Greetings, and welcome to Tenable Q2 2024 Earnings Conference Call. This conference is being recorded. It is now my pleasure to introduce your host Ms. Erin Karney, Senior Director, Investor Relations. Thank you, Ms. Karney, you may begin.

Thank you, operator, and thank you all for joining us on today's conference call to discuss Tenable's second quarter 2024 financial results. With me on the call today are Amit Yoran, our Chief Executive Officer; and Steve Vintz, our Chief Financial Officer. Prior to this call, we issued a press release announcing our financial results for the quarter. You can find the press release on our IR website at tenable.com. We will make forward-looking statements during the course of this call, including statements related to our guidance and expectations for the third quarter and full year 2024, growth and drivers in our business changes in the threat landscape in the security industry, and our competitive position in the market; growth in our customer demand for and adoption of our solutions, including Tenable One, planned innovation and new products and services, the potential benefits and financial impact of our recent acquisition of Eureka, and our expectations regarding long-term profitability and free cash flow. These forward-looking statements involve risks and uncertainties, some of which are beyond our control, which could cause actual results to differ materially from those anticipated in these statements. You should not rely upon forward-looking statements as a prediction of future events. Forward-looking statements represent our beliefs and assumptions only as of today and should not be considered representative of our views as of any subsequent date, and we disclaim any obligation to update any forward-looking statements or outlook. For further discussion of the material risks and other important factors that could affect our actual results, please refer to those contained in our most recent annual report on Form 10-K and subsequent reports that we file with the SEC. In addition, all of our financial results we will discuss today are non-GAAP financial measures with the exception of revenue. These non-GAAP financial measures are in addition to and not a substitute for or superior to measures of financial performance prepared in accordance with GAAP. There are a number of limitations related to the use of these non-GAAP financial measures versus their closest GAAP equivalents. Our press release includes GAAP to non-GAAP reconciliations for these measures. I'll now turn the call over to Amit.

Thank you, Erin. We delivered mixed results for the quarter with lower-than-expected CCB, but with outperformance in revenue and earnings. Exposure management continues to generate demand, particularly for Tenable One and cloud security as key priority areas for CISOs. Before I get into the quarter, I'd like to first comment briefly on the recent CrowdStrike outage. This incident highlights the importance of independent cybersecurity assessments and the negative global consequences of creating single points of failure with any one vendor. Excessive reliance on any one vendor reduces enterprise resilience just as deviating from best-of-breed platforms increases exposure to risk. Boards have a fiduciary responsibility to oversee cyber hygiene, and we expect regulators will play an increasingly critical role in promoting resiliency and requiring transparency. We believe the path forward for modern organizations lies in interoperable best-of-breed platforms that empower enterprises to reduce risk and improve cyber hygiene. Now on to the quarter, a few areas stood out as notable in Q2. First, customers continue to highly scrutinize their spend and rigorously prioritize their investments. Second, and this is a positive trend for us, is that exposure management is gaining increasing momentum in the industry among customers and analysts. Customers need and want to understand their level of risk across their attack surface, from their IT environment to the cloud to their critical infrastructure, and we believe that has resulted in strong traction for Tenable One. And third, as customers increasingly rely on cloud, we are seeing strong momentum for our cloud exposure solution. In fact, one of our largest deals for the quarter was for our cloud security products with a major financial services company. I will talk more about that in a few minutes. Let me dig deeper on the first point regarding spending patterns that we noticed in Q2. We continue to see a great deal of customer uncertainty around cyber spending. This makes it more difficult to transact and close new deals as new projects and procurements are getting the greatest scrutiny. This trend becomes more apparent as deal sizes get larger. These two dynamics were more pronounced in our Vulnerability Management business in Q2 than what we had seen historically. And while our mix shift to our faster-growing exposure solutions is healthy, it is not enough to offset the cyclical impact of our traditional stand-alone VM business. While VM is becoming more cyclical, we remain the clear leader. VM continues to drive initial Tenable One adoption and lays the groundwork for future upsell opportunities. Our win rates continue to be very strong. Exposure management is becoming increasingly critical for customers. We pioneered this category knowing that point products leave customers with an incomplete view of actual risk in their environments. This is where Tenable shines. Tenable One, our exposure management platform, provides a unified approach and consolidated visibility across asset types to deliver insights that individual products alone cannot provide. And there's also a compelling ROI to customers who consolidate spend and reduce complexity in their security stack. We are expanding into budgets beyond VM and broadening our reach within enterprises. Tenable has become a trusted source of truth for boards and executives needing to understand their businesses’ exposure and risk. We're seeing this play out in our product mix as Tenable One represented 30% of new business in Q2. We are also seeing increased utilization with different asset types, which allows customers to leverage features such as ATT&CK path analytics, visualize the riskiest exposures and toxic combinations, and enables customers to quickly assess and safeguard their business. We're also seeing significant momentum in cloud security. The prioritization of cloud security spending, coupled with our CNAPP offering, resulted in strong growth in our cloud security for the quarter. Tenable cloud security delivers immediate value as an exceptionally user-friendly multi-cloud solution. We're starting to land technical wins with large sophisticated enterprises. In fact, it is in the second quarter in a row that one of our largest deals, including cloud security, as I mentioned, the Fortune 100 financial services company selected us this quarter for a team that is an integral piece of CNAPP. The other cloud security provider for CNAPP was not able to deliver visibility in identity for cloud, where we are the best provider to meet their needs. During the quarter, we acquired Eureka, a leading data security posture management company, integrating data security into Tenable cloud. We're excited to add enhanced DSPM to our CNAPP offering, which we expect to happen this year. We're also expanding our generative AI capabilities to maximize customer value. Along with integrating AI into our products, we're also seeing rapid adoption of our exposure management platform to identify where and how AI is operating in customer environments. We introduced two new capabilities in Q2. First, an AI security posture management capability within our cloud security offering that detects misconfigurations in services like AWS Bedrock and Azure OpenAI and ensures compliance with their organization's security policies. Second, we now provide runtime detection to identify AI software libraries and browser plug-ins that may be in use within the enterprise. We believe this is an innovative capability to alert security teams regarding the unauthorized use of AI that may be taking place in their environments. As we look ahead, we are going to focus on optimizing the business by investing in areas that matter most to our customers while continuing to drive profitability in the business. We will continue to enhance our CNAPP offering, add additional features to Tenable One, and leverage AI to drive efficiency in our products to solve problems for our customers. On that note, Steve will go into more detail, but we are introducing our 2025 unlevered free cash flow target of $280 million to $290 million today. We believe this is a strong initial target representing our commitment to deliver durable cash flow growth, and we look forward to updating you as we get through the second half of the year. We'll continue to evaluate the appropriate level of investment in resources going forward to strike the right balance of growth and profitability. This is an exciting time for Tenable. We are leveraging our leadership position, seeing major momentum in cloud and delivering a broader exposure management platform. Despite challenges for this quarter, I am confident in our long-term strategy and our ability to grow over the ensuing years. I'll now turn the call over to Steve for further commentary on our financial results and outlook.

