Earnings Call Transcript - TENB Q1 2024

Operator, Operator

Greetings, and welcome to Tenable Q1 2024 Earnings Conference Call. As a reminder, this conference is being recorded. It is now my pleasure to introduce your host, Ms. Erin Karney, Vice President, Investor Relations. Thank you, Ms. Karney. You may begin.

Erin Karney, Vice President, Investor Relations

Thank you, operator, and thank you all for joining us on today's conference call to discuss Tenable's first quarter 2024 financial results. With me on the call today are Amit Yoran, our Chief Executive Officer; Steve Vintz, our Chief Financial Officer; and Jason Merrick, Senior Vice President, Products. Prior to this call, we issued a press release announcing our financial results for the quarter. You can find the press release on our IR website at tenable.com. We will make forward-looking statements during the course of this call, including statements relating to our guidance and expectations for the second quarter and full year 2024, growth and drivers in our business, changes in the threat landscape and the security industry and our competitive position in the market; growth in our customer demand for and adoption of our solutions; including Tenable One, planned innovation and new products and services, the potential benefits and financial impact of our recent acquisition of Ermetic, our expectations regarding the cost savings associated with optimizing our go-to-market efforts and our expectations regarding long-term profitability and free cash flow. These forward-looking statements involve risks and uncertainties, some of which are beyond our control, which could cause actual results to differ materially from those anticipated by these statements. You should not rely on forward-looking statements as a prediction of future events. Forward-looking statements represent our beliefs and assumptions only as of today, and should not be considered representative of our views as of any subsequent date, and we disclaim any obligation to update any forward-looking statements or outlook. For a further discussion of the material risks and other important factors that could affect our actual results, please refer to those contained in our most recent annual report on Form 10-K and subsequent reports that we file with the SEC. In addition, all of the financial results we will discuss today are non-GAAP financial measures with the exception of revenue. These non-GAAP financial measures are in addition to and not a substitute for or superior to measures of financial performance prepared in accordance with GAAP. There are a number of limitations related to the use of these non-GAAP financial measures versus their closest GAAP equivalent. Our press release includes GAAP to non-GAAP reconciliations for these measures. I will now turn the call over to Amit.

