UNITED STATES
SECURITIES AND EXCHANGE COMMISSION
Washington, D.C. 20549
__________________
FORM 10-Q
__________________
| Quarterly Report Pursuant to Section 13 or 15(d) of the Securities Exchange Act of 1934 | |||||
For the Quarterly Period Ended September 30, 2024
or
| Transition Report Pursuant to Section 13 or 15(d) of the Securities Exchange Act of 1934 | |||||
For the transition period from _____ to _____
Commission file number 001-38600
__________________
(Exact name of registrant as specified in its charter)
__________________
| (State or other jurisdiction of incorporation or organization) | (I.R.S. Employer Identification Number) | |||||||
(Address of principal executive offices, including zip code)
(410 ) 872-0555
(Registrant’s telephone number, including area code)
__________________
Securities registered pursuant to Section 12(b) of the Act:
| Title of each class | Trading Symbol(s) | Name of each exchange on which registered | ||||||
Indicate by check mark whether the Registrant (1) has filed all reports required to be filed by Section 13 or 15(d) of the Securities Exchange Act of 1934 during the preceding 12 months (or for such shorter period that the Registrant was required to file such reports), and (2) has been subject to such filing requirements for the past 90 days. Yes ☒ No ☐
Indicate by check mark whether the registrant has submitted electronically every Interactive Data File required to be submitted pursuant to Rule 405 of Regulation S-T during the preceding 12 months (or for such shorter period that the registrant was required to submit such files). Yes ☒ No ☐
Indicate by check mark whether the registrant is a large accelerated filer, an accelerated filer, a non-accelerated filer, a smaller reporting company or an emerging growth company. See the definitions of “large accelerated filer,” “accelerated filer,” “smaller reporting company” and "emerging growth company" in Rule 12b-2 of the Exchange Act.
| ☒ | Accelerated filer | ☐ | ||||||||||||
| Non-accelerated filer | ☐ | |||||||||||||
| Emerging growth company | Smaller reporting company | |||||||||||||
If an emerging growth company, indicate by check mark if the registrant has elected not to use the extended transition period for complying with any new or revised financial accounting standards provided pursuant to Section 13(a) of the Exchange Act. ☐ | ||||||||||||||
Indicate by check mark whether the registrant is a shell company (as defined in Rule 12b-2 of the Exchange Act). Yes ☐ No ☒
The number of shares of the Registrant's common stock outstanding as of October 31, 2024 was 120,135,387 .
TENABLE HOLDINGS, INC.
TABLE OF CONTENTS
| Page | ||||||||
Where You Can Find More Information
Investors and others should note that we may announce material business and financial information to our investors using our investor relations website (https://investors.tenable.com), our filings with the Securities and Exchange Commission (SEC), our website, webcasts, press releases, and conference calls. We use these mediums, including our website, to communicate with investors and the general public about our company, our products, and other issues, and for complying with our disclosure obligations under Regulation FD. It is possible that the information that we make available on our website may be deemed to be material information. We therefore encourage investors and others interested in our company to review the information that we make available on our website, in addition to following our SEC filings, our webcasts, press releases, and conference calls. The information we post through these channels is not a part of this Quarterly Report on Form 10-Q. These channels be may updated from time to time on our investor relations website.
2
PART I. FINANCIAL INFORMATION
Item 1. Financial Statements
TENABLE HOLDINGS, INC.
