Tenable Holdings, Inc. (TENB) Q2 2026 Earnings Report, Transcript and Summary

Greetings, and welcome to the Tenable Q2 2026 Earnings Conference Call. As a reminder, this conference is being recorded. It is now my pleasure to introduce your host, Erin Karney, Vice President, Investor Relations. Thank you. You may begin.

Thank you, operator, and thank you all for joining us on today's conference call to discuss Tenable's second quarter financial results. With me on the call today are Co-Chief Executive Officers, Steve Vintz and Mark Thurmond; and Chief Financial Officer, Matt Brown. Prior to this call, we issued a press release announcing our financial results for the quarter. You can find the press release on our IR website at tenable.com. We will make forward-looking statements during the course of this call, including statements relating to our guidance and expectations for the third quarter and full year 2026, growth and drivers in our business, changes in the threat landscape in the security industry, particularly regarding AI security, the expected impact of Frontier AI models and accelerated vulnerability discovery and the shift to preemptive security, our competitive position in the market, growth in customer demand for and adoption of our solutions, including the impact of new pricing and packaging models, the expansion of Tenable One, including agentic AI security orchestration through Hexa AI and planned AI exposure coverage across third-party models, the expected benefits of our strategic partnerships with Frontier AI Labs, our ongoing research and development investments, our capital allocation strategy, including share repurchases and our future results of operations and financial position. These forward-looking statements involve risks and uncertainties, some of which are beyond our control, which could cause actual results to differ materially from those anticipated by these statements. You should not rely upon forward-looking statements as a prediction of future events. Forward-looking statements represent our beliefs and assumptions only as of today and should not be considered representative of our views as of any subsequent date, and we disclaim any obligation to update any forward-looking statements or outlook. For a further discussion of the material risks and other important factors that could affect our actual results, please refer to those contained in our most recent annual report on Form 10-K and subsequent reports that we file with the SEC. Today's discussion includes non-GAAP financial measures. These non-GAAP financial measures are in addition to and not a substitute for or superior to measures of financial performance prepared in accordance with GAAP. There are a number of limitations related to the use of these non-GAAP financial measures versus their closest GAAP equivalents. Additionally, please see our press release for reconciliations of GAAP to non-GAAP financial measures that we discuss today. I will now turn the call over to Steve.

Thanks, Erin. We're very pleased with our results in the quarter as we exceeded all of our guided metrics and are raising our outlook for the year. Tenable One was a record 50% of new business this quarter, continuing its strong upward trajectory. Earlier this year, we launched new pricing and packaging for Tenable One, introducing Tenable One Foundation and Tenable One Advanced. Notably, we are seeing greater-than-anticipated adoption of Tenable One Advanced, which reflects growing customer demand given the evolving AI threat landscape. Accordingly, larger land and expansion deals with Tenable One helped drive average deal sizes higher this quarter, and it also helped increase our net dollar expansion rate to 106%. This is the first acceleration in our expansion rate in many quarters. The takeaway here is that our results are a clear validation of our strategy and the opportunity in front of us. As AI reshapes the attack surface faster than most organizations can respond, we believe customers are increasingly choosing Tenable One as the platform that turns complexity into clear, actionable insight to reduce risk. And that differentiation is what's resulting in higher deal sizes, faster expansion and durable leadership in this category. In fact, we believe it is becoming increasingly clear that companies who lead in this market will need 3 core capabilities to survive in the agentic era. First, the ability to understand every exposure across the enterprise; next, the ability to prioritize tasks that matter most and then translate that intelligence into action. I'll discuss each of these 3 capabilities in a bit more detail. First, organizations must understand exposure holistically across the enterprise. AI is accelerating vulnerability discovery and increasing the volume of issues requiring attention. But vulnerabilities are only part of the attack surface. Misconfigurations, compromised identities and other non-CVE weaknesses represent more than 60% of potential breach entry points, and we capture both CVE and non-CVE risk. As attackers operate with greater speed and scale, organizations need a unified view of all of the conditions that create business risk, not simply a longer list of vulnerabilities. Second, more findings make effective prioritization essential. Tenable combines broad exposure intelligence, deep contextual data and decades of security research to help customers distinguish the exposures that create meaningful business risk from those that do not. This allows security teams to concentrate their resources on the relatively small number of actions capable of producing the greatest reduction in risk. And third, prioritization is only as valuable as the action it enables. As AI models become more broadly available, the key to agentic security is not the model itself. It's what sits between the model and the customer's environment, ensuring that agents operate safely and accurately with human oversight and an audit trail. We call that the harness. Built into Tenable One, our harness draws on decades of exposure data, research and our trusted sensor layer. Hexa, our agentic engine for Tenable One, operates within this harness to orchestrate the right fixes deterministically for customers. Digging a little further into Hexa, we continue to expand what Hexa can do. Just yesterday, we announced new capabilities that equip security teams with a coordinated fleet of agents capable of operating continuously, executing multistep security tasks and orchestrating remediation across the exposure management life cycle. Together, the Tenable One Harness and Hexa's agentic capabilities move exposure management from periodic analysis and manual intervention towards a continuous always-on defense. As frontier models become more widely available, we believe this combination will become an increasingly important and durable differentiator for Tenable. In addition to the exciting AI capabilities we're building into our platform, we're also helping our customers secure their use of AI. With Tenable's AI exposure, we're extending coverage to include Gemini alongside Claude, ChatGPT, Copilot as well as major MCP deployments and AI native development tools. Together, these capabilities give security teams a more complete view of where AI is used, the risk it creates and where action is needed. As part of Tenable One, AI Exposure and Hexa are highly complementary, helping security teams secure their organization's use of AI while harnessing AI to improve operational efficiency. And finally, we're deepening our relationships with the 2 leading Frontier AI labs, Anthropic through Project Glasswing and OpenAI through their Daybreak program. These partnerships are deep and broad working collaborations. We have access to nonpublic models. We're participating in joint research. We have early insight into how the attack landscape is evolving before these capabilities are broadly available in the market. More specifically, our testing as a part of Glasswing demonstrated that Frontier AI can dramatically increase the speed and scale of vulnerability discovery, but it also reinforced that discovering more potential vulnerabilities does not by itself tell an organization where it is truly exposed or what it should fix first. The output requires a trust letter to validate and provide context to determine if an exposure is reachable and exploitable and whether existing controls can mitigate the risk. This is the direction the market is moving, and it's the direction we've been building toward. Customers need more than just another stand-alone AI feature. They're looking for an integrated platform that can act with the speed and context this moment demands. And that's exactly what we're seeing show up in how our customers are buying today. Mark will walk you through what that looks like in practice because it says a lot about where this shift is taking us.