Amit Yoran, CEO

Thank you, Erin. We're very pleased with our results in the quarter. CCB revenue, operating income and cash flow all came in better than expected. Our leadership and exposure management resulted in strong momentum in Tenable One. In short, we're off to a good start for the year. There are two clear takeaways this quarter. First, exposure management, the category we pioneered over five years ago, is increasingly recognized as a crucial practice for security teams. Tenable is uniquely positioned to identify and mitigate risks across the attack surface, including cloud, identities, operational technology, applications, and IT assets. Second, the convergence of these categories onto a single platform is the most efficient way to truly understand and reduce risk, and we believe we are the only security vendor in the market providing these capabilities with Tenable One. Let me go deeper on the first point. Exposure management is gaining widespread attention and validation from security practitioners, industry analysts, and vendors. In fact, Gartner predicts that by 2026, organizations prioritizing their security investments based on an exposure management program will suffer two-thirds fewer breaches. We believe there is no company better positioned than Tenable to seize this opportunity, thanks to our early focus and ongoing commitment to delivering innovative exposure management solutions. Our focus is paying off with these solutions now representing approximately half of our total new sales in the quarter, inclusive of Tenable One. This momentum is a result of customers realizing that managing risks with solid programs is failing them. Security products for identifying and closing exposures of different types are still very disjointed, forcing security teams to work in isolation just like their tools. This approach to security makes it extremely difficult to defend against advanced threats or more sophisticated campaigns leveraging multiple attack methods and complex tool sets. For example, an attacker may gain access from an end point vulnerability, move laterally to an over-provisioned identity for privileged access and from there exploit misconfigured services running in the cloud. Point solutions simply are not able to identify and remediate these risks across domains. A unified approach that consolidates visibility from assets, identities, and risk configurations, spanning across domains, from on-prem to the cloud to critical infrastructure creates leverage and insights previously undiscovered. This is exactly what Tenable One is designed to deliver. A great example of Tenable One's impact involves a multibillion-dollar automotive parts company that selected Tenable One in Q1. They're looking to gain a unified understanding of risk across their attack surface. Recognizing the limitations of separate solutions, they replaced a key incumbent in vulnerability management with Tenable, while also adopting Tenable OT and cloud security to extend their visibility and remediation capabilities. Notably, the customer opted for our cloud security solution because it outperformed several well-known pure-play CNAPP competitors in uncovering exposures in the cloud and the fact that it integrates with the rest of their stack using Tenable One. We repeatedly encounter scenarios that underscore this new way of thinking. Conversations with customers and prospects often lead them to realize the dangerous limitations of using separate products to manage risk, like using a specific control system security product that has no connection to the rest of their environment. Customers are coming to grips with a fundamental truth: You cannot fully understand the risk of an interconnected environment when your risk management practice is compartmentalized. These scenarios are the reasons why solutions like our OT and our CNAPP capabilities are gaining traction with our customers. Given the scope of our coverage, Tenable stands out in our capacity to identify and prioritize risk. We leverage the data lake built around exposure information that encompasses hundreds of billions of aspects of threat, vulnerability, entitlement, and configuration data. This robust foundation underpins all of our products, from CNAPP to vulnerability management to identity to OT. Each product is strengthened by the deep insights gleaned from our entire portfolio. Last quarter, we continued to innovate aggressively in exposure management along many fronts, including the integration of more generative AI capabilities into Tenable One. These new advancements bring to life interactive attack path visualizations and offer an AI assistant that answers queries and delivers specific mitigation advice. This tool is our customers' real-time access to the latest exposure data tailored to their specific environment. Additionally, it provides customized guidance for fixing these issues. In an era marked by huge cybersecurity talent shortages, our generative AI-driven enhancements help streamline workflows, enhance security insights, and boost productivity, and once again, position Tenable at the forefront of exposure management innovation. We have demonstrated an ability to differentiate our core products as well as with our broader exposure management platform. Whether it's in identity, OT, cloud security, or our unified platform, we are delivering solutions that enable our customers to better understand and remediate risk, and we are doing it in a way that has delivered impressive margin expansion. Finally, on a personal note, thanks to everyone for the well wishes regarding my recent diagnosis. My treatment is going well, but my voice has been temporarily impacted. As a result, I will not be able to fully participate in the Q&A session today, and I apologize in advance for subjecting you to even more time with Steve. But I do look forward to speaking with you in the upcoming investor events in the near future. I'll now turn the call over to Steve for further commentary on our financial results and outlook.