Thanks, Amit. Calculated current billings, defined as revenue recognized in the quarter, plus the change in current deferred revenue, grew 10% year-over-year to $221.1 million. While we only guide to CCB on an annual basis, I think it's fair to say CCB growth in the quarter fell short of our expectations. Accordingly, we are revising our outlook for the year to reflect a more challenging selling environment. Now let's get into the results for the quarter as it will provide context to our outlook for the full year. Overall, we went into the quarter with a healthy pipeline and a large number of six and seven figure opportunities. We closed fewer deals than expected as customers defer new projects in the face of a more challenging macro environment and tighter budgetary constraints. This shortfall was specific to VM, particularly with large opportunities in North America, where we experienced longer sales cycles and more modest growth in comparison to other geographies. Other areas of new business continue to gain traction despite the selling environment; Tenable One grew to 30% of total new enterprise sales and is up from 26% last quarter. Exposure solutions, which includes Tenable One, stand-alone cloud identity, and operational technology security solutions represented over 50% of our total new sales in the quarter. As a point of comparison, exposure solutions were under 10% of total new enterprise sales in Q2 of 2020. So we've made a lot of progress in this regard. This healthy mix of new business demonstrates our ability to broaden the product portfolio and expand into new markets over the years and reflects the growing demand for exposure management and the actionable insights we deliver to CISOs and their security teams. As Amit commented earlier, cloud security was also a major highlight for us with several sizable six-figure wins in the large market, including a global financial services and payments firm, a large defense contractor, and a multinational enterprise software company. We believe our success here is a clear indication that we will continue to take and win share in one of the faster-growing areas of the cybersecurity market. Finally, I also want to note that current RPO growth in the quarter was 14%. Turning to other highlights, we added 408 new enterprise platform customers and 76 net new six-figure customers during the quarter. Our net dollar expansion rate was 109% this quarter, consistent with last quarter, and our renewal rate remained strong. Now on to the P&L for the quarter; revenue was $221.2 million, which represents 13% year-over-year growth. Revenue in the quarter exceeded the midpoint of our guided range by $3.2 million. Our percentage of recurring revenue remains high at 96% this quarter. I'll now turn to expenses. I'll start with gross margin, which was 82% this quarter, up 70 basis points from last quarter. Gross margin was better than expected due to our continued ability to cost-effectively scale our public cloud infrastructure for our exposure management platform and other cloud-based offerings. Sales and marketing expense was $84.8 million, up modestly from $84.5 million last quarter, and as a percentage of revenue, was 38% compared to 39% last quarter. Sales and marketing expense was higher sequentially on an absolute dollar basis, primarily due to greater marketing investments to promote our cloud security and exposure management offerings, as well as to build our global brand, partially offset by costs in Q1 related to our annual sales kickoff conference. Overall, we are pleased with the improved efficiency in our go-to-market efforts this quarter and expect sales and marketing spend as a percentage of revenue to continue to trend lower over the remainder of the year and beyond. R&D expense was $33.4 million, which is up from $32.6 million last quarter. R&D expense as a percentage of revenue was 15% this quarter, flat compared to last quarter. Wages were higher in the quarter related to the acquisition of Eureka. G&A expense was $19.6 million, which was down from $20.6 million last quarter, primarily due to lower payroll taxes related to the divesting of RSUs in Q1. G&A expense as a percent of revenue was 9% this quarter compared to 10% last quarter. Income from operations was $42.8 million and exceeded the midpoint of our guided range by $7.8 million. Operating margin for the quarter was 19%, which was approximately 325 basis points better than the midpoint of our guided range. The notable outperformance in earnings this quarter reflects our ability to continually drive leverage in our business while making investments to win share in