Thanks, Steve. The market dynamics surrounding AI that Steve described are increasingly translating into customer action and stronger commercial outcomes for Tenable. We are now seeing customer conversations convert into action, which we believe points to the early stages of ongoing tailwinds to the business. Customers are moving beyond education to investing in broader, more sophisticated exposure management programs. They recognize that addressing this new environment requires a unified view of exposure across the enterprise, the intelligence to identify what creates the greatest risk and the ability to take actions before the attackers do. As Steve noted, Tenable One sales accounted for 50% of new business, a really exciting record for us. We believe 2 factors are contributing to this momentum. First, the pricing and packaging changes we introduced earlier this year have made the path to Tenable One clearer and easier for customers. The new model gives organizations the flexibility to start where they are, expand over time and move seamlessly across asset types and the attack surface with predictable spend, simplified procurement and faster time to value. Second, the AI-driven threat environment is accelerating customer demand for exposure management. Tenable is meeting that demand with capabilities such as Tenable Hexa and AI Exposure, which are making the value of the broader platform more immediate and tangible. We are already seeing encouraging signs in how customers engage with Hexa. More than 80% of customers who open Hexa submit a prompt and nearly half are using it to take action rather than simply consuming information. Hexa users are also engaging with an average of 6 Tenable One tools, indicating that the agentic engine can help customers discover and use more of the platform while freeing security teams to focus on higher-value work. For one customer, Hexa connected fragmented data across systems, workflows and geographies to identify a single patch that could neutralize 53 potential attack paths. This illustrates the efficiency opportunity Hexa creates, focusing resources on the action that reduce the most risk, accelerating remediation and enabling security teams to accomplish more with their existing resources. These early indicators reinforce our belief that Hexa can become an important driver of Tenable One adoption and expansion over time. Customers are also seeing the benefits of Tenable One AI exposure, which helps customers discover, govern and secure the rapidly growing use of AI platforms and agents across their organizations. Together, as part of Tenable One, these highly complementary capabilities help security teams secure their organization's use of AI while using the power of AI to create operational efficiencies. This results in a very powerful preemptive security strategy. Our position in this evolving market is also receiving external recognition. In June 2026 report, Gartner named Tenable the company to be in AI-powered exposure assessment, noting that Tenable's long-standing dominance in vulnerability assessment, its strong asset and attack surface discovery capabilities and its ability to execute on its AI strategy make it the frontrunner in an AI-powered exposure assessment. We believe this recognition validates the strength of our position today and our strategy for where the market is heading. Let me bring these trends to life through 3 customer examples from the quarter. First, a global manufacturing services company selected Tenable One Advanced, resulting in a 6-figure deal, replacing a legacy vulnerability management provider. The deployment brings together multiple asset types to both consolidate and give the customer a more unified view of exposures across its environment. This is another example of a large enterprise moving away from fragmented tools to consolidate on Tenable One. Second, a leading financial services company significantly expanded its relationship with Tenable in our largest transaction of the quarter. An existing Tenable customer, the company made a 3-year 7-figure commitment to Tenable One, including services. This expansion demonstrates our ability to deepen relationships with some of the world's largest and most sophisticated organizations and establish Tenable One as the foundation for their exposure management programs. Finally, we also displaced a major competitor who had a long-standing relationship at a large European postal service. Once again, this customer saw the need to move beyond traditional VM to Tenable One for full exposure management. The win was supported by the region's largest cybersecurity service provider and provides a strong foundation for broader collaboration and additional opportunities in the region. This was a strategically important win that demonstrates our ability to disrupt established competitive relationships in key international markets. Together, these wins illustrate the broader trends we saw during the quarter. First, increased customer demand for exposure management, driven by the Frontier AI Labs, specifically Mythos. Second, very strong competitive displacements. Third, increasing adoption of Tenable One Advanced; and fourth, meaningful expansion within our installed base. In addition to these exciting customer wins, we also achieved FedRAMP high authorization for Tenable One cloud exposure during the quarter, one of the most rigorous security authorizations in the U.S. federal government. This expands our opportunity in the federal market and reinforces the trust that mission-critical organizations place in our platform. With that, I'll turn the call over to Matt to discuss our financial results.