Stephen Vintz, CFO

Thanks, Amit. I'm glad to see that you have not lost your sense of humor. Now on to our results for the quarter, which reflect better-than-expected top line growth and operating income. Calculated current billings, defined as revenue recognized in the quarter plus change in current deferred revenue, grew 12% year-over-year to $197.8 million. CCB exceeded expectations for the quarter, and accordingly, we are increasing our annual CCB outlook today. As Amit commented earlier, Tenable One was a major highlight in the quarter and grew to 26% of total new enterprise sales, up from 22% last quarter. Exposure solutions, which includes Tenable One and stand-alone cloud security, identity security, and operational technology security represented approximately 50% of our total new enterprise sales in the quarter. We believe this reflects the growing demand for our exposure management solutions and the actionable insights it delivers to CISOs and their security teams. Turning to other highlights, sales to new customers were exceptionally strong for us. During the quarter, we added 410 new enterprise platform customers, including a healthy number of 6-figure LANs. The strength in new logos resulted in nearly 30% year-over-year ACV growth from our newly acquired customers. To put matters in perspective, this was one of our best quarters for year-over-year ACV growth to new customers since 2022. This dynamic impacted our net dollar expansion rate, which was 109% this quarter compared to 111% last quarter, which we believe is a result of the natural variance in the mix of pipeline opportunities between new and expansion. The takeaway here is that we saw strength in new logo sales and large LANs, and we believe it's enabling us to win shares in the exposure management market. Pipeline generation was also strong for us and is very encouraging. Our net new 6-figure customers decreased by 4% in the quarter. This is a result of a higher-than-usual number of customers who dropped below the $100,000 threshold in Q1 of 2023, which impacts this metric now because these customers dropped out of the LTM count this quarter. This was concentrated primarily in the financial services and tech and telecom verticals impacted by the regional banking crisis in March last year. This dynamic more than offset the strong number of new 6-figure logo LANs in the quarter. I would note that we always have some number of customers who dip below the $100,000 threshold in any given quarter. Q1 of '23 was an outlier last year. Consequently, we do not expect this to be a headwind to the net new 6-figure customer calculation for the remainder of this year. Now on to the P&L for the quarter. Revenue was $216 million, which represents 14% year-over-year growth. Revenue in the quarter exceeded the midpoint of our guided range by $3 million. Our percentage of recurring revenue remains high at 96% this quarter. I will now turn to expenses. I'll start with gross margin, which was 81% this quarter and last quarter and higher than our expectations. Gross margin benefited this quarter from the successful integration of cloud infrastructure and the overall efficiency with which we have been able to scale our exposure management platform. Sales and marketing expense was $84.5 million, which was down from $88.5 million last quarter. Sales and marketing expense as a percentage of revenue was 39% compared to 41% last quarter. Sales and marketing expense was lower sequentially primarily due to reduced headcount from our cost optimization efforts, seasonally lower program spend, and commission expense, which was partially offset by the cost associated with our annual sales kickoff conference in February. Overall, we are pleased with the improved efficiency in our go-to-market efforts this quarter and expect sales and marketing spend as a percentage of revenue to trend lower over the remainder of the year. R&D expense was $32.6 million, which was up from $27.8 million last quarter. R&D expense as a percentage of revenue was 15% this quarter compared to 13% last quarter. R&D expense increased sequentially primarily due to increased personnel costs and other costs largely in cloud analytics and VM, as well as the foreign R&D tax credits that we received last quarter. G&A expense was $20.6 million, which was up from $19.5 million last quarter, primarily due to higher payroll taxes, which reset at the beginning of the year. G&A expense as a percentage of revenue was 10% this quarter compared to 9% last quarter. Income from operations was $37 million, which was significantly better than expected and exceeded the midpoint of our guided range by $9 million. Operating margin for the quarter was 17%, which was 400 basis points better than the midpoint of our guidance. The outperformance in earnings this quarter reflects the timing of certain expenses and our ability to deliver profitable growth and drive leverage in the business while continuing to invest in our largest market opportunities. The sizable beat in operating income resulted in significant EPS upside. EPS for the quarter was $0.25, which is $0.08 better than the midpoint of our guided range. Now let's turn to the balance sheet. We finished the quarter with $510.8 million in cash and short-term investments. Accounts receivable was $156.8 million and total deferred revenue was $722.7 million. Current deferred revenue was $562.6 million, which gives us a lot of visibility into expected revenue over the next 12 months. We generated $54.7 million of unleveraged free cash flow during the quarter, which is up from $43.3 million last quarter. With high recurring revenue, gross margins, and renewal rates, we feel confident that we can continue to expand our operating and free cash flow margins over the ensuing years. Our higher margin profile has also caught the attention of the rating agencies as Moody's recently upgraded our issuer credit rating to Ba3, and S&P upgraded to BB minus in late November. During the quarter, we repurchased 526,000 shares of our common stock for an aggregate purchase price of $25 million. That leaves $60.1 million of remaining authorization under our share repurchase program. We continue to take a programmatic approach to partially offsetting our share creep, and we'll continue to evaluate the size of the program going forward based on the evaluation of our common stock and other factors. With the results of the quarter behind us, I'd like to discuss our outlook for Q2 and the remainder of the year. For the second quarter, we currently expect revenue to be in the range of $217 million to $219 million. Non-GAAP income from operations to be in the range of $34 million to $36 million. Non-GAAP net income to be in the range of $28 million to $30 million, assuming interest expense of $8.2 million, interest income of $5.9 million, and a provision for income taxes of $3.1 million. Non-GAAP diluted earnings per share to be in the range of $0.22 to $0.24, assuming 124.5 million fully diluted weighted average shares outstanding. For the full year, we currently expect calculated current billings to be in the range of $986 million and $994 million, revenue to be in the range of $900 million to $908 million. Non-GAAP income from operations to be in the range of $158 million to $163 million. Non-GAAP net income to be in the range of $135 million to $140 million, assuming interest expense of $32.8 million, interest income of $24.2 million, and a provision for income taxes of $12.3 million. Non-GAAP diluted earnings per share to be in the range of $1.08 to $1.12, assuming 125 million fully diluted weighted average shares outstanding and unleveraged free cash flow to be in the range of $220 million to $230 million. I would like to provide some commentary regarding our increased outlook today. Our CCB guide represents a range of 13% to 14% growth for the full year and reflects a $2 million beat in our expectations in Q1 and a $1 million raise at the midpoint. Similarly, revenue reflects a $3 million beat and a $1 million raise at the midpoint of the range. Consistent with the directional comments I provided on our last call, we expect CCB growth to accelerate modestly in the second half of the year, as we continue to build pipeline opportunities in the first half of the year in connection with our more expansive CNAPP offering and some of the newly acquired capabilities from Ermetic. Our guidance today also reflects a full year operating margin of 18% at the midpoint, which is a 50 basis point improvement over our prior guidance and is a terrific start to the year for us. We continue to expect to follow similar seasonal spending patterns as prior years, with incremental investment more weighted in the first half of the year, resulting in higher operating margins in the second half. I also want to provide an update on the restructuring costs that we discussed in February. We incurred $1.4 million of restructuring costs in Q1 associated with one-time severance benefits related to the reduction in force that took place in January, which was better than the $2 million to $3 million range that we previously provided. Further, we are still in negotiations to sublease a portion of our real estate, which is expected to result in a non-cash impairment charge of $6 million to $7 million in Q2. Please note that restructuring expenses are excluded from our non-GAAP results.

