Greetings and welcome to the Tenable Third Quarter 2020 Earnings Conference Call. At this time, all participants are in a listen-only mode. A question and answer session will follow the formal presentation. As a reminder, this conference is being recorded. It is now my pleasure to introduce your host, Andrea DiMarco, Vice President of Investor Relations and Strategy. Thank you, you may now begin.

Thank you, operator, and thank you all for joining us on today’s conference call to discuss Tenable’s third quarter 2020 financial results. With me on the call today are Amit Yoran, Tenable’s Chief Executive Officer; and Steve Vintz, Chief Financial Officer. Prior to this call, we issued a press release announcing our third quarter financial results. You can find the press release on the IR website at tenable.com. Before we begin, let me remind you that we will make forward-looking statements during the course of this call, including statements relating to Tenable’s guidance and expectations for the fourth quarter and full year 2020, growth and drivers in Tenable’s business, changes in the threat landscape and security industry, and our competitive position in the market, growth in our customer demand for and adoption of our solutions, Tenable’s expectations regarding the long-term profitability, the impact of COVID-19 on our business and the global economy, and planned innovation and new products and services. These forward-looking statements involve risks and uncertainties, some of which are beyond our control, which could cause actual results to differ materially from those anticipated by these statements. You should not rely upon forward-looking statements as a prediction of future events. Forward-looking statements represent our management’s beliefs and assumptions only as of today and should not be considered representative of our views as of any subsequent date. We disclaim any obligation to update any forward-looking statements or outlook. For a further discussion of the material risks and other important factors that could affect our actual results, please refer to those contained in our most recent quarterly report on Form 10-Q and subsequent reports that we file with the SEC, which are available on the SEC’s website at sec.gov. In addition, during today’s call, we will discuss non-GAAP financial measures. These non-GAAP financial measures are in addition to and not a substitute for or superior to measures of financial performance prepared in accordance with GAAP. There are a number of limitations related to the use of these non-GAAP financial measures versus their closest GAAP equivalent. Our earnings release that we issued today includes GAAP to non-GAAP reconciliations for these measures, and it also available on the investor relations section of our website. I'll now turn the call over to Amit.

