Tenable Holdings, Inc. (TENB) Q1 2021 Earnings Report, Transcript and Summary

Greetings, and welcome to the Tenable First Quarter Earnings Conference Call. [Operator Instructions]. As a reminder, this conference is being recorded. It is now my pleasure to introduce your host, Erin Karney. Thank you, Erin. You may begin.

Thank you, operator, and thank you all for joining us on today's conference call to discuss Tenable's First Quarter 2021 Financial Results. With me on the call today are Amit Yoran, Tenable's Chief Executive Officer; and Steve Vintz, Chief Financial Officer. Prior to this call, we issued a press release announcing our financial results for the quarter. You can find the press release on the IR website at tenable.com. Before we begin, let me remind you that we will make forward-looking statements during the course of this call, including statements relating to Tenable's guidance and expectations for the second quarter and full year 2021; growth and drivers in Tenable's business; changes in the threat landscape in the security industry and our competitive position in the market; growth in our customer demand for and adoption of our solutions; the potential benefits of the acquisition of Alsid; planned innovation and new products and services; Tenable's expectations regarding long-term profitability; and the impact of COVID-19 on our business and on the global economy. These forward-looking statements involve risks and uncertainties, some of which are beyond our control, which could cause actual results to differ materially from those anticipated by these statements. You should not rely upon forward-looking statements as a prediction of future events. Forward-looking statements represent our management's beliefs and assumptions only as of today and should not be considered representative of our views as of any subsequent date. We disclaim any obligation to update any forward-looking statements or outlook. For a further discussion of the material risks and other important factors that could affect our actual results please refer to those contained in our most recent annual report on Form 10-K and subsequent reports that we file with the SEC, which are available on the SEC website at sec.gov. In addition, during today's call, we will discuss non-GAAP financial measures. These non-GAAP financial measures are in addition to and not a substitute for or superior to measures of financial performance prepared in accordance with GAAP. There are a number of limitations related to the use of these non-GAAP financial measures versus their closest GAAP equivalent. Our earnings release that we issued today includes GAAP to non-GAAP reconciliations for these measures and is also available on the Investor Relations section of our website. Before I turn the call over to Amit, I want to quickly bring to your attention the corporate social responsibility report we recently published to support our environmental, social and governance initiatives. The report can be found on our Investor Relations website. With the direction of our Board of Directors, executive leadership and other relevant parties, we pooled internal and external sources to do a deep dive into our ESG practices. We are very excited about the results and encourage you to take a look at the published report. I'll now turn the call over to Amit.