Thanks, Mark. We delivered excellent results in the second quarter, underscored by our highest ever adoption of the Tenable One platform, which reflects the early success of the new pricing and packaging introduced in the quarter. Growth in the platform and meaningful operating leverage drove second quarter results above the high end of the range for every metric we guided to for the quarter, and we are once again raising our full year outlook across the board, reflecting the growing momentum we're seeing in the business. Let's dive into the details. Revenue for the quarter was $268.5 million, representing growth of 8.6% year-over-year. The year-over-year growth in revenue for the quarter as well as outperformance relative to guidance was driven by strong expansion within existing accounts and underpinned by continued strength in renewals. Professional services, which are often attached to our larger Tenable One deals, also contributed ahead of expectations. Despite the strength in professional services, our percentage of recurring revenue remained high at 95% for the quarter. We had a record quarter for Tenable One with 50% of new business coming from the platform, a new milestone, up from 41% in the prior quarter and 40% in Q2 of last year. We believe this growing adoption reflects the increasing conviction customers have in leveraging the platform, including Hexa AI to manage risk across their entire attack surface. Importantly, while adoption of the platform was at an all-time high, we're also seeing an increase in average deal sizes within the platform, reflecting customer preferences for our Tenable One advanced offering, which boasts a more robust feature set and price point compared with Tenable One Foundation. We added 381 new enterprise customers in the quarter and added 32 net new 6-figure accounts. But my favorite metric of the quarter was our net dollar expansion rate, which improved to 106%, up from 105% in the prior quarter. This is the first quarter since Q1 2022, more than 4 years ago that we have seen a percentage point quarter-over-quarter increase in the net dollar expansion rate. The growth here was driven by strong expansion and renewals business and reflects important stabilization of our growth rate. Non-GAAP gross margin was 81.4% for the quarter compared to 82.0% in Q2 2025 and within our typical historical range of 81% to 82% over the last couple of years. Non-GAAP income from operations for the quarter was $66.2 million or 24.7% of revenue compared to $47.7 million in Q2 2025, an increase of 38.8%. We're continuing to benefit from the efficiencies that I highlighted last quarter, while rotating spend into the opportunities for growth in product development and sales capacity. We expect to continue investing in the second half while still meeting our profitability targets for the year. Non-GAAP earnings per share for the quarter was $0.51 compared to $0.34 in Q2 2025, an increase of 50%. The improvement year-over-year reflects the increase in profitability combined with a decrease in diluted shares outstanding, driven by our share repurchase program. Turning to the balance sheet. Cash and short-term investments totaled $298.2 million. We generated $45.3 million in unlevered free cash flow during the quarter compared to $44.3 million in Q2 2025. During the second quarter, we repurchased 5.2 million shares for $100 million and have $108 million remaining on our current share repurchase authorization as of the end of the quarter. So far this year, we've repurchased 11.4 million shares for approximately $230 million, reflecting an average repurchase price of $20.23. Our repurchase program remains an active pillar of our capital allocation strategy, reflecting our view that returning capital to shareholders through buybacks represents an effective use of our free cash flow, given the underlying strength of the business. We are realizing the benefits of these share repurchases as our weighted average diluted shares outstanding for the quarter is now the lowest it has been since Q4 2020, more than 5 years ago. Turning to the financial outlook for Q3 and full year 2026. For Q3, we expect revenue to be in the range of $270 million to $273 million, representing a year-over-year increase of 7.6% at the midpoint. Given the strength we've seen in the first half of the year and our expectations for continued momentum into the second half, for full year 2026, we are raising our guidance range for revenue to $1.075 billion to $1.081 billion, representing a year-over-year increase of 7.9% at the midpoint. We expect non-GAAP income from operations for Q3 to be in the range of $66 million to $69 million or 24.9% of revenue at the midpoint. For full year 2026, we are raising our guidance range for non-GAAP operating income to $258 million to $264 million or 24.2% of revenue at the midpoint, representing a year-over-year increase of 230 basis points. We expect non-GAAP net income for Q3 to be in the range of $58 million to $61 million, representing a year-over-year increase of 15.8% at the midpoint. For full year 2026, we are raising our guidance range for non-GAAP net income to $228 million to $234 million, representing a year-over-year increase of 18.8% at the midpoint. We expect non-GAAP earnings per share for Q3 to be in the range of $0.49 to $0.52 per share, representing a year-over-year increase of 20.2% at the midpoint. For full year 2026, we are raising our guidance range for non-GAAP earnings per share to $1.95 to $2 per share, representing a year-over-year increase of 24.2% at the midpoint. We are also raising our unlevered free cash flow outlook at the midpoint and now expect a range of $289 million to $295 million or 27.1% of revenue at the midpoint. Before I open it up to Q&A, I want to thank the entire Tenable team for another strong quarter of execution. We are really excited by the momentum we're seeing in the business and expect that to continue into the second half. We look forward to seeing you all at the upcoming Stifel and Piper Sandler conferences. With that, we are happy to open up the call for questions. Operator?

