Tenable Holdings, Inc. (TENB) Q3 2026 Earnings Report, Transcript and Summary

Greetings, and welcome to the Tenable Q3 2026 Earnings Conference Call. [Operator Instructions] As a reminder, this conference is being recorded. It is now my pleasure to introduce your host, Erin Karney, Vice President, Investor Relations. Thank you. You may begin.

Thank you, operator, and thank you all for joining us on today's conference call to discuss Tenable's third quarter financial results. With me on the call today are Co-Chief Executive Officers, Steve Vintz and Mark Thurmond; and Chief Financial Officer, Matt Brown. Prior to this call, we issued a press release announcing our financial results for the quarter. You can find the press release on our IR website at tenable.com. We will make forward-looking statements during the course of this call, including statements relating to our guidance and expectations for the fourth quarter and full year 2026, growth and drivers in our business; changes in the threat landscape in the security industry, particularly regarding AI security, the expected impact of frontier AI models on accelerated vulnerability discovery and the shift to preemptive security, the expected size, durability and growth of the market opportunity created by the shift to AI-driven exposure management; our competitive position in the market; growth in customer demand for and adoption of our solutions, including the impact of new pricing and packaging models, the expansion of Tenable One, including Agentic AI security, orchestration through Hexa AI and planned AI exposure coverage across third-party models, the expected growth, adoption and role of our CyberAgents Exchange in the Agentic Security ecosystem; the expected benefits of our strategic partnerships with Frontier AI Labs, our ongoing research and development investment, our capital allocation strategy, including share repurchases and our future results of operations and financial position. These forward-looking statements involve risks and uncertainties, some of which are beyond our control, which could cause actual results to differ materially from those anticipated by these statements. You should not rely upon forward-looking statements as a prediction of future events. Forward-looking statements represent our beliefs and assumptions only as of today and should not be considered representative of our views as of any subsequent date, and we disclaim any obligation to update any forward-looking statements or outlook. For a further discussion of the material risks and other important factors that could affect our actual results, please refer to those contained in our most recent annual report on Form 10-K and subsequent reports that we file with the SEC. Today's discussion includes non-GAAP financial measures. These non-GAAP financial measures are in addition to and not a substitute for or superior to measures of financial performance prepared in accordance with GAAP. There are a number of limitations related to the use of these non-GAAP financial measures versus their closest GAAP equivalent. Additionally, please see our press release for reconciliations of GAAP to non-GAAP financial measures that we discuss today. I'll now turn the call over to Steve.

Thanks, Erin. We delivered excellent results in the third quarter. On our last call, we discussed the increasing momentum in our business. And this quarter, we are very pleased to see that momentum start to translate into acceleration. What excites me most are the leading indicators, which show inflection and signal durability of growth ahead. Our net dollar expansion rate accelerated to 107%, up from 106% in Q2, which is the first time in over 4 years we've seen acceleration in the expansion rate for 2 consecutive quarters. Tenable One reached a record 59% of new business, up from 50% in Q2. Average Tenable One deal sizes year-over-year rose for the second straight quarter, driven by the pricing and packaging we introduced earlier this year. And CCB accelerated to 9% growth in the third quarter. These results demonstrate that we're delivering what customers need most, which is the ability to see and act on risk across the entire environment at the speed this new era demands and no force is shaping that more than AI. Before we dive into the product updates for the quarter, I want to touch upon PHP2Shell, the critical vulnerability disclosed last week. Earlier this year, we said AI would surface more vulnerabilities and exposures faster. That's playing out now. PHP runs nearly everywhere in the enterprise, including web applications, cloud workloads, containers and legacy systems. The vulnerability is the headline, but the risk goes beyond the vulnerabilities themselves. Organizations need to find affected instances, including those they may not know about and understand how they connect to misconfigurations, credentials and critical systems. Following PHP2Shell disclosure, customers turned to Hexa, and we've seen prompt volume increase dramatically by as much as 5x. Beyond Hexa, customers have been turning to Tenable as a trusted partner during this critical time, and we've been working closely with them to ensure they can leverage the full power of the platform to reduce their exposure. PHP is a real-time example of a broader shift in the market, and that is AI is reshaping the attack surface faster than most organizations can respond. This is more than a moment. It's a mandate and a structural shift for enterprises. As a result, every enterprise is adopting AI and every model, every agent, every MCP server they deploy creates new exposures. Meanwhile, attackers are using frontier AI to find weaknesses faster, and we're now witnessing the early automation of exploit development. The risk extends well beyond CVEs, and we believe this is a powerful demand catalyst for exposure management and a significant growth opportunity for Tenable. As I outlined last quarter, winning in exposure management requires 3 capabilities: understanding every exposure, prioritizing what matters most and acting with speed and confidence to reduce risk. As frontier models become widely available, intelligence itself becomes abundant. The differentiator is putting it to work safely. That's the Tenable advantage, decades of exposure intelligence, deep visibility across the attack surface and an AI harness that keeps agents acting safely with human oversight and an audit trail. In this quarter, we significantly expanded what that platform can do across all 3. In September, we announced that we're bringing Anthropic's Claude Mythos into Tenable One. This expands our partnership with Anthropic beyond Project Glasswing. Our first capability powered by Claude Mythos, Tenable One Adversary View, lets security teams see their environment through the eyes of an attacker. Every time Tenable assesses the system, we learn what's running on it, how it's configured, who can access it and what it connects to. Adversary View applies Mythos to that telemetry to reason like an attacker. It sees how low signal exposures can be chained together to reach critical systems, then recommends the specific fixes that break those chains. It's a compelling example of how we're turning frontier AI into differentiated capabilities designed to keep customers ahead of emerging threats. We also expanded Tenable Hexa AI, our agentic engine for Tenable One. Hexa now works as a coordinated fleet of agents that continuously identify critical exposures, orchestrate remediation and verify fixes even when security teams are offline. Since June, Hexa has evaluated more than 2 billion assets and findings, which enable Hexa users to resolve more critical and high-severity vulnerability detections per month than match peers and patch actively exploited vulnerabilities faster. Tenable Hexa AI saves security practitioners time and resources, enabling them to reclaim analyst capacity, maintain always-on defense and dramatically reduce mean time to remediation. Importantly, Hexa is model agnostic. It works with leading frontier and open weight models, so customers benefit as those models improve, while our harness keeps every action grounded in validated exposure data. Finally, we launched the CyberAgents Exchange, the industry's first open source vendor-agnostic registry for cybersecurity AI agents and skills. Its AI inspector pairs OpenAI's ChatGPT cyber models with Tenable researchers to vet community-built components before enterprises deploy them, putting Tenable's data and expertise at the center of trusted agentic security. Cybersecurity used to be about detecting and triaging threats. Today, it determines how fast the world can adopt AI. As a result, security is no longer a line item inside IT. It's becoming its own business function with a budget tied to business risk and growth. We believe Tenable is uniquely positioned to lead in this AI era, and the momentum we are seeing today gives us confidence in the durability of growth ahead. With that said, Mark will now walk you through how the momentum we are seeing is showing up with our customers. Mark?