Thank you, Erin, and thank you all for joining us today. First, I want to say that we're very pleased to announce the closing of our acquisition of Alsid and welcome the Alsid team to Tenable. We'll talk more about Alsid after a quick review of the quarter. Today, I'll highlight our strong Q1 results, the rising importance of Cyber Exposure and our holistic approach to our portfolio, including Tenable.ep and our new Active Directory solution, Tenable.ad, and new partnerships we've added that we think further validate our market leadership and strengthen our ability to assist customers with rapid remediation. With that, let me first touch on our Q1 results. We are off to a great start for the year as reflected in our compelling Q1 results. Our calculated current billings and revenue each grew 20% year-over-year, driven in part by recent cyber incidents, the acceleration of shift to cloud and growing cross-sell opportunities. We also had strong free cash flow in the quarter, so an expansion of our non-GAAP operating margin and had an $0.08 beat in EPS. Steve will discuss the quarter in greater detail, but we feel these results put us on a solid footing to have a very successful year and are a reflection of the growing demand for our solutions and our attractive business model. Recent high-profile breaches have highlighted the need for comprehensive vulnerability management and an understanding of where exposure exists to enable attack disruption and facilitate informed incident response. VM and Cyber Exposure play a central role in providing broad visibility into the attack surface. What Tenable offers, the continuous dynamic monitoring of assets and user permissions, along with the means to prioritize remediation based on risk is more important than ever. Key highlights from the quarter are continued traction in cloud and cross-sell, including contribution from Tenable.io and the launch of Tenable.ep. Tenable.ep is a new go-to-market motion across our platform of products that includes Tenable.io, Lumin, web app security and Container Security. In addition, with the closing of Alsid, we have simultaneously launched Tenable.ad, a solution designed to audit and monitor Active Directory security and disrupt identity as an attack path in both advanced persistent threats and common hacks. Our customers recognize that as the attack surface continues to expand, a holistic approach to Cyber Exposure is the most effective way to measure, prioritize and manage risk. I'd like now to talk about Tenable EP. Given the momentum of our solutions, we're looking for new ways to deliver more leverage to our customers and make it easier for them to benefit from the full suite of our capabilities. In Q1, we announced Tenable.ep, enabling customers to use more of Tenable's capabilities in combination as a unified platform. EP enables our customers to effectively assess the moderate attack surface by combining VM, web app, Container and Lumin in a unified platform and allows customers to dynamically allocate licenses across all asset types according to their needs and modify as their environment changes. This gives customers flexibility to take a holistic rather than piecemeal approach to assessing the exposure and then prioritize the results through Lumin to obtain recommended actions based on risk. Tenable.ep was made available for sale in late February, and I'm very happy to say that we're seeing really good adoption and interest from our customers. A great example of this is a competitive takeaway with a global customer. This customer had been actively seeking a combination of Tenable.io, Container and Web App Security to improve visibility. In addition, we're able to show the value of Lumin, which became the key differentiator from a technology perspective. EP provided the unified platform they needed for both the short and long term. The result was a 6-figure Tenable.ep win. We're enthusiastic about the meaningful early wins and the growing pipeline we are seeing with EP. In addition to momentum in Tenable.io and expansions from frictionless assessment, we expect Tenable.ep to advance our role in securing our customers' cloud deployments. Now onto our very exciting acquisition of Alsid. We are thrilled to announce the closing of Alsid and simultaneously launched Tenable.ad, our new Active Directory security solution. This solution is designed to secure Active Directory environments and disrupt adversary attack paths. AD environments are incredibly complex and are a top concern for many of the CSOs we speak with. Tenable.ad provides insights into the weaknesses in Active Directory deployments and identifies misconfigurations that can be used to elevate permissions and create persistent access. AD is the basis for managing user permissions across on-prem and hybrid cloud deployments. It is foundational to the security of cloud workloads, security of remote work and adopting Zero Trust architectures. We're excited to expand our cyber exposure solution and advance our cross-sell opportunities to include this capability. In summary, we see strong momentum and expanding use cases for our broader platform of products. Recent events such as the security breaches in water facilities in Florida and Kansas highlight the need for proper cyber risk management, especially in the operational technology sector. This has been further emphasized by the recent presidential executive order on understanding vulnerabilities and securing bulk power systems. As part of the critical infrastructure supporting the global pandemic, a large multinational medical device manufacturer required visibility into their production assets to better understand and manage their risk. Partnering with a global advisory, Tenable offered a unique differentiator across both IT and OT. We remain excited about the opportunity to help enterprises understand and manage their OT risk. Across our portfolio of products, our platform enables customers to take a holistic continuous approach to managing risk. Our offerings deliver differentiated solutions designed to answer the fundamental questions of: How exposed am I? How at risk am I? And what should I do about it? Now at Tenable, we talk a lot about the importance of being best-of-breed. This approach and differentiated capabilities help us forge stronger partnerships and an expansive ecosystem. We had 2 particularly exciting partnerships solidified during the first quarter. We're excited about our new partnership with IBM, where we're a preferred partner for fully integrated vulnerability insights native within IBM SIM. IBM chose Tenable as a preferred partner due to our technology leadership, including covering more vulnerabilities and providing both on-prem and cloud-based offerings, ease of transition and our market leadership. We also announced our new partnership with HCL BigFix, a leading endpoint management platform, making it easier for our customers to automate remediation using infrastructure platforms they've already selected. In summary, we're off to a great start for the year. and we're excited about our outlook. Our portfolio creates a compelling way to measure and manage risk. We believe foundational drivers like digital transformation, the shift to cloud and Zero Trust will continue to fuel long-term success in our business. I will now turn the call over to Steve.

