merry of industries, including retail, consumer, telecom, financial services and public sector, to name a few. While our…

Thanks, Steve. We continue to be excited about the opportunity in risk-based vulnerability management and pioneering cyber exposure. We're very pleased to be recognized as the leader in this transformational and increasingly strategic market. We believe the combination of our differentiated technology, even stronger now with Lumin, our data integration capabilities and our strategic approach to risk-based VM position Tenable to successfully aid our customers in their journey to secure their digital transformation. We now like to open the call up for questions.

[Operator Instructions]. Our first question comes from the line of Sterling Auty with JPMorgan.

So last quarter, you guys made some changes in the sales leadership. Just wondering if you can update us on if there's any additional changes that were made and kind of what you see in terms of the transition post those changes.

Sterling, we're -- I think we're very comfortable with the sales leadership that we have in place. We have -- as you know and as we mentioned on the last call, David Feringa has been with the company since the beginning of the year and has had very good ramp-up time, and we don't anticipate any significant additional changes in the sales organization in the foreseeable future.

All right. Great. And then one follow-up. You talked about the operating leverage, which really has shone through both last quarter and this quarter. This quarter seemed to be more on the R&D side. You did mention the innovation priority. So should we think about the increasing operating leverage from here being more focused on sales and marketing?

Sterling, this is Steve. I think it's a combination of a couple of factors, and it's something that I called out earlier. But the leverage that you're seeing in R&D, we are demonstrating good leverage in R&D, but part of that was aided by the capitalization of development costs in connection with the -- with Lumin. So we launched Lumin in the third quarter or made it available in the third quarter. And so you'll no longer see those costs coming out of the P&L and going into the balance sheet. But in summary, we are demonstrating leverage not only in sales and marketing. I think it was 58% of revenues this quarter. It's down from the beginning of the year. And our expectation going forward is that there's just a lot of leverage in the business, and you'll see leverage in -- primarily in sales and marketing, to a lesser degree, R&D. But some -- and of course G&A as we grow larger and fully absorb public company costs.

Our next question comes from the line of Melissa Franchi with Morgan Stanley.

I wanted to follow up on Sterling's question on the sales organization. So last quarter, you commented on longer sales cycle as you're selling more enterprise-wide deals. I'm wondering if that was still the case in Q3 or if that was more moderate than you initially expected, particularly in light of the new head of sales and new sales leadership.

No. I think it's fairly consistent. So as we noted earlier, we're seeing longer, more complex sales cycles in the large enterprise segment of the market where they're doing enterprise-wide transactions. They're doing -- going through a more strategic procurement process. We do have, I think, continued consistency in our kind of bread-and-butter market that operates as it has consistently.

Melissa, this is Steve. The one thing that I would add is sales cycles overall are not getting longer for us. They are -- we're doing more larger deals, and these larger deals come with longer sales cycles. So a bread-and-butter $30,000 to $40,000 deal sale cycles have been pretty modest, and they really haven't changed. But what you've seen over the year is tremendous progress in our ability to transact larger deals. Years ago, we had 15 customers that are spending in excess of 6 figures. Today, we're almost at 600. We're adding 50 new 6-figure customers a quarter, and it's not just a $100,000 deals. We're doing $250,000 and $0.5 million deals. We added named accounts last year, so the success in enterprise corresponds with the investments we're making, to focus on larger organizations, serve larger, more complex customers. And so with that, we are doing larger deals that have larger sales cycles. But all this really underscores the opportunity in the market and the demand that we're seeing from larger organizations.

Okay. That's helpful. And one follow-up. I wanted to see how your fed business did this quarter given the federal year-end. And I'm particularly wondering if there's been any change in the competitive environment in the federal space.

No. Our federal business remains on target for the year. We've got a very strong position in the federal market. We've got strategic relationships with just about every department and agency out there. We've got a lot of confidence in that business, and we have not seen any significant shift in the competitive dynamics in that market.

Our next question comes from the line of Gur Talpaz with Stifel.

Amit, you're painting a pretty bullish picture here with Lumin. Would you classify initial interest here having exceeded your expectations? And if so, why do you think demand is so meaningful here just out of the gates?

Yes. So I have high expectations for the product. So I don't know that they've exceeded my expectations, but I think it's a transformative type of product. You've got a very technical cybersecurity industry that has historically really struggled with data and metrics that answer the simple question that's being asked by the business leadership: how at risk are we, how exposed are we, how vulnerable are we, how do we do relative to our peers, are we exercising a reasonable standard of care or not with our IT systems. And that is seemingly a very obvious question to ask, but you can't answer that with things like firewall logs and IDS alerts and a protective application on an endpoint or host or a network perimeter type of application or by encrypting your data. That data is system of record type of security information, which stems from its core or at its core from VM program data. And we think building asset criticality, building benchmark, building prioritization on top of it just become a very natural way for our business to translate or for our solutions to translate to the business level. So we're extremely excited about the market potential for Lumin.

