Tenable Holdings, Inc. (TENB) Q2 2026 Earnings Call Transcript

Greetings, and welcome to the Tenable Q2 2026 Earnings Conference Call. As a reminder, this conference is being recorded. It is now my pleasure to introduce your host, Erin Karney, Vice President, Investor Relations. Thank you. You may begin.

Thank you, operator, and thank you all for joining us on today's conference call to discuss Tenable's second quarter financial results. With me on the call today are Co-Chief Executive Officers, Steve Vintz and Mark Thurmond; and Chief Financial Officer, Matt Brown. Prior to this call, we issued a press release announcing our financial results for the quarter. You can find the press release on our IR website at tenable.com. We will make forward-looking statements during the course of this call, including statements relating to our guidance and expectations for the third quarter and full year 2026, growth and drivers in our business, changes in the threat landscape in the security industry, particularly regarding AI security, the expected impact of Frontier AI models and accelerated vulnerability discovery and the shift to preemptive security, our competitive position in the market, growth in customer demand for and adoption of our solutions, including the impact of new pricing and packaging models, the expansion of Tenable One, including agentic AI security orchestration through Hexa AI and planned AI exposure coverage across third-party models, the expected benefits of our strategic partnerships with Frontier AI Labs, our ongoing research and development investments, our capital allocation strategy, including share repurchases and our future results of operations and financial position. These forward-looking statements involve risks and uncertainties, some of which are beyond our control, which could cause actual results to differ materially from those anticipated by these statements. You should not rely upon forward-looking statements as a prediction of future events. Forward-looking statements represent our beliefs and assumptions only as of today and should not be considered representative of our views as of any subsequent date, and we disclaim any obligation to update any forward-looking statements or outlook. For a further discussion of the material risks and other important factors that could affect our actual results, please refer to those contained in our most recent annual report on Form 10-K and subsequent reports that we file with the SEC. Today's discussion includes non-GAAP financial measures. These non-GAAP financial measures are in addition to and not a substitute for or superior to measures of financial performance prepared in accordance with GAAP. There are a number of limitations related to the use of these non-GAAP financial measures versus their closest GAAP equivalents. Additionally, please see our press release for reconciliations of GAAP to non-GAAP financial measures that we discuss today. I will now turn the call over to Steve.