Thanks, Amit. As Amit mentioned earlier, we're very pleased with our results for the first quarter, highlighted by attractive top line growth, a sizable beat in non-GAAP EPS and exceptional free cash flow, which is a testament to the inherent operating leverage in our recurring revenue model. I'll discuss our results for the quarter momentarily. But first, please note that all financial results we will discuss today are on a non-GAAP financial measure basis, with the exception of revenue. As Erin mentioned at the start of this call, GAAP to non-GAAP reconciliations may be found in our earnings release issued earlier today, which is posted on our website. Now on to our results. Revenue for the quarter was $123.2 million, which represents 20% year-over-year growth. Revenue in the quarter exceeded the midpoint of our guided range by approximately $4 million. Our percentage of recurring revenue remains high at 94%, which is primarily a result of our annual prepaid subscription model. Revenue in the quarter was aided by strong demand for both new and renewal business. In terms of new business, we had 331 new enterprise platform customers, which is up from the 319 we added in Q1 of last year. Of particular note, this is the first quarter since the start of the pandemic in which new enterprise platform adds are up on a year-over-year basis. In terms of large deals, we added 29 net new 6-figure customers in the quarter, which is also up year-over-year. This brings the total number of customer spending in excess of $100,000 annually to 866, a 30% increase year-over-year. This demand is also reflected in our calculated current billings. CCB, defined as the change in deferred revenue plus revenue recognized in the quarter, grew 20% year-over-year to $119.5 million. As Amit highlighted earlier, we attribute the strength in the top line to the growing importance of Cyber Exposure, further accentuated by recent SolarWinds and Microsoft attacks. Cyber Exposure is also a key component of digital transformation, which continues to be a top priority for many organizations. While some of our customers took a measured pace of investment last year as a result of the pandemic, we are starting to see early indications of a stronger spending environment attributed to pent-up demand. Some early indications of this demand surfaced in Q1 in our middle market business, where sales cycles tend to be much shorter compared to those in the large enterprise market. The good news here is that enterprise performance was strong in the first quarter and has healthy pipeline and activity levels that could potentially further benefit from this trend. It's also worth noting that we're seeing an accelerated adoption of Tenable.io and associated add-on modules that is positively impacting our cross-sell efforts, which will be further rated by the launch of Tenable.ep, which commands a notably higher selling price versus our core VM offering. This also positively impacted our net dollar renewal rate. I'll now turn to operating expenses. which include incremental investments, offset in part by continued efficiencies in our business. I'll start with gross margin, which was 83% this quarter and 84% last quarter. Our gross margin continues to be very healthy and reflects increased investment in our public cloud infrastructure to support a broader set of predictive analytics and a more expansive data lake. As a reminder, we plan to continue to make incremental cloud investments throughout the year, including all said related costs. As such, we expect our gross margin for the full year 2021 to moderate by approximately 100 basis points, reflecting higher cloud adoption. Sales and marketing expense for the quarter was $52.3 million, which is up from $50.8 million last quarter. Sales and marketing increased sequentially, primarily due to incremental investment in demand generation activities and sales headcount-related costs, including an increased number of quota-carrying sales reps. This quarter represents the second consecutive quarter of increased sales and marketing investment, which we attribute to the increasing confidence in our business and a broader base of demand with the pandemic starting to abate. Despite the higher levels of investment, sales and marketing expense as a percentage of revenue was approximately 42% or 50 basis points better than last quarter. R&D expense for the quarter was $22.7 million, which is up from $20.4 million last quarter. As a percent of revenue, R&D expense was 18% compared to 17% last quarter. Given our best-of-breed approach, innovation remains a top priority, and we plan to continue to invest throughout the year. G&A expense was $13.7 million compared to $12.5 million last quarter. As a percent of revenue, G&A expense was 11% this quarter, which is flat compared to last quarter. Income from operations was $13.9 million in Q1 compared to $15.4 million last quarter. Operating margin was positive 11% for Q1 compared to positive 13% last quarter. I'd also like to provide some commentary regarding the tax provision. As a reminder, our Q1 outlook provided in February assumed a non-GAAP tax provision of $1.5 million. However, discrete benefits recognized in the quarter in foreign jurisdictions that were previously not contemplated actually swung us to a non-GAAP tax benefit of approximately $1 million. Now all of this resulted in significant EPS upside for the first quarter as our non-GAAP earnings per share was $0.13, which was $0.08 better than the midpoint of our guided range. The beat was a combination of better-than-expected top line results, good cost management despite the incremental investments in our business and the discrete tax items I just mentioned. Now let's turn to the balance sheet. We finished the quarter with $340 million in cash and cash equivalents and short-term investments, an increase of approximately $48 million compared to last quarter. Total deferred revenue at March 31, 2021, was approximately $429 million, giving us a lot of visibility into revenue headed into Q2 and the remainder of the year. Turning to cash flow. We generated $37.6 million of positive free cash flow in the quarter, which compared quite favorably to free cash flow of $3.9 million in Q1 last year. Over the last 12 months, we've generated approximately $78 million of positive free cash flow. With high recurring revenue, high gross margins and high renewal rates, we feel confident that we can continue to generate attractive levels of free cash flow while continuing to invest in the business. That said, Q1 does tend to have higher collections given the seasonally strong bookings in Q4. So free cash flow is expected to moderate in Q2. Plus we will have the acquisition-related costs and the incremental OpEx associated with Alsid. This is all expected to result in modestly positive free cash flow in Q2 with higher levels in the second half of the year. With the results of the quarter behind us, I'd like to discuss our outlook for the second quarter and full year 2021. While our assumption is that the health crisis will continue to create some uncertainty, our strong start to the year gives us greater confidence in the business environment now versus last quarter. I'd also like to provide some commentary on Alsid, which closed yesterday. When we announced the acquisition in February, we indicated that Alsid would add 1 point of incremental CCB and revenue growth and $15 million to $20 million of incremental OpEx for the remainder of the year. Our outlook for Alsid today has not changed. In Q2, Alsid is expected to have minimal CCB and revenue impact, given sales cycles and the write-down of the acquired deferred revenue, while operating expenses will include 2 months of activity. With that said, I will review the outlook for Q2 and the full year 2021. With the second quarter, we currently expect revenue to be in the range of $124 million to $126 million. Non-GAAP income from operations to be in the range of $7 million to $8 million. Non-GAAP net income to be in the range of $5 million to $6 million, assuming a provision for income taxes of $1.5 million. Non-GAAP diluted earnings per share to be in the range of $0.04 to $0.05, assuming 114.5 million fully diluted weighted average shares outstanding. And for the full year, we currently expect calculated current billings to be in the range of $575 million to $585 million. Revenue to be in the range of $520 million to $524 million. Non-GAAP income from operations to be in the range of $34 million to $38 million; and non-GAAP net income to be in the range of $28 million to $32 million, assuming a provision for income taxes of $3.5 million. Non-GAAP diluted earnings per share to be in the range of $0.24 to $0.28, assuming 115.5 million fully diluted weighted average shares outstanding. As a matter of clarity, the guidance we are providing today reflects not only the expected contribution from Alsid, but also our Q1 beat and $1 million improvement in revenue and a $0.02 raise in EPS for Tenable on a stand-alone basis. In summary, we're pleased with the results of the quarter, which gives us increasing confidence that we remain well positioned to deliver compelling growth and profitability over the long term. And now I'll turn the call back to Amit for some closing comments.