Thanks, Steve. Before I jump into the quarter, I want to touch on what we're seeing in the field and how we've responded to PHP. Tenable Research closely tracked the situation as it evolved. We provided constant updates to help educate and prepare customers so they were ready to act. We shipped plug-ins overnight and kicked off a series of customer webinars. Attendance has been off the charts. Moving on to the quarter. The shift that Steve described is showing up in how customers are buying. Last quarter, we said conversations were turning into action. This quarter, pipe build is turning to conversion. We saw clear signs that customers are adding incremental budget to their exposure management programs with Tenable One, both with new lands and existing customers. Q3 was our best quarter ever for Tenable One new logos with more than half of the new logos landing on our Advanced package. At the same time, existing customers are broadening their commitment to Tenable One, and many of our largest deals this quarter were vulnerability management customers converting to the full platform. Platform expansion was the primary driver of our acceleration in net dollar expansion rate and average deal size. When customers consolidate onto Tenable One, they bring more asset types and more of their attack surface with them. We see 2 primary factors behind the increased demand for Tenable One. First, customers need a comprehensive platform with a broad set of capabilities to manage risk in a post-Mythos environment. And those capabilities are only available in the new Tenable One packages. Second, our pricing and packaging continues to make the path to the platform easier. As a result, we ended the quarter with more than 5,000 customers on Tenable One. Both pricing tiers are doing what we designed them to do. The Foundation tier gives customers a simple way to start on the platform and grow over time. The Advanced tier gives organizations facing the most acute AI [ era ] risk the broadest set of capabilities from day 1. And it is clear that AI capabilities are pulling customers deeper into the platform. We're hearing directly from customers about how Tenable Hexa AI is changing the way their teams work. Tasks that used to take weeks are now getting done in hours. Analyses that once took days of exports and scripts now take minutes. Some customers are building their first automated routine on day 1, and others are connecting their own agents to Hexa to drive remediation. Customers using Hexa resolve 2 to 3x more critical exposures across all affected asset types in their environment than comparable customers. The common thread is that security teams are spending less time gathering information and more time reducing risk, essentially letting the same security team do the work of a much larger one. And the more they use it, the better the results, with our largest and most complex customers seeing the biggest gains. Let me bring these trends to life with 3 customer examples from the quarter, a couple of which we believe were Mythos-driven expansions. A global industrial leader selected Tenable One over a leading endpoint security platform provider in a competitive evaluation. Despite the competitor's aggressive bundling strategy, the customer chose Tenable One for its superior asset discovery, broader exposure visibility, Hexa agentic AI capabilities and being able to consolidate multiple security tools into a single platform. This example reinforces our competitive advantage as customers look for a more comprehensive approach to exposure management in the post-Mythos era. In another example, a Fortune 100 global technology leader significantly expanded its investment in Tenable One through a multimillion dollar agreement extending its deployment to the full platform. The customer was one of our largest VM deployments with millions of assets across business units and geographies. They are expanding with Tenable One to consolidate security capabilities, simplify operations and manage exposure at enterprise scale. We are deepening strategic relationships and driving substantial platform expansion within our installed base. And finally, a global software company expanded its Tenable contract by nearly $1 million with our cloud security offering, providing differentiated capabilities over a leading endpoint security platform provider. The customer is also adopting Hexa AI capabilities with early indications of time savings. Our comprehensive platform and AI-driven innovation is driving larger deals with additional asset coverage. Together, these wins reflect the trends we saw throughout the quarter. These trends include AI-driven urgency for exposure management and meaningful expansion, specifically with our VM customers upgrading to Tenable One. There was also strong adoption of Tenable One within new customers along with major competitive wins. Additionally, Steve mentioned our CyberAgents Exchange. Beyond advancing the broader cybersecurity community, the exchange is also demonstrating commercial value. We are already seeing a strong response, particularly considering it was introduced in August. A great example of what we've seen was a Tenable One win at a financial services company. The CyberAgents Exchange helped influence this competitive deal where agentic AI was a key purchasing requirement. We're also seeing the exchange become an important point of engagement with enterprise customers, reinforcing the differentiation of Hexa AI and Tenable One. We believe the exchange positions Tenable to play a central role in the emerging agentic security ecosystem, creating new opportunities to drive platform adoption as this market develops. And finally, a word on why we're winning. We compete with large platform vendors, with legacy vulnerability management providers and with new entrants. What we are seeing in the field is that customers are selecting Tenable for the breadth and depth of our exposure data, our multiple asset types, advanced prioritization and for a harness they can trust to act in their live environments. This is all showing up in our winback reports and competitive displacements. Now with that, I'll turn the call over to Matt to discuss our financial results.