Thanks, Erin. We're very pleased with our results in the quarter as we exceeded all of our guided metrics and are raising our outlook for the year. Tenable One was a record 50% of new business this quarter, continuing its strong upward trajectory. Earlier this year, we launched new pricing and packaging for Tenable One, introducing Tenable One Foundation and Tenable One Advanced. Notably, we are seeing greater-than-anticipated adoption of Tenable One Advanced, which reflects growing customer demand given the evolving AI threat landscape. Accordingly, larger land and expansion deals with Tenable One helped drive average deal sizes higher this quarter, and it also helped increase our net dollar expansion rate to 106%. This is the first acceleration in our expansion rate in many quarters. The takeaway here is that our results are a clear validation of our strategy and the opportunity in front of us. As AI reshapes the attack surface faster than most organizations can respond, we believe customers are increasingly choosing Tenable One as the platform that turns complexity into clear, actionable insight to reduce risk. And that differentiation is what's resulting in higher deal sizes, faster expansion and durable leadership in this category. In fact, we believe it is becoming increasingly clear that companies who lead in this market will need 3 core capabilities to survive in the agentic era. First, the ability to understand every exposure across the enterprise; next, the ability to prioritize tasks that matter most and then translate that intelligence into action. I'll discuss each of these 3 capabilities in a bit more detail. First, organizations must understand exposure holistically across the enterprise. AI is accelerating vulnerability discovery and increasing the volume of issues requiring attention. But vulnerabilities are only part of the attack surface. Misconfigurations, compromised identities and other non-CVE weaknesses represent more than 60% of potential breach entry points, and we capture both CVE and non-CVE risk. As attackers operate with greater speed and scale, organizations need a unified view of all of the conditions that create business risk, not simply a longer list of vulnerabilities. Second, more findings make effective prioritization essential. Tenable combines broad exposure intelligence, deep contextual data and decades of security research to help customers distinguish the exposures that create meaningful business risk from those that do not. This allows security teams to concentrate their resources on the relatively small number of actions capable of producing the greatest reduction in risk. And third, prioritization is only as valuable as the action it enables. As AI models become more broadly available, the key to agentic security is not the model itself. It's what sits between the model and the customer's environment, ensuring that agents operate safely and accurately with human oversight and an audit trail. We call that the harness. Built into Tenable One, our harness draws on decades of exposure data, research and our trusted sensor layer. Hexa, our agentic engine for Tenable One, operates within this harness to orchestrate the right fixes deterministically for customers. Digging a little further into Hexa, we continue to expand what Hexa can do. Just yesterday, we announced new capabilities that equip security teams with a coordinated fleet of agents capable of operating continuously, executing multistep security tasks and orchestrating remediation across the exposure management life cycle. Together, the Tenable One Harness and Hexa's agentic capabilities move exposure management from periodic analysis and manual intervention towards a continuous always-on defense. As frontier models become more widely available, we believe this combination will become an increasingly important and durable differentiator for Tenable. In addition to the exciting AI capabilities we're building into our platform, we're also helping our customers secure their use of AI. With Tenable's AI exposure, we're extending coverage to include Gemini alongside Claude, ChatGPT, Copilot as well as major MCP deployments and AI native development tools. Together, these capabilities give security teams a more complete view of where AI is used, the risk it creates and where action is needed. As part of Tenable One, AI Exposure and Hexa are highly complementary, helping security teams secure their organization's use of AI while harnessing AI to improve operational efficiency. And finally, we're deepening our relationships with the 2 leading Frontier AI labs, Anthropic through Project Glasswing and OpenAI through their Daybreak program. These partnerships are deep and broad working collaborations. We have access to nonpublic models. We're participating in joint research. We have early insight into how the attack landscape is evolving before these capabilities are broadly available in the market. More specifically, our testing as a part of Glasswing demonstrated that Frontier AI can dramatically increase the speed and scale of vulnerability discovery, but it also reinforced that discovering more potential vulnerabilities does not by itself tell an organization where it is truly exposed or what it should fix first. The output requires a trust layer to validate and provide context to determine if an exposure is reachable and exploitable and whether existing controls can mitigate the risk. This is the direction the market is moving, and it's the direction we've been building toward. Customers need more than just another stand-alone AI feature. They're looking for an integrated platform that can act with the speed and context this moment demands. And that's exactly what we're seeing show up in how our customers are buying today. Mark will walk you through what that looks like in practice because it says a lot about where this shift is taking us.