cloud security and the exposure management markets. The sizable beat in operating income resulted in significant EPS upside. EPS for the quarter was $0.31, which was $0.08 better than the midpoint of our guided range. Let me briefly touch on the restructuring expense in the quarter, which is excluded from our non-GAAP results. You'll recall that in Q4 2023, we announced an optimization plan, including the potential sublease of a portion of our real estate. In Q2, we executed the sublease and recognized a $4.5 million impairment charge related to the leaseholds and furniture and fixtures. Now let's turn to the balance sheet. We finished the quarter with $487 million in cash and short-term investments, reflecting the $29.2 million of net cash used for the Eureka acquisition. Accounts receivable was $179.6 million and total deferred revenue was $725.8 million. Current deferred revenue was $562.6 million, which gives us a lot of visibility into expected revenue over the next 12 months. We generated $36.5 million of unlevered free cash flow during the quarter, which reflects the seasonal pattern of billings during the year. To date, unlevered free cash flow was $91.2 million and puts us well within reach to achieve our annual guide for the full year, which we are raising today. We feel confident that we can continue to expand our operating and free cash flow margin over the ensuing years as we have done so every year since our IPO. During the quarter, we repurchased 589,000 shares of common stock for an aggregate purchase price of $25 million. Thus far, we've repurchased almost 1.5 million shares and have $35.1 million of remaining authorization under our initial $100 million share repurchase program. With the results of the quarter behind us, I'd like to discuss our outlook for Q3 and the remainder of the year. For the third quarter, we currently expect revenue to be in the range of $222 million to $224 million, non-GAAP income from operations to be in the range of $42 million to $44 million, non-GAAP net income to be in the range of $35 million to $37 million, assuming interest expense of $8.3 million, interest income of $5.7 million, and a provision for income taxes of $3.8 million. And non-GAAP diluted earnings per share to be in the range of $0.28 to $0.30 per share, assuming 123 million fully diluted weighted average shares outstanding. For the full year, we currently expect calculated current billings to be in the range of $957 million to $967 million, revenue to be in the range of $889 million to $895 million, non-GAAP income from operations to be in the range of $167 million to $171 million, non-GAAP net income to be in the range of $143 million to $147 million, assuming interest expense of $32.7 million, interest income of $23.5 million, and a provision for income taxes of $12.8 million. Non-GAAP diluted earnings per share to be in the range of $1.16 to $1.19, assuming $123.5 million in fully diluted weighted average shares outstanding. I would like to provide some commentary regarding our revised outlook today, which reflects lower CCB in revenue for the year. As we think about the second half of the year, we are taking a more cautious approach to new business, not only with large VM opportunities but also with other pipeline opportunities. While demand generation remains healthy, the rate at which these opportunities are expected to progress through the funnel in the second half of the year is expected to be more moderate than previously anticipated, which will constrain our near-term results. Despite the reduction in our top-line outlook, we remain committed to our margin targets and are pleased to be raising our operating income and unlevered free cash flow outlook for the year. We're also providing an unlevered free cash flow target today of $280 million to $290 million for the full year 2025, which is 24% growth year-over-year at the midpoint, and a major milestone toward achieving our updated long-term target unlevered free cash flow margin of 35% or more. With over 95% recurring revenue, high gross margins, and high renewal rates, we have a lot of confidence in our ability to drive continued leverage in our business. It's important to note that we are committed to delivering on this level of cash flow in 2025 based on a range of growth scenarios, and we'll continually evaluate the appropriate level of investment and resources to achieve this target. As a platform and cloud-first company, we will invest in areas where we see outsized growth and we'll reprioritize spend in other areas where appropriate. I will now turn the call back to Amit for some closing comments.