Thanks, Mark. The product innovations and competitive wins that Steve and Mark just spoke about translated to excellent results in the third quarter. Tenable One represented an all-time high percentage of new business, driving third quarter results above the high end of the range for every metric we guided to. And we are once again raising our full year outlook, reflecting the growing momentum we're seeing in the business. Let's dive into the details. Revenue for the quarter was $276.4 million, representing growth of 9.5% year-over-year. The year-over-year growth in revenue as well as outperformance relative to guidance was driven by strong expansion within existing accounts and underpinned by continued strength in renewals. Our percentage of recurring revenue remained high at 95% for the quarter. We had a record quarter for Tenable One with 59% of new business coming from the platform, a new milestone, up from 50% in the prior quarter and 39% in Q3 of last year. As Steve discussed, we continued to make platform enhancements in Q3, including equipping security teams with autonomous agentic capabilities with Hexa AI and bringing Anthropic's Claude Mythos for frontier cyber reasoning in Adversary View. Advancements like these are helping accelerate the adoption of Tenable One with new and existing customers. We added 413 new enterprise customers in the quarter and added 39 net new 6-figure accounts. With the continued shift towards Tenable One, average deal sizes are increasing, which helped drive new 6-figure account annual contract value up 18% year-over-year. Our net dollar expansion rate increased for the second quarter in a row to 107%, up from 106% in the prior quarter. The continued acceleration reflects sustained demand in the business and was driven by strong expansion and renewal business. Non-GAAP gross margin was 81.5% for the quarter compared to 81.6% in Q3 2025 and within our typical historical range of low 80s over the past couple of years. Non-GAAP income from operations for the quarter was $74.9 million or 27.1% of revenue compared to $58.9 million or 23.3% of revenue in Q3 2025, an increase of 380 basis points. Growth in profitability in the quarter highlights our ability to steadily increase margins while investing significantly in product development and sales capacity. Non-GAAP earnings per share for the quarter was $0.63 compared to $0.42 in Q3 2025, an increase of $0.21. The improvement year-over-year reflects the growth in profitability and also includes a onetime discrete tax benefit that increased earnings per share by $0.03. Turning to the balance sheet. We generated $69.4 million of unlevered free cash flow during the quarter compared to $58.5 million in Q3 2025, an increase of 18.7% and ended the quarter with cash and short-term investments of $495.3 million. During the quarter, we raised $800 million in a convertible note offering, using the proceeds to pay off our existing Term Loan B, enter into a capped call transaction with a cap price of $64.06 per share and repurchased 5.3 million shares for $170.5 million. In addition, on October 13, we closed a revolving line of credit, giving us access to $400 million in additional liquidity. The net result is overwhelmingly positive. We pushed out the maturity of our debt to September 2031, reduced our shares outstanding, expanded our liquidity capacity and added $186 million in cash to our balance sheet, all at a significantly lower overall cost of capital. In addition to the shares we repurchased in connection with the convertible notes, we repurchased 1.5 million shares for $53 million during the quarter and have $54 million remaining on our current share repurchase authorization as of the end of the quarter. In total, so far this year, we've repurchased 18.2 million shares for approximately $454 million, reflecting an average repurchase price of $24.93. Our repurchase program remains an active pillar of our capital allocation strategy, reflecting our view that returning capital to shareholders through buybacks represents an effective use of our free cash flow given the underlying strength of the business. Turning to the financial outlook for Q4 and full year 2026. Given the continued strength we've seen through Q3, we are raising our full year 2026 guidance range for revenue to $1.084 billion to $1.087 billion, representing a year-over-year increase of 8.6% at the midpoint. For Q4, we expect revenue to be in the range of $277 million to $280 million, representing a year-over-year increase of 6.9% at the midpoint. We are also raising our full year 2026 guidance range for non-GAAP operating income to $270 million to $273 million or 25.0% of revenue at the midpoint, which is a year-over-year increase of 310 basis points. We expect non-GAAP income from operations for Q4 to be in the range of $67.1 million to $70.1 million or 24.6% of revenue at the midpoint. The outperformance we drove in operating income so far this year, along with the favorable impact to interest income and expense in Q4 as a result of our debt refinancing, is driving significant incremental upside to net income and earnings per share for the year. In addition, the onetime tax benefit we realized in Q3 drove a benefit of $3.3 million to net income and $0.03 to earnings per share. As a result, we are raising our full year 2026 guidance range for non-GAAP net income to $250 million to $253 million, representing a year-over-year increase of 29.4% at the midpoint. We expect non-GAAP net income for Q4 to be in the range of $63.6 million to $66.6 million, representing a year-over-year increase of 13.6% at the midpoint. Due to the increase in non-GAAP net income, we are raising our full year 2026 guidance range for non-GAAP diluted earnings per share to a range of $2.16 to $2.19, representing a year-over-year increase of $0.59 at the midpoint. We expect non-GAAP diluted earnings per share for Q4 to be in the range of $0.56 to $0.58 per share, representing a year-over-year increase of $0.09 at the midpoint. Before I open it up to Q&A, I want to thank the entire Tenable team for another excellent quarter of steady execution. We're looking forward to closing out the year strong. With that, we are happy to open the call up for questions. Operator?

