Tenable Holdings, Inc. Q2 2026 Earnings Call

Greetings, welcome to the Tenable Q2 2026 earnings conference call. At this time, all participants are in a listen-only mode. A brief question and answer session will follow the formal presentation. Should anyone require operator assistance during the conference, please press star zero on your telephone keypad. As a reminder, this conference is being recorded. It is now my pleasure to introduce your host, Erin Carney, Vice President, Investor Relations. Thank you. You may begin.

Thank you, Operator, thank you all for joining us on today's conference call to discuss Tenable's second quarter financial results. With me on the call today are Co-Chief Executive Officers Steve Vintz and Mark Thurmond, and Chief Financial Officer Matt Brown. Prior to this call, we issued a press release announcing our financial results for the quarter. You can find the press release on our IR website at tenable.com.

We will make forward-looking statements during the course of this call, including statements relating to our guidance and expectations for the third quarter and full year 2026, growth and drivers in our business, changes in the threat landscape in the security industry, particularly regarding AI security, the expected impact of frontier AI models and accelerated vulnerability discovery, and the shift to preemptive security, our competitive position in the market, growth in customer demand for and adoption of our solutions, including the impact of new pricing and packaging models, the expansion of Tenable One, including agentic AI security, orchestration through Hexa AI, and planned AI exposure coverage across third-party models, the expected benefits of our strategic partnerships with Frontier AI labs, our ongoing research and development investments, our capital allocation strategy, including share repurchases, and our future results of operations and financial position.

These forward-looking statements involve risks and uncertainties, some of which are beyond our control, which could cause actual results to differ materially from those anticipated by these statements. You should not rely upon forward-looking statements as a prediction of future events. Forward-looking statements represent our beliefs and assumptions only as of today and should not be considered representative of our views as of any subsequent date. We disclaim any obligation to update any forward-looking statements or outlook. For a further discussion of the material risks and other important factors that could affect our actual results, please refer to those contained in our most recent annual report on Form 10-K and subsequent reports that we file with the SEC. Today's discussion includes non-GAAP financial measures. These non-GAAP financial measures are in addition to, and not a substitute for or superior to, measures of financial performance prepared in accordance with GAAP.

There are a number of limitations related to the use of these non-GAAP financial measures versus their closest GAAP equivalents. Additionally, please see our press release for reconciliations of GAAP to non-GAAP financial measures that we discuss today. I will now turn the call over to Steve.

Thanks, Erin. We're very pleased with our results in the quarter as we exceeded all of our guided metrics and are raising our outlook for the year. Tenable One was a record 50% of new business this quarter, continuing a strong upward trajectory. Earlier this year, we launched new pricing and packaging for Tenable One, introducing Tenable One Foundation and Tenable One Advanced. Notably, we are seeing greater than anticipated adoption of Tenable One Advanced, which reflects growing customer demand given the evolving AI threat landscape. Accordingly, larger lands and expansion deals with Tenable One helped drive average deal sizes higher this quarter, and it also helped increase our net dollar expansion rate to 106%. This is the first acceleration in our expansion rate in many quarters.

The takeaway here is that our results are clear validation of our strategy and the opportunity in front of us. As AI reshapes the attack surface faster than most organizations can respond, we believe customers are increasingly choosing Tenable One as the platform that turns complexity into clear, actionable insight to reduce risk. That differentiation is what's resulting in higher deal sizes, faster expansion, and durable leadership in this category. In fact, we believe it is becoming increasingly clear that companies who lead in this market will need three core capabilities to survive in the agentic era. First, the ability to understand every exposure across the enterprise. Next, the ability to prioritize tasks that matter most, then translate that intelligence into action. I'll discuss each of these three capabilities in a bit more detail. First, organizations must understand exposure holistically across the enterprise.

AI is accelerating vulnerability discovery and increasing the volume of issues requiring attention. Vulnerabilities are only part of the attack surface. Misconfigurations, compromised identities, and other non-CVE weaknesses represent more than 60% of potential breach entry points, and we capture both CVE and non-CVE risks. As attackers operate with greater speed and scale, organizations need a unified view of all of the conditions that create business risk, not simply a longer list of vulnerabilities. Second, more findings make effective prioritization essential. Tenable combines broad exposure intelligence, deep contextual data, and decades of security research to help customers distinguish the exposures that create meaningful business risk from those that do not. This allows security teams to concentrate their resources on the relatively small number of actions capable of producing the greatest reduction in risk. Third, prioritization is only as valuable as the action it enables.

As AI models become more broadly available, the key to agentic security is not the model itself. It's what sits between the model and the customer's environment, ensuring that agents operate safely and accurately with human oversight and an audit trail. We call that the harness. Built into Tenable One, our harness draws on decades of exposure data, research, and our trusted sensor layer. Hexa, our agentic engine for Tenable One, operates within this harness to orchestrate the right fixes deterministically for customers. Digging a little further into Hexa, we continue to expand what Hexa can do. Just yesterday, we announced new capabilities that equip security teams with a coordinated fleet of agents capable of operating continuously, executing multi-step security tasks, and orchestrating remediation across the exposure management lifecycle.