Thank you, Andrea. And thank you for joining us today. I hope you and your families continue to be healthy and safe. I remain incredibly pleased to see the Tenable team come together to support our customers in this unpredictable macro environment. We continue to remain laser-focused on our mission to help customers measure and manage their cyber risk especially in an environment of increased risk and accelerated digital transformation. The current environment has forced so many organizations to rapidly shift to cloud to maintain productivity for remote employees, allowing them to securely connect and collaborate with colleagues. Additionally, as web and app traffic surge, organizations are looking to modernize and strengthen their cloud security posture; digital transformation journeys and the shift to the cloud are accelerating across the globe. All this innovation is occurring in the midst of a threat environment that remains elevated. We believe Tenable is well positioned to help customers navigate this environment and invest in the cloud confidently and securely. We empower our customers to take a risk-based approach to vulnerability management across all of their systems, whether on-premise or in the cloud. Our results underscore the mission-critical nature of innovative vulnerability management and its foundational importance in managing risk in the enterprise. Today, I'll highlight our strong Q3 results, our cloud security strategy, and the exciting innovations we announced at Tenable Edge and our continued leadership position in the public sector. I am very pleased with our results for the third quarter which include attractive top-line growth and expanding operating and free cash flow margins. Our revenue grew 22% year-over-year in the third quarter, and our operating margin continued to expand. We also generated record free cash flow since our IPO again this quarter. These results demonstrate the strong growth and profitability in our model. The vast majority of our business is generated from large enterprise companies. We saw a healthy number of new six-figure ads with an emphasis on 500K plus deals, partially aided by more cross-sells contributing to larger deals including momentum with Lumin. For the second quarter in a row, we're seeing an increased demand for securing cloud workloads, resulting in accelerated adoption of Tenable.io and cloud security modules such as web application security, container security, and Lumin. Tenable is helping companies around the world identify and manage cyber risk as they accelerate their shift to the cloud. A great example of this is a new six-figure competitive displacement with one of the largest telecommunications companies in the APAC region. This customer purchased Tenable.io and Lumin to manage vulnerabilities for devices in their service cloud deployment. This continues to demonstrate our cloud solution gaining traction globally. This customer wanted to increase the security of their infrastructure to help grow public trust after a cyber-breach. They indicated they chose Tenable because of the quality and reliability of our data. The acceleration of digital transformation has made cloud security more critical than ever, in both the enterprise and in the public sector. We saw strength across many industries including technology, telecommunications, healthcare, financial services, and we continue to enjoy a very strong position in the federal sector with a growing presence in state and local government. The best example of this is a six-figure win in one of the largest local government entities on the West Coast. This customer was a new enterprise platform win for us as they replaced an outdated VM Solution with our full cloud offering which includes Tenable.io, web app security, container security, and Lumin. Notably in the quarter, in addition to seeing increased demand for securing cloud applications, we're pleased to achieve several large competitive takeaways that we attribute to our best-of-breed strategy. As you can see from our customer highlights this quarter, we continue to see an increasing number of customers who subscribe to our SaaS platform and use us to secure their cloud environments. Great security starts with a complete and continuous understanding of the attack surface, including the cloud infrastructure and growing remote workforce. Our customers expect holistic visibility of their entire attack surface and that’s why securing cloud assets has been a core part of our technology platform for years. With that, I want to call out some of our cloud-centric security product announcements we recently highlighted at our user conference Tenable Edge 2020. We unveiled a new cloud security capability, frictionless assessment, that empowers customers to instantly and continuously evaluate their cloud assets without interruption. With frictionless assessment, customers can have complete visibility of their assets in the cloud and can quickly detect new vulnerabilities of their environment changes without having to schedule a scan or deploy an agent. Frictionless assessment, which we expect to be available in the fourth quarter, creates an opportunity for customers to easily expand asset coverage in the cloud with no additional deployment or scanning, no risk from downloading an agent, and no performance impact. It's frictionless. Frictionless assessment is a very cloud-centric and cloud-native way of operating and an important part of our growing cloud story. This is another way in which Tenable is revolutionizing vulnerability management for modern assets to deliver on our cyber exposure vision. During Edge, we also announced exciting enhancements to Tenable Lumin, including new capabilities to assess and benchmark organization’s remediation, maturity, and inventory of endpoint security controls and predictive scoring for a more comprehensive insight into an organization's cyber exposure. We expect these enhancements will also be available in the fourth quarter. In addition to our new frictionless assessment and Lumin enhancements, Tenable has been integrating with each and every major public cloud vendor, as many of our customers maintain a hybrid environment across multiple cloud providers. The combination of our cloud-native connectors, frictionless assessment, comprehensive web app scanning, and DevOps-integrated container security provides extensive visibility into the security of our customers' cloud deployments. Increased adoption of cloud and hybrid IT, digital transformation, and expanding attack surfaces have been driving our business for the past several years and will continue to drive our business well into the future. These trends resonate now more than ever, and we believe our leadership position going into this crisis will further enhance as we expand our presence and product offerings. We believe the cloud represents a huge business opportunity, not just to build new business models, but to build them with a security-first strategy. We expect to hear a lot more about these and other cloud security capabilities in the coming months and quarters. We're excited about our ability to advance a customer's cloud security as we continue to focus on exciting new product announcements. As the shift to cloud accelerates in the commercial sector, we're also seeing an increased focus on cloud in the public sector. We remain very pleased with a strong market share in the public sector and highly value our partnerships across the federal government. We're excited about our FedRAMP in-process designation, as the public sector increasingly shifts to cloud. We've seen success in the public sector domestically and abroad and have leveraged that success to grow our state and local business. In the third quarter, we announced a new partnership with the Center for Internet Security that will bolster cyber hygiene for both public and private sector organizations. This partnership is an important step in making foundational cybersecurity more attainable for organizations of any size. Tenable solutions are now the only comprehensive risk-based vulnerability management offering available in the CIS cyber market. Going forward, we believe that our best-of-breed VM strategy, strong presence in securing cloud environments, our operational technology capabilities, and advanced analytics through Lumin will continue to fuel attractive growth and profitability. With all the trends we outlined, the dynamics that have been propelling our business remain robust, and we believe will continue to strengthen over time. While we're excited about our current and future prospects, we understand that we're in the midst of an uncertain economic environment that millions of people and businesses around the world are facing difficult times. We remain focused on managing through the current situation as we benefit from the significant financial and operating strength of our recurring revenue and the natural leverage in our business. I will now turn the call over to Steve.