[Operator Instructions] The first question is from Mike Cikos from Needham & Company.

Congratulations on the strong results here. Great to see the net dollar expansion and the 9 handle on that CCB growth. First question for Steve, if I could. But I think the key metric to me that stood out in your prepared remarks was the 5,000-plus Tenable One customers you have today. And really, I'm thinking it was probably a year ago where the company was citing just 3,000. So you've seen a meaningful uptick as far as that pool of Tenable One customers you're touching. I would just love to get a better sense. Can you help us segment Tenable One customers, like how many are coming from existing customers adopting Tenable One versus new logos to the platform?

Management, your line is open. One moment while we reconnect the speakers. [Technical Difficulty] Thanks, everyone, for your patience. We're just reconnecting the speakers while they dial back in. Thanks for your patience. All right. You can go ahead. You are now reconnected.

All right. Hopefully, everyone can hear us. We have absolutely no idea. We got disconnected. I'm not sure. Mike, are you there?

I am. Can you hear me okay?

Yes, I can hear you fine. I'll kind of give you the answer to your question. We have literally no clue what happened. The line just dropped. So -- but listen, in regard to the momentum that we saw in Tenable One, it was across multiple different aspects. So a -- we had an incredible quarter in regard to net new logos landing on Tenable One. So we had 1,413 (sic) [ 413 ] new logos, a significant portion of those new logos were Tenable One. We also saw a huge conversion from our stand-alone VM installed base, hundreds of VM customers transitioned over to Tenable One, which is -- was outstanding. And then we saw a conversion also from our legacy Tenable One onto the new SKU. So every measurement that we track to drive new logo in regard to Tenable One were record-setting quarters. So multiple fronts, multiple competitive wins, that was one of the key drivers of why we had such a successful quarter. Tenable One absolutely crushed it in Q3.

That's great. That's great to hear, Mark. And just a quick follow-up here. I just wanted to tackle the customer examples that you had given as well. Great to hear how Hexa is winning out and Tenable One is really gaining momentum with these enterprise companies. I'm just curious, could you speak to the competition versus those endpoint vendors? And I'm just trying to get a better sense, are they coming up more in these at bats? Or do you see them becoming more competitive with their bundling strategy? It sounds like the win rates are unaffected, but I'm just curious to what degree they're actually showing up in these bids.

Yes. No, listen, they're out there, and we didn't see any change whatsoever from a competitive dynamic in Q3. We did see our win rates improve and increase. And I think it's because our channel and our sellers are extremely efficient now on selling Tenable One, right? So they will -- we will position a VM stand-alone if need be, but the majority of all of our seller interactions and reseller interactions are Tenable One. And our compete level is extremely strong. As you highlighted, one of the use -- one of the customer wins we talked about was against a very large endpoint player. And we won based on the depth and breadth of the platform, all of the different asset types, which is a huge differentiator in Tenable One. Also our accuracy within finding and identifying vulnerabilities, not having false positives. And then you put on top of it now, Mike, Hexa has become a really big driver. It is a huge differentiator. We demo it, we position it on all of our new business, but also it's a big driving force to get VM customers in our installed base and our legacy T1 customers onto the new SKU. So you kind of combine all of that, and we're in just a very, very good compete level right now in regards to T1.