Thanks, Steve. In summary, this market is very fluid, and we are taking a more cautious approach to our CCB and revenue outlook today. We are very encouraged by the momentum in exposure management and cloud security, and we are excited about where we are as a company and the opportunity in front of us. We hope to see you at the Canaccord, Stifel, and Piper Sandler conferences in the upcoming weeks. We'd now like to open the call for questions.

The first question comes from Saket Kalia with Barclays. Please go ahead.

Okay, great. Hey guys, thanks for taking my questions here and good to hear from everyone. I mean maybe to start with you, I thought it was interesting in your prepared remarks that you talked about sort of traditional VM becoming more cyclical. Maybe to start us off, can you just talk about some of the market dynamics in VM? And maybe why you think the demand for Tenable One feels just decently stronger right now than traditional VM. Does that make sense?

It does. Saket, thank you for the question. With respect to VM, it's an established market. We're seeing some cyclical patterns in it, but we are the clear market leader. In Q2, we saw greater scrutiny of transactions, specifically in North America and in the large enterprise segment of the market. With respect to Tenable One, it's just a more modern infrastructure and a more strategic conversation that we're having with our customers. We continue to see strong demand for Tenable One, which accounted for 30% of our new sales in the quarter. And that's even more broadly than T1. We saw attractive growth for exposure solutions, including cloud, and we're proving ourselves to be highly competitive with market leaders in identity.

Got it. Got it. That's helpful. Steve, for my follow-up, maybe for you. Despite the challenges in VM that we just spoke about, the focus on free cash flow definitely comes through and certainly appreciate the early look at how you're thinking about 2025. Just understanding that it's still very early. Can you just talk us through how you kind of think about the balance between growth and margins in setting that target, even anecdotally?

Sure. Thanks, Saket. Well, we're very pleased to be providing an initial unlevered free cash flow target today for 2025, $280 million to $290 million. That's for the full year next year. That's up 24% at the midpoint. And that's also a major milestone, by the way, towards achieving our updated long-term target for unlevered free cash flow of 35% plus. Previously, our long-term target for cash flow was 30%. So I have a lot of confidence in our ability to continue to drive margin leverage. In terms of growth for next year, look, I'm not going to comment about that. We're not through our planning process yet. And we have to see how the second half of the year plays out. But the one thing I will say is that we're firmly committed to delivering on our unlevered free cash flow targets. We're also raising our levered free cash flow outlook for the year. And we're going to continually evaluate the appropriate level of investment and resourcing to achieve these targets. Some areas will continue to lean in and invest, and other areas will reprioritize where appropriate. So overall, we just have confidence in our ability to drive higher levels of cash flow.

Next question comes from the line of Brian Essex with JPMorgan. Please go ahead.

Great, thank you. Thank you for taking the question. Amit, great to see you back in the seat. So congratulations to you. I guess I wanted to touch on Ermetic cloud security. Maybe if we can get an update on that, where are you integrating it? Is it only on the analytics portion of that business? Are you integrating with the rest of the company? And are you able to lead with cloud security? I know you talked about seeing it as a point of strength there, but I would love to get more detail on where you're seeing success and plans for integration longer term.

Thanks, Brian. It's great to be back. I'll start off talking a little bit about the strength we're seeing in our cloud security product. We're providing a full end-to-end full CNAPP solution, and that's resonated with customers. A majority of our cloud sales are for that full CNAPP capability. That said, in the very large enterprise side of the market, where they may already have a DSPM solution, they already have a CNAPP solution. We have market-leading capability, particularly strength around identity and the keen functionality. So I think our largest single transaction for the quarter came as a key win from a Fortune 500 company in the financial services segment, a very sophisticated consumer of technology where they were doing bake-offs. In terms of our ability to generate leverage with our cloud security product, we have a lot of confidence that the majority of our cloud security sales in fact, stem from cloud security through Tenable One licensing. So we're extremely excited with that that is resonating with VM customers choosing to move to the modern platform to assess exposures and then diversifying the asset types and recognizing that we've got market-leading cloud security that they can procure, and we can do that and get more leverage through an integrated Tenable One platform. So we think the strategy makes sense. We think we're really in the early innings here.

Great. And just maybe a quick follow-up for Steve. Steve, could you comment on the Fed business or just public sector in general? I know that I think last quarter, you felt really good about it and called out some strength there. I think we've heard about federal spend trickling down to SLED. Maybe just a comment on mix strength of the business there? And is that reacting or behaving differently than the enterprise side of the business?

Our public sector business was good this quarter and in line with our expectations. There are some very large seven-figure agency-wide opportunities in our pipeline for the second half of the year. Some of these large deals involve coordination and budgetary, I mean, across dozens of sub-agencies for some deals, which can introduce some variability. But overall, we continue to see strength in the public sector, and we're set up for a good second half of the year with U.S. Federal.

Next question comes from the line of Hamza Fodderwala with Morgan Stanley. Please go ahead.

Hey, good evening. Thank you for taking my question and good to hear from everybody as well. Amit or Steve, I wanted to follow up on the public sector question. You mentioned obviously good strength there for Q2. We have heard that there have been some delays on the Fed budget and perhaps some agencies who are a bit uncertain due to the potential change in administration with the elections later this year. I'm wondering if you're seeing any of that impact elongate some of the sales cycles for you within that vertical and if that is reflected in your guidance?