Thanks Amit. As Amit commented earlier, we are very pleased with our results for the third quarter, highlighted by attractive top-line growth, continued momentum with large enterprise deals, and strong profitability and free cash flow. I'll discuss our results for the quarter momentarily. But first, please note that all financial results we will discuss today are non-GAAP financial measures with the exception of revenue. As Andrea mentioned at the start of this call, GAAP to non-GAAP reconciliations may be found in our earnings release issued earlier today and posted on our website. Now on to our results. Revenue for the quarter was $112.3 million, which represents 22% growth year-over-year. Revenue in the quarter exceeded the midpoint of our guidance range by approximately $3 million. Our percentage of recurring revenue remained high at 94%, a result of our annual prepaid subscription model. Revenue was aided by better than expected demand not only in terms of flow and the number of new enterprise deals, but also the number of large six-figure wins. Specifically, we added 335 new enterprise platform customers and 56 net new six-figure customers in the quarter. This brings the total number of customers spending in excess of $100,000 annually to 771. To provide some context here, 56 was one of our best quarters ever for net new six-figure customers, with particular strengths in the 500K plus category, including another quarter of strong competitive takeaways. While we continue to see a healthy number of wins from Greenfield opportunities, some of our largest deals in the quarter were displacements, which we believe is a testament to our cyber exposure value proposition and our best-of-breed strategy. Another important highlight for the quarter is the growing demand for our solutions that help secure the cloud, which has resulted in an increased adoption of Tenable.io and other cloud security modules such as Lumin, web application security, and container security. This trend is an expansion beyond the traditional asset VM use case and total addressable market as customers are increasingly trying to manage the risk and complexity related to digital transformation and hybrid cloud deployments. To summarize, we continue to add a healthy number of new customers and six-figure customers in an uncertain macro environment, but with more favorable market and competitive dynamics on the back of higher cloud adoption. This demonstrates the relevance of our offerings in the current environment. Our calculated current billings grew 21% year-over-year to $133.7 million, which is up markedly from last quarter. As a follow-up from last quarter, we want to briefly discuss our short-term related performance obligation. Short-term RPL, which we define as deferred revenue and backlog expected to be recognized as revenue over the next 12 months, also grew a little over 20% in the third quarter. As we discussed in our last call, there can be natural variation in growth between calculated current billings and short-term RPL due to deal timing, early renewals, and multiyear prepaid deals. Across both metrics, it is clear we had a strong sales quarter in Q3. Growth was strong in the quarter and came in better than expected, which was reflected in our dollar-based net expansion rate of approximately 110%. As discussed last quarter, our dollar-based net expansion rate is also experiencing some impact from larger initial allowance and a more moderate pace of asset expansion in the current environment. I'll now turn to expenses, where we continue to demonstrate leverage in our financial model, highlighted by record profitability and free cash flow. I'll start with gross margin, which was 84% and consistent with Q3 last year, but up slightly from 83% last quarter. Our gross margin continues to be very healthy and reflects increased investment in our public cloud infrastructure related to the growing demand for our cloud-based Tenable.io platform, partially offset by efficiencies in storage and compute, so we continue to scale. Also, we continue to benefit from improved resource utilization in the delivery of professional services as a result of increased virtualization of training and implementation. Let's turn to operating expenses. Sales and marketing was $48.2 million, compared to $53.2 million in the third quarter last year and $50.1 million last quarter. Sales and marketing expense as a percent of revenue was 43%, which improved from 58% in Q3 of 2019 and 47% last quarter. We're very pleased with this significant leverage we've demonstrated in sales and marketing over the past year, which we attribute to the maturing investments we previously made in sales overhead and markets where we achieved critical