Thanks, Steve. The market dynamics surrounding AI that Steve described are increasingly translating into customer action and stronger commercial outcomes for Tenable. We are now seeing customer conversations convert into action, which we believe points to the early stages of ongoing tailwinds to the business. Customers are moving beyond education to investing in broader, more sophisticated exposure management programs. They recognize that addressing this new environment requires a unified view of exposure across the enterprise, the intelligence to identify what creates the greatest risk and the ability to take actions before the attackers do. As Steve noted, Tenable One sales accounted for 50% of new business, a really exciting record for us. We believe 2 factors are contributing to this momentum. First, the pricing and packaging changes we introduced earlier this year have made the path to Tenable One clearer and easier for customers. The new model gives organizations the flexibility to start where they are, expand over time and move seamlessly across asset types and the attack surface with predictable spend, simplified procurement and faster time to value. Second, the AI-driven threat environment is accelerating customer demand for exposure management. Tenable is meeting that demand with capabilities such as Tenable Hexa and AI Exposure, which are making the value of the broader platform more immediate and tangible. We are already seeing encouraging signs in how customers engage with Hexa. More than 80% of customers who open Hexa submit a prompt and nearly half are using it to take action rather than simply consuming information. Hexa users are also engaging with an average of 6 Tenable One tools, indicating that the agentic engine can help customers discover and use more of the platform while freeing security teams to focus on higher-value work. For one customer, Hexa connected fragmented data across systems, workflows and geographies to identify a single patch that could neutralize 53 potential attack paths. This illustrates the efficiency opportunity Hexa creates, focusing resources on the actions that reduce the most risk, accelerating remediation and enabling security teams to accomplish more with their existing resources. These early indicators reinforce our belief that Hexa can become an important driver of Tenable One adoption and expansion over time. Customers are also seeing the benefits of Tenable One AI exposure, which helps customers discover, govern and secure the rapidly growing use of AI platforms and agents across their organizations. Together, as part of Tenable One, these highly complementary capabilities help security teams secure their organization's use of AI while using the power of AI to create operational efficiencies. This results in a very powerful preemptive security strategy. Our position in this evolving market is also receiving external recognition. In a June 2026 report, Gartner named Tenable the company to be in AI-powered exposure assessment, noting that Tenable's long-standing dominance in vulnerability assessment, its strong asset and attack surface discovery capabilities and its ability to execute on its AI strategy make it the frontrunner in an AI-powered exposure assessment. We believe this recognition validates the strength of our position today and our strategy for where the market is heading. Let me bring these trends to life through 3 customer examples from the quarter. First, a global manufacturing services company selected Tenable One Advanced, resulting in a 6-figure deal, replacing a legacy vulnerability management provider. The deployment brings together multiple asset types to both consolidate and give the customer a more unified view of exposures across its environment. This is another example of a large enterprise moving away from fragmented tools to consolidate on Tenable One. Second, a leading financial services company significantly expanded its relationship with Tenable in our largest transaction of the quarter. An existing Tenable customer, the company made a 3-year 7-figure commitment to Tenable One, including services. This expansion demonstrates our ability to deepen relationships with some of the world's largest and most sophisticated organizations and establish Tenable One as the foundation for their exposure management programs. Finally, we also displaced a major competitor who had a long-standing relationship at a large European postal service. Once again, this customer saw the need to move beyond traditional VM to Tenable One for full exposure management. The win was supported by the region's largest cybersecurity service provider and provides a strong foundation for broader collaboration and additional opportunities in the region. This was a strategically important win that demonstrates our ability to disrupt established competitive relationships in key international markets. Together, these wins illustrate the broader trends we saw during the quarter. First, increased customer demand for exposure management, driven by the Frontier AI Labs, specifically Mythos. Second, very strong competitive displacements. Third, increasing adoption of Tenable One Advanced; and fourth, meaningful expansion within our installed base. In addition to these exciting customer wins, we also achieved FedRAMP High authorization for Tenable One cloud exposure during the quarter, one of the most rigorous security authorizations in the U.S. federal government. This expands our opportunity in the federal market and reinforces the trust that mission-critical organizations place in our platform. With that, I'll turn the call over to Matt to discuss our financial results.