That's super helpful. And then, Steve, maybe one for you. You've maintained a pretty wide range here on the current billings guidance. We're about a month through Q4 here. Can you talk about some of the puts and takes here as to why you sort of maintained that range? What could drive it towards the higher end? What could potentially drive it towards the middle of the range?

Sure. Well, we're pleased with the results for the quarter, which I think is fair to say gives us more confidence in our business and our outlook. So we're reiterating guidance for CCB. We're keeping the same range, we think positions -- which positions us well for a successful Q4. And keep in mind, the fourth quarter represents our largest quarter. We can transact as much as 30% of our total sales in the quarter. So the range reflects a myriad of possible outcomes but we think positions us well to cap a very good year for us.

Our next question comes from the line of Jonathan Ho with William Blair.

Can you maybe talk a little bit about what you're seeing in the macro environment and just maybe demand trends in general around vulnerability management?

Yes. I think in the macro environment, it's something that we're trying to keep a very close eye on, obviously getting a lot of coverage, getting a lot of attention in the business press and media and has the potential impact customer budgets and customer spending habits. We have not seen that behavior, that change in behavior to date. We're seeing strong performance, perhaps especially in our international markets, in EMEA. So that potential exists, and we're trying to keep a close eye on it. But that said, we do feel that vulnerability management, understanding your assets and your cyber exposure is incredibly strategic and relatively low cost in today's operating environment. And so we're optimistic that it'll continue to get prioritized even in tough economic times.

Got it. And then what drove the $1 million nonrecurring revenue bump? Can you just maybe remind us of what that's coming from?

Yes. We wanted to call it out because it is a discrete item, but it's $1 million that we recognized in the third quarter in connection with the termination of a contract. Keep in mind, this has nothing to do with our ability to deliver the product. But we have confidentiality requirements with our contracts, so couldn't specifically call it out. But we wanted to note it since it's something that's going to be nonrecurring.

Our next question comes from the line of Daniel Ives with Wedbush Securities.

So in terms of head of sales and just execution. Maybe can you just talk a little more granular with Dave as Head of Sales, how maybe things are changing in terms of the way that you're going after customers, especially Lumin, more enterprise going further upstream? Maybe just give us some examples.

Yes. I think there's a lot of consistency in how we're going after customers, but there's probably the addition of a more disciplined sales process, particularly in the, we'll call, the nonsales end of the process. But it's understanding what's required to forecast and close a transaction. It's not just having a great sales call, getting the customer excited about it, getting the user to say that's what I want but understanding the full budget cycles, the procurement processes, legal, compliance, privacy, all the folks that might have to get involved and making sure we've got line of sight into that with greater discipline and ultimately resulting in greater forecast accuracy. In terms of the messaging and positioning. I think we've had this vision, if you rewind back 1 year, 1.5 year to the IPO time, paying this vision for cyber exposure. It's not just vulnerability management. But it's understanding modern asset types, containers, cloud-based infrastructure, web applications and DevOps environments and OT environments and the more complex analytics that are available to help make use of the data that's being exposed, and a study, I think John may have released these, enhancements to the product portfolio, new innovation, whether it's predictive prioritization, the release of Lumin, some of the other products. And it enables our sales team to talk about the vision of the company but also point very tangibly that we're delivering on that vision, not just a VM company with great hopes and aspirations.

And maybe to that point with Lumin, does it really feel like as you're talking to customers, products out that there's a change now in terms of how they're looking at Tenable with product now launched and just some of the interest?

Yes. And I'll give you an example. Before the release of Lumin, because we had a phased rollout during the course of Q3, we had a challenge where one of the customers, one of the prospects rather, was looking to deploy a VM solution. They were deploying Tenable.io, but they came back and they said, "Hey, we're not going to issue a purchase unless we can also get a quote for Lumin because that's a key part of our vision for how we want to drive and manage our exposure." We had another example in the current -- at the end of Q3, where we had a long-time Tenable customer come back to us and purchase both the OT solution as well as go through the eval process with Lumin, saying, "Hey, this is exactly the way I wanted to understand the more complete attack surface and have a deeper understanding of it." So we think Lumin is a way to transform how customers use vulnerability data from compliance purposes to the business insight they need to make informed risk decisions. And so we think that there's a tremendous appetite for it.