Amit Yoran, CEO

Thanks, Steve. In summary, Q1 was marked by a healthy balance of growth and margin expansion. We are excited about where we are as a company and the opportunity in front of us. We hope to see you at the Morgan Stanley conference in the coming weeks. We would like to open the call up for questions for Steve. Also Jason Merrick, our Senior Vice President, Products, is here today to participate in the Q&A session.

Operator, Operator

The first question comes from the line of Joel Fishbein with Truist Securities.

Joel Fishbein, Analyst

And congrats on the good quarter. I'd like to ask about Ermetic. I know that Amit talked about a win there in the automotive space that included cloud security. I'd just love to understand the competitive dynamics around that space. And I just have a quick follow-up for Steve.

Unknown Executive, Unknown

Joel, thank you very much for the question. So we could not be more excited with the competitive capabilities across the Tenable portfolio and even more so with our cloud security solution that Ermetic brings. With their more expansive CNAPP capabilities, it gives our customers the ability to leverage the entire platform, but we also have the flexibility for customers to choose specific components within our cloud security offering. So customers can choose infrastructure as code, CSPM, CWPP. But we also believe that we've got the industry-leading Cloud Infrastructure and Entitlement Management capabilities, the acronym is called CIEM. This gives organizations the ability to have visibility into the entitlements of the workloads that are working in the cloud. And this is a differentiator for us in the market. Even customers that have made a cloud security solution today with other competitors are choosing to add our CIEM capability in. Now the other major competitive dynamic is Tenable One and being able to bring the cloud security data into Tenable One.

Brian Essex, Analyst

I was wondering maybe either Jason or Steve, could you talk about the spending environment in macro? I know last year, Q1 was a bit unusual. What are you seeing so far, you're a bit early in the earnings season, so it would be great to get your insights around how you see the spending environment unfolding so far this year? Are enterprises willing to spend, maybe compare that to the environment last year? And where you're seeing any strength or weakness, whether that's selling enterprise side, recovery in the small bank credit union side after the disruption last year? Maybe give us a sense of that and how the pipeline is looking as we head into Q2.