The next question is from Rudy Kessinger from D.A. Davidson.

Again, similar to Mike, congrats on the improvement in some of the metrics here. Firstly, I'm curious as -- let me take a step back. One of the questions I get from a lot of investors is just with Mythos and increase in the number of vulnerabilities being discovered, wouldn't customers be scanning more frequently? And how might that impact the results for a company like Tenable? You mentioned Hexa with PHP, 5x increase in usage in some instances. Historically, you guys have priced on a per asset basis. I guess, as you look forward, as your customers are scanning more frequently, they're patching more frequently, is there any opportunity to maybe evolve the pricing on some of your core VM scanning products in conjunction with Hexa to capture more of that usage in terms of revenue?

This is Steve. Yes, as we've talked about, our pricing and packaging has evolved considerably. So one of the big highlights in the quarter was ASPs. So this quarter, we saw the expansion rate tick up, the selling prices increased, and we also saw CCB consequently increase as well. And so we are having success expanding with our customers. Pricing and packaging plays a major role here. One of the big reasons why is because of Hexa. And as a result of PHP, more customers turn to Hexa, prompt volume increased. And we're also selling Hexa packs back into our base. So we've seen the pricing evolve here. Yes, it's an asset-based pricing model. We'll continue to charge that way, but we're also charging based on volume. We don't want to do it based on the number of scans. We don't want to discourage usage. But if you look at PHP2Shell, I -- because that's really where your question originated, it's a clear signal of where the market is going, right? And it signals 2 things. First is scale. It took the industry 26 years to record over 300,000 CVEs. That's the cumulative total to date since the number of CVEs has been initially recorded many, many years ago. And that's the number of CVEs at the start of the year. This year alone, there's been 90,000 new CVEs that's been published. This month alone to date, it's been 15,000 new CVEs. So the velocity is clearly increasing here. And second, PHP2Shell clearly shows the challenge goes well beyond just the vulnerability itself. Yes, that's the headline, but it's more about the underlying exposure it creates in your environment. And PHP is everywhere, as we all know, and nearly every organization has exposure here. And reportedly, and this is recently, attackers are starting to chain PHP2Shell together with other flaws to now access and compromise identity systems. So the threat is evolving. It's moving beyond remote code execution and that's where exposure management comes in. That's why it's more important now than ever before. We will see more events like this, not fewer, and that's why customers are turning to Tenable, as Mark highlighted earlier.

Okay. Got it. Super helpful. And then secondly, I appreciate the color on that key win versus on the endpoint vendors and the competitive color. One of the questions I also get is, you guys have said you see those endpoint vendors more so in Tier 2 and 3 assets. Can you share any, kind of, figures when you evaluate your customer base, what percent of the assets that you guys are protecting are Tier 1 versus Tier 2 or Tier 3 assets?

Yes, most are Tier 1. I mean, to some degree, there's Tier 2 and Tier 3. We have an asset-based pricing model. And we all know, the real risk here in the AI era is not a single CVE, it's not a single misconfiguration or just access and entitlements. It's the chaining together of all those things into a critical attack path that leads to your most important data. And that's what exposure management is all about. So a lot of it is Tier 1 assets. So that's why the selling prices are higher. That's why we're having success this year, is because we're selling more assets. Customers are turning to us as they lock in place more AI agents and models and applications in their environment, they're turning to Tenable to help secure and assess more of that because it expands the attack surface. So we've seen no change in competitive dynamics as Mark mentioned, and our competitive positioning is very strong as our results would indicate.

The next question is from Jonathan Ho from William Blair.

Congratulations on the strong quarter. One thing I wanted to better understand is, as customers start to shift from planning to buying, can you help us understand how much of the growth that you saw this quarter was driven from asset expansion versus upsell of the product versus just completely buying new products? If you could give us maybe some type of breakdown, that would help us understand the different drivers that are there.

Yes. I'll tell you, it really came from both. I mean this was one of the most balanced quarters that we have seen and really all the different fronts over-executed and delivered, right? So we saw significant expansion in the installed base. And one of the big trends we saw was some of our largest VM customers converting to Tenable One. So we've been working with some of these customers for close to 9 months to get them to convert, and we saw that conversion happen in Q3 with a lot of big global Fortune 1000, Fortune 500 companies moving from VM to T1. So great expansion there. We also saw it within the mid-range commercial space with customers wanting to leverage Hexa because they didn't have as big of security teams and wanted to automate a bunch of use cases and be able to use agentic AI to get more leverage and get more productivity out of the smaller teams they had. So we saw really good execution there. And then as we hit on, right, our net new logo count was outstanding. And then as I highlighted, the percentage of new logos that came in through T1 was outstanding. So really, it was across the board.

Fantastic. And then just as a quick follow-up. With Tenable One adoption, can you help us understand this can serve as potentially a stepping stone for broader adoption on -- the most Advanced versions of Tenable One as well as Hexa, but does it also expand the types of assets that you can cover for customers? Just want to see what you've seen with customers as they've adopted Tenable One and what that road map looks like once you've gotten them on to the platform.