Thanks, Steve. As I stated earlier in the call, recent security events and digital transformation have raised the profile of Cyber Exposure. These events prove that we can't rely on strong perimeter defenses and have highlighted the need for assessing risk across the entire enterprise. Our message has been very consistent. For Tenable, our core strength in understanding cyber risk has driven our success. Its aim is on natural expansion across the surface of attack into improving the security posture for cloud and OT deployments. Our strengthening platform of capabilities positions us for long-term success as our customers shift from hybrid and cloud environments. We hope to see many of you virtually at the JPMorgan, Needham and William Blair conferences in the coming weeks. We now would like to open the call up for questions.

[Operator Instructions]. Our first question comes from Brian Essex with Goldman Sachs.

Congrats on some nice results. Amit, I was wondering if maybe you could start with a little bit of color. I think Steve pointed to, in his prepared remarks, strong momentum in expanding use cases and some pent-up demand. Where exactly are you seeing that? And maybe the outlook as particularly with regard to change in velocity of the sales cycle and how things might change given a return to office of some of your enterprise customers?

Thanks, Brian. We're seeing demand, I'd say, primarily as a result of digital transformation, right? So we've seen earlier in the pandemic the whole shift to work from home. We've seen an acceleration of cloud adoption and the recognition that this is the new operating environment. And so as part of that security team is now trying to get up to speed, trying to get their arms around what the risk associated with operating in these environments look like. So that's resulted in, I think that and just the broader increase help your spend environment result in some of the acceleration that we're seeing and believe that it also accounts for the strong -- over the last couple of quarters, the increasing strength of some of the cross-sell that we're seeing across product lines where it's not just the traditional VM or even risk-based VM they're really embracing, leveraging our technology set to really understand exposure and risk.

Got it. Maybe can you point to the sales cycles, how they might be changing? And it looks like sales and marketing was quite a bit more efficient than we had anticipated in the quarter. Where did that greater efficiency come from? I guess in spite of perhaps incremental sales, head adds?

Hey Brian, this is Steve. A couple of things I mentioned there. First and foremost, we're delighted with the results in the first quarter. We grew CCB by 20% as well as revenue and delivered sizable beats in EPS and had record levels of free cash flow. In terms of demand, we did see, as Amit commented earlier, strength across the board, both domestically and abroad, in the large market as well as the mid-market where we called out that, that was an area of outperformance. We've previously disclosed that the mid-market represents about 25% of our total sales. And as a reminder, we have a very compelling go-to-market model where we have a product in Nessus that had broad adoption and use across the mid-market as well as large, and the ubiquitous nature of Nessus has created a cost-effective one ramp for us. In Q1, we saw some really good pull-through in the mid-market from the flywheel effect of Nessus, channel and MSSP also played a role and contributed. Sales cycles are more modest in the mid-market versus that in the large. And so some of the things that we're seeing here out of the gate in Q1 have bode well, not only for the mid-market, but we also think it's encouraging potentially for other larger deals down the road. So pleased with the performance on not only in the mid but also large in Q1, and there are some really early signs that demand will potentially remain healthy throughout the year, which has given us the confidence to raise our outlook for both CCB and revenue for the full year today.

Our next question comes from Sterling Auty with JPMorgan.