Together, the Tenable One harness and Hexa's agentic capabilities move exposure management from periodic analysis and manual intervention towards a continuous always-on defense. As frontier models become more widely available, we believe this combination will become an increasingly important and durable differentiator for Tenable. In addition to the exciting AI capabilities we're building into our platform, we're also helping our customers secure their use of AI. With Tenable's AI Exposure, we're extending coverage to include Gemini alongside Claude, ChatGPT, Copilot, as well as major MCP deployments and AI-native development tools. Together, these capabilities give security teams a more complete view of where AI is used, the risk it creates, and where action is needed. As part of Tenable One, AI Exposure and Hexa are highly complementary, helping security teams secure their organization's use of AI while harnessing AI to improve operational efficiency.

Finally, we're deepening our relationships with the two leading frontier AI labs, Anthropic through Project Glasswing and OpenAI through their Daybreak program. These partnerships are deep and broad working collaborations. We have access to non-public models. We're participating in joint research. We have early insight into how the attack landscape is evolving before these capabilities are broadly available in the market. More specifically, our testing as a part of Glasswing demonstrated that frontier AI can dramatically increase the speed and scale of vulnerability discovery. It also reinforced that discovering more potential vulnerabilities does not by itself tell an organization where it is truly exposed or what it should fix first. The output requires a trust layer to validate and provide context to determine if an exposure is reachable and exploitable, and whether existing controls can mitigate the risk.

This is the direction the market is moving. It's the direction we've been building toward. Customers need more than just another standalone AI feature. They're looking for an integrated platform that can act with the speed and context this moment demands. That's exactly what we're seeing show up and how our customers are buying today. Mark will walk you through what that looks like in practice because it says a lot about where this shift is taking us.

Thanks, Steve. The market dynamics surrounding AI that Steve described are increasingly translating into customer action and stronger commercial outcomes for Tenable. We are now seeing customer conversations convert into action, which we believe points to the early stages of ongoing tailwinds to the business. Customers are moving beyond education to investing in broader, more sophisticated exposure management programs. They recognize that addressing this new environment requires a unified view of exposure across the enterprise, the intelligence to identify what creates the greatest risk, and the ability to take actions before the attackers do. As Steve noted, Tenable One sales accounted for 50% of new business, a really exciting record for us. We believe two factors are contributing to this momentum. First, the pricing and packaging changes we introduced earlier this year have made the path to Tenable One clearer and easier for customers.

The new model gives organizations the flexibility to start where they are, expand over time, and move seamlessly across asset types and the attack surface with predictable spend, simplified procurement, and faster time to value. Second, the AI-driven threat environment is accelerating customer demand for exposure management. Tenable is meeting that demand with capabilities such as Tenable Hexa and AI Exposure, which are making the value of the broader platform more immediate and tangible. We are already seeing encouraging signs in how customers engage with Hexa. More than 80% of customers who open Hexa submit a prompt, and nearly half are using it to take action rather than simply consuming information. Hexa users are also engaging with an average of six Tenable One tools, indicating that the agentic engine can help customers discover and use more of the platform while freeing security teams to focus on higher-value work.

For one customer, Hexa connected fragmented data across systems, workflows, and geographies to identify a single patch that could neutralize 53 potential attack paths. This illustrates the efficiency opportunity Hexa creates, focusing resources on the action that reduce the most risk, accelerating remediation, and enabling security teams to accomplish more with their existing resources. These early indicators reinforce our belief that Hexa can become an important driver of Tenable One adoption and expansion over time. Customers are also seeing the benefits of Tenable One AI Exposure, which helps customers discover, govern, and secure the rapidly growing use of AI platforms and agents across their organizations. Together, as part of Tenable One, these highly complementary capabilities help security teams secure their organization's use of AI while using the power of AI to create operational efficiencies. This results in a very powerful preemptive security strategy.

Our position in this evolving market is also receiving external recognition. In June 2026 report, Gartner named Tenable the company to beat in AI-powered exposure assessment, noting that Tenable's long-standing dominance and vulnerability assessment, its strong asset and attack surface discovery capabilities, and its ability to execute on its AI strategy make it the front runner in an AI-powered exposure assessment. We believe this recognition validates the strength of our position today and our strategy for where the market is heading. Let me bring these trends to life through three customer examples from the quarter. First, a global manufacturing services company selected Tenable One Advanced, resulting in a six-figure deal, replacing a legacy vulnerability management provider. The deployment brings together multiple asset types to both consolidate and give the customer a more unified view of exposures across its environment.

This is another example of a large enterprise moving away from fragmented tools to consolidate on Tenable One. A leading financial services company significantly expanded its relationship with Tenable in our largest transaction of the quarter. An existing Tenable customer, the company made a three-year, seven-figure commitment to Tenable One, including services. This expansion demonstrates our ability to deepen relationships with some of the world's largest and most sophisticated organizations and establish Tenable One as the foundation for their exposure management programs. We also displaced a major competitor who had a long-standing relationship at a large European postal service. Once again, this customer saw the need to move beyond traditional VM to Tenable One for full exposure management. The win was supported by the region's largest cybersecurity service provider and provides a strong foundation for broader collaboration and additional opportunities in the region.