Our next question comes from the line of Gray Powell with Deutsche Bank.

Can you hear me?

Now we can.

We can now.

Okay. All right. Great. Yes. I just want to follow up on an earlier question on Lumin. So I mean you guys sound pretty positive. Is there any material contribution to billings from Lumin expected in Q4? And then just how should we think about the uplift to a customer's bill as they adopt the product?

Gray, this is Steve. I'll answer the first part of the question. Yes. I think the early data points are very positive as Amit alluded to earlier. But it is early innings, and we'll have more insight with Lumin as time goes on. And just given normal sales cycles, we expect very little contribution from Lumin in the fourth quarter. However, we'll update you on what we expect from Lumin in 2020 on our Q4 earnings call in February.

[Operator Instructions]. Our next question comes from the line of Nick Yako with Cowen and Company.

Maybe just another one on Lumin. Do you guys see Lumin as a driver of incremental spend with existing customers? Or do you think Lumin can really evolve to become another landing product for new customers?

The answer to that, and I think we believe this very emphatically, is both. Lumin has shown already in the early innings that it will allow us to drive additional revenues through existing customers. We also have examples in the early innings of Lumin helping to pull other products and the purchase of other products. So you can not only see your vulnerability data but other exposure that you have in Lumin as part of this sort of vision for cyber exposure. And that becomes a compelling cross-sale of product opportunity for Lumin. We also believe it can be a substantial land product for us, for customers or for those in the market using other solutions for their VM requirements but really want to understand their exposure, want to understand the translation to risk, the benchmarking, the business context. So again, we feel like it can be a very strong land product for us as well.

Okay. Maybe just one follow-up. Any update in terms of the mix between SC and I/O, particularly as you move further up in the enterprise?

Yes. I think what we said and we continue to say is that our sales of our I/O platform continue to represent a significant growing percentage of our overall sales. So -- but keep in mind that the demand for whether you want SC or I/O really depends often on the market and maybe even the geo. Sometimes there's a procurement bias in fed and public sector more towards SC, which is an on-prem offering, and maybe even parts of Asia as well. Whereas in other markets such as North America, it may skew more towards cloud. But we also often sell it together, and we have over 1,000 customers that use both. And that's really important because we have a technology stack and a solution that really reflects the compute environments of our customers. Customers don't have 100% of their workloads in the cloud, and they don't have 100% on-prem. And so we are able to sell both because customers are increasingly looking to secure both environments.

Our next question comes from the line of Joshua Tilton with Berenberg.

Just one more on Lumin if I could. Correct me if I'm mistaken, but I would assume that the customer would need a certain percentage of their total assets on the platform in order for the product to actually produce an accurate representation of their overall exposure. So if we look at it from that perspective, what percentage of the customer base would you say is a good fit for Lumin?

So you are correct and part of the vision for Lumin is providing them an assessment of their program maturity as well. So being able to say, hey, how -- what percentage rather of assets do you have under coverage, how frequently are you giving looks to your data, how quick -- frequently are you assessing the assets in your environment, how frequently are you updating the plug-ins, if you will, on the checks that was there -- on the security configuration side or vulnerabilities being discovered. So there's -- there are a number of factors which can impact the maturity of a program. And part of the Lumin score and exposure score will include a score for your level of program maturity. So I think the short answer is every customer is a prospect for Lumin, and every enterprise is a prospect for Lumin. How much data they feed in will dictate their level of program maturity.

Okay. That was helpful. And then just maybe another one on SC versus I/O. I noticed earlier this month, there were some features released that were just for SC, but it doesn't look like they were released to I/O. Could you maybe just comment on how you think about balancing the investments into each product?

Yes. We have a strategic commitment to both products -- both platforms rather. And we have a -- whatever makes sense in the time line that makes sense type of approach. So you saw, I think, predictive prioritization come out first on Tenable.sc and then followed shortly thereafter with predictive prioritization on Tenable.io. I think our industrial security, our OT product came out first on I/O and then shortly thereafter on SC. So we aren't particularly focused or biased if it takes an extra couple of weeks, couple of months to deliver some of the capability on one platform versus the other. We're not going to hold up delivering capabilities to either of our customer bases. And we've got a tremendous number of customers, well over 1,000 at this point, that use both platforms. So we're committed to both, and we're going to drive a development roadmap that produces innovation for both of those product lines.

There are no further questions in the queue. This does conclude today's teleconference. Thank you for your participation. You may disconnect your lines at this time and have a wonderful day.