Stephen Vintz, CFO

Sure. This is Steve. I'll say first, I think we're executing very well, certainly within the confines of the current market. Overall security spend remains healthy and a top priority. As mentioned earlier, the exposure management category that we pioneered continues to gain widespread adoption and validation, not only from security practitioners but also partners and industry analysts. Gartner, as you heard earlier, is now talking about cyber exposure as a critical means to reducing breaches. We're seeing large enterprise organizations create risk management departments. We're seeing our partners also starting to go exposure management practices and exposure management engineers. Clearly, there's a lot of momentum in the space and specifically with our platform. One of the major areas of strength for us, what with Tenable One, our unified platform and exposure management offering, it represented 26% of our total new sales this quarter, it's up from 22% last quarter. We also saw strength in our core VM business, where we continue to enjoy high win rates. Out of the gate here, we're very pleased with the demand that we're generating, specifically in cloud. Top of the funnel there remains very strong. We're seeing some terrific engagement on both the customer and the partner front. Overall, we're seeing good spending across the board, good start to the year, and we think we're providing a good outlook as a result.

Saket Kalia, Analyst

Steve, maybe just to start with you. Just on that last point, great to see just that growing mix of Tenable One as a percentage of new sales. Do you have any data or just even anecdotes on what exposure management modules outside of core VM customers are most gravitating towards? Because you get a nice uplift there on Tenable One versus sort of kind of buying a la carte. What are the modules that are sort of driving that most often?

Stephen Vintz, CFO

Yes. A notable example from the quarter is our significant win with a European manufacturer, where we secured a seven-figure contract. We achieved this by winning the cloud security mandate with Tenable One. This was a key development for us. In addition to that win, we replaced an existing VM vendor and successfully integrated all OT security into Tenable One. Tenable One enables customers to gain insights into their risk posture across the attack surface and facilitates the consolidation of various security categories, including VM, cloud, and OT. The Web App module is also gaining traction for us. The comprehensive offerings in Tenable One not only provide coverage for different areas of the attack surface but also deliver valuable insights and analytics. It connects various threats with identities and entitlements, allowing for lateral movement analysis. We are extremely pleased with the momentum of Tenable One, and exposure management is gaining significant traction, resonating well with both customers and partners.

Unknown Executive, Unknown

Yes, that's a great question. I think the market is starting to dictate this. I can tell you that at Tenable, we're having more conversations with CISOs that are looking for more than a single solution vendor. With Tenable, we have the portfolio of products to help an organization deal with the ever-growing attack surface. And maybe this is an area that I can explain a little bit more about Tenable One, what it does for our customers. It starts with building an inventory for a customer. We bring in assets from the cloud, from OT. We bring in identities, human and nonhuman. We can even bring in third-party data assets. So being able to bring all this information allows an organization to understand what assets they're responsible for. The second piece is we then analyze that inventory. We look for findings, look for risk, look for toxic combinations, and we contextualize and normalize this information. The third step is we help with prioritization. We provide business contact information from a business perspective regarding associated risks, and why it's important. But just as importantly, we also provide the technical prioritization details about what assets need to be remediated. This helps clients and drives remediation. The true power of Tenable One is we bring all these things together, the analytics, the ability to optimize, and to share this information with executive management, boards, and peer groups to drive actionability. The circular process also innovates continuously, as Tenable One builds inventory, analyzes risks, and prioritizes actions, enhancing the understanding of the attack surface.

Hamza Fodderwala, Analyst

Steve, a lot of macro uncertainty out there. I'm wondering, just on the spending environment again, how would you characterize the environment relative to when you last gave guidance 90 days ago? And could you give any commentary on early pipeline trends for Q2 as it relates to your guidance?

Stephen Vintz, CFO

Well, specifically with regard to Q2, pipeline remains healthy, and this is the first time we're setting expectations for the quarter and providing an outlook, and the outlook we're providing, we think, is strong, not only for Q2 but also for the year. As a reminder, in Q1, we beat CCB, we beat revenue. We're flowing through the beat for both CCB and revenue. We're also raising both areas. So the outlook for Q2, we believe, is absolutely strong. The outlook for the year is improved relative to 90 days ago. I would say certainly some areas of strength, as we talked about earlier with regard to Tenable One and even in our core VM business where many opportunities await us, and we are continuing to perform well there. Some areas that have been more fluid for us over the past year were strong for us, specifically mid-market. We're off to a good start. The pending environment was also healthy this quarter. Deal sizes continue to be favorable. We've made progress with cloud there, transacting large 6-figure deals. OT continues to resonate well not only in the enterprise market but also in the mid-market. So mid-market remains strong. The Fed in Q1, defense and critical infrastructure was an area of interest for us in the public sector. We also saw good traction in state, local, and higher end. Pipeline and Fed remain exceptionally strong. We had the opportunity to see a bit of upside in the quarter from U.S. Federal, but CR continuing resolution influenced some of the upside for us in the quarter. That said, selling environments are stronger now than last year, and we had a great year last year in Fed. We expect another strong year this year. Funds are beginning to open up and slow down various agencies, and we've noticed strong customer activity, so we're certainly excited, and we believe we have a bullish outlook for the year with a great start.