This was a strategically important win that demonstrates our ability to disrupt established competitive relationships in key international markets. Together, these wins illustrate the broader trends we saw during the quarter. Increased customer demand for exposure management driven by the Frontier AI labs, specifically Mythos. Very strong competitive displacements. Increasing adoption of Tenable One Advanced. Meaningful expansion within our install base. In addition to these exciting customer wins, we also achieved FedRAMP High authorization for Tenable One Cloud Exposure during the quarter, one of the most rigorous security authorizations in the U.S. federal government. This expands our opportunity in the federal market and reinforces the trust that mission-critical organizations place in our platform. With that, I'll turn the call over to Matt to discuss our financial results.

Thanks, Mark. We delivered excellent results in the second quarter, underscored by our highest-ever adoption of the Tenable One platform, which reflects the early success of the new pricing and packaging introduced in the quarter. Growth in the platform and meaningful operating leverage drove second quarter results above the high end of the range for every metric we guided to for the quarter, and we are once again raising our full year outlook across the board, reflecting the growing momentum we're seeing in the business. Let's dive into the details. Revenue for the quarter was $268.5 million, representing growth of 8.6% year-over-year. The year-over-year growth in revenue for the quarter, as well as outperformance relative to guidance, was driven by strong expansion within existing accounts and underpinned by continued strength in renewals.

Professional services, which are often attached to our larger Tenable One deals, also contributed ahead of expectations. Despite the strength in professional services, our percentage of recurring revenue remained high at 95% for the quarter. We had a record quarter for Tenable One, with 50% of new business coming from the platform, a new milestone, up from 41% in the prior quarter and 40% in Q2 of last year. We believe this growing adoption reflects the increasing conviction customers have in leveraging the platform, including Hexa AI, to manage risk across their entire attack surface. Importantly, while adoption of the platform was at an all-time high, we're also seeing an increase in average deal sizes within the platform, reflecting customer preferences for our Tenable One Advanced offering, which boasts a more robust feature set and price point compared with Tenable One Foundation.

We added 381 new enterprise customers in the quarter and added 32 net new six-figure accounts. My favorite metric of the quarter was our net dollar expansion rate, which improved to 106%, up from 105% in the prior quarter. This is the first quarter since Q1 2022, more than four years ago, that we have seen a percentage point quarter-over-quarter increase in the net dollar expansion rate. The growth here was driven by strong expansion and renewals business and reflects important stabilization of our growth rate. Non-GAAP gross margin was 81.4% for the quarter, compared to 82.0% in Q2 2025, and within our typical historical range of 81%-82% over the last couple of years. Non-GAAP income from operations for the quarter was $66.2 million, or 24.7% of revenue, compared to $47.7 million in Q2 2025, an increase of 38.8%.

We're continuing to benefit from the efficiencies that I highlighted last quarter while rotating spend into the opportunities for growth in product development and sales capacity. We expect to continue investing in the second half while still meeting our profitability targets for the year. Non-GAAP earnings per share for the quarter was $0.51 compared to $0.34 in Q2 2025, an increase of 50%. The improvement year-over-year reflects the increase in profitability combined with a decrease in diluted shares outstanding, driven by our share repurchase program. Turning to the balance sheet. Cash and short-term investments total $298.2 million. We generated $45.3 million in unlevered free cash flow during the quarter, compared to $44.3 million in Q2 2025. During the second quarter, we repurchased 5.2 million shares for $100 million and have $108 million remaining on our current share repurchase authorization as of the end of the quarter.

Far this year, we've repurchased 11.4 million shares for approximately $230 million, reflecting an average repurchase price of $20.23. Our repurchase program remains an active pillar of our capital allocation strategy, reflecting our view that returning capital to shareholders through buybacks represents an effective use of our free cash flow, given the underlying strength of the business. We're realizing the benefits of these share repurchases as our weighted average diluted shares outstanding for the quarter is now the lowest it has been since Q4 2020, more than five years ago. Turning to the financial outlook for Q3 and full year 2026. For Q3, we expect revenue to be in the range of $270 million-$273 million, representing a year-over-year increase of 7.6% at the midpoint.

Given the strength we've seen in the first half of the year and our expectations for continued momentum into the second half, for full year 2026, we are raising our guidance range for revenue to $1.075 billion-$1.081 billion, representing a year-over-year increase of 7.9% at the midpoint. We expect non-GAAP income from operations for Q3 to be in the range of $66 million-$69 million or 24.9% of revenue at the midpoint. For full year 2026, we are raising our guidance range for non-GAAP operating income to $258 million-$264 million or 24.2% of revenue at the midpoint, representing a year-over-year increase of 230 basis points. We expect non-GAAP net income for Q3 to be in the range of $58 million-$61 million, representing a year-over-year increase of 15.8% at the midpoint.

For full year 2026, we are raising our guidance range for non-GAAP net income to $228 million-$234 million, representing a year-over-year increase of 18.8% at the midpoint. We expect non-GAAP earnings per share for Q3 to be in the range of $0.49-$0.52 per share, representing a year-over-year increase of 20.2% at the midpoint. For full year 2026, we are raising our guidance range for non-GAAP earnings per share to $1.95-$2 per share, representing a year-over-year increase of 24.2% at the midpoint. We are also raising our unlevered free cash flow outlook at the midpoint, and now expect a range of $289 million-$295 million or 27.1% of revenue at the midpoint. Before I open it up to Q&A, I want to thank the entire Tenable team for another strong quarter of execution.