So it's very clear that the tone has changed dramatically since last quarter. And you've highlighted a number of factors to it, including your answers to Brian. But maybe just kind of rank order what you think the biggest differences are, from what we were talking about just a quarter ago in terms of the pent-up demand and all the other reasons? Just what are having the biggest influences in the change?

Hey Sterling, great to hear from you. I would just characterize it slightly differently, say, we definitely had a fairly bullish tone even going into the year, saying hey, there's a lot of potential here. You have a lot of indicators that it could be a very strong year. But we're still in the midst of a global pandemic, with lots of uncertainty, political climate and a lot of selling off the year. And so we're very pleased that the quarter played out as it did. We did see continued strength building throughout the quarter, driven primarily by -- I don't call it digital transformation, but really customers operating in this new environment where they've got a more complex set of technologies to deal with, where they recognize that they've got to not only embrace VM, to have the agility to respond to high-profile incidents, but also start getting their arms around the cloud-based infrastructure, the web applications, the DevOps environments. And ultimately, that over the last couple of quarters has started accounting for what we're seeing in terms of stronger costs of new products. And ultimately, we believe we'll continue to accelerate with the foundations that we're laying with Tenable.ep.

That makes sense. And then one quick follow-up. You mentioned that EP, the pricing and, it has potential for larger deals. Any sense even with some of the couple of early wins that you had, how much different should we think about the average deal size and revenue run rate from customers on EP versus your traditional deals?

Yes, so...

Go ahead, Steve.

I'd just comment that, and Amit, maybe you can provide further context. But just in terms of the pricing, there's a notable uplift with EP. It's very much an enterprise solution. And so EP is priced at a premium relative to core VM as well as core VM plus Lumin. And it includes a broader set of capabilities to address risk holistically across the enterprise. It includes VM, Lumin, Container and WAS. And out of the gate, we're very pleased with our progress activity levels. And interest remain very high, and we think this is certainly going to be helpful in our efforts to sell our very broad product suite into the enterprise in a more effective way. At 60% uplift relative to what we see with core VM, to answer your question.

Our next question comes from Hamza Fodderwala with Morgan Stanley.

First question for you. You mentioned some pretty strong momentum with Tenable.io. I was wondering if you could give some color on some of the early momentum with the frictionless assessment since you announced that for AWS. How has that been sort of trending? And what do you see as some of the -- perhaps the white space sort of opportunity here versus some of the traditional VM spend that you've seen in the past?

Yes. I think we're very encouraged by what I'll characterize as early wins and strong interest. Frictionless really plays well as a complement to how people think about securing their cloud workloads. So in many cloud environments, you have very ephemeral assets, you have things that may last hours, days, weeks. But you don't manage those types of systems in the same way as you do your long-term uses of infrastructure. So in a lot of these environments, it doesn't make sense to deploy agents, and this kind of frictionless approach is really the best way to get a much deeper understanding of what you've got and the level of exposure. So we think it fits really hand-in-glove with what we're doing with respect to the container security product, the web app scanning and the sort of cloud-native connector. So in some parts of the environment, it makes sense to deploy agents. In other parts, frictionless is providing a very quick zero touch way to understand exposure and risk. So we've had a number of early wins and momentum continues to build and with that product, and we -- we're quite enthusiastic about where it could go over time.

Yes. And just a brief follow-up on that for Steve. I guess as you guys sort of focus on an expanding number of assets within your existing enterprise base, I'm wondering what are the dollar retention rates been looking like in Q1 relative to what you've seen in the past? I think it's sort of in 110% plus? Any sort of change there?

Yes. Cross-sell was strong in the quarter and drove our net dollar renewal rate higher. That's something that I commented on earlier. This comes on the heels of a very strong cross-sell effort in Q4. And Lumin and OT and a lot of our products are really a big part of the story here. And we're not only selling those on a stand-alone basis, but we're -- as part of our core VM offering, but also part of the broader exposure platform that we discussed earlier. So out of the gate, we're pleased with the levels of cross-sell. Cross-sell is not -- it comes to us not only in the way of product but also greater asset coverage. And we did talk about performance in the mid-market and we talked about the flywheel effect of Nessus. And a lot of that was not only upsell from Nessus into the enterprise platform, but also our efforts in the mid-market were also aided by broader asset coverage. So growth appear to be moving in the right direction for us out of the gate in Q1, and we're off to a good start.

Our next question comes from Daniel Ives with Wedbush Securities.

So can you just walk through your view on the federal side, here especially given everything we've seen there in your exposure? I mean, what are you seeing from a pipeline perspective and just view of deals going in to the next few quarters.