The first question is from Rob Owens from Piper Sandler.

Great to see the DBNER reverse course here at points. Do you think we've hit the low watermark? Or could we see continued volatility? And secondarily, what are you guys seeing from a new customer perspective, especially given all the noise that's been created in the post-Mythos environment?

Rob, this is Matt. I'll take the first part of your question, and then I'll pass it over to Mark and Steve to answer the second part. Yes, we were really pleased to see the net dollar expansion rate increase quarter-on-quarter. And as I mentioned in my prepared remarks, the first time we've seen that in quite some time, and it was ahead of expectations. So seeing that strength come through and in particular, seeing that strength continue on now into the second half, that gives us confidence that, that rate holds steady at 106, that's our expectation for the rest of the year, and that's the expectation that we've built into our guidance.

Yes. And I'll kind of hit on some of the customer demand. I mean, as we kind of talked about a little bit in regard to some of the investor conversations, this has definitely been -- when you look at Mythos and some of the Frontier AI labs, this has been a tailwind without a doubt. So we are seeing strong demand from our customers around exposure management, specifically based on what they've seen and some of the feedback they've been getting from the research that's been done with the AI Frontier labs, again, highlighted with Mythos. We saw a significant uptick in our competitive displacements of customers that might be on old school standard VM wanting to move to an exposure management platform, moving from competition to us. So that was a very strong highlight in Q2. And with the new pricing and packaging we've highlighted, we've now been able to streamline and make it much easier and simpler for customers to move into either foundation or advanced, and we saw a higher percentage move to advanced, which was great. And we're continuing to see the momentum. The last thing is our expansion. We saw some phenomenal expansion. I highlighted one of the accounts in the remarks. We are seeing great expansion opportunity within the installed base. So very strong demand, very happy with what we saw in Q2, and we're going to continue with the momentum.

The next question is from Mike Cikos from Needham & Company.

This is Matt Calitri on for Mike Cikos over at Needham. Wondering if you guys could give some more color on how customers are responding to flex pricing and packaging. I know you noted greater-than-expected adoption of Advance, which is obviously great to hear. But just curious if there's anything you could share on if customers are in any way rationalizing certain asset types in favor of others? Or if there are any leading indicators in terms of what the actual uplift looks like?

Yes. Well, as Mark commented earlier, we're very pleased with our expansion this quarter and our new lamps. Something that we talked about earlier, but one of the big takeaways from the quarter are higher average selling prices. I couldn't be more pleased. And pricing and packaging is playing a big role. More customers opted for Advanced, which has a notably higher selling price in comparison to stand-alone VM. We added a healthy number of net new 6-figure customers, but the big takeaway was the number of net new 7-figure customers, which more than double than what we typically do with one of our best net new 7-figure customers adds in nearly 2 years. Customers -- and what drove that is really 2 things. Number one, customers migrating from stand-alone products into the platform at a greater rate. And then number two is the customers that are in Tenable One that are expanding where we're doubling and increasing the selling price there dramatically. And things just feel different since April in a post Mythos world. I think customers recognize they need unified visibility. They need unified insights and they need to be able to take action deterministically. And that's exactly what the platform does. That's what Hexa AI does. And things feel different, and we feel really good about the setup for the second half of the year and have confidence in our ability to continue to execute here.

The next question is from Patrick Colville from Scotiabank. Conner Weed This is Conner Weed calling in for Patrick. And we were just wondering what the initial feedback on Hexa was looking like from customers? And if you could remind us of what the average selling price kind of uplift looks like for customers moving from VM to Hexa. And if there is a scenario where customer spend goes up to remediate a lot of vulnerabilities that we're seeing kind of currently, but then customer spend kind of falls back as well.

Yes. Just I'll comment a bit on kind of what we're seeing from a demand perspective. So Hexa, we launched in Q2 has actually picked up to a very, very high level in regard to customer adoption. So we now have hundreds of Tenable One customers using Hexa. And as we highlighted, they're not just using Hexa to go get more information and content. They're actually taking prompts, they're taking actions. They're automating significant parts of how and what they do around automated remediation. Some of the use cases that we're starting to see is they're creating dashboards for certain exposure scores. They're identifying and updating different findings, now doing this autonomously. They're being able to manage their tagging environment and managing and scanning workflows from servers and workstations. So the adoption that we have seen has been fantastic. To give you a bit of sense, we actually created a new SKU for incremental tokens for overages from the customers because customers with significant percentages were over on their tokens. So we actually created a SKU to sell them incremental tokens because of the overages. So all of the signs that we've seen since we've launched. And again, early days, there's going to be some great announcements coming out of Black Hat next week, but super happy and the customer feedback has been phenomenal in regard to what they're actually doing with Hexa.