We are really excited by the momentum we're seeing in the business and expect that to continue into the second half. We look forward to seeing you all at the upcoming Stifel and Piper Sandler conferences. We are happy to open up the call for questions. Operator? Thank you. We'll now be conducting a question and answer session.

If you would like to ask a question, please press star one on your telephone keypad. A confirmation tone will indicate your line is in the question queue. You may press star two if you would like to remove your question from the queue. For participants using speaker equipment, it may be necessary to pick up your handset before pressing the star keys. One moment please while we pull for questions. The first question is from Rob Owens from Piper Sandler. Please go ahead. Great. Good afternoon.

Thanks for taking my question. Great to see the DBNER reverse course here of points. Do you think we've hit the low water mark or could we see continued volatility? Secondarily, what are you guys seeing from a new customer perspective, especially given all the noise that's been created in the post-Mythos environment? Thanks. Hey, Rob. This is Matt.

I'll take the first part of your question. I'll pass it over to Mark and Steve to answer the second part. We were really pleased to see the net dollar expansion rate increase quarter-over-quarter. As I mentioned in my prepared remarks, the first time we'd seen that in quite some time, and it was ahead of expectations. Seeing that strength come through and in particular, seeing that strength continue on now into the second half, that gives us confidence that that rate holds steady at 106%. That's our expectation for the rest of the year, and that's the expectation that we've built into our guidance.

Yeah. I'll hit on some of the customer demand. As we have talked about a little bit in regards to some of the investor conversations, this has definitely been, when you look at Mythos and some of the frontier AI labs, this has been a tailwind without a doubt. We are seeing strong demand from our customers around exposure management, specifically based on what they've seen and some of the feedback they've been getting from the research that's been done with the AI frontier lab, again, highlighted with Mythos. We saw a significant uptick in our competitive displacement of customers that might be on old school standard VM wanting to move to an exposure management platform, moving from competition to us. That was a very strong highlight in Q2.

With the new pricing and packaging we've highlighted, we've now been able to streamline and make it much easier and simpler for customers to move into either Foundation or Advanced. We saw a higher percentage move to Advanced, which was great, and we're continuing to see that momentum. The last thing is our expansion. We saw some phenomenal expansion. I highlighted one of the accounts in the remarks. We are seeing great expansion opportunity within the install base. Very strong demand, very happy what we saw in Q2, and we're going to continue with the momentum.

Thank you. The next question is from Mike Cikos from Needham & Company.

Please go ahead. Hey, guys.

This is Matt Calitri for Mike Cikos over at Needham. Thanks for taking our questions. Wondering if you guys could give some more color on how customers are responding to flex pricing and packaging. I know you noted greater than expected adoption of Advanced, which is obviously great to hear, but just curious if there's anything you could share on if customers are in any way rationalizing certain asset types in favor of others, or if there are any leading indicators in terms of what the actual uplift looks like.

As Mark commented earlier, we're very pleased with our expansion this quarter and our new lamps. Something that we talked about earlier, but one of the big takeaways from the quarter are higher average selling prices. Couldn't be more pleased, and pricing and packaging is playing a big role. More customers opted for Advanced, which has a notably higher selling price in comparison to standalone VM. We added a healthy number of net new 6-figure customers, but the big takeaway was the number of net new 7-figure customers was more than double than what we typically do. It's one of our best net new 7-figure customers adds in nearly 2 years. What drove that is really 2 things. Number 1, customers migrating from standalone products into the platform at a greater rate.

Number 2 is the customers that are in Tenable One that are expanding, where we're doubling and increasing the selling price there dramatically. Things just feel different since April in a post-Mythos world. I think customers recognize they need unified visibility, they need unified insights, and they need to be able to take action deterministically, and that's exactly what the platform does. That's what Hexa AI does. Things feel different, and we feel really good about the setup for the second half of the year and have confidence in our ability to continue to execute here.

That's great. Thanks so much.

The next question is from Patrick Colville from Scotiabank. Please go ahead. Hi, this is Connor Weed calling in for Patrick.

We were just wondering what the initial feedback on Hexa was looking like from customers, and if you could remind us of what the average selling price kind of uplift looks like for customers moving from VM to Hexa. If there is a scenario where customer spend goes up to remediate a lot of vulnerabilities that we're seeing currently, but then customer spend kind of falls back as well. Thank you. Yeah, just I'll comment a bit on what we're seeing from a demand perspective.

Hexa as we launched in Q2, has actually picked up to a very high level in regard to customer adoption. We now have hundreds of Tenable One customers using Hexa. As we highlighted, they're not just using Hexa to go get more information and content. They're actually taking prompts, they're taking actions, they're automating significant parts of how and what they do around automated remediation. Some of the use cases that we're starting to see is they're creating dashboards for certain exposure scores. They're identifying and updating different findings, now doing this autonomously. They're being able to manage their tagging environment and managing and scanning workflows from servers and workstations. The adoption that we've seen has been fantastic.