Andrew Nowinski, Analyst

Great to hear that Amit's recovery is going well. I wanted to ask, Steve, maybe just a follow-up on the Fed side, as it relates to the Ivanti vulnerability that seems pretty widespread in the industry. I guess was that one of the drivers of Fed demand? And how much of an impact did it have on the quarter or your pipeline going forward?

Stephen Vintz, CFO

These types of vulnerabilities tend to bubble up quickly but don’t have a significant impact in the current quarter. However, what drove the results in Fed in Q1 was defense and critical infrastructure. Tenable One continues to resonate well within the federal level but we are also witnessing strong performance at state and local levels. OT also remains a tailwind for us. Overall spending environment in Fed is very strong, and I’m excited about Q2 and our outlook for the remainder of the year. The net retention rates in the quarter, as I mentioned earlier in the call, was a result of the mix of business, biased more towards new than expansion. By the way, that is a very good thing for us. It's important to note that we disclose a number of new customers, large deals, and the rate of expansion with customers in the current quarter, and we do not optimize our business around a single metric. These metrics can fluctuate naturally from quarter to quarter. Our key performance indicators should be evaluated in aggregate for a better appreciation of the factors that influence our results for the quarter. With the outlook we have for the year, we believe there is modestly higher growth in the second half, which reflects an improvement in one or more of those metrics.

Brad Reback, Analyst

Steve, I know during the prepared remarks, you talked about an acceleration in CCB growth in the back half of the year, consistent with last quarter. What are the things that need to get better for that to happen?

Stephen Vintz, CFO

There are a couple of things to consider. First, we have been integrating our current capabilities with the Ermetic platform, which is ongoing and should enhance our pipeline opportunities within the broader exposure management market. We anticipate increased growth for cloud security in the second half of the year as we complete product integration and continue building pipeline opportunities. We believe public sector spending will serve as a catalyst, particularly with Fed, where we see strong engagement with our customers.

Jonathan Ho, Analyst

Just wanted to echo my thoughts and prayers with Amit as he continues to improve as well. I wanted to get a sense from you in terms of the OT markets, you've mentioned this a number of times in the discussions, but what's maybe changed there? And where are we in terms of the adoption curve around these OT solutions?

Unknown Executive, Unknown

Absolutely, great question. What you're seeing in the industry is quite interesting. More CISOs are now having to accept the risk to take on OT security requirements. We are beginning to see this not only in manufacturing and industrial controls, but also in building management systems. CISOs are now taking on responsibility for this. I recently met with a CISO in the financial services sector, who just received a mandate from his board to oversee building management systems. This trend is becoming widespread, giving us a unique opportunity as we see significant numbers of opportunities in the OT space.

Michael Cikos, Analyst

I just want to ensure I better understand the guidance we have here today. Second quarter coming in slightly below on the top line versus where consensus was, but you guys are taking the full year guidance up above and beyond just this Q1 beat, right?

Stephen Vintz, CFO

The guidance we've given for Q2 reflects strength in execution and outperformance relative to Q1, as well as our revised outlook for the year. There are factors that influence the guidance such as the ongoing strength in mid-market and public sector, particularly with regard to the Fed's fiscal year end in September. Additionally, cloud security continues to build pipeline opportunities. We believe we are set up well for success, not just in the current quarter, but for the rest of the year.

Unknown Executive, Unknown

We saw that Tenable One had released AI-assisted attack path analysis, part of the higher-tier SKU, Tenable One enterprise. Should we consider Tenable's strategy with GenAI capabilities as driving an upward tier towards those higher SKU packages? It’s important for us at Tenable to leverage proprietary information that sets us apart in the AI landscape. As the market leader in vulnerability management with over 20 years of data, we have the advantage of rich threat intelligence, which we can leverage moving forward. Our focus is on embedding AI capabilities across our product portfolio, not limited to just the Tenable One top-tier offering. We believe these enhancements will assist organizations in explaining threats and providing actionable insights.