Thanks, Mark. We delivered excellent results in the second quarter, underscored by our highest ever adoption of the Tenable One platform, which reflects the early success of the new pricing and packaging introduced in the quarter. Growth in the platform and meaningful operating leverage drove second quarter results above the high end of the range for every metric we guided to for the quarter, and we are once again raising our full year outlook across the board, reflecting the growing momentum we're seeing in the business. Let's dive into the details. Revenue for the quarter was $268.5 million, representing growth of 8.6% year-over-year. The year-over-year growth in revenue for the quarter as well as outperformance relative to guidance was driven by strong expansion within existing accounts and underpinned by continued strength in renewals. Professional services, which are often attached to our larger Tenable One deals, also contributed ahead of expectations. Despite the strength in professional services, our percentage of recurring revenue remained high at 95% for the quarter. We had a record quarter for Tenable One with 50% of new business coming from the platform, a new milestone, up from 41% in the prior quarter and 40% in Q2 of last year. We believe this growing adoption reflects the increasing conviction customers have in leveraging the platform, including Hexa AI to manage risk across their entire attack surface. Importantly, while adoption of the platform was at an all-time high, we're also seeing an increase in average deal sizes within the platform, reflecting customer preferences for our Tenable One Advanced offering, which boasts a more robust feature set and price point compared with Tenable One Foundation. We added 381 new enterprise customers in the quarter and added 32 net new 6-figure accounts. But my favorite metric of the quarter was our net dollar expansion rate, which improved to 106%, up from 105% in the prior quarter. This is the first quarter since Q1 2022, more than 4 years ago that we have seen a percentage point quarter-over-quarter increase in the net dollar expansion rate. The growth here was driven by strong expansion and renewals business and reflects important stabilization of our growth rate. Non-GAAP gross margin was 81.4% for the quarter compared to 82.0% in Q2 2025 and within our typical historical range of 81% to 82% over the last couple of years. Non-GAAP income from operations for the quarter was $66.2 million or 24.7% of revenue compared to $47.7 million in Q2 2025, an increase of 38.8%. We're continuing to benefit from the efficiencies that I highlighted last quarter, while rotating spend into the opportunities for growth in product development and sales capacity. We expect to continue investing in the second half while still meeting our profitability targets for the year. Non-GAAP earnings per share for the quarter was $0.51 compared to $0.34 in Q2 2025, an increase of 50%. The improvement year-over-year reflects the increase in profitability combined with a decrease in diluted shares outstanding, driven by our share repurchase program. Turning to the balance sheet. Cash and short-term investments totaled $298.2 million. We generated $45.3 million in unlevered free cash flow during the quarter compared to $44.3 million in Q2 2025. During the second quarter, we repurchased 5.2 million shares for $100 million and have $108 million remaining on our current share repurchase authorization as of the end of the quarter. So far this year, we've repurchased 11.4 million shares for approximately $230 million, reflecting an average repurchase price of $20.23. Our repurchase program remains an active pillar of our capital allocation strategy, reflecting our view that returning capital to shareholders through buybacks represents an effective use of our free cash flow, given the underlying strength of the business. We are realizing the benefits of these share repurchases as our weighted average diluted shares outstanding for the quarter is now the lowest it has been since Q4 2020, more than 5 years ago. Turning to the financial outlook for Q3 and full year 2026. For Q3, we expect revenue to be in the range of $270 million to $273 million, representing a year-over-year increase of 7.6% at the midpoint. Given the strength we've seen in the first half of the year and our expectations for continued momentum into the second half, for full year 2026, we are raising our guidance range for revenue to $1.075 billion to $1.081 billion, representing a year-over-year increase of 7.9% at the midpoint. We expect non-GAAP income from operations for Q3 to be in the range of $66 million to $69 million or 24.9% of revenue at the midpoint. For full year 2026, we are raising our guidance range for non-GAAP operating income to $258 million to $264 million or 24.2% of revenue at the midpoint, representing a year-over-year increase of 230 basis points. We expect non-GAAP net income for Q3 to be in the range of $58 million to $61 million, representing a year-over-year increase of 15.8% at the midpoint. For full year 2026, we are raising our guidance range for non-GAAP net income to $228 million to $234 million, representing a year-over-year increase of 18.8% at the midpoint. We expect non-GAAP earnings per share for Q3 to be in the range of $0.49 to $0.52 per share, representing a year-over-year increase of 20.2% at the midpoint. For full year 2026, we are raising our guidance range for non-GAAP earnings per share to $1.95 to $2 per share, representing a year-over-year increase of 24.2% at the midpoint. We are also raising our unlevered free cash flow outlook at the midpoint and now expect a range of $289 million to $295 million or 27.1% of revenue at the midpoint. Before I open it up to Q&A, I want to thank the entire Tenable team for another strong quarter of execution. We are really excited by the momentum we're seeing in the business and expect that to continue into the second half. We look forward to seeing you all at the upcoming Stifel and Piper Sandler conferences. With that, we are happy to open up the call for questions. Operator?

The first question is from Rob Owens from Piper Sandler.

Great to see the NDRR reverse course here at points. Do you think we've hit the low watermark? Or could we see continued volatility? And secondarily, what are you guys seeing from a new customer perspective, especially given all the noise that's been created in the post-Mythos environment?

Rob, this is Matt. I'll take the first part of your question, and then I'll pass it over to Mark and Steve to answer the second part. Yes, we were really pleased to see the net dollar expansion rate increase quarter-on-quarter. And as I mentioned in my prepared remarks, the first time we've seen that in quite some time, and it was ahead of expectations. So seeing that strength come through and in particular, seeing that strength continue on now into the second half, that gives us confidence that, that rate holds steady at 106, that's our expectation for the rest of the year, and that's the expectation that we've built into our guidance.