To give you a bit of sense, we actually created a new SKU for incremental tokens for our overages from the customers, because customers with significant percentages were over on their tokens, we actually created a SKU to sell them incremental tokens because of the overages. All of the signs that we've seen since we've launched, and again, early days, there's going to be some great announcements coming out of Black Hat next week, but super happy, and the customer feedback has been phenomenal in regard to what they're actually doing with Hexa.

I'll just add one thing, too. Hexa, as you know, is only available in the platform, and so that was a major driver of customers adopting the platform in the quarter. As you know, there's a significant price uplift going from standalone VM into Tenable One. We think a big driver of the record adoption that we had in new business in Tenable One at 50% this quarter was due to some of the improvements that we've made and really a lot of the robust features that Hexa delivers.

Great. Thank you. The next question is from Rudy Kessinger from D.A.

Davidson. Please go ahead. Hey, great.

Thanks for taking my question, guys, and congrats on the nice results here. You guys mentioned that the uptake of Advanced was higher than your expectations versus Foundation. Can you share any more color on what that split looks like for new logos who are taking Tenable One in terms of what % are taking Foundation versus what % are taking Advanced?

Yeah. This is Matt. Thanks for your question. Advanced this quarter benefited at a ratio of something like 2 to 1 versus Foundation. It was a meaningful % higher than what we had seen in Foundation for the quarter.

Yeah. The only thing I'll piggyback on that is what we saw with the customers and why we are seeing this significant adoption on Advanced compared to Foundation is there's some things with Foundation you get. There's some specific cloud CNAPP capability that you get in Advanced that was a very big driver. We're seeing strong demand for cloud security. You get some advanced capabilities around attack path analysis and some scoring within Advanced, which was a big differentiator. You also get a significantly more amount of tokens when you go with Advanced. Some of these customers that want to be able to leverage Hexa are getting a significant incremental amount of tokens in Advanced compared to Foundation, and they just have more domains, more assets that can actually go in different types of assets.

We were extremely pleased with that motion and what we saw, and I think it's one of the reasons that you're now seeing 50% of our new business coming in from Tenable One. I think the pricing and packaging had a lot to do with it, and our sellers and our partners are getting just more comfortable talking to our install base and our competitive opportunities about it.

Great. Thank you. For my follow-up, it sounds like you've got really some good early momentum following Mythos. You talked about NDR kind of being stable at 106%. I know there's some noise and volatility in both CCB and CRPO, with revenue, I guess, being the best indicator of the business for the time being, when might we see some of this momentum you're seeing translate into accelerated revenue growth?

Yeah. Some of that we're seeing already. Like we've talked about before, that first step to inflecting growth higher is really to stabilize our top-line growth rate, the good news is we're seeing early signs of that. We saw that this quarter. Pipeline, super strong this quarter. Competitive win rates, very strong this quarter. We had one of the strongest quarters in expansion growth that we've had in quite some time.

What that enabled us to do is to raise guidance by $5 million to the midpoint for a full year, which is great. You saw our 106% NDR rate, which was excellent also. One of the things, when we started the year, we talked about CCB being roughly in line with consensus expectations. As we sit here today, we think that's probably $8 million-$10 million higher than where we started the year, with the majority of that benefiting the back half, just based on the strength and the momentum that we've seen so far.

The next question is from Jonathan Ho from William Blair. Please go ahead. Hi, good afternoon.

With your existing AI solutions, what's been sort of the customer feedback? This is the non-Hexa solutions. Can you talk a little bit about maybe what that means from an asset coverage standpoint? Is that potentially growing as well as people start to look at the existing solutions that you have?

Yeah, Jonathan. First, just some color on Hexa. I think Mark talked about the commercial traction that we're getting, it's worth adding a little more color. We're off to a terrific start with Hexa AI. We GA'd it in Q2. More than 80% of the users in Hexa submit a prompt and use it to take action, over 90% of the actions that Hexa recommends are accepted by customers. We're continuing to innovate there. We introduced recently advanced multi-step reasoning and automated remediation workflows. Now we have Hexa that's always on, orchestrating a continuous autonomous defense without needing humans to re-prompt. We're getting great traction there. I think you asked about our non-Hexa capabilities as well. That would take us really to Exposure AI Exposure, which is important because it addresses a couple of key use cases. We do really three things, right?

If you think about Hexa AI's ability to take action within the platform deterministically and with trust, what AI Exposure does, it helps customers understand AI as a threat vector, which is one of the biggest blind spots in all of security today. Look, it starts with visibility, we do three things. Number one, visibility, we help discover what's running in a customer's environment, shadow AI agents, browser plugins, APIs, things like that. The second thing we do is we provide infra protection, infrastructure protection related to AI models, workloads, and agents on shelves. We can discover agents, more importantly, we understand what agents are connected to and what they have access to, and whether it's exposed to the internet and what kind of permissions kind of surround agents and if there's identity weaknesses.

The third thing, we monitor our customers' use of prompts across a wide range of models and tie it back to security policy. Both on the front end, helping customers understand their posture and helping them secure their use of AI, as well as AI infrastructure, also helping them take action deterministically with trust on the back end in the platform so they can reduce their risk. We're certainly at the forefront of AI in security, we have a big role here to play, you're starting to see some really good traction on it.