Patrick Colville, Analyst

Steve, let me ask you a question about the competitive environment in vulnerability management. What are you seeing in terms of dynamics in that market and how are these impacting Tenable?

Stephen Vintz, CFO

The competitive dynamics in vulnerability management are favorable for us. The close rates and win rates remain high. Our success stems from years of investing in this market. We’re seeing strong performance reflected in our growing customer base, where we added 400 new customers in the quarter. A significant portion of these customers derive from Tenable One, but many are also coming from our core offerings. We're optimistic about our prospects in VM moving forward, and we plan to continue innovating in this area.

Gary Powell, Analyst

I was hoping to dig in on some of the disclosures. The stats you gave on Tenable One at 26% and then broader exposure management solutions at 50% of new sales were helpful. Can you provide a sense of what stand-alone cloud security contributed? Or was the bigger contribution of that incremental more like on the OT and some of the other products?

Stephen Vintz, CFO

We do not disclose bookings or current calculated billings by product. I will say that nearly half of the 50% of new sales comes from exposure management solutions and Tenable One. We expect greater contributions from cloud security in the second half of the year, particularly as we build pipeline opportunities and begin closing deals related to our expansive CNAPP offering.

Shaul Eyal, Analyst

Congrats on the results. Great to hear Amit is doing much better. My question relates to new logos. Were the 410 logos mostly displacement or were they greenfield?

Stephen Vintz, CFO

On average, about one-third of all our new logos are greenfield opportunities, where customers have had no enterprise-wide VM solution. This could arise from using systems integrators or MSSPs. There's abundant untapped opportunities within VM as well as in adjacent markets like cloud, identity, and OT. So about one-third of our opportunities are greenfield, while the rest are displacements, where we continue to maintain very high win rates against incumbents.

Unknown Analyst, Unknown

Could you quantify the Ermetic contribution to revenue and CCB in Q1? Or any other data points that we can use for the model?

Stephen Vintz, CFO

Ermetic contributed minimally in Q1, and that's expected. We closed on Ermetic in Q4. We are in the process of integrating the product, and we expect to see a greater impact in the second half of the year. Our outlook for Ermetic has not changed since our last call; we expect about two points of incremental CCB growth due to Ermetic, which remains unchanged this quarter.

Unknown Analyst, Unknown

Quick follow-up, what percent of your sales came from overlay teams in the past years? And are you seeing any sales reps selling the entire portfolio successfully since the past that you announced?

Stephen Vintz, CFO

Most if not all of our sales reps are successfully selling combined offerings, leading with Tenable One. This has resonated with customers, and we've seen good traction. While we initially required specialist reps to sell the broader product portfolio, we’ve seen that our reps are increasingly capable of selling those products as mainstream offers. The efficiency of our spend in sales and marketing reflects this progress.

Unknown Analyst, Unknown

Could you elaborate on the generative AI roadmap, identifying near-term opportunities versus long-term objectives?

Unknown Executive, Unknown

From a product perspective, we aim to leverage our AI capabilities to enhance understanding of asset risk. This includes identifying toxic combinations by enriching asset data with identity data. Additionally, we will enable an AI chatbot capability for users to obtain personalized insights. Our AI capabilities will be applied not only to prioritization and explainability but also to drive significant business outcomes.

Unknown Analyst, Unknown

With the 109% NRR, is there anything specific to call out regarding expansion or gross retention outside of the financial services tech and telecom areas?

Stephen Vintz, CFO

Retention this quarter was stable; the slight moderation in expansion rates is largely due to the business mix skews towards new additions. We added 410 new Tenable enterprise platform customers, resulting in year-over-year ACV growth of 30% from the newly acquired cohort. That’s a positive outcome. We will continue to focus on improving our overall metrics throughout the rest of the year.

Operator, Operator

Thank you. This concludes today's teleconference. You may disconnect your lines at this time. Thank you for your participation.