Yes. And I'll kind of hit on some of the customer demand. As we talked about in regard to some of the investor conversations, this has definitely been — when you look at Mythos and some of the Frontier AI labs, this has been a tailwind without a doubt. So we are seeing strong demand from our customers around exposure management, specifically based on what they've seen and some of the feedback they've been getting from the research that's been done with the AI Frontier labs, again, highlighted with Mythos. We saw a significant uptick in our competitive displacements of customers that might be on old school standard VM wanting to move to an exposure management platform, moving from competition to us. So that was a very strong highlight in Q2. And with the new pricing and packaging we've highlighted, we've now been able to streamline and make it much easier and simpler for customers to move into either Foundation or Advanced, and we saw a higher percentage move to Advanced, which was great. And we're continuing to see the momentum. The last thing is our expansion. We saw some phenomenal expansion. I highlighted one of the accounts in the remarks. We are seeing great expansion opportunity within the installed base. So very strong demand, very happy with what we saw in Q2, and we're going to continue with the momentum.

The next question is from Mike Cikos from Needham & Company.

This is Matt Calitri on for Mike Cikos over at Needham. Wondering if you guys could give some more color on how customers are responding to flex pricing and packaging. I know you noted greater-than-expected adoption of Advanced, which is obviously great to hear. But just curious if there's anything you could share on if customers are in any way rationalizing certain asset types in favor of others? Or if there are any leading indicators in terms of what the actual uplift looks like?

Well, as Mark commented earlier, we're very pleased with our expansion this quarter and our new lands. Something that we talked about earlier, but one of the big takeaways from the quarter are higher average selling prices. I couldn't be more pleased. And pricing and packaging is playing a big role. More customers opted for Advanced, which has a notably higher selling price in comparison to stand-alone VM. We added a healthy number of net new 6-figure customers, but the big takeaway was the number of net new 7-figure customers, which more than doubled compared to what we typically do with one of our best net new 7-figure customer adds in nearly 2 years. What drove that is really 2 things. Number one, customers migrating from stand-alone products into the platform at a greater rate. And then number two is the customers that are in Tenable One that are expanding where we're increasing the selling price dramatically. Things just feel different since April in a post-Mythos world. I think customers recognize they need unified visibility. They need unified insights and they need to be able to take action deterministically. And that's exactly what the platform does. That's what Hexa AI does. And things feel different, and we feel really good about the setup for the second half of the year and have confidence in our ability to continue to execute here.

The next question is from Patrick Colville from Scotiabank.

This is Conner Weed calling in for Patrick. We were just wondering what the initial feedback on Hexa was looking like from customers? And if you could remind us of what the average selling price uplift looks like for customers moving from VM to Hexa. And is there a scenario where customer spend goes up to remediate a lot of vulnerabilities that we're seeing currently, but then customer spend falls back as well?

I'll comment a bit on what we're seeing from a demand perspective. Hexa, which we launched in Q2, has picked up to a very high level in customer adoption. We now have hundreds of Tenable One customers using Hexa. As we highlighted, they're not just using Hexa to get more information and content. They're actually submitting prompts and taking actions. They're automating significant parts of how and what they do around automated remediation. Some of the use cases that we're starting to see include creating dashboards for certain exposure scores, identifying and updating different findings autonomously, managing their tagging environment, and managing and scanning workflows for servers and workstations. The adoption we've seen has been fantastic. To give you a bit of sense, we actually created a new SKU for incremental tokens for overages because customers with significant percentages were over on their tokens. So we created a SKU to sell them incremental tokens because of the overages. All of the signs since launch are positive. Early days, there's going to be some great announcements coming out of Black Hat next week, but super happy and the customer feedback has been phenomenal regarding what they're actually doing with Hexa.

And I'll just add one thing, too. Hexa, as you know, is only available in the platform. And so that was a major driver of customers adopting the platform in the quarter. As you know, there's a significant price uplift going from stand-alone VM into Tenable One. And we think a big driver of the record adoption that we had in new business in Tenable One is that 50% this quarter was due to some of the improvements that we've made and the robust features that Hexa delivers.

The next question is from Rudy Kessinger from D.A. Davidson.

Congrats on the nice results here. You mentioned that the uptake of Advanced was higher than your expectations versus Foundation. Could you share any more color on what kind of split looks like for new logos who are taking Tenable One in terms of what percent are taking Foundation versus what percent are taking Advanced?

Advanced this quarter benefited at a ratio of something like 2:1 versus Foundation. So it was a meaningful percentage higher than Foundation for the quarter.