Yes, I'll start and say we saw in line delivery with our expectations for the product sector in Q2. Q3 obviously is a seasonally high quarter for the public sector. It is an election cycle. We have a significant number of six and seven figure opportunities in public sector. That said, I think we're taking a cautious approach for the remainder of the year and trying to understand that there's a certain amount of unpredictability around public sector and the election cycle.

Yes. And the only thing I'd add there is, look, we're trying to take a more cautious approach here to new business, specifically with large deals in the second half of the year. This is predominantly in VM, but we're also applying that more broadly across our business, which includes public sector. While demand generation remains healthy, the rate at which these opportunities are expected to progress through the funnel in the second half of the year is expected to be more moderate. So we're trying to factor that into the guidance and trying to be cautious.

Next question comes from the line of Rob Owens with Piper Sandler. Please go ahead.

Yeah, thank you for taking my question. Amit, I appreciate your comments around the VM business, but what can you say to assuage investor concerns that it's not secular, that it is cyclical that you're seeing right here either in terms of pipelines or customer behavior?

Yes, I'll start off by saying I've got a lot of confidence in the market, in the VM business. It's a strategic market as you and others have been in the space for a long time, recognizing that it's one of those foundational tools that CISOs need and report regularly to auditors, risk committees, sometimes cyber committees, and to the Boards of Directors. So it's a foundational market requirement within cyber. It's not one that we anticipate going away or even having a more secular downward trend. It is cyclical, and I think we're going to see an improved outlook in the VM market with improved macro conditions. We saw this specifically in North America and with large enterprises, and we're trying to take a more cautious approach to our guidance and ensure we're setting ourselves up for a successful remainder of the year. I do think that there's opportunity for outperformance in VM and growth over time.

Next question comes from the line of Mike Cikos with Needham & Co. And go, please. Go ahead.

Hey, guys, thanks for taking the question here. Wanted to go back, I think you guys had called out that Tenable One contributed 30% to new business in this quarter, if I had the metrics right. Can you just help us think about if it's contributing, I guess that percentage, right, 30%, when can we start expecting Tenable One to start showing up in the revenue stream, just given the ASP uplift that management has historically spoken about for Tenable One?

Well, thanks, Mike, for the question. We have broadened our business over the years and expanded into adjacent markets. The one thing I will say is that VM, as Amit commented earlier, is foundational; we're the clear leader, but growth here, as we mentioned earlier, has become more moderate. That said, we have confidence in that business to be able to drive growth higher in the ensuing years. Of course, we have a portion of our business, most notably cloud security and platform that is growing at a very high rate, and we expect that to continue, and that will represent an increasing mix of our total business going forward. So our core market has seen slower growth right now in this macro. And then we have a portion of our business that's expected to represent a greater percentage of our total business going forward that has seen outsized growth. Obviously, we expect going forward that we'll be able to drive higher levels of cash flow regardless of the growth outcomes even in the second half of the year for next year.

And I also just wanted to circle up on the new business to the extent that customers are showing increased cyber scrutiny on these. Help us because I know Q1, you guys were the strength that you were seeing in new deals. In hindsight, is it fair to think that, that 1Q strength may have been more tied to the pause that we saw in March of last year with SVB and the easier comp? Or was there something that really showed up that was different in Q2? And can you maybe clarify when that showed up in Q2? Was it in April, May, June, really the last couple of days of the quarter, how did that progress?

Yes, by saying this, we are pleased with our Q1 results. We came into Q2 with a strong pipeline and a healthy number of six and seven-figure deals. Obviously, a large portion of that comes in New North America. As the quarter played itself out, we saw some of the softness in VM in North America, in the large enterprise, which has a disproportionately large impact on those larger transactions that play a factor in our financials, depending on the size of the company. So I think we've got a reputation for calling it like we see it, as we did with strength in businesses in Q1. So we felt good about ourselves for Q2. Obviously, the quarter just played out that way.

The next question comes from the line of Joel Fishbein with Truist Securities. Please go ahead, Joel.

Thanks for taking the question, Amit. Good to hear your voice. A question on Eureka. The DSPM market seems very crowded. Can you just help us understand how that's going to fit in the product portfolio, when we would likely see revenue from it? And what the target customer is there? That would be really helpful.

Thanks, Joel. Great to be back. We're excited about the Eureka acquisition. DSPM is a strategic component of the CNAPP platform. I anticipate that over time, most organizations will procure unified SaaS solutions, and that will include a component or some licensing component of DSPM. We have the DSPM in our current CNAPP offering that's tightly integrated in a unified workflow, and that's really one of the strengths that Eureka brought to the table with Tenable's cloud security capability. With the Eureka acquisition, we're able to introduce the next-generation features and next-generation SPM capabilities into that CNAPP offering into our cloud security offering, and feel like we can now be highly competitive with the absolute market leaders in DSPM. So we do compete in the DSPM space. I think we can lead the market when it comes to team and Uniface workflow. I think some of the early indicators here with our cloud security offering are starting to bear that out, and we're excited to prove that out over time.