Yes. Thanks, Dan. As you know, we have an exceptionally strong position in the federal market. Federal market has always been a very healthy part of our business. And we see very positive signs with respect to the overall federal approach to cyber. We've seen a Presidential Executive Board recently that called out, assessing vulnerabilities and securing bulk power. And we've seen an increase in funding for not only IT modernization, which obviously Tenable could play a role in, but also funding specifically for CISA, where the CDM program, and Tenable's a significant participant, a significant component of the CDM program funding there. So we're encouraged by what we see. Nothing, I think in the federal space moves extremely fast. But we have a strong installed base. We have strategic relationships where we're providing a vital function and believe that they will continue to be strong opportunities for us to grow in the federal space in the coming periods.

Great. And then, so just when you talk about Lumin, obviously, I think we've seen in the last few quarters it just become more and more of a driver. Does that change even who you're selling into with an organization? Like is that, it that much of a door opener now that is really starting to hit its stride?

Yes. Absolutely. We're as, if you rewind a couple of years back, it was largely Tenable delivering a superior vulnerability management experience. So better coverage, better accuracy, better outcomes for customers. And we've embarked on this. Hey, it's not just providing better data, it's doing better analytics. So working with, prioritizing vulnerabilities and then ultimately -- and we embedded that into the core products so that customers would start understanding that Tenable can be a strategic partner in their programs, not just delivering insightful tactical information. With Lumin, we've really up-leveled the conversation to be able to start talking with enterprises about not just exposure but about risk, about how their hygiene compares to peer group, about how mature their program looks relative to their peer group. And all the things that start getting at questions of standards of care and negligence. And ultimately, those are CISO, but those are also Audit and Risk Committee, CEO, Risk Officer types of questions. And so it's really enabled us to have much more strategic conversations with our customers. And we think also a sort of natural prepositioning to what we're starting to do now with EP, which is really expand this -- the visibility into those types of insights beyond just traditional infrastructure and really across a much larger swath of their attack surface.

Our next question comes from Jonathan Ho with William Blair.

Congrats on the strong quarter. I just wanted to start out with some of your comments around recent breaches and how is this maybe translating into either deal activity or pipeline?

This is Steve. I'll jump in here. Look, it's -- we are very encouraged with what we're seeing out of the gate. It's early, we're seeing some clear indications that some of our customers are leaning into digital transformation this year with greater focus and investment. We do believe this has been further accentuated by high-profile, sophisticated attacks in a more complex threat environment. So -- and we're -- there's also some early signs that there's some pent-up demand for certain -- for certain segments of our customers. So for example, last year, in the pandemic for surface, there were investments in digital transformation, but perhaps first on connectivity and collaboration and all the essential things to communicate and work from home, there -- as the pandemic has played out and started to abate, we're seeing a lot of our customers bring a renewed focus into digital transformation and resuming some of those activities that perhaps were put on hold or perhaps were temporarily paused. So again, it's 1 quarter out of the gate. There's some encouraging signs here. And we think the demand dynamics in Q1 are healthy and it sets us up potentially for a good 2021.

Got it. And then just relative to the Tenable.ad product, can you talk about how this maybe fits within the portfolio? And does Tenable.ad also help you to sell your existing products as well?

Yes. So Tenable.ad definitely fits into kind of the existing vision, right? If you go back and rewind the message and what we're trying to deliver to our customers is helping them understand what their attack surface looks like and where and how that attack surface is exposed. But ultimately, for the purpose of helping them identify their level of risk and which actions they can take to most efficiently reduce risk. As you with your attack surface, active directory has become one of the primary targets for adversaries, whether they're sophisticated attackers or foreign intelligence services, as we've seen recently or something much lower scale. And ultimately, that's because once you've gained access, you want to escalate your privilege level, you want to get to be able to move laterally within the organization, you want to be able to establish persistence. And so Active Directory, which is extremely difficult to secure well in the enterprise, has become a go-to target for adversaries. So being able to assess, to audit in an incredibly detailed way, a sophisticated active directory deployment to help identify where the exposures are, how they can be tightened down is absolutely critical. And also to be able to provide ongoing monitoring as new high-risk activities are identified, things that might be indicators of an attack, the creation of privileged accounts or new trust relationships and so on and so forth. So there's -- it's definitely an integral part of the strategy and a natural leverage point where you can look and see not only which systems are exposed, but a system that it has exposures, that has vulnerabilities. That is also a system that a domain administrator -- a system administrator comes in from could be prioritized, could be higher -- a shorter attack path, if you will. And so those are the types of insights that we can help our customers with. And we're really excited. There's a significant need and a real shortage of capability to help enterprises secured, and we're excited about the opportunity.

Our next question comes from Andrew Nowinski with D.A. Davidson.