Excellent. Just as a quick follow-up, you talked a little bit about your harness advantages relative to other exposure management providers. Can you talk a little bit about what you have that's unique there? Are you concerned at all about the LLM providers maybe trying to move more upstream into your area? Can you just talk about the barriers to entry there? Thank you. Sure. It is something we talked about at Investor Day.

Look, the moat here, we're likely starting to see the commoditization of the intelligence layer. I think models will continue to get infinitely good, and that's important. There's also open-weight models that give enterprises flexibility and control to effectively deploy AI in their own environment. Again, the best model today may not be the best model tomorrow, or six months, or even a year from now. With that, the real moat we think will be above the model and below the model. The real moat will be the application layer, which provides the context and trust to run these models safely and securely and deterministically in your environment. Hexa was built with this in mind.

Hexa routes the right task to the right model, frontier or otherwise, and allows customers to take action in near real time with confidence. Also moat is below the model, which is the extensive sensor layer and the ability to deploy agents and scanners and sensors on a wide range of domains to be able to collect data. We have one of the largest data fabrics in all of security, one of the largest customer bases. We're deeply embedded behind the firewall. It's proprietary, it's unique to us, and now with our harness, which is the scaffolding around the model and orchestrates the workflow and allows us to take action and to reduce risk with customers deterministically, that's an important part of the value add. It's one of the reasons why customers are increasingly choosing Tenable One.

It's one of the reasons why 50% of all of our new business is coming from the platform. We feel really good about differentiation and moat.

Thank you. The next question is from Brian Essex from J.P.

Morgan. Please go ahead. Hi, guys.

Thanks for taking the question. I guess, I would love to follow up and get your feel, and I apologize if I missed it. We're bouncing around between a few calls, but the one thing that resonated throughout this quarter, well, last quarter across most of the companies that reported in this quarter, across most of the partners that we spoke with, is that CFOs or CIOs are freaking out about Mythos. It's leading to an elevated threat environment and there's an emphasis to push to get the most updated software operating systems hardware into those enterprise networks. I just wanted to take a step back in terms of what you've commented on in terms of pipeline acceleration, how companies are engaging with you to address those concerns, and how an elevated pipeline might convert to revenue as you walk through the year.

How much visibility you might have on that?

Yep. Let me take a shot at that one because there's a couple of different parts of it. First and foremost, right? The Mythos AI lab discussion is still omnipresent, right? It's still happening. It's still going on. There's still an enormous amount of interest from customers on, A, what we've learned as a cybersecurity company and the pressure they're getting from the board of directors and from the CEO. It is definitely creating this demand. It is creating sense of urgency. When you're talking to CISOs and they're saying, "Hey, we know that there's going to be this massive influx of vulnerabilities and all of these other potential risks coming down the road.

We know that one of the most productive things we can do is have a preventative and proactive exposure management platform so we can actually get ahead of it and understand what's happening and get true visibility across the entire attack surface." We are going in, having those discussions, and that's why you're seeing Tenable One hit that 50% of new business because customers want to get off VM, they want to get all the benefits of exposure management, and they are doing it with more urgency. You're definitely seeing that. That's why Matt commented, we are seeing accelerated pipeline. Obviously, we feel great about what we achieved in Q2 and the guide that we gave for Q3 and Q4. There is a significant amount of momentum in this business right now and in exposure management. That is definitely a tailwind, without a doubt.

From a budgeting perspective, you're not seeing this massive incremental flow of budgets saying, "We're going to increase the cyber budget by 10, 15, 20%." What you are seeing is this consolidation story happen at a very rapid pace. They do not want to have the number of tools. They want to consolidate. They want to do more, with fewer vendors and have platforms. You're seeing these exposure management projects happen at a faster pace, and that's why you're seeing the positivity and some of the momentum we're seeing in our business, because that's what's happening at the customer level.

Is that permeating through the network scanning exposure that you might have? In other words, are they scanning more of their estate, or are they just taking what they have and then focusing on the analytics aspect of it?

Nope. It's a great question. It's both. We did see a very significant pickup in our expansion business in Q2. We absolutely saw our installed base customers expand the asset coverage to, again, get better visibility on what's happening in the environment. We absolutely saw that. We saw them look at incremental different types of assets. We had a very strong OT quarter. A very strong OT quarter around the globe, especially in the federal government. It was outstanding. We saw strong cloud demand for that asset type. It's both expanding overall coverage within their environment, their infrastructure environment, but then also looking at incremental asset types.

Got it. Super helpful. Thank you very much.

The next question is from Meta Marshall from Morgan Stanley Investment Management. Please go ahead. Hi, this is Abhishek Murli on for Meta Marshall.

Thanks for taking the question. Could you talk us through some of the dynamics you're having with customers as they are looking to move towards automated remediation? I understand that there was some press releases inter-quarter as well on this. Would love to hear what you're hearing on the ground. I have a follow-up. Yeah.