Next question comes from the line of Andrew Nowinski with Wells Fargo. Please go ahead.

Great, thank you. It is great to have you back, Amit. I wanted to ask about, I guess, your guidance. The CrowdStrike outage obviously occurred after the quarter in July, but do you think this outage might have maybe exacerbated the scrutiny that you're seeing on some of these larger deals at your customers in that they're maybe just holding back spending now because of the outage in Q3? Do you factor that in, I guess, is what I'm asking? Is that a factor in your guidance?

Yes. We are definitely considering the increased scrutiny from large enterprise transactions. We recognize that customers who have faced issues or significant outages are now more cautious and asking detailed questions. Fortunately, we have strong responses for them. We can function without an agent as we have for many years, and when we do use an agent, we can operate without impacting kernel mode, providing added safety for our customers. We also do not mandate upgrades, allowing customers to choose when to use the agent or to work with a different setup, ensuring their operations are not affected by prior experiences. We are observing heightened scrutiny in procurement, which is reflected in our guidance, and we are taking a cautious approach for the second half of the year. We believe we are well-prepared to address the concerns of procurement teams as the CrowdStrike outage situation unfolds.

Congratulations on releasing the fiscal '25 free cash flow guidance; it was really impressive. I was wondering, given the recent rumors, can you confirm whether you hired advisors for a potential acquisition?

Yes. Obviously, good question, but we don't comment on rumors and speculation.

Next question comes from the line of Jonathan Ho with William Blair. Please go ahead.

Hi, good afternoon. Regarding your 2025 free cash flow guidance, could you provide more insight into where you see opportunities to achieve this additional leverage? Are there plans for further rationalization? Any comments would be helpful for understanding how you intend to drive this growth.

Yes. I would say, first, we had notable performance in the quarter, and that reflects our ability to continue to drive leverage in our business while also making investments to continue taking share in cloud security and the exposure management market. We're trying to be more efficient in our business, specifically with regard to sales and marketing; this is something we talked about at the beginning of the year. How it played out this year has proven to be true. For example, sales and marketing as a percentage of our revenue was 42% last year; this year, it is 38% for this quarter. We expect continued leverage in sales and marketing. In terms of G&A, as we grow and scale, we'll be able to more fully absorb some of those costs, which are somewhat fixed. We're driving leverage in our gross margins as we scale our cloud security offerings and our unified exposure management platform. Every year since we've been public, we've expanded our free cash flows. We expect the continuation of that trend. Given our confidence in our business and what we've demonstrated to date, as I mentioned earlier, we're also raising our long-term target from unleveraged free cash flow from 30% previously to now 35% plus.

Excellent. And just very quickly, in terms of your ability to win on the CNAPP side, clearly, there's a lot of competition in this space. You've got a clear differentiation with your capabilities. Can you help us understand what percentage of the market you think you can take or how the competitive dynamics are really playing out in the space, just given how many players are sort of targeting this market?

Yes, the market is definitely crowded with many players in cloud security. I consider us among the top five in Tier 1 CNAPP solutions. As we compete against other leading products, our position is becoming clearer, whether we land as the first, second, or third player this year, I am quite confident. We are delivering innovative solutions with strong competitive win rates. It will be interesting to see how it develops over time. We have great faith in our team, which provides a market-leading solution offering some of the best CNAPP experiences available today.

Next question comes from the line of Shaul Eyal with TD Cowen. Please go ahead.

Thank you. Good afternoon, everybody. Great to hear Amit's voice on the call. Steve, actually, let me start with you. Some of the might have seen towards the end of the quarter. Has anything been booked back over the course of the past 30, 31 days now?

The short answer is yes. But what I will say is this; in our experience, when we see deals push out of the quarter, it would not be prudent to assume that for the upcoming quarter, in the second half of the year, that we will continue to close what we expected plus the deals that pushed overall. We're just seeing longer sales cycles, specifically with large deals. The good news is we are transacting those large deals, and we have lots of pipeline opportunities that are in the high six and seven-figure range. But we're just assuming a longer sales cycle, and longer sales cycle means it impacts not only the current quarter but also the outlook for the second half of the year. That's what we're factoring into the guidance, as it needs to be more cautious.

Fair enough. And maybe for Amit, when you run a quick comparison with the softness you've observed back at the beginning of the 1Q '23, what would that comparison look like? Is it strictly geographic? Is it product? Is it category-driven? Just curious.