And I'll just add one thing, too. Hexa, as you know, is only available in the platform. And so that was a major driver of customers adopting the platform in the quarter. As you know, there's a significant price uplift going from stand-alone VM into Tenable One. And we think a big driver of the record adoption that we had in new business in Tenable One is 50% this quarter was due to some of the improvements that we've made and really a lot of the robust features that Hexa delivers.

The next question is from Rudy Kessinger from D.A. Davidson.

Congrats on the nice results here. You guys mentioned that the uptake of Advanced was higher than your expectations versus Foundation. Could you share any more color on what kind of that split looks like for new logos who are taking Tenable One in terms of what percent are taking Foundation versus what percent are taking Advance?

Yes. So Advanced -- this is Matt. Thanks for your question. Advanced this quarter benefited at a ratio of something like 2:1 versus Foundation. So it was a meaningful percentage higher than what we had seen in Foundation for the quarter.

And the only thing I'll piggyback on that is what we saw with the customers and why we are seeing this significant adoption on Advanced compared to foundation is there are some things with foundation you get. There's some specific cloud CNAPP capability that you get in Advanced that was a very big driver. We're seeing strong demand for cloud security. You get some advanced capabilities around attack path analysis and some scoring within Advanced, which was a big differentiator. You also get a significantly more amount of tokens when you go with Advanced. So some of these customers that want to be able to leverage Hexa are getting a significant incremental amount of tokens in Advanced compared to Foundation. And they just have more domains, more assets that can actually go in different types of assets. So we were extremely pleased with that motion and what we saw. And I think it's one of the reasons that you're now seeing 50% of our new business coming in from Tenable One. I think the pricing and packaging had a lot to do with it and our sellers and our partners are getting just more comfortable talking to our installed base and our competitive opportunities about it.

Great. And then for my follow-up, it sounds like you've got really some good early momentum following Mythos. You talked about NRR kind of being stable at 106%. I know there's some noise of volatility in both CCB and cRPO. And so with revenue, I guess, being the best indicator of the business for the time being, when might we see some of this momentum you're seeing translate into accelerated revenue growth?

Yes. So some of that we're seeing already. So like we've talked about before, that first step to inflecting growth higher is really to stabilize our top line growth rate. And the good news is we're seeing early signs of that. We saw that this quarter. So pipeline, super strong this quarter. Competitive win rates, very strong this quarter. We had one of the strongest quarters in expansion that we've had, expansion growth that we've had in quite some time. And so what that enabled us to do is to raise guidance by $5 million at the midpoint for the full year, which is great. You saw our 106% NDRR rate, which was excellent also. And then one of the things, when we started the year, we talked about CCB being roughly in line with consensus expectations. And as we sit here today, we think that, that's probably $8 million to $10 million higher than where we started the year with the majority of that benefiting the back half just based on the strength and the momentum that we've seen so far.

The next question is from Jonathan Ho from William Blair.

With your existing AI solutions, what's been sort of the customer feedback? This is the non-Hexa solution? And can you talk a little bit about maybe what that means from an asset coverage standpoint? Is that potentially growing as well as people start to look at the existing solutions that you have?

Yes, Jonathan. First, just some color on Hexa. I think Mark talked about the kind of the commercial traction that we're getting, but it's worth adding a little more color. We're off to a terrific start with Hexa AI. We see it in Q2, more than 80% of the users in Hexa, summit prompts and use it to take action. And over 90% of the actions that Hexa recommends are accepted by customers. We're continuing to innovate there. We introduced recently advanced multistep reasoning and automated remediation workflows. And now we have Hexa that's always on, orchestrating like a continuous autonomous defense without needing humans to reprompt. So we're getting great traction there. I think you asked about our non-Hexa capabilities as well. And that would take us really to exposure AI, AI exposure, which is important because it addresses a couple of key use cases. And we do really 3 things, right? And if you think about Hexa AI is the ability to take action within the platform deterministically with trust, what AI exposure does, it helps customers understand AI as a threat vector, which is one of the biggest blind spots in all of security today. And look, it starts with visibility, and we do 3 things. Number one, visibility, and we help discover what's running in a customer's environment, shadow AI agents, browser plug-ins, APIs, things like that. The second thing we do is we provide infra protection, infrastructure protection related to AI models, workloads and agents themselves. We can discover agents. But more importantly, we understand when agents are connected to and what they have access to and whether it's exposed to the Internet and what kind of permissions kind of surround agents and if there's identity weaknesses. And the third thing, we monitor customers' use of prompts across a wide range of models and ties back to security policy. So both on the front end, helping customers understand their posture and helping them secure their use of AI as well as AI infrastructure and also helping them take action deterministically with trust on the back end and the platform so they can reduce their risk. So we're certainly at the forefront of AI and security and we have a big role here to play, and you're starting to see some really good traction on it.