Congrats on a nice quarter. So I've got a -- just a question on competition and then a follow-up. So we did notice an uptick in Rapid7 displacements this quarter in our channel survey, which seems to align with your comments on the performance of the mid-market business. So I'm wondering if you could just give us any more color on that competitive landscape and if you're seeing any sort of shift in win rates in the -- with regard to the competition.

As you pointed out, we called out a strong performance, our strong performance in the commercial market. We didn't see any notable change. We believe we've always competed favorably with both Rapid7 and Qualys and continue to do so. So there's no real notable change, if you will. But we did see an uptick in the -- in sales in the commercial market this quarter. And part of it, I think, in part due to SolarWinds' response and sort of recognition of need, which and perhaps underspending during the pandemic.

Okay. Got it. And then maybe a question for Steve. You had very consistent or very -- very consistent growth in your current quarter billings, and it was very consistent with revenue growth. I would say, if you look ahead to Q2, Q3 and Q4, you've got relatively easy comps for the remainder of the year. So what are you factoring into your guidance for the full year that implies that CCB growth will not remain at or above this 20% level you just generated in Q1?

I think it's hard to comment beyond the guidance that we currently gave. But what I will say is, if you look at revenue, we're flowing through a beat in Q1, were flowing through a raise and obviously, the contribution from Alsid. So the midpoint of our previously provided range on a full year basis was like $512 million. Today, it's like $522 million, again, at the midpoint, that's over a $10 million raise. And while we don't guide to CCB on a quarter-to-quarter basis, if you look at the full year, it's a similar story. Midpoint of the guidance range was 5.70. Today, the midpoint is 5.80, reflects your beat and a raise in Q1 and then, relative to our expectations. And then obviously, the contribution from Alsid. So pleased to see both revenue and CCB growth growing at 20%. It's early in the year. We're encouraged with what we see. And activity levels remain healthy in our expectations and confidence in the business continues to grow as a result.

[Operator Instructions]. Our next question comes from Saket Kalia with Barclays.

Amit, maybe first for you. Maybe just a little bit of a different angle. I was wondering if you could talk a little bit about some of the partnerships you've announced this quarter, particularly with BigFix. And I'm wondering how do you feel that, that partnership could help Tenable competitively? And do you feel like, especially BigFix is sort of a presence in the endpoint management space. Do you feel like customers were pulling you that way in terms of working with an endpoint tool? Or just talk a little bit about what sort of drove that and how you feel like it kind of helps Tenable competitively.

Yes. I think it's a great question. It's a natural progression for us. We've -- our focus has always been on providing the visibility and the accuracy. And then with broader asset types and improved analytics so that it's not just visibility and accuracy, but it is helping people to prioritize what these exposures look -- mean to them from a risk perspective and what are the actions they can take to be most impactful. So the natural progression from there is to help them take those actions. And so from our perspective, we remain laser-focused on being a best-of-breed provider. And as part of that, working well in the enterprise means through open APIs and open integrations, working with other best-of-breed technologies and other technologies which enterprises have already deployed, to accomplish their systems management function. And so in the enterprise, BigFix is a tried and true and preferred systems management tool. And so integrating and automating that workflow with BigFix can help make our customers' lives easier. And it sort of aligns with what we've been doing with SSCM and other configuration management technologies. So we think it's a natural progression and definitely can help drive value for our customers.

Got it. It's very helpful. Steve, maybe for my follow-up for you, and you've touched on Lumin a couple of times in the prepared comments and Q&A. But I was wondering if you could just dig in a little bit more, whether that's through the lens of an attach rate or just sort of any sense of size in terms of CCB contribution? Anything you could talk about Lumin and sort of how it's become a bigger part of the business, potentially?

Yes. Attach rates continue to grow with Lumin. Obviously, there's seasonal patterns to our business. But our expectation directionally over the course of time is that Lumin attach rates -- and I want to be careful about my comments, because Lumin is a big part of the value prop for our exposure platform, EP. And probably going forward, a lot of what we sell in Lumin will come more likely through the exposure platform. But we expect attach rates to continue to decline. We don't provide disclosures for individual products. We have a lot, everything from OT to Lumen to WAS and Container, but we do talk about cross-sell more broadly, strong in Q4, off to a really good start in Q1, ticked up the net [indiscernible] rate on an LTM basis in Q1. And in a big part of the offering here. So happy to continue to provide more updates on our cross-sell efforts and the momentum around the exposure platform throughout the rest of the year.

Our next question comes from Joshua Tilton with Berenberg Capital Markets.

For my first one, I kind of just wanted to touch on the billings guidance from a different perspective. So you mentioned that in Q1, you started to see signs of a better demand environment relative to last year. If this continues throughout the year, how much of this improving demand environment is baked into the full year guidance?