CONSOLIDATED BALANCE SHEETS
| September 30, 2024 | December 31, 2023 | ||||||||||
| (in thousands, except per share data) | (unaudited) | ||||||||||
| Assets | |||||||||||
| Current assets: | |||||||||||
| Cash and cash equivalents | $ | $ | |||||||||
| Short-term investments | |||||||||||
Accounts receivable (net of allowance for doubtful accounts of $ | |||||||||||
| Deferred commissions | |||||||||||
| Prepaid expenses and other current assets | |||||||||||
| Total current assets | |||||||||||
| Property and equipment, net | |||||||||||
| Deferred commissions (net of current portion) | |||||||||||
| Operating lease right-of-use assets | |||||||||||
| Acquired intangible assets, net | |||||||||||
| Goodwill | |||||||||||
| Other assets | |||||||||||
| Total assets | $ | $ | |||||||||
| Liabilities and Stockholders’ Equity | |||||||||||
| Current liabilities: | |||||||||||
| Accounts payable and accrued expenses | $ | $ | |||||||||
| Accrued compensation | |||||||||||
| Deferred revenue | |||||||||||
| Operating lease liabilities | |||||||||||
| Other current liabilities | |||||||||||
| Total current liabilities | |||||||||||
| Deferred revenue (net of current portion) | |||||||||||
| Term loan, net of issuance costs (net of current portion) | |||||||||||
| Operating lease liabilities (net of current portion) | |||||||||||
| Other liabilities | |||||||||||
| Total liabilities | |||||||||||
| Stockholders’ equity: | |||||||||||
Common stock (par value: $ | |||||||||||
| Additional paid-in capital | |||||||||||
Treasury stock (at cost: | ( | ( | |||||||||
| Accumulated other comprehensive income | |||||||||||
| Accumulated deficit | ( | ( | |||||||||
| Total stockholders’ equity | |||||||||||
| Total liabilities and stockholders’ equity | $ | $ | |||||||||
The accompanying notes are an integral part of these consolidated financial statements.
3
TENABLE HOLDINGS, INC.
CONSOLIDATED STATEMENTS OF OPERATIONS
(Unaudited)
| Three Months Ended September 30, | Nine Months Ended September 30, | ||||||||||||||||||||||
| (in thousands, except per share data) | 2024 | 2023 | 2024 | 2023 | |||||||||||||||||||
| Revenue | $ | $ | $ | $ | |||||||||||||||||||
| Cost of revenue | |||||||||||||||||||||||
| Gross profit | |||||||||||||||||||||||
| Operating expenses: | |||||||||||||||||||||||
| Sales and marketing | |||||||||||||||||||||||
| Research and development | |||||||||||||||||||||||
| General and administrative | |||||||||||||||||||||||
| Restructuring | |||||||||||||||||||||||
| Total operating expenses | |||||||||||||||||||||||
| Loss from operations | ( | ( | ( | ( | |||||||||||||||||||
| Interest income | |||||||||||||||||||||||
| Interest expense | ( | ( | ( | ( | |||||||||||||||||||
| Other income (expense), net | ( | ( | ( | ||||||||||||||||||||
| Loss before income taxes | ( | ( | ( | ( | |||||||||||||||||||
| Provision for income taxes | |||||||||||||||||||||||
| Net loss | $ | ( | $ | ( | $ | ( | $ | ( | |||||||||||||||
Net loss per share, basic and diluted | $ | ( | $ | ( | $ | ( | $ | ( | |||||||||||||||
Weighted-average shares used to compute net loss per share, basic and diluted | |||||||||||||||||||||||
The accompanying notes are an integral part of these consolidated financial statements.
4
TENABLE HOLDINGS, INC.
CONSOLIDATED STATEMENTS OF COMPREHENSIVE LOSS
(Unaudited)
| Three Months Ended September 30, | Nine Months Ended September 30, | ||||||||||||||||||||||
| (in thousands) | 2024 | 2023 | 2024 | 2023 | |||||||||||||||||||
| Net loss | $ | ( | $ | ( | $ | ( | $ | ( | |||||||||||||||
| Other comprehensive income, net of tax: | |||||||||||||||||||||||
| Unrealized gains on available-for-sale securities, net | |||||||||||||||||||||||
| Other comprehensive income | |||||||||||||||||||||||
| Comprehensive loss | $ | ( | $ | ( | $ | ( | $ | ( | |||||||||||||||
The accompanying notes are an integral part of these consolidated financial statements.