Yes. You bet. I mean what we see, and Matt covers this quite a bit in regard to the expansion, in regard to the margin and the ASPs we see in our deals. When you move up to especially Advanced, you're usually looking at 2, 3, sometimes 4 different asset types. You're also leveraging a much more advanced attack path analysis capability, which a lot of the customers want now. And obviously, you're getting significantly more tokens to run Hexa AI. And then our prioritization is extremely clean when you look at what we're doing from an Advanced package. So it's multiple layers in regard to what we're doing. But we're landing the majority of our Tenable One, when you look at the new logos and you look at the expansion is significantly coming in on Advanced compared to Foundation.

The next question is from Roger Boyd from UBS.

Congrats on the nice results. Good to see pipeline conversion starting to tick up. For Steve or Mark, just on PHP for shell, can you remind us what impact Log4j had on your business? I know it's a little hard to parse out, but what was in some way a tailwind? And how do you see that situation maybe comparable to what's going on with PHP for shell in terms of that driving interest and very clearly helping the Hexa volumes?

Well, over the years, we've seen a number of threats and breaches. And some have had an impact and others have not. And with regard to Log4j, I think [ it ] first surfaced in Q4 of 2021. We saw the expansion rate inflect higher than I think in the subsequent quarter and that was Q4 of 2021 and then in Q1 of '22. We also saw the growth rate expand and new business strength. And look, as we look at PHP2Shell here, I -- our first area of focus is really supporting our customers in time of need. It's too early to quantify right now, but we're -- the impact it will have on our business. But clearly, we're spending a lot of time with customers. Engagement with customers has never been better. We're seeing a record impact on the number of attendees for webinars and web traffic is all up and all the early signals are there. But look, security teams are buried right now trying to figure out what this means for them internally, and that takes time. So our focus is making sure that we're providing the support and the resources necessary to help them assess risk. I think what it also signals is that exposure management is center stage here in the midst of all these AI-enabled threats and AI-enabled attacks and AI-driven exposures. So we see a good durable tailwind of growth for Tenable in the quarters and weeks to come. And I think the results in the quarter are an early sign of this. So PHP had little impact in the quarter, just given the timing, of course, but what's driving the momentum and the inflection of the business today is what we've talked about since the early part of the year, which is -- Mythos is creating not a moment, but it's creating certainly a mandate for us to go out and expand with customers, transact new business, close larger deals. And as a result, exposure management is becoming more strategically relevant to our customers.

Got it. Makes total sense. And then maybe just a follow-up for Matt. Really strong margin performance in the quarter as well as the increase to the guide for the full year. Any considerations you can give us just around gross margin as you move forward? I know Steve mentioned that you're including a lot of Hexa capacity into Tenable One packages. But when you see prompt volume go up 5x, to what degree does that maybe impact, kind of, your gross margin visibility?

Yes. Thanks for the question. So gross margins were 81.5% or so. That's in line with our historical range of the low 80s. I expect that it will probably remain about there. Hexa is not putting pressure on our gross margins because in order to get access to Hexa, customers need to upgrade into the platform, which is a huge pull then for customers to upgrade. And you've heard us say it many times now on this call, Tenable One was a record for us this quarter. Hexa was a big part of that. And so once customers are into the platform, their upgrade and the price increase and the value that they get along with the value that we receive, sort of, pays for that Hexa usage. Once customers have run out of their allotment within the platform, there's an add-on SKU that protects us from a margin perspective. And so while we're encouraging more and more usage in Hexa because we think it provides very, very valuable insights, customers ultimately pay for that once they run out of their allocated amounts within their package.

The next question is from Adam Borg from Stifel Financial.

This is Ben Goldberg on for Adam Borg over at Stifel. Just double-clicking on that add-on SKU you just mentioned. So I know you mentioned it last quarter. Did you, kind of, see that increase this quarter given the stronger Hexa volumes? And is that recognized ratably or on a consumption basis?

Yes. We did see a tick up this quarter. But for us, the main draw really is in moving folks into the platform and specifically into Advanced where they're allowed a pretty significant volume for Hexa usage. We think that's a large reason why 3/4 of customers are opting to go -- of our new business are opting to go into Tenable One Advanced. So in terms of being a, sort of, a revenue growth driver for us, which I think is probably what you're getting to, the revenue growth driver really comes in the form of the platform, which is we're really happy to see come through this quarter, and we expect that trend to continue.

The next question is from Joseph Gallo from Jefferies.

This is Liam Bellamy on for Joe Gallo. You described OT security as very strong globally last quarter, particularly in Fed, and we've seen several attacks on critical infrastructure in recent months. Is OT gaining further momentum within Fed? And is it becoming a repeatable cross-sell motion across the broader commercial installed base?

Yes, it is. And yes, we were very, very happy with the results we saw in Q3 for OT globally. So it is continuing to gain momentum. And specifically in federal was an outstanding quarter for OT, not only within the Federal Government, which played a very large role, but also in the state and local business. When you look at, for instance, like Watershed in Texas and all of the different critical infrastructure and water treatment plant issues, we saw really good adoption of OT in state and local. So yes, happy with the adoption, not just here in the U.S., but globally for OT and definitely was a highlight of our federal business in Q3.