Excellent. And just as a quick follow-up, you talked a little bit about your harness advantages relative to other exposure management providers. Can you talk a little bit about what you have that's unique there? And are you concerned at all about the LLM providers maybe trying to move more upstream into your area? Can you just talk about the barriers to entry there?

Sure. And it's something we talked about at Investor Day. I mean look, the moat here, we're likely starting to see the commoditization of the intelligence layer. I think models will continue to get infantly good, and that's important. There's also open weight models that give enterprises flexibility and control to effectively deploy AI in their own environment. Again, the best model today may not be the best model tomorrow or 6 months or even a year from now. But with that, the real moat, we think will be above the model and below the model. The real moat will be the application layer, which provides the context and trust to run these models safely and securely and deterministically in your environment. And Hexa was built with this in mind. Hexa routes the right task to the right model, frontier or otherwise and allows customers to take action in near real time with confidence. And also moat is below the model, which is the extensive sensor layer and the ability to deploy agents and scanners and sensors on a wide range of domains to be able to collect data. We have one of the largest data fabrics in all the security, one of the largest customer bases. We're deeply embedded behind the firewall. It's proprietary. It's unique to us. And now with our harness, which is the scaffolding around the model and orchestrates the workflow and allows us to take action and to reduce risk with customers deterministically. That's an important part of the value add. It's one of the reasons why customers are increasingly choosing Tenable One. It's one of the reasons why 50% of all of our new business is coming from the platform. And we feel really good about differentiation in them.

The next question is from Brian Essex from JPMorgan.

I guess -- I would love to follow up and get your feel, and I apologize if I missed it, we're bouncing around between a few calls. But the one thing that resonated throughout this quarter across the last quarter across most of the companies that reported in this quarter across most of the partners that we spoke with is that CFOs or CIOs are freaking out about Mythos. And it's leading to an elevated threat environment, and there's an emphasis to push to get the most updated software operating systems, hardware into those enterprise networks. And I just want to kind of take a step back in terms of what you've commented on in terms of pipeline acceleration, how companies are engaging with you to address those concerns and how an elevated pipeline might convert to revenue as you kind of walk through the year, how much visibility you might have on that?

Yes. So let me take a shot at that one because there's a couple of different parts of it. So first and foremost, right, the Mythos kind of AI lab discussion is still omnipresent, right? So it's still happening. It's still going on. There's still an enormous amount of interest from customers on, a, what we've learned as a cybersecurity company and the pressure they're getting from the Board of Directors and from the CEO. And so it is definitely creating this demand. It is creating sense of urgency. So when you're talking to CISOs and they're saying, "Hey, we know that there's going to be this massive influx of vulnerabilities and all of these other potential risks coming down the road." We know that one of the most productive things we can do is have a preventative and proactive exposure management platform so we can actually get ahead of it and understand what's happening and get true visibility across the entire attack surface. And so we are going in having those discussions, and that's why you're seeing Tenable One hit that 50% of new business because customers want to get RPM. They want to get all the benefits of exposure management, and they are doing it with more urgency. So you're definitely seeing that. That's why Matt commented, we are seeing accelerated pipeline. Obviously, we feel great about what we achieved in Q2 and the guide that we gave for Q3 and Q4. There is a significant amount of momentum in this business right now and in exposure management. And so that is definitely a tailwind without a doubt. From a budgeting perspective, it isn't -- you're not seeing this massive incremental flow of budgets saying we're going to increase the cyber budget by 10%, 15%, 20%. What you are seeing is this consolidation story happen at a very rapid pace. They do not want to have the number of tools. They want to consolidate. They want to do more, right, with fewer vendors and have platforms. And so you're seeing these exposure management projects happen at a faster pace, and that's why you're seeing kind of the positivity and some of the momentum we're seeing in our business because that's what's happening at the customer level.

And is that permeating through like the network scanning exposure that you might have? In other words, are they scanning more of their estate? Or are they just taking what they have and then focusing on the analytics aspect of it?

No, it's a great question. It's both, but we did see a very significant pickup in our expansion business in Q2. So we absolutely saw our installed base customers expand the asset coverage to, again, get better visibility on what's happening in the environment. So we absolutely saw that. And we saw them look at incremental different types of assets. So we had a very strong OT quarter. Very strong OT quarter around the globe, especially in the federal government. It was outstanding. We saw strong cloud demand for that asset type. And so it's both expanding overall coverage within their environment, their infrastructure environment, but then also looking at incremental asset types.

The next question is from Meta Marshall from Morgan Stanley Investment Management.

This is Abhishek Murli on for Meta Marshall. Could you talk us through some of the dynamics you're having with customers as they are looking to move towards automated remediation? I understand there was some press release in intra-quarter as well on this, but I would love to hear what you're hearing on the ground. And then I have a follow-up.