mass. We're also enjoying better than expected levels of productivity as a result of a more tenured sales organization that can sell an increasingly broader solution set to address cyber exposure. For example, we have more sellers today with tenure of a year or more than at any time since our IPO. Further, the current environment has resulted in some savings in sales and marketing spend, most notably in the areas of field marketing and travel, which we estimate to be approximately $2 million to $3 million again this quarter, as well as a more moderate rate of hiring due to the uncertain macro environment. That said, our expectation for the fourth quarter is that sales and marketing spend will trend sequentially higher, due in part to the early investment and expanding quarter capacity for the upcoming year. R&D was $21.2 million, compared to $18.6 million in the third quarter last year and $21.4 million last quarter. As a percent of revenue, R&D expense was 19% compared to 20% in both Q3 2019 and last quarter. The increase in R&D expense over the prior year is due to incremental investments that support growth initiatives in cloud and operational technology as well as data science to maintain our leadership and vulnerability coverage and accuracy. G&A expense was $12.5 million, compared to $13.3 million in the third quarter last year and $12.3 million in Q2 2020. As a percent of revenue, G&A expense was 11% this quarter, flat with last quarter and down notably from 14% in Q3 last year, reflecting our ability to more fully absorb public company costs and improve efficiency and automation in many of our back office functions. Non-GAAP income from operations was $12.4 million compared to a loss of $7.7 million in Q3 last year and a profit of $5.7 million last quarter. Non-GAAP operating margin was positive 11%, compared to negative 8% for the third quarter last year and positive 5% last quarter. We're very excited to continue to see operating leverage in the model play out as we expand our non-GAAP operating income. All of this translated to significant EPS upside, as our non-GAAP earnings per share was $0.09 this quarter, which was $0.06 to $0.07 better than expected. Now, let's turn to the balance sheet. We finished the quarter with $269 million in cash and cash equivalents and short-term investments. Turning to cash flow, we achieved $16.7 million of positive free cash flow in the quarter, up from $6.6 million sequentially. This compares favorably to a free cash flow burn of $9.6 million in Q3 last year. As I commented earlier, we saw strong sales flow in the quarter, which aided collections and consequently free cash flow in the quarter. Looking ahead, while Q4 is seasonally our largest quarter, we expect free cash flow to be flat to modestly higher as a result of a more normalized pace of collections and payment timing. With the results of the quarter behind us, I'd like to discuss our outlook for the fourth quarter. We developed our fourth quarter guidance under the realization that certain geographies are starting to experience a second wave of the pandemic. Given the uncertainty and fluidity of the current environment, we will continue to manage the business closely and plan to make additional growth related investments in areas such as go-to-market, including a head start on 2021 hiring levels, which is reflected in our guidance. With that as a backdrop, for the fourth quarter we currently expect revenue to be in the range of $113 million to $115 million, non-GAAP operating income to be in the range of $8 million to $9 million. Non-GAAP net income to be in the range of $6 million to $7 million, non-GAAP diluted earnings per share to be in the range of $0.05 to $0.06, assuming a $113 million fully diluted weighted average shares outstanding. And for the full year 2020, we currently expect revenue to be in the range of $435.1 million to $437.1 million, non-GAAP operating income to be in the range of $18.4 million to $19.4 million, non-GAAP net income to be in the range of $12.4 million to $13.4 million. Non-GAAP diluted earnings per share to be in the range of $0.11 to $0.12, assuming a $110.6 million fully diluted weighted average shares outstanding. In summary, we're pleased with the results of the quarter which gives us increasing confidence that we remain well positioned to deliver compelling growth and profitability over the long term. We've developed a comprehensive foundational cyber exposure platform that provides significant value to customers and we're actively managing throughout the current challenging macro environment while continuing to execute and invest in the long-term opportunity. And now, I'll turn the call back to Amit for some closing comments.