That's great to hear. And just a quick follow-up. I think it's becoming clear that patching is the most important aspect and the competitive differentiator in EM. Can you talk through where you are in that product journey? I know the ambition is fully autonomous patching, but when can that come to fruition?

Sure. So first, just a reminder of what exposure management is because it's very different than vulnerability management. Vulnerability management is the discovery of CVEs and the output of which is a report, and it's often sold to a frontline security manager or maybe even a pen tester. Exposure management is very different, the outgrowth of vulnerability management and assessment into solving a much bigger problem. And it's really predicated on 3 things. Number one, identify every -- all your exposures across a wide range of domains. Number two, prioritize what's truly at risk; and then three, remediate and confirm the fix actually reach the production environment. I mean that's exposure management and something -- some capabilities we have natively in the platform to be able to address the fix. Others, we integrate with third parties to help orchestrate the fix. And we want to do that in a very seamless way with our customers. So sometimes we're leveraging APIs and MCP. Other times, we're doing it natively ourselves. But the key takeaway here is we'll continue to go deeper and wider on remediation, number one. Number two, the mandate for us has evolved. It's no longer about finding problems. We're about fixing problems. That's what exposure management is about. And that's why Hexa, which is part of our agentic harness is so important because it sits on top of our vast exposure data fabric and data fabric that's been built over the last 20 years and data fabric that -- a lot of this exposure data sits behind the [ guarded ] firewall. It's not publicly available. And it is also -- it's tied to our vast sensor network that feeds it raw telemetry data. So that's differentiation. That's what gives us the ability to help our customers address AI threats and move at machine speed because that's what this environment demands. And remediation and orchestration is a big part of it. And so we're happy with how we're serving customers today and look for deeper and wider capabilities there.

The next question is from Patrick Colville from Scotiabank.

This is Conner Weed on for Patrick Colville. Congrats on the quarter. It was nice to see that 9.5% revenue growth. And in terms of the full year guide, I was wondering if you could provide more color on what you are seeing in the business and the pipeline to give the confidence for the magnitude of that raise there.

Yes. This is Matt. So yes, we're really, really happy with the quarter and our ability to raise the full year guide and not just for revenue, but really across the board. And part of what gives us that confidence in order to do that was the performance that we saw in Q3, but also the pipeline growth that we're seeing in Q4. You mentioned the revenue growth that we saw in Q3. We also talked about CCB growth at 9%. We think that probably ticks up slightly in Q4, and that's giving us confidence to be able to raise the guide for revenue in Q4 as well. So yes, happy with what we're seeing in momentum in the business and our ability to take up the numbers from the top line all the way down to the bottom.

The next question is from Meta Marshall from Morgan Stanley.

This is Abhishek Murli on for Meta Marshall. Congrats on a great quarter. I was just curious if we could follow up a little bit on the federal aspect. Any, sort of, quantification or commentary on how much that contributed to the upside outside of the OT piece? And then any, sort of, broader, sort of, feedback or commentary on what you're seeing in terms of the federal landscape overall?

Yes. As you know, we have major market leadership in federal across a wide range of 3-letter federal agencies. We're pleased with the results of our federal business this quarter. It was strong. And the one thing I will say here is that we've seen, if you look more broadly at the U.S. federal space, we've seen a wave of new AI Security Policy drop over the last 6 months. We believe that policy will ultimately be a tailwind for Tenable. The Federal Government is moving towards a preemptive risk-based security model. So we believe Tenable is in the right category at the right time. We're working directly with CISA. We're part of the JCDC with regard to a response for PHP2Shell. We're participating in Gold Eagle, which is the AI security vulnerability Clearinghouse. We participated in the launch event for Project Watershed 250, which is what Mark talked about earlier, working directly with the NCD National Cybersecurity Director, Texas Governor and other dignitaries along those lines. So we expect big things in the U.S. federal space. We know we have an election coming up. Cybersecurity is a bipartisan issue. It will have bipartisan support. We expect budgets to be strong here. Perhaps with a divided government depending on the election, we'll see a CR, but we're in one now. That could likely extend into January. That's nothing new to cyber, nothing new to Tenable. And so we expect to continue to take and win share of the U.S. public sector space. And that would also separately include state and local, as Mark mentioned.

The next question is from Rob Owens from Piper Sandler.

Maybe you could help me a little bit parse the delta between your net enterprise adds as I look at that year-over-year versus these record new logo Tenable One quarter that you just had.