Hi Josh, this is Steve. So I want to be clear, and revenue is probably the best way to see this. But we guided to $510 million to $515 million on the last call. Our guidance today is $520 million, $524 million at the high end of the guided range, that's 19% and even at the midpoint. What the revenue reflects as well as the higher CCB guide, because they're both similar, reflects the beat in Q1, reflects a raise and reflects the contribution from Alsid. I think it's fair to say that the raise is probably more modest relative to the beat, but it's certainly is a raise. And it reflects our increasing confidence in the business. It reflects the incremental contribution from Alsid. And obviously, the beat in the first quarter out of the gate.

And if I could just follow up real quick. When I think about it from a customer perspective, what is the benefit of adopting EP versus adopting these offerings as a stand-alone solution? Is there a pricing benefit? Or is it like an integration, single pane of glass-type benefit? Any color there would be helpful.

Yes. In its simplest form, there's pricing benefit. There's license benefit in that you can allocate license, the licenser malleable between products and platforms. So as your environment changes, it becomes easy to scale up, scale down, shift to asset types from here to there. And increasingly, also the analytics in the platform itself. So as I called out examples earlier, leveraging the insight of identity when looking at exposures on systems and items like that or identifying web app services on a host when assessing the host and then being able to kick off and automate a web application security assessment, a web app, application-specific security assessment in addition to assessing the host. So there's natural points of leverage between the products that we'll be taking advantage of in the Tenable.ep platform.

Our next question comes from Brad Reback with Stifel.

Given the 60% price uplift with Tenable.ep, can you give us a sense of what type of tailwind we should get in that dollar expansion rate as the product gains momentum?

Hi, Brad. I think it's difficult to predict the impact it will have on net dollar expansion rate. And one of the reasons why is because, first, we don't optimize the business for a single metric. Pipelines can vary from quarter-to-quarter as the mix between new opportunities and upsell opportunities can vary. We do believe, though, that EP is going to be a far more compelling way for us to sell the broader product suite into a larger customer base that continues to struggle with understanding their risk in a heightened threat environment, in a zero-trust environment. So for us, it's a natural evolution of our product strategy and go-to-market. And keep in mind, years ago, we had a handful of customers spending in excess of $100,000. We've made tremendous progress over the years. Today, we have over 800. That's up 30% year-over-year. So we're doing more enterprise deals, more larger deals in the way we go to market and sell that and as part of a broader offering, we think is really important. And EP is your first step out of the gate. I expect us to continue to evolve our thinking and our efforts there, because we've made good progress over the years and we think our best days are still ahead, given the innovation that we brought to market over the past couple of quarters and couple of years on the product side.

Our last question comes from Gray Powell with BTIG.

Congratulations on the quarter. So yes, I'll be quick. I know you don't want to give an exact number, but I -- just to be curious, roughly speaking, what's the mix of new business that's being driven by Tenable.io versus SC? And then I think you hinted it at it -- or I think you said it in the prepared remarks, but how should we think about the net expansion rates for customers on IO versus SC? And just ballpark, how much of upside is there for customers that are on IO?

Well, in terms of mix of business, well also, as a reminder, we launched Tenable.io in 2017, and we said in the year following our expectations that IO would represent a majority of our new enterprise sales. I think it's very fair to say that we're pleased with the progress we've made over that time. Certainly, the pandemic and the shift to home has created heightened demand for cloud and greater demand for IO. And so in Q1, we saw a record level of new business coming from IO. And that's no surprise just given some of the secular trends and data that we're seeing play out in the market. So IO is doing well and is exceeding our expectations. It's a preposition to selling other products that we've talked about specifically in EP with regard to WAS and Container Security and of course, Lumin. But SC is a very important part of what we do. And If you look at most customers' compute environments, they're not 100% on-prem. They're not 100% cloud, they're hybrid. We're one of the few companies and only companies in the VM space that addresses both via -- cloud and on-prem, and both traditional and modern assets. So both are really important to us and both come -- have the ability for us to pull through other products in connection with it. With regard to cross-sell and net dollar expansion rate, as we mentioned here last year, it did moderate a little bit because of the pandemic. But what we're seeing in Q4 and even in Q1 is very encouraging, as it continues to see an uptick in the right direction. And we're very pleased with our cross-sell efforts. this will be a continued area of focus for us, but not to go unnoticed here is our ability to add new customers, right? And so we added a lot of new customers this quarter, a lot of larger deals. That's really important. So going forward, both are going to be important, both levers. And with the go-to-market model and the installed base to do it, both transact new business and land new customers as well as sell more into the account base. And we're super excited about AD here. Having closed it here yesterday and announcing here today, it's going to be an important part of what we do, and it will be another way for us to drive deeper penetration into our enterprise customers.

This concludes today's conference. You may disconnect your lines at this time. Thank you for your participation. Have a wonderful evening.