Thanks, Steve. Regardless of the macro environment, we believe vulnerability management will continue to grow in priority. For Tenable, our core strength in vulnerability management has driven our success and aided in our natural expansion across the attack surface. Its cloud and operational technology deployment. Our strengthening product portfolio positions us for long-term success as our customers shift to the cloud and maintain hybrid environments. We hope to see many of you virtually at the Gartner Invest Virtual Conference, AWS Reinvent, and at the Barclays, Stifel, UBS, and Wells Fargo Tech conferences in the coming months. We'd now like to open the call up for questions.

Thank you. Our first question comes from Sterling Auty with JP Morgan. Please proceed with your question.

Hi, guys. This is Matt on for Sterling. Thanks for taking the question. I was wondering, if you guys could give a little bit more color on the new customers. What was the average deal size for new customers? And how has that kind of changed from previous trends? Thanks.

Well, first and foremost, we're very pleased with the velocity of new customers that we continue to add even during the pandemic. We added over 300 new enterprise platform customers in the quarter. Amit commented earlier, but we have particular traction on larger deals, not just 100K opportunities, but we call it out in the 500K plus category. So, not only do we have the ability to attract new logos during a pandemic, which is increasingly difficult in an uncertain macro environment, but we're also transacting and closing larger deals. We also saw strength with competitive takeaways. So overall, I think we're very, very pleased with the traction in new logos. And we think all of this really underscores the growing importance of vulnerability management, specifically cyber exposure. A good part of this is attributed to our ability to secure the cloud as well, with a higher mix of IO sales and increasing adoption of our cloud-based applications such as web apps, container security, and even Lumin. So, very pleased overall with the new business that we're closing.

Great, that's very helpful. And then one follow-up, you talked about some of the success you saw in the federal space this quarter. What's really been driving those trends that you've been seeing?

This is Steve.

On the federal side, I think the federal market is an incredibly strategic sector for us. I think we've got a very sizeable footprint for a strong market leadership and terrific relationships in and across the federal government. We're seeing some of that demand performance and relationships translate directly into momentum building in state and local and some notable wins there. I think I mentioned one of them on the call earlier. We saw a seasonally strong uptick in Q3, and this quarter was no different from kind of seasonally strong Q3s in previous years. We continue to invest in the market. We're excited about our FedRAMP in-process designation, and I believe that there's additional opportunity for us in cloud and web-based opportunities in the federal space.

Great, thanks so much, guys.

Our next question comes from the line of Hamza Fodderwala with Morgan Stanley. Please proceed with your question.

Hey guys, thank you for taking my question. Amit, my first question is for you. So, it seems like vulnerability management is clearly growing in priority, especially as we remain in a more distributed work environment. I was wondering if you could expand on that a little bit, because obviously, you talked about the prioritization of VM for quite some time. As you talk to your customers on their spending priorities into 2021, what are you seeing as far as vulnerability management in Tenable in particular becoming a more strategic focus for Chief Security Officers? Are you seeing customers who perhaps saw VM as a 'nice to have' now becoming more of a 'must have' in this current environment?

Yeah, I think there's really a great maturation happening in the security market. I think, folks in years past may have looked at VM as a requirement for some compliance driver, some compliance needs, that they have some regulatory driver. I think people are starting to understand and the market is starting to appreciate the fact that vulnerability management and understanding your asset base, understanding your compute base, understanding your level of exposure, and what that means to you from a risk perspective, are just fundamental building blocks for security. Over the last three years, we've seen vulnerability security spend remain strong, but we've seen vulnerability management rise to the number one, two or three position in just about every single CISO survey, and in many instances, rating extremely high in CIO surveys. So, I think that's a strong trend. I still think we're in the early innings. We look at the number of new customer lands that we're achieving out on our enterprise platforms. We're looking at the Greenfield accounts and analyzing our larger transactions, which ones are currently chosen from Greenfield. We believe they're still great opportunities in the market, both from a Greenfield perspective as well as an expansion in the existing customer base as a great opportunity. Even more broadly outside of VM or traditional VM, looking at new and modern parts of the attack surface, the cloud-based infrastructure, web applications, analytic opportunities to create additional value, and operational technology. We believe strongly that we're still in the early innings of this market.