I think Mark talked about the momentum that we have with customers. This was a quarter where we added over 300 new customers, a healthy number of new lamps. This was a quarter where we added a healthy number of new six-figure customers. The big takeaway was really the expansion within the customer base and the higher selling prices. Packaging and pricing plays a big role in that. With that, there's really two core use cases around our pricing and packaging. Number one, Foundation, which is all about unified asset visibility, which discovering and continuously inventorying assets across a wide range of domains.

As Mark called out, the reason why customers are choosing overwhelmingly Advanced, where the selling prices are notably higher, which is having an impact not only on the results for the quarter, but gives us confidence to have a really good raise for the full year, is really because of the ability to take action and measure risk for customers. The Orchestrator remediation comes in Advanced. Risk measurement and benchmarking and scoring, that comes in Advanced. That's a big problem, and that's the problem we're here to solve. That's the critical asset in the AI and the agentic era, and that's the moat we have. Things, as I mentioned before, feel different. Customer conversations feel different. Obviously, all of this has to go through procurement and sales cycles.

We feel really good about what we're seeing in the business, and there's some good early signs of strong momentum here, and that's the takeaway.

Super helpful. Thank you. Maybe as a follow-up, you also laid out in the Analyst Day that the Tenable One platform could be around half of revenue exiting 2029. I guess, given the traction you're seeing across the portfolio, is there potential for that to happen sooner?

We're definitely seeing progress towards that goal. At the time of Analyst Day, we called out Tenable One making up roughly one-third of our total business. That number is increasing. We hope to get it up to 40% by the time we get to the end of the year, and we've made some progress against that goal already. Having a quarter like we had in Q2, where we had a record amount of new business coming into the platform, certainly helps. We've increased from a third, and we're on our way to 40% and hope that that's where we get to by the end of this year.

Awesome. Thank you. The next question is from Joseph Gallo from Jefferies.

Please go ahead. Hi, this is Grant Verstandig on for Joe Gallo.

Thanks for taking the question. I wanted to circle back real quick on competition, as I think it's certainly clear that exposure management is increasingly important in an AI world, which puts you in a great position. I wanted to ask, has there been any changes in competitive dynamics with regard to some of these larger platform vendors, especially with them trying to embed some of these LLM technologies and what you're seeing there? Thank you. Yeah. I mean, listen, we commented on a couple of the customer examples that we gave and in some of the commentary.

This is one of the best competitive quarters we have had. Our compete level in regard to the deals of rip and replacing incumbent players was unbelievably strong with very specific programs, which grew double digits in Q2, so we're super happy to see that. It was a very strong quarter in regard to some of the larger players that have pricing and packaging, where they talk to a customer and want to give away free capabilities as part of their pricing and packaging. We had a very strong quarter there. There are certain things when you look at Tenable One and exposure management about visibility in the entire environment that we see that these players simply do not see.

We've got massive advantage around our accuracy and finding significantly more vulnerabilities than some of these free solutions bundled in. We also, when you look at just the coverage, the amount of coverage we have around CISA KEV coverage is exponentially more than them. When we deal with CISOs and lay out the technical differentiation we have, we have an extremely high win rate and compete level, and we saw that without a doubt in Q2.

Very helpful. Thank you. The next question is from Jonathan Ruykhaver from Cantor Fitzgerald.

Please go ahead. Yeah, thank you.

I'd like to just talk about the importance you see of identities within exposure management. It would just seem immediately from a high-level view that including a view of attack paths that includes risk related to identities broadens out a exposure management view. I know you have the Tenable Identity Exposure solution in the market. We haven't heard much in terms of adoption, but just where are customers around that vision of including identity risk paths, and what do you expect to see out of that solution looking out the next couple of quarters?

What we're seeing is that you're 100% right in regards to the importance of identity. Where we have really taken the identity technology that we've had, we very much, from an engineering perspective, been focused on embedding it seamlessly into Tenable One. Instead of selling it as an independent identity solution, it's about how do we get leverage within the Tenable One platform. When you hear us talk about one of the big differentiators, which is our attack path analysis, that is a huge play from an identity perspective, where we're able to differentiate and get insight into certain areas around the attack path that other platforms simply cannot do.

It is definitely, when you look at decision criteria being created for exposure management platform, it's one of the areas that we differentiate, we've got a long history in the identity business, now it is embedded into Tenable One, it's allowing us to get leverage based on the advanced feature set and capabilities and monetization of identities also.

Is it more about driving that attach across Hexa in exposure management or compared to the monetization opportunity? Just explain that. Yeah. This is Steve.

What Mark said, it is really an important contextualized feed in the platform itself. The ability to first identify flaws and exposures. If you look at our data fabric, a substantial percentage of what we have is non-CVE related. Understanding Critical vulnerabilities and exposures, understanding where they exist across what assets, systems, devices, workloads, models.

More importantly, understanding if those flaws and exposures are on those systems that have sensitive data. The contextualization. All of that feeds into and is scored with regard to risk. Prioritization becomes critical where the identity is an important aspect to that because we need to look at the access and entitlements. In order to identify attack paths, we need to basically aggregate and chain together all of these different exposures. You need to understand prioritization and contextualization, which we are able to do leveraging our harness, and therefore, be able to take action. Access and entitlements are important here. You have to understand, in the event that there is an incident or attack, what is the blast radius? Who owns which assets, which systems?