What we saw with customers and why we are seeing significant adoption of Advanced compared to Foundation is there are specific cloud CNAPP capabilities that you get in Advanced that were a big driver. We're seeing strong demand for cloud security. You get advanced capabilities around attack path analysis and some scoring within Advanced, which was a big differentiator. You also get significantly more tokens when you go with Advanced. Customers that want to leverage Hexa are getting a significant incremental amount of tokens in Advanced compared to Foundation. They often have more domains, more assets, and want to cover different types of assets. We were extremely pleased with that motion and what we saw. I think it's one of the reasons that you're now seeing 50% of our new business coming in from Tenable One. The pricing and packaging had a lot to do with it and our sellers and partners are more comfortable talking to our installed base and competitive opportunities about it.

Great. And then for my follow-up, it sounds like you've got really good early momentum following Mythos. You talked about NRR being stable at 106%. I know there's some noise of volatility in both CCB and cRPO. With revenue being the best indicator of the business for the time being, when might we see some of this momentum translate into accelerated revenue growth?

Some of that we're seeing already. As we've talked about before, the first step to inflecting growth higher is really to stabilize our top line growth rate. The good news is we're seeing early signs of that. We saw that this quarter. Pipeline was super strong this quarter. Competitive win rates were very strong this quarter. We had one of the strongest quarters in expansion that we've had in quite some time. What that enabled us to do is raise guidance by $5 million at the midpoint for the full year, which is great. You saw our 106% net dollar retention rate, which was excellent also. When we started the year, we talked about CCB being roughly in line with consensus expectations. As we sit here today, we think that's probably $8 million to $10 million higher than where we started the year with the majority of that benefiting the back half just based on the strength and the momentum that we've seen so far.

The next question is from Jonathan Ho from William Blair.

With your existing AI solutions, what's been sort of the customer feedback? This is the non-Hexa solution. And can you talk a little bit about maybe what that means from an asset coverage standpoint? Is that potentially growing as well as people start to look at the existing solutions that you have?

First, some color on Hexa. Mark talked about the commercial traction, but it's worth adding a little more color. We're off to a terrific start with Hexa AI. In Q2, more than 80% of Hexa users submit prompts and use it to take action. Over 90% of the actions that Hexa recommends are accepted by customers. We're continuing to innovate there. We introduced advanced multistep reasoning and automated remediation workflows. Now we have Hexa that's always on, orchestrating continuous autonomous defense without needing humans to reprompt. We're getting great traction. For non-Hexa capabilities, that takes us to AI Exposure, which addresses a couple of key use cases. We do three things. Hexa AI is the ability to take action within the platform deterministically with trust. AI Exposure helps customers understand AI as a threat vector, which is one of the biggest blind spots in security today. It starts with visibility: we help discover what's running in a customer's environment — shadow AI agents, browser plug-ins, APIs, things like that. Second, we provide infrastructure protection related to AI models, workloads and agents themselves. We can discover agents but more importantly understand when agents are connected to what they have access to and whether it's exposed to the Internet and what kind of permissions surround agents and if there are identity weaknesses. Third, we monitor customers' use of prompts across a wide range of models and tie that back to security policy. So both on the front end, helping customers understand their posture and secure their use of AI as well as AI infrastructure and helping them take action deterministically with trust on the back end so they can reduce their risk. We're at the forefront of AI and security and are seeing good traction.

Excellent. And as a quick follow-up, you talked a little bit about your harness advantages relative to other exposure management providers. Can you talk a little bit about what you have that's unique there? And are you concerned at all about the LLM providers maybe trying to move more upstream into your area? Can you talk about the barriers to entry there?

We discussed this at Investor Day. The moat here is starting to be the application layer above and below the model. Models will continue to improve and there are open weight models giving enterprises flexibility. The best model today may not be the best model tomorrow. The real moat will be the application layer, which provides context and trust to run models safely and deterministically in your environment. Hexa was built with this in mind. Hexa routes the right task to the right model, frontier or otherwise, and allows customers to take action in near real time with confidence. The moat below the model is our extensive sensor layer and ability to deploy agents, scanners and sensors across domains to collect data. We have one of the largest data fabrics in security, a large customer base, and deep embedding behind the firewall. It's proprietary and unique to us. Our harness provides scaffolding around the model, orchestrates workflows and allows us to take action and reduce risk deterministically. That's an important part of the value add and one reason customers increasingly choose Tenable One.