Got it. Thank you.

Our next question comes from the line of Rob Owens with Piper Sandler. Please proceed with your question.

Great, thank you for taking my questions. Amit, with the emphasis on cloud as we have remote work and digital transformation and other cloud adoption, you mentioned DevOps integrated container security. And I think it begs the question, does this require any type of channel adjustments or changing go-to-market motion relative to how these technologies are adopted versus how security has traditionally been purchased and deployed?

Yeah, as you unpack the security requirements in DevOps environments and in container environments, they're large, complex and changing quite rapidly as the way people develop changes and evolves. We've seen this even in just the last two or three years. What I would say about the opportunity for Tenable isn't trying to be all things to all people. What we're laser-focused on is helping our customer base and the security community understand what their asset base looks like, what that means and how that asset base is exposed and how they can efficiently manage, remediate, or lower that risk level. When it comes to container security, we think it's an integral part of our cloud story. We're not going to try and do every aspect of container security; we're going to help our customers assess what exposures those containers and the DevOps environment is introducing to their cloud deployments, to their enterprise. We think we can do that very efficiently. We think we can do it without introducing a lot of drag or friction into the DevOps process. We can do it for existing security users, the enterprises that already trust us with their VM requirements and understand their level of risk. So if we can do it without impacting DevOps, do it in a frictionless type of way, we think that's the approach that works for our customer base and will fit nicely with our go-to-market motions. We're not hindering a radical change in who would be bringing that product to or how we could bring it to market.

And then Steve, you mentioned the 110% renewal rates due to the size of land getting bigger, and then asset expansion in the current environment. As cloud continues to ramp and you've run the portfolio, is there a potential inflection point in this metric moving forward?

Yes, we think so. As previously noted, renewals were strong in the quarter and came in better than expected. With larger initial lands, which we talked about earlier and a more moderate pace of asset expansion in the current environment, we did see the dollar-based net expansion rate temper a bit, although it continues to be healthy. We don't manage the business to any one single metric, but as more workloads move to the cloud and with frictionless assessment, we believe customers may expand coverage of cloud deployed assets. This quarter, we’re pleased with the number of new logos we added and the number of large deals, because the mix between new and upsell can vary from quarter to quarter. However, because we're adding a healthy number of new logos, we think this bodes well for long-term expansion.

Our next question comes from the line of Gur Talpaz with Stifel. Please proceed with your question.

Okay, great. Thanks for taking my questions. Amit, this is the second that is directly competitive takeaways. My question is this: do you think the current environment is placing greater emphasis on best-of-breed VM, and if so, why?

Well, I definitely think that we're growing as a result of our best-of-breed strategy. The enterprise always emphasizes best-of-breed historically in a meaningful way. Our ability through native integration into a rich ecosystem of strategic infrastructure investments that our customers have already made allows them to drive significantly more value from Tenable and at the same time, have tremendous confidence in the results that they're seeing from our product. In these tough economic markets, there's a reflected quality, and I think we're the quality provider in the space, proving that consistently in evaluations and proof of values and in the lab testing of various products.

That's helpful. And Steve, maybe one for you. Last quarter, you noted some late-period seasonality. Did you see anything noteworthy this quarter, or would you classify it as more linear or more typical of Q3 here?