It is an area we are going to continue to focus on. It is one of the reasons why customers continue to buy the platform. It is an important part of the value add when it comes to attack path analysis.

Yep. Understood. Thank you. The next question is from Joshua Tilton from Wolfe Research.

Please go ahead. Hey, guys, this is Ivan here on the line for Josh.

Thanks for taking my question. Maybe one more on the competitive side. Microsoft announced a VM program a couple of days ago, just wanted to get your thoughts on what are you thinking about that, and how do you see Tenable's position in this context? Thank you. Yeah. Listen, we feel very strong.

As I said, a lot of the points that I brought up earlier fall into that category in regard to when we're discussing Tenable One and we're discussing exposure management. They're really, right now, especially, with some of the frontier AI labs and the heightened threat landscape and some of the things you're seeing around some of the state-sponsored attacks that happened, for instance, in Minneapolis. People and CISOs are looking for best-of-breed from an exposure management perspective. We feel, again, very confident about our compete level against Microsoft and what was launched. We just will keep on working with our CISOs and walking them through the value prop of what we do from a Tenable One perspective.

The next question is from Kingsley Crane from Canaccord Genuity. Please go ahead. Hi. Thanks for fitting me in.

I appreciated the comments on differentiation above and below the model. At the Investor Day, you talked about part of that differentiation coming from 300,000 plugins, built over time, producing around 100 new plugins per week. If AI is reducing time to exploit, then with what we've seen with some of these more novel agentic attacks, I'm just wondering if there's room to accelerate the new plugins per week, with AI-enabled threat discovery, tying into your deep partnerships with OpenAI and Anthropic or even using some of those open-weight models. Just kind of curious your thoughts there. Thanks. Yes. The short answer is we are.

I think the point we made at Investor Day is that humans in the loop still matter, humans doing research, providing plugins and coverage, for zero days, well before even a KEV is published. We're also leveraging AI in a way to create plugins and automate the process. You still need a human in the loop to exercise judgment. Look, threat actors have the ability to weaponize AI and move at machine speed. Our goal here with the platform and exposure management is to be able to put capability in the hands of defenders so they can move even faster. Mean time to exploit here, I think has compressed over the years from 30 days down to 1.6 days. If you look at the average SLA for applying a patch, that's like 30-plus days.

We have to do better. That imbalance right there creates the risk. It's one of the reasons why in a post-Mythos world, customers are increasingly choosing the platform. Here our goal is to not build a bigger telescope. Our goal is to tie vulnerabilities and exposures to fixes and to fix things, to shrink the attack surface, to take action, change configurations. What you mentioned here is exactly how we're applying AI. We're applying AI not only in the product, but also on the back end, on the plugins and the coverage. It's one of the reasons why our coverage in our database continues to grow. We have one of the largest data fabrics in the market, and it's driving the actions that we can take deterministically with Hexa.

Really helpful. Thank you. The next question is from Shaul Eyal from TD Cowen.

Please go ahead. Thank you.

Good afternoon, everybody. Steve, very simple question. What are your hiring plans, into the second half of this year? Maybe in other words, how do they build on the first half of 2026 given the success you're seeing out there?

Great question. We saw some of the highest levels of productivity in sales that we've seen in a few years here. We are going to add capacity the second half of the year, more capacity in the second half than we've added really over the last two years.

We have confidence to go out and invest. We have confidence that we'll generate return. Mark and I spent a lot of time on this, we're going to continue to invest and balance growth with profitability. We see a big opportunity here, we're pleased with the productivity levels and the achievement rates against quota, we're leaning in.

Thank you so much. Next question is from Richard Poland from Wells Fargo.

Please go ahead. Hey, guys.

Thanks for taking my question. I just wanted to get an understanding of, it sounds like there's a lot of excitement around just the value proposition that Tenable's able to deliver, the activity that's kind of going on, whether it's actually converting to pipeline or not. I guess, I think one of the things investors are going to struggle with is when you just look at kind of what's implied in Q4 revenue growth and just the back half guidance. It's still not perking up to the tune of exactly what we've been hearing the whole call. I guess just to level set, help us bridge kind of the excitement or activity you're seeing in the market, some of the competitive displacement with just kind of where numbers are headed.

Sure. Yeah, I can take that. I think just to level set, right, we are in a better spot today than we were 90 days ago with respect to the second half, and pretty meaningfully. As you know, revenue is a lagging indicator, right? It takes a while for when you book a deal, of course, to recognize that over the course of the contract, because we're recognizing that revenue ratably. We took the guidance up for the full year by $5 million at the midpoint. Of course, a portion of that is in the second half. Importantly, and I mentioned this earlier in response to a question, our expectations with respect to CCB that we laid out at the beginning of the year have improved by $8 million-$10 million, and the majority of that is coming into the second half.

I think that's important. When you break down the kind of Q3, Q4 dynamics with revenue, there's a little bit of timing going on there with expectations when we think professional services are going to come in. The key takeaway is that the second half is better for revenue and meaningfully better when you look at our short-term billings.

Very clear. Thank you, guys.

This concludes the question and answer session, as well as today's teleconference. You may disconnect your lines at this time. Thank you for your participation.