Yes. Well, certainly product and category-driven. So on the product side, we specifically saw it in our VM business in North America and the large enterprise segment. We, in fact, had reasonable performance in the commercial market, mid-market with no notable change. I think what we're trying to do in the outlook is apply that same level of scrutiny to our other theaters and ensure that we're taking a cautious approach to the remainder of the year, setting ourselves up for success. What we are seeing is a healthy amount of engagement in strategic conversations with our customers. That's what's driving the impressive growth with Tenable One where they are discussing exposure management and leveraging Tenable One as an exposure management platform, and we're able to engage with them with our exposure solutions and strengthen cloud which we saw and expect to continue with this product, which is highly competitive as well as identity and operational technology.

Our next question comes from the line of Gray Powell with BTIG. Please go ahead.

Okay, great. Thanks for taking the questions. Just a couple of quick ones on my side. So in terms of the, I guess, we'll call it new disclosures, you've called out 50% plus of new sales from exposure solutions, and then 30% of new sales from Tenable One. So this might be a little basic, but does that mean that 20% of your new sales are stand-alone products like cloud security, identity, and OT? And then I just want to make sure that I'm correlating it correctly. Like when you say new enterprise sales, like what specifically is the definition there? Does that correlate more with something like current bookings? Or should we think of something else?

Gray, yes, this is Steve. So when we said that 50% of our total sales in the quarter is exposure solutions, that is inclusive of Tenable One and inclusive of 30%. Just as a clarification. We often talk about enterprise sales, right? We have two really go-to-market motions. We have a direct sales organization that stands shoulder to shoulder with partners that transact deals. They have quotas. We refer to that business as our enterprise sales business. They are targeting either mid-sized or large-sized customers and also part of our go-to-market is an unaided sale without the assistance of a sales rep or we transact deals through DMRs or online via our e-commerce engine. Collectively, total new business refers to our enterprise direct sales organization and also refers to our unaided sales motion with kind of lower ASPs and high-velocity yields.

Next question comes from the line of Brad Reback with Stifel.

This is Rob on behalf of Brad. With the upcoming federal fiscal year and the next quarter, I wanted to know if you have noticed an increase in federal and public sector customers transitioning to Tenable One compared to the adoption trends for perpetual licenses observed in last year's third quarter. Also, should we anticipate the same CCB challenges we faced in last year's third quarter recurring in the next quarter?

Yes. I think we're seeing out of the federal market is similar in volume patterns and behaviors to other market segments. We're seeing some adoption of Tenable One, but obviously, as a multiyear, given the penetration in the account base we have in the federal market, that's going to be a multiyear account effort to transition when we go down into Tenable One.

Next question comes from the line of Shrenik Kotari with Robert W. Baird. Please go ahead.

Thanks for taking my question. Welcome back, Amit. Just a follow-up to an earlier question and your commentary on the CrowdStrike outage-driven deal scrutiny being factored in the second half. At the very beginning, you highlighted the importance of best-of-breed solutions in promoting resilience and reducing risk associated with over-reliance on a single vendor. Can you elaborate on how you are positioning Tenable to address that? And I was just curious if you're already seeing some traction in the ongoing customer conversations.

Yes. I think we're in the early innings of how customers are going to proceed with this, and you hear different responses and different approaches from CISOs around the world that have been impacted. For us, we look at it and say, hey, there are certainly some characteristics that could serve as tailwinds. When you look at vendor consolidation on higher-risk agents, things like kernel-level usage, or even operating system diversification. We think that there is significant validation for having an independent audit, an independent exposure assessment from a vendor like Tenable that is not also providing an operating system or other security functionality. We think that message resonates. It makes great sense in a high resiliency architecture. There are good arguments that we might see some tailwind from this, just as we spoke earlier on the call, but there's good arguments for increased scrutiny that might occur. Customers might see consistent scrutiny from large enterprises, whether procurement teams have experienced outages and are asking corporate leadership or security leadership for different levels of assurances and different terms around liabilities and assurances around failure. I think we have great answers for those teams.

Got it. And Steve, a quick follow-up on the net dollar expansion rate, remaining steady at 109%. So just can you provide more insights into how this stacks up against building softness? Is it just the lagging indicator, that dynamic versus real-time billing standard that we're missing contributing to this?

Well, obviously, there's a lot of interplay between new deals in the quarter from new logos and then expansion within existing customers. Each quarter is different in its own right. That mix between new business from new logos and expansion from existing customers can vary. As you mentioned earlier, our net dollar expansion rate in the quarter was 109%, which was good to see stabilize. That reflects customers' ability to expand and add Tenable One. But also, we're acknowledging here in this market, specifically with large deals, and particularly VM, where you're seeing customers moderate the rate of expansion within that product set. Overall, we have a big customer base. We are confident our go sell a broader product portfolio back into that base, and we would expect the net dollar expansion rate to trend up over the course of the years here.

Next question comes from the line of Joshua Shilton with Wolf Research.