Not to the degree in which we saw it in Q2. Specifically in CCB, as we mentioned earlier, CCB during a pandemic may not be a good leading indicator of future revenue because it's predicated on a multitude of factors including overall deal timing, multi or prepaid deals, and even URLs, which can have more variability in an uncertain macro environment. In Q3, deal timing was a consideration. We saw fewer multiyear prepaid deals, meaning that less customers elected to pay their subscriptions 300 in advance. We did not see this in Q2, but it surfaced in Q3. To clarify, with multiyear prepaid deals, the long-term portion of current deferred revenue automatically runs off into the current portion of deferred revenue each period, thereby positively impacting CCB. It’s too early to tell if this is a persistent trend, but the CCB is something we’ll continue to monitor during the pandemic. CCB may not be a good leading indicator. Overall, I think it's clear we had a good result for the quarter, and we're very pleased.

That's great. Thank you.

Our next question comes from the line of Jonathan Ho with William Blair. Please proceed with your question.

Hi, good afternoon. I just wanted to start out with some of the Lumin enhancements that you talked about, and perhaps understand a little bit better, what these, I guess differentiators could mean, and how that can potentially impact the pace of adoption of Lumin?

Oh, sorry. Well, I guess I take myself off mute; that would help greatly. Lumin has a very long vision of where we can go with that product. I think we're still in the early innings, showing great progress and tremendous value through analyzing the vulnerabilities, the asset criticality, translated to risk introduces benchmarking, and innovative capability across a very large customer base. When you start looking at how enterprises assess risk beyond exposure levels, there are all sorts of other controls in place. We’ve started inventorying and assessing those security controls, compensating controls, adding those capabilities and insights to Lumin. We’ve also added assessment maturity, which is really important, because it's not just about how exposed or at risk one is; it also involves understanding how confident we are in that answer. So, if I have large parts of my environment where I don’t have visibility, or understanding, or where I can’t assess risk, assessing how I am doing that in depth versus cursory ways and how it compares to peers, we believe those types of strategic steps are important in what Lumin brings to the table. There's just a long runway of innovative capabilities that we're excited to be adding to the product going forward.

Fantastic. And just one for Steve, given the COVID uncertainty, how are you thinking about balancing your investments in sales capacity expansion? Can you give us some sense of the puts and takes there just given the environment? Thank you.

Sure, that's important to us and something we've talked about for some quarters. The takeaway here is that we are actively balancing growth with profitability and cash flow; we announced almost $17 million in cash flow this quarter, $0.09 in EPS, which is an outsize beat for the quarter, with attractive top-line growth. During the pandemic, we think it's important to maintain that balance, but I will say this: we also want to lean in and ensure we invest, invest in go-to-market and innovation. We talked about several new exciting enhancements to Lumin, as well as frictionless assessment for our ability to go deeper and wider into the cloud. Sales and marketing leverage has started probably three or even four quarters ago; last year, we were spending over 60% of our revenues in sales and marketing, this quarter it was in the low 40% range. One of the reasons why we're seeing leverage is the maturity of the sales organization with more reps having been here for a year and more than ever. We've also been able to optimize sales overhead and markets where we have critical mass. As a result, we've driven a lot of leverage in sales and marketing. We did acknowledge COVID-related savings in field marketing and travel, which we estimate to be about $2 million to $3 million a quarter, but some savings will likely endure even post-pandemic. We're able to transact larger deals virtually. It still requires a lot of intimacy and touch with both customers and partners alike. We’re really proud of the strength and the resiliency of the team and how we've come together. It also speaks to the value of VM in this market. We’ll continue to balance growth and profitability, and we plan to invest in early starts for 2021, reflecting in our EPS guidance. We'll provide an update on 2021 during our February call.

Our next question comes from Daniel Ives with Wedbush Securities. Please go ahead with your question.

Yeah, thanks. So my question is a little on the Lumin side. Are you getting the sense from talking to the team Dave and whether it's housing or partners, I mean, is Lumin changing the conversation with customers for Tenable?