Yes. Rob, I can take that. One of the dynamics, and I mentioned it in my prepared remarks that we're seeing is we're happy that we're adding -- we added 413 new enterprise customers. But the dynamic that I think is driving value even more is actually the value that the larger customers are bringing. So we saw new 6-figure annual account value -- contract value go up 18% year-on-year, which is really showing that customers are not only moving to the platform, they're moving to the platform, spending more and expanding once they're there, too. So our larger customers are spending more, which is great. In addition to that, some of the -- you can, sort of, take your pick on the top line metrics that we saw for the quarter. It wasn't just the revenue growth. It was the expansion in our net dollar retention rate moving from 106% to 107%. So another quarter of expansion there. Of course, there was the record 59% of new business Tenable One. That was a big deal, too. But it's also things like cRPO, that grew 12%. CCB growth was 9%. So 95% recurring revenue, kind of, across the board when you look at the top line metrics, it was just a really, really strong quarter.

Great. And last quarter, you spoke to that expansion rate potentially being flat to up, and it's great that it improved another point quarter-over-quarter. How are you thinking about the fourth quarter from here? And was there any dynamic that helped that from the Fed here in the third quarter? Or are you seeing that, kind of, across the board in terms of expansion?

Yes. I expect that the 107% probably stays, remains intact in Q4 -- and Fed helped contribute in Q3, and I think Fed will do well again in Q4. But we're expecting that rate to hold steady at 107%.

The next question is from Josh Tilton from Wolfe Research.

Can you hear me?

Yes, we can.

Awesome. I have 2 questions, and I've been bounced around on a bunch of calls, so I apologize if people asked this already. But my first question is just, I believe in the quarter, there was a point where you guys made a flip or a switch to the Hexa product that, kind of, enabled customers to do more of these continuous autonomous workflows, like basically really get real value from the product. And I guess my question is, what have you seen from a usage perspective within Hexa in the customer base since you made this switch? And if there are any customers that have really been using it, like how are they addressing their token limits? And what are they doing with tokens if they've reached their limit? And then my second follow-up question, probably more for Matt, is just -- we have these long-term targets out there. I think they call for an improvement in the revenue growth back to the double-digit range at some point. I'm not asking for guidance here, but we're going to get an outlook for next year. And I'm trying to understand, are we going to start to see the trajectory of revenue growth trend toward that double-digit range next year? Or is this more -- that inflection happens as we get closer to the long-term target here?

Josh, this is Steve. I'll take the first part of the question with regard to Hexa adoption and use cases. Something we talked about, something we launched recently was Hexa now has a coordinated fleet of AI agents that continuously identify critical exposures and orchestrate fixes, so you don't have to come in and prompt every time that you want to be able to take an action and you want to be able to remediate and take effects. So that's a huge productivity boost for security teams who are trying to do more perhaps with less in a heightened threat environment where there's more applications and agents and the attack surface is expanding. Customers are using Hexa to resolve their most critical [ vulns ]. I mean that's -- we saw a dramatic increase in the number of usage, the number of customers that are using Hexa and the number of customers -- and the usage within those customer cohorts. So that's what's exciting about Hexa. What used to take hours or should I say days, now it gets done in hours and sometimes even minutes and customers can build automated routines. And the right way to think about Hexa is really twofold. Number one is helping solve the drudgery, automating workflow, a major pain point for customers and security teams and reducing the amount of cycle time that it takes to help understand, assess and analyze an environment. And then more importantly, go out and just get stuff done. That's a big part of the value prop for Hexa. And again, these are things that we can do natively within the platform to reduce risk, but also integrating with other security providers because no security company can fix everything.

Yes. And Joshua, I'll answer your second question. So we feel really good about our long-term targets. What we feel good about, in particular, though, is the leading indicators, and you saw a lot of those in the quarter. And I think we're going to continue to see those. New business growth is performing really, really well. Bookings are fantastic and revenue follows. I mean we know that revenue lags a little bit. So as we look out a couple of years, of course, we feel good about the midterm targets that we put out there. But right now, we're focusing on some of the underlying leading indicators in the business.

The next question is from Rich Poland from Wells Fargo.

I guess just one quick one around the Tenable One uplift. It's great to see the continued success there. And I'm curious if -- you mentioned a lot of the ACV expansion related to Tenable One and just, kind of, the shift over to the platform there. I guess, if we put a finer point on it, I think the like-for-like uplift you've talked about in the past is somewhere in the realm of 25% plus when it's on the Advanced side. I'm curious, is that something that you think you guys are starting to see realize now? Or would you say the focus is more on getting people over to the platform first and then you could worry about the potential uplift over time?

Yes. It's actually a little bit of both because we see increasingly brand-new customers are coming directly into the platform and they're spending more. Average customer value is double in the platform what it is versus stand-alone SKUs. And if you look at -- you forget about our Nessus product, but Nessus actually serves as an on-ramp to the platform as well. We're seeing Nessus customers not only upgrading into some other stand-alone SKUs, but also directly to the platform. And those customers are -- platform customers are paying 15x what Nessus customers are paying. So there is a meaningful on-ramp when you're going from Nessus into stand-alone SKUs or from stand-alone SKUs into the platform. Once they're there, they're also expanding usage, which is another way that they can increase value. So yes, we're really happy with the motion of moving folks into the platform and then once they're there, expanding.

This concludes the question-and-answer session as well as the teleconference today. You may disconnect your lines at this time. Thank you for your participation.