The next question is from Brian Essex from JPMorgan.

One thing that resonated this quarter across many companies and partners is that CFOs or CIOs are highly concerned about Mythos. It's leading to an elevated threat environment and emphasis to push updated software, operating systems and hardware into enterprise networks. I'd like to take a step back on how pipeline acceleration is progressing, how companies are engaging with you to address those concerns and how an elevated pipeline might convert to revenue as you walk through the year. How much visibility do you have on that?

When you look at Mythos and the AI lab discussion, it's still omnipresent. There's enormous interest from customers on what we've learned as a cybersecurity company and the pressure they're getting from the board and CEO. It's creating demand and urgency. CISOs are saying they expect a massive influx of vulnerabilities and other potential risks and that one productive thing is a preventative, proactive exposure management platform to get ahead of it and understand what's happening. We're having those discussions, and that's why Tenable One hit 50% of new business — customers want exposure management. We're seeing accelerated pipeline, strong Q2 results and guidance for Q3 and Q4 reflects that momentum. From budgeting, it isn't a massive incremental flow increasing cyber budgets by 10%–20%. What you are seeing is consolidation: customers want to reduce the number of tools, consolidate to platforms, and do more with fewer vendors. So exposure management projects are happening faster and that's driving the positivity and momentum in our business.

Is that permeating through network scanning exposure? Are customers scanning more of their estate or just focusing on analytics?

It's both. We saw a significant pickup in expansion business in Q2. Installed base customers expanded asset coverage to gain better visibility. We saw incremental asset types: a very strong OT quarter globally, especially in the federal government, and strong cloud demand. So it's both expanding coverage and adding new asset types.

The next question is from Meta Marshall from Morgan Stanley Investment Management.

This is Abhishek Murli on for Meta Marshall. Could you talk us through some of the dynamics you're having with customers as they are looking to move towards automated remediation? I understand there was some press release in intra-quarter as well on this, but I would love to hear what you're hearing on the ground. And then I have a follow-up.

We added over 300 new customers this quarter and a healthy number of new lands, and the big takeaway was expansion within the customer base and higher selling prices that pricing and packaging plays a big role in. There are two core use cases in our pricing and packaging. Foundation is about unified asset visibility, discovering and continuously inventorying assets across domains. Advanced includes the ability to take action and measure risk, orchestration and remediation, risk measurement and benchmarking and scoring. That's a big problem we're here to solve. It's critical in the AI and agentic era and forms a moat. Customer conversations feel different and procurement and sales cycles are progressing. We see good early signs of strong momentum.

Super helpful. Maybe as a follow-up, you also laid out at Analyst Day that the Tenable One platform could be around half of revenue in 2029. Given the traction you're seeing, is there potential that could happen sooner?

We're seeing progress toward that goal. At the time of Analyst Day, Tenable One was roughly one-third of our business. That number is increasing. We hope to get it up to 40% by the end of the year and have made progress against that goal already. A quarter like Q2, with a record amount of new business into the platform, certainly helps. We've increased from one-third and are on our way to 40% and hope to reach that by year-end.

The next question is from Joseph Gallo from Jefferies.

This is Grant Darling on for Joe Gallo. I wanted to circle back on competition. Exposure management is increasingly important in an AI world. Has there been any changes in competitive dynamics with regard to larger platform vendors, especially with them trying to embed LLM technologies and what you're seeing there?

We had one of our best competitive quarters. Our compete level on deals of size and replacing incumbent players was unbelievably strong with very specific programs, which grew double digits in Q2. We saw strong traction against larger players that bundle free capabilities. From a visibility perspective across the entire environment, these players simply do not see what we see. We have a massive advantage on accuracy and finding significantly more vulnerabilities than some of those bundled solutions. Our coverage is exponentially more in many areas, so when we discuss technical differentiation with CISOs, we have an extremely high win rate. We saw that in Q2.

The next question is from Jonathan Ruykhaver from Cantor Fitzgerald.