5
TENABLE HOLDINGS, INC.
CONSOLIDATED STATEMENTS OF STOCKHOLDERS' EQUITY
(Unaudited)
| Additional Paid-in Capital | Accumulated Other Comprehensive (Loss) Income | Total Stockholders’ Equity | |||||||||||||||||||||||||||||||||||||||
| Common Stock | Treasury Stock | Accumulated Deficit | |||||||||||||||||||||||||||||||||||||||
| (in thousands) | Shares | Amount | |||||||||||||||||||||||||||||||||||||||
Balance at June 30, 2024 | $ | $ | $ | ( | $ | ( | $ | ( | $ | ||||||||||||||||||||||||||||||||
| Exercise of stock options | — | — | — | ||||||||||||||||||||||||||||||||||||||
| Vesting of restricted stock units | ( | — | — | — | |||||||||||||||||||||||||||||||||||||
| Vesting of performance stock units | — | — | — | — | — | — | |||||||||||||||||||||||||||||||||||
| Issuance of common stock under employee stock purchase plan | — | — | — | ||||||||||||||||||||||||||||||||||||||
| Stock-based compensation | — | — | — | — | — | ||||||||||||||||||||||||||||||||||||
| Other comprehensive income | — | — | — | — | — | ||||||||||||||||||||||||||||||||||||
| Net loss | — | — | — | — | — | ( | ( | ||||||||||||||||||||||||||||||||||
Balance at September 30, 2024 | $ | $ | $ | ( | $ | $ | ( | $ | |||||||||||||||||||||||||||||||||
| Balance at December 31, 2023 | $ | $ | $ | ( | $ | $ | ( | $ | |||||||||||||||||||||||||||||||||
| Exercise of stock options | — | — | — | ||||||||||||||||||||||||||||||||||||||
| Vesting of restricted stock units | ( | — | — | — | |||||||||||||||||||||||||||||||||||||
| Vesting of performance stock units | ( | — | — | — | |||||||||||||||||||||||||||||||||||||
| Issuance of common stock under employee stock purchase plan | — | — | — | ||||||||||||||||||||||||||||||||||||||
| Purchase of treasury stock | — | — | — | ( | — | — | ( | ||||||||||||||||||||||||||||||||||
| Fair value of replacement equity attributable to pre-acquisition service | — | — | — | — | — | ||||||||||||||||||||||||||||||||||||
| Stock-based compensation | — | — | — | — | — | ||||||||||||||||||||||||||||||||||||
| Other comprehensive income | — | — | — | — | — | ||||||||||||||||||||||||||||||||||||
| Net loss | — | — | — | — | — | ( | ( | ||||||||||||||||||||||||||||||||||
Balance at September 30, 2024 | $ | $ | $ | ( | $ | $ | ( | $ | |||||||||||||||||||||||||||||||||
Balance at June 30, 2023 | $ | $ | $ | $ | ( | $ | ( | $ | |||||||||||||||||||||||||||||||||
| Exercise of stock options | — | — | — | ||||||||||||||||||||||||||||||||||||||
| Vesting of restricted stock units | ( | — | — | — | |||||||||||||||||||||||||||||||||||||
| Vesting of performance stock units | — | — | — | — | — | — | |||||||||||||||||||||||||||||||||||
| Issuance of common stock under employee stock purchase plan | — | — | — | ||||||||||||||||||||||||||||||||||||||
| Stock-based compensation | — | — | — | — | — | ||||||||||||||||||||||||||||||||||||
| Other comprehensive income | — | — | — | — | — | ||||||||||||||||||||||||||||||||||||
| Net loss | — | — | — | — | — | ( | ( | ||||||||||||||||||||||||||||||||||
Balance at September 30, 2023 | $ | $ | $ | $ | ( | $ | ( | $ | |||||||||||||||||||||||||||||||||
Balance at December 31, 2022 | $ | $ | $ | $ | ( | $ | ( | $ | |||||||||||||||||||||||||||||||||
| Exercise of stock options | — | — | — | ||||||||||||||||||||||||||||||||||||||
| Vesting of restricted stock units | ( | — | — | — | |||||||||||||||||||||||||||||||||||||
| Vesting of performance stock units | ( | — | — | — | |||||||||||||||||||||||||||||||||||||
| Issuance of common stock under employee stock purchase plan | — | — | — | ||||||||||||||||||||||||||||||||||||||
| Stock-based compensation | — | — | — | — | — | ||||||||||||||||||||||||||||||||||||
| Other comprehensive income | — | — | — | — | — | ||||||||||||||||||||||||||||||||||||
| Net loss | — | — | — | — | — | ( | ( | ||||||||||||||||||||||||||||||||||
Balance at September 30, 2023 | $ | $ | $ | $ | ( | $ | ( | $ | |||||||||||||||||||||||||||||||||
The accompanying notes are an integral part of these consolidated financial statements.