Yes. I think Mark talked about the momentum that we have with customers. This is a quarter where we added over 300 new customers, a healthy number of new lands. This is a quarter where we added a healthy number of new 6-figure customers. The big takeaway was really the expansion within the customer base and the higher selling prices and packaging and pricing plays a big role in that. And with that, there's really 2 core use cases around our pricing and packaging. Number one, Foundation, which is all about unified asset visibility with discovering and continuously inventorying assets across a wide range of domains. But as Mark called out, the reason why customers are choosing overwhelmingly advanced where the selling prices are notably higher, which is having an impact not only on the results for the quarter, but gives us confidence to have a really good raise for the full year is really because of the ability to take action and measure risk for customers. So the orchestrator remediation comes in advance. Risk measurement and benchmarking and scoring, that comes in advance. That's a big problem, and that's the problem we're here to solve. That's the critical asset in the AI and the agentic era, and that's the moat we have. So things, as I mentioned before, feel different. Customer conversations feel different. Obviously, all of this has to go through procurement and sales cycles. But we feel really good about what we're seeing in the business, and there's some good early signs of strong momentum here. And that's the takeaway.

Super helpful. Maybe as a follow-up, you also laid out in the Analyst Day that the Tenable One platform could be around half of revenue in 2029. I guess given the traction you're seeing across the portfolio, is there a potential that to happen sooner?

We're definitely seeing progress towards that goal. I think at the time of Analyst Day, we called out Tenable One making up roughly 1/3 of our total business. That number is increasing. We hope to get it up to 40% by the time we get to the end of the year, and we've made some progress against that goal already. So having a quarter like we had in Q2 where we had a record amount of new business coming into the platform certainly helps. But we've increased from 1/3, and we're on our way to 40% and hope that, that's where we get to by the end of this year.

The next question is from Joseph Gallo from Jefferies.

This is Grant Darling on for Joe Gallo. I wanted to circle back real quick on competition as I think it's certainly clear that exposure management is increasingly important in an AI world, which puts you in a great position. But I wanted to ask, has there been any changes in competitive dynamics with regard to some of these larger platform vendors, especially with them trying to embed some of these LLM technologies and what you're seeing there?

Yes. I mean, listen, we commented on a couple of the customer examples that we gave and in some of the commentary. This is one of the best competitive quarters we have had. Our compete level in regard to the deals of [indiscernible] and replacing incumbent players was unbelievably strong with very specific programs, which grew double digits in Q2. So we're super happy to see that. And it was a very strong quarter in regard to some of the larger players that have pricing and packaging where they talk to a customer and want to give away free capabilities as part of their pricing and packaging, we had a very strong quarter there. There are certain things when you look at Tenable One and exposure management about visibility, right, in the entire environment that we see that these players simply do not see. We've got massive advantage around our accuracy and finding significantly more vulnerabilities in some of these free solutions bundled in. We also -- when you look at just the coverage, the amount of coverage we have around [indiscernible] coverage is exponentially more than that. So when we deal with CISOs and lay out the technical differentiation we have, we have an extremely high win rate and compete level. And we saw that without a doubt in Q2.

The next question is from Jonathan Ruykhaver from Cantor Fitzgerald.

So I'd like to just talk about the importance you see of identities within exposure management. It would just seem to me at least from a high-level view that including a view of [indiscernible] that includes exposure risk related to identities kind of broadens out an exposure management view. And I know you have the Tenable identity exposure solution in the market. We haven't heard much in terms of adoption. But just where are customers around that vision of including identity risk Path? And what do you expect to see out of that solution looking out the next couple of quarters?

So what we're seeing is you're 100% right in regards to the importance of identity. And where we have really taken the identity technology that we've had, we've very much from an engineering perspective, been focused on embedding it seamlessly into Tenable One. And so instead of selling it as an independent identity solution, it's about how do we get leverage within the Tenable One platform. So when you hear us talk about one of the big differentiators, which is our attack path analysis, that is a huge play from an identity perspective, where we're able to differentiate and get insight into certain areas around the attack path that other platforms simply cannot do. So it is definitely -- when you look at kind of decision criteria being created for exposure management platform, it's one of the areas that we differentiate. We've got a long history in the identity business. And now it is embedded into Tenable One, and it's allowing us to get leverage based on the advanced feature set and capabilities and monetization of identities also.

So is it more about driving that attach across Hexa and exposure management or compared to the monetization opportunity, just explain that.

Yes. This is Steve. And just what Mark said, it's really an important contextualized feed in the platform itself. And so the ability to first identify flaws and exposures. And if you look at our data fabric, a substantial percentage of what we have is non-CVE related. So understanding critical vulnerabilities and exposures, understanding where they exist across what asset systems, devices, workloads, models and then more importantly, understanding if those laws and exposures are on those systems that have sensitive data for the contextualization. All of that feeds into and is scored with regard to risk. And so prioritization becomes critical where the identity is an important aspect to that because we need to look at the access and entitlements. So in order to identify attack paths, you need to basically aggregate and change together all of these different exposures. You need to understand prioritization and contextualization, which we're able to do leveraging our harness and therefore, be able to take action. So access and entitlements are important here. You have to understand in the event that there's an incident or attack, what is the blast radius, who owns which assets, which systems. So it's an area we're going to continue to focus on. But it's one of the reasons why customers continue to buy the platform. It's an important part of the value add when it comes to attack path analysis.