I'd like to talk about the importance you see of identities within exposure management. Including a view of the environment that includes exposure risk related to identities seems to broaden exposure management. I know you have the Tenable identity exposure solution in the market. Where are customers around that vision of including identity risk paths? What do you expect to see from that solution in the next couple of quarters?

You're 100% right about the importance of identity. From an engineering perspective, we've focused on embedding identity technology seamlessly into Tenable One rather than selling it as an independent solution. The value is how we leverage it within Tenable One. When you hear us talk about attack path analysis, that's a huge play from an identity perspective and allows us to differentiate and gain insights other platforms cannot. It's now embedded into Tenable One, allowing us to leverage the advanced feature set and capabilities and monetize identity as well.

So is it more about driving that attach across Hexa and exposure management versus the monetization opportunity? Just explain that.

It's an important contextualized feed in the platform itself. The ability to identify flaws and exposures is crucial. Our data fabric contains a substantial percentage of non-CVE related data. Understanding vulnerabilities and exposures across assets—systems, devices, workloads, models—and understanding whether those systems have sensitive data is critical for contextualization. All of that feeds into our risk scoring. Prioritization becomes critical where identity is an important aspect because we need to look at access and entitlements. To identify attack paths, you aggregate and correlate these different exposures, prioritize and contextualize using our harness, and then be able to take action. Access and entitlements are important to understand the blast radius in an incident and who owns which assets. It's an area we will continue to focus on and a reason why customers buy the platform.

The next question is from Joshua Tilton from Wolfe Research.

This is Yvon here on the line for Josh. Maybe one more on the competitive side. Microsoft announced a VM program a couple of days ago. What are your thoughts on that and how do you see Tenable positioned in this context?

We feel very strong. Many of the points I mentioned earlier fall into this category: with the heightened threat landscape and the Frontier AI labs, CISOs are looking for best-of-breed exposure management. We feel confident about our compete level against Microsoft and what was launched. We'll continue working with CISOs and walking them through the Tenable One value proposition.

The next question is from Kingsley Crane from Canaccord Genuity.

I appreciated the comments on differentiation above and below the model. At Investor Day, you talked about part of that differentiation coming from 300,000 plug-ins built over time, producing around 100 new plug-ins per week. If AI is reducing time to exploit and we're seeing novel agentic attacks, is there room to accelerate the new plug-ins per week with AI-enabled threat discovery, tying into your partnerships with OpenAI and Anthropic or using open weight models?

Yes. We are leveraging AI to create plug-ins and automate the process, though humans in the loop still matter for judgment. Threat actors can weaponize AI and move at machine speed, so our goal is to equip defenders to move faster. Mean time to exploit has compressed dramatically; patch SLAs are far longer. That imbalance creates risk, and customers are choosing the platform to address it. We're applying AI to the product and to plug-ins and coverage on the back end. Our coverage continues to grow, and we have one of the largest data fabrics in the market, driving actions we can take deterministically with Hexa.

The next question is from Shaul Eyal from TD Cowen.

Steve, a simple question. What are your hiring plans into the second half of this year? How do they build on the first half of 2026, given the success you're seeing?

Great question. We've seen some of the highest levels of productivity in sales in a few years. We are going to add capacity in the second half of the year — more capacity than we've added over the last two years. We have confidence to invest and expect to generate return. Mark and I spent a lot of time on this. We'll continue to invest and balance growth with profitability. We see a big opportunity and are pleased with productivity and quota achievement, and we're leaning in.

The next question is from Richard Poland from Wells Fargo.

There's a lot of excitement around the value proposition and activity converting to pipeline. But investors may struggle since implied Q4 revenue growth and back half guidance don't appear to reflect the call's enthusiasm. Help us bridge the excitement and activity you're seeing in the market and where the numbers are headed.

I'll take that. We are in a better spot today than 90 days ago for the second half and meaningfully better. Revenue is a lagging indicator because deals are recognized ratably over contract life. We increased full year guidance by $5 million at the midpoint. A portion of that benefits the second half. Importantly, our expectations for CCB at the start of the year have improved by $8 million to $10 million, with the majority benefiting the back half. There's some timing with Q3/Q4 dynamics and when professional services come in, but the key takeaway is the second half is meaningfully better when you look at our short-term billings.

This concludes the question-and-answer session as well as today's teleconference. You may disconnect your lines at this time. Thank you for your participation.