This is Rich Magnus on for Josh Shilton. Coming back to the macro. Some other software names you've reported are saying the macro is starting to stabilize, and your results and commentary suggest maybe some potential softness there. Can you guys give any other points on inputs that may be driving that or some thoughts on the possible disconnect from others who have reported? So any additional color on things that changed quarter-over-quarter would be helpful.

Well, we reported a good Q1 and raised our outlook for the year, due to strength specifically in new dollars from new logos. As I mentioned earlier, every quarter is different in its own right. In Q1, that was at a time when others were reporting a tougher macro and softness. This quarter, we saw certainly more levels of review and budgetary constraints with respect to large deals, reflecting our outlook for the year. Again, each quarter is different in its own right. We try to be cautious in our outlook, reflecting what we saw in Q2 for the second half of the year.

Next question comes from the line of Patrick Colville with Scotiabank. Please go ahead.

All right. Thank you so much for taking my question. Steve, this one for you, please. So current billings rose 10% this quarter, which, I mean, given the tough comp is pretty respectable. But the guidance implies quite a big fall-off in the back half. I mean, I model an exit billings growth rate in 4Q of about 7%. So I guess, am I thinking about it the right way? And then is it these trends you've been talking about shortfall in VM because of the cyclicality, North America softness, and large enterprise softness; those trends going to get worse through the year, like what we see in 2Q kind of worsens?

Yes. So I would say it's impacting our CCB guide a little bit. If you look at the second half of the year, that suggests that we're expecting to grow, call it, 9%, 10%, given the range that we provided. So yes, we are expecting more moderate growth in the second half of the year relative to what we experienced in the first half. What we said specifically in Q2 is that we saw a challenge getting deals across the line, specifically in the VM and North America. It is more notably in our VM business, but we're also trying to hedge large deals across our theaters, whether it's public sector or otherwise. We think that's the right thing to do. Overall, we're going to take a cautious approach for the second half of the year. The good news is that pipelines are full and the funnel remains strong, and our focus will be on closing lots of those large opportunities.

That's very helpful. You mentioned the importance of VM, which is essential for every enterprise CISO. Considering your observations about the current cyclical downturn and what has happened in previous cycles, when do you believe this cycle will end for VM?

Yes, I think it's obviously quite speculative to throw out a particular quarter. It's more just a recognition of the importance of the market. At some point, both from a macro perspective but more specifically from a VM perspective, we believe it will come back in favor and have an increasing share of budget over time, the way it has in years passed. It has been cyclical in years past as well. We saw it a couple of years ago; it was the #1 priority in some CIO, CISO surveys. And then before that, it was number five, number six priorities. These things are cyclical. We believe that it will come back; it's just quite difficult to project when.

And we're certainly not factoring that into our outlook for the year. Our expectation is that we would see growth higher in the VM certainly over the upcoming years.

Next question comes from the line of Roger Boyd with UBS. Please go ahead.

Great. Thanks for taking the question. Steve, I wonder if you could help bridge the CCB performance versus the CRPO performance. And anything you're seeing from billings duration or payment terms perspective, given the relatively better CRPO and current bookings growth?

Yes. So current RPO growth grew 14%. We talked about CCB as a proxy of what we sell; in some quarters, CCB can closely correlate to the underlying health and sales of the business. In other quarters, we talked about this in Q3 of last year. RPO is a better approximation. I think it's fair to say regardless of what metric, top line came in lighter than expected, which we talked about. But there's not a perfect metric. CCB here is influenced by deal timing, early renewals, a number of other factors. Overall, it's a corollary to our performance in the quarter, which we've discussed.

Got it. And then maybe a quick follow-up for me, just approaching the cloud competition debate from another perspective. Any color on the contract durations or strategic nature of the deals you're seeing in cloud security? It seems like you're having a lot of success with the keen function in particular, winning alongside existing CNAPP solutions. Can you just talk to your confidence in winning that broader cloud security budget over time and not the other way around as other CNAPP vendors expand their own capabilities?

Yes, sure. I'll start by saying the vast majority of the transactions that we're pulling in on the cloud security side are for cloud security and the broader CNAPP solution. A lot of customers begin their CNAPP journey with CSPM. We think we have a highly competitive CSPM functionality, but really, that unified CNAPP approach is an area where we shine, especially when competing. Our early win rates are starting to prove themselves out in the specialty and large enterprises where they're doing bake-offs and testing. For organizations that have already deployed a CNAPP or just deployed CSPM, we don't have to go in and displace or replace in order to pull down budget. The great example we called out was a sophisticated customer, which was able to differentiate our capabilities from what they were able to get with their existing vendor. It also opened up additional total addressable market (TAM) for us as we were able to tap into identity and access management budget. It wasn't even coming from the cloud security budget. So again, that opens up additional TAM to us and one that I feel great about continuing to expand over time.

Next question comes from the line of Rudy Kessinger with D.A.Davidson.

Since there's no questions at this point of time, this concludes today's teleconference. You may disconnect your lines at this time. Thank you for your participation.