The next question is from Joshua Tilton from Wolfe Research.

This is [ Yvon ] here on the line for Josh. Maybe one more on the competitive side. Microsoft announced a VM program a couple of days ago. So I just wanted to get your thoughts on how -- what are you thinking about that? And how do you see Tenable's positioned in this context?

Yes. I mean, listen, we feel very, very strong. As I said, a lot of the points that I brought up earlier fall into that category in regard to when we're discussing Tenable One and we're discussing exposure management, they're really -- right now, especially with some of the front AI labs and the heightened threat landscape and some of the things you're seeing around some of the state-sponsored attacks that happened, for instance, in Minneapolis, people and CISOs are looking for best-of-breed from an exposure management perspective. So we feel, again, very, very confident about our compete level against Microsoft and what was launched. And we just will keep on working with our CISOs and walking them through the value prop of what we do from a Tenable One perspective.

The next question is from Kingsley Crane from Canaccord Genuity.

So I appreciated the comments on differentiation above and below the model. At the Investor Day, you talked about part of that differentiation coming from 300,000 plug-ins built over time, producing around 100 new plug-ins per week. So if AI is reducing time to exploit and then with what we've seen with some of these more novel agentic attacks, I'm just wondering if there's room to accelerate the new plug-ins per week with AI-enabled threat discovery, tying into your deep partnerships with OpenAI and Anthropic or even using some of those open weight models. Just kind of curious your thoughts there.

Yes. The short answer is we are. So I think the point we made at Investor Day is that humans in the loop still matter, humans doing research. Providing plug-ins and coverage for 0 days well before even a cab is published. But we're also leveraging AI in a way to create plug-ins and automate the process. You still need a humans in the loop to exercise judgment. But look, threat actors have the ability to weaponize AI and move at machine speed. And so our goal here with the platform and exposure management is to be able to put capability in the hands of defenders so they can move even faster. Mean time to exploit here, I think, has compressed over the year from 30 days down to 1.6 days. If you look at the average SLA for applying a patch, that's like 30-plus days. So we have to do better. That imbalance right there creates the risk. It's one of the reasons why in a post-Mythos world, customers are increasingly choosing the platform. Our goal is to not build a bigger telescope here. Our goal is to tie vulnerabilities and exposures to fixes and to fix things to shrink the attack surface, to take action, change configurations. So what you mentioned here is exactly how we're applying AI. We're applying AI only in the product, but also on the back end on the plug-ins and the coverage, and it's one of the reasons why the number -- our coverage in our database continues to grow. And we have one of the largest data fabrics in the market, and it's driving the actions that we can take deterministically with Hexa.

The next question is from Shaul Eyal from TD Cowen.

Steve, a very simple question. What are your hiring plans into the second half of this year? Or maybe in other words, how do they build on the first half of 2026, given the success you're seeing out there?

Yes, great question. We saw -- some of the highest levels of productivity in sales that we've seen in a few years here. We are going to add capacity in the second half of the year. More capacity in the second half than we've added really over the last 2 years. So we have confidence to go out and invest. We have confidence that we'll generate return. Mark and I spent a lot of time on this. And we're going to continue to invest and balance growth with profitability. So we see a big opportunity here, and we're pleased with the productivity levels and the achievement rates against quota, and we're leaning in.

The next question is from Richard Poland from Wells Fargo.

So I just wanted to get an understanding of -- it sounds like there's a lot of excitement around just the value proposition that Tenable is able to deliver, the activity that's kind of going on, whether it's actually converting to pipeline or not. But I guess like I think one of the things investors are going to struggle with is when you just look at kind of what's implied in Q4 revenue growth and just the back half guidance, it's still not perking up to the tune of exactly what we've been hearing in the whole call. So I guess just to level set, help us bridge kind of the excitement or activity you're seeing in the market, some of the competitive displacement with just kind of where numbers are headed.

Sure. Yes, I can take that. I think just to level set, right, we are in a better spot today than we were 90 days ago with respect to the second half and pretty meaningfully. And as you know, revenue is a lagging indicator, right? It takes a while for -- when you book a deal, of course, to recognize that over the course of the contract because we're recognizing that revenue ratably. So we took the guidance up for the full year by $5 million at the midpoint. And of course, a portion of that is in the second half. But then importantly, and I mentioned this earlier in response to your question, our expectations with respect to CCB that we laid out at the beginning of the year have improved by $8 million to $10 million, and the majority of that is coming into the second half. And so I think that's important. When you break down the kind of Q3, Q4 dynamics with revenue, that's -- there's a little bit of timing going on there with expectations when we think professional services are going to come in. But the key takeaway is that the second half is better for revenue and meaningfully better when you look at our short-term billings.

This concludes the question-and-answer session as well as today's teleconference. You may disconnect your lines at this time. Thank you for your participation.