Absolutely. When we think about the future of VM, the direction of VM and how enterprises are maturing their programs, it's not just about scanning their systems or deploying agents or understanding all of these different vulnerabilities. These are data points trying to answer foundational questions: how secure am I? How at risk am I? Am I exercising a reasonable standard of care with the data I'm entrusted with as an organization? Lumin is able to really drive at those answers. What do you have? How is it exposed? What does it mean from a risk perspective? How are you rating relative to peers? How confident are you in your answers? So it is allowing us to move from conversations with users about the efficiency of our products, about the accuracy and the differentiation there to having much more strategic conversations with enterprise leaders. It's driving radically different conversations, and we couldn't be more pleased about that.

Great. And just in terms of federal or state government, are you sensing that deals are just getting larger as you look out in the next two, three, or four quarters, given some of the cloud shifts going on with many of these government agencies in a remote environment?

Yeah, we're definitely seeing new and more opportunities that are web-based and cloud-based. We're certainly excited to be in process with our FedRAMP designation to align with those requirements. More broadly, the federal government is continuing to mature their cybersecurity and risk management practices, going through the same digital transformation that we’re seeing in the private sector, and to some extent influencing and leading the way for many large enterprises. We think we hold a position of great strength in our relationships in the federal space. As those compute bases continue to expand and evolve, we believe that will bring greater and more opportunity for us.

Thanks.

Our next question comes from the line of Joshua Tilton with Berenberg. Please proceed with your question.

Hi, guys, thanks for taking my questions. I just wanted to follow up on the comments about profitability, maybe from a different perspective. If we look at the guidance, it implies an incremental non-GAAP operating margin of 75% for FY'20, which I believe is up from 7% in 2019. Should we expect this metric to revert in '21 as you invest in more sales reps, and maybe sales and marketing starts to grow again?

Well, as I mentioned earlier, we'll talk more about ’21 in February. The leverage that you're seeing today is really a natural reflection of the model: 94% recurring revenue, over 80% gross margins, and high renewal rates. We have a lot of confidence in our cash flow and operating margins long-term. Over the past few years, we've successfully traded points of margin for points of growth. We know we will be profitable in the future, and our goal is to strike the right balance. There's a lot of opportunities to invest here. Our expectation is we'll continue to walk this off in the margins cautiously, balancing that with growth. Given the uncertainties around COVID, we’ve demonstrated resilience in closing new business. Overall, I think it's clear we're pleased with our results for the quarter.

That was helpful. And just a follow-up, you highlighted some deals in the prepared remarks that included Lumin. Could you comment on the increase in the deal size you saw from those customers buying Lumin? Would you say that the $500,000 deals were a function of more assets under coverage or more product purchases?

Yeah, where Lumin is attached, we're seeing a notable uptick in ASPs. The impact on ASPs can range anywhere from 30% to 40% plus. We’re having success raising the ASP where Lumin is attached. Now obviously, our focus here is to drive the attach rates even more. Over the course of many years here, I think the attach rates can be 50% plus or more. In the $500,000 plus category, it's a combination of both. We're delighted in cross-sells this quarter, with growth over last quarter, and we continue to have success selling more. We think it's a compelling long-term opportunity to secure the cloud, not just with Tenable.io, but alongside web application security, with Lumin and container security. We know our close rates increase when we sell more add-on products.

Thank you. And if I may sneak one more in, any chance you could comment on how investors should think about the calculated current growth going into Q4 and what the puts and takes are there?

We don't give guidance on CCB on a quarterly basis. During our Q1 call this year, we suspended our full year CCB guidance. CCB is influenced by many factors and may not be a good leading indicator of underlying performance. We talked about deal timing and multi-year prepaid deals for the quarter and early renewals. Given these factors and macro uncertainty surrounding the resurgence of COVID cases, there is potential for a wider range of outcomes in CCB as we head into our largest quarter for sales. Despite this variability, though, we feel good about the overall health and momentum of the business. So, the short answer is that there’s potential for a wider range of outcomes, but we’re delighted with the health of the business.

Thank you so much. Congrats on the quarter guys.

That was our final question in the queue. This concludes today's teleconference. Thank you all for participating. You may disconnect your lines at this time and have a wonderful day.