Tenable Holdings, Inc. Q3 FY2026 earnings call

• Strategic Shift to Exposure Management: Management emphasized that AI is reshaping the attack surface faster than organizations can respond, creating a structural shift toward preemptive exposure management rather than just vulnerability detection.
• PHP 2 Shell Response: Following the disclosure of PHP 2 Shell, customer engagement surged, with HEXA prompt volumes increasing up to 5x. This validated the demand for real-time exposure management capabilities.
• HEXA AI Adoption: Tenable’s agentic AI engine, HEXA, now operates as a coordinated fleet of agents. It has evaluated over 2 billion assets since June, enabling users to resolve critical vulnerabilities faster and reclaim analyst capacity.
• Platform Consolidation: Customers are consolidating onto Tenable One to manage risk across multiple asset types. The Advanced Tier is pulling customers deeper into the platform due to its comprehensive AI capabilities.
• Cyber Agents Exchange: Launched as an open-source registry for cybersecurity AI agents, it positions Tenable at the center of the agentic security ecosystem and aids in competitive wins by demonstrating trusted agent vetting.
• Competitive Wins: Tenable secured significant wins against endpoint security vendors and legacy VM providers by leveraging breadth of asset coverage, accuracy, and HEXA’s autonomous remediation capabilities.

Total revenue for the quarter was $276.4 million, representing 9.5% year-over-year growth. Recurring revenue accounted for 95% of total revenue. Tenable One represented a record 59% of new business (up from 50% in Q2 and 39% in Q3 2025). The company added 413 new enterprise customers and 39 net new six-figure accounts. Average deal sizes increased year-over-year for the second consecutive quarter.

• Raised full-year 2026 revenue guidance to $1.084 billion - $1.087 billion (midpoint ~8.6% YoY growth).
• Raised full-year 2026 non-GAAP operating income guidance to $270 million - $273 million (midpoint 25.0% margin).
• Raised full-year 2026 non-GAAP net income guidance to $250 million - $253 million (midpoint ~29.4% YoY growth).
• Raised full-year 2026 non-GAAP diluted EPS guidance to $2.16 - $2.19.
• Q4 2026 Revenue expected to be $277 million - $280 million (midpoint ~6.9% YoY growth).
• Q4 2026 Non-GAAP Operating Income expected to be $67.1 million - $70.1 million (midpoint 24.6% margin).
• Q4 2026 Non-GAAP Net Income expected to be $63.6 million - $66.6 million.
• Q4 2026 Non-GAAP Diluted EPS expected to be $0.56 - $0.58.

• AI-Driven Vulnerability Velocity: Frontier AI models accelerate vulnerability discovery and exploit automation, requiring rapid response capabilities that may strain resources if not managed via automated platforms like HEXA.
• Market Saturation/Competition: Intense competition from large platform vendors and endpoint security providers who may use aggressive bundling strategies, though Tenable differentiates via exposure data depth and agentic AI.
• Execution Risk on New Pricing Models: Success depends on continued successful migration of customers to the Tenable One platform; failure to drive adoption could impact average deal size and expansion rates.
• Regulatory and Policy Changes: While current federal policies are tailwinds, future changes or government shutdowns (Continuing Resolutions) could impact federal spending cycles.

Q: Analyst asked for a breakdown of Tenable One customer acquisition sources (new logos vs. existing expansions) and competitive dynamics against endpoint vendors. / A: Mark Thurmond reported record-setting quarters across all fronts: strong new logo acquisition, significant conversion of standalone VM install bases to Tenable One, and migration from legacy Tenable One SKUs. Competitive win rates improved as sellers efficiently position Tenable One based on its breadth, accuracy, and HEXA differentiation, winning deals against endpoint vendors despite their bundling strategies.

Q: Analyst inquired about pricing evolution given increased scanning frequency due to AI-driven vulnerabilities and whether Tenable would change its per-asset pricing model. / A: Steve Vintz explained that while pricing remains asset-based, ASPs and CCB growth have increased due to expanded usage and value. They do not price per scan to avoid discouraging usage. The PHP 2 Shell example highlighted that risk extends beyond CVEs to exposure chaining, driving demand for broader exposure management platforms where Tenable captures more value through larger contracts covering more asset types.

Q: Analyst sought details on the drivers of Q3 growth (asset expansion vs. upsell vs. new products) and how Tenable One adoption expands asset coverage. / A: Mark Thurmond described Q3 as balanced with outperformance across all metrics. Growth was driven by Fortune 1000 VM customers converting to Tenable One, mid-market adoption of HEXA for automation, and strong new logo penetration. Adopting Tenable One typically involves moving to the Advanced tier, which covers 2-4 asset types, offers advanced attack path analysis, and includes higher token allotments for HEXA AI.

Q: Analyst compared the potential business impact of PHP 2 Shell to Log4j and asked about gross margin visibility given high HEXA usage volumes. / A: Steve Vintz noted Log4J provided a tailwind in late 2021, while PHP 2 Shell is too early to quantify but shows durable momentum for exposure management. Matt Brown stated gross margins (~81.5%) remain stable because HEXA access requires upgrading to the platform (which increases ARPU), and excess usage is capped or sold via add-on SKUs, protecting margins while encouraging adoption.

Q: Analyst asked about OT security momentum in federal/state sectors and the timeline for fully autonomous patching capabilities. / A: Mark Thurmond highlighted outstanding OT performance in federal, state, and local sectors (e.g., water treatment), driven by critical infrastructure attacks and policy shifts. Steve Vintz clarified that exposure management focuses on identifying, prioritizing, and remediating risks. While native remediation exists, they integrate with third parties for orchestration. HEXA enables machine-speed remediation, and they plan to deepen and widen these capabilities continuously.