6
TENABLE HOLDINGS, INC.
CONSOLIDATED STATEMENTS OF CASH FLOWS
(Unaudited)
| Nine Months Ended September 30, | |||||||||||
| (in thousands) | 2024 | 2023 | |||||||||
| Cash flows from operating activities: | |||||||||||
| Net loss | $ | ( | $ | ( | |||||||
| Adjustments to reconcile net loss to net cash provided by operating activities: | |||||||||||
| Depreciation and amortization | |||||||||||
| Stock-based compensation | |||||||||||
| Net accretion of discounts and amortization of premiums on short-term investments | ( | ( | |||||||||
| Amortization of debt issuance costs | |||||||||||
| (Gain) loss on other investments | ( | ||||||||||
| Restructuring | |||||||||||
| Other | |||||||||||
| Changes in operating assets and liabilities: | |||||||||||
| Accounts receivable | |||||||||||
| Prepaid expenses and other assets | |||||||||||
| Accounts payable, accrued expenses and accrued compensation | ( | ||||||||||
| Deferred revenue | ( | ||||||||||
| Other current and noncurrent liabilities | ( | ( | |||||||||
| Net cash provided by operating activities | |||||||||||
| Cash flows from investing activities: | |||||||||||
| Purchases of property and equipment | ( | ( | |||||||||
| Capitalized software development costs | ( | ( | |||||||||
| Purchases of short-term investments | ( | ( | |||||||||
| Sales and maturities of short-term investments | |||||||||||
| Proceeds from other investments | |||||||||||
| Purchases of other investments | ( | ||||||||||
| Business combinations, net of cash acquired | ( | ||||||||||
| Net cash (used in) provided by investing activities | ( | ||||||||||
| Cash flows from financing activities: | |||||||||||
| Payments on term loan | ( | ( | |||||||||
| Proceeds from loan agreement | |||||||||||
| Proceeds from stock issued in connection with the employee stock purchase plan | |||||||||||
| Proceeds from the exercise of stock options | |||||||||||
| Purchase of treasury stock | ( | ||||||||||
| Other financing activities | ( | ||||||||||
| Net cash (used in) provided by financing activities | ( | ||||||||||
| Effect of exchange rate changes on cash and cash equivalents and restricted cash | ( | ( | |||||||||
| Net increase in cash and cash equivalents and restricted cash | |||||||||||
| Cash and cash equivalents and restricted cash at beginning of period | |||||||||||
| Cash and cash equivalents and restricted cash at end of period | $ | $ | |||||||||
| Supplemental disclosure of cash flow information: | |||||||||||
| Cash paid for interest | $ | $ | |||||||||
| Cash paid for income taxes, net of refunds | |||||||||||
Supplemental cash flow information related to leases: | |||||||||||
Cash payments for operating leases | $ | $ | |||||||||
The accompanying notes are an integral part of these consolidated financial statements.
7
TENABLE HOLDINGS, INC.
NOTES TO CONSOLIDATED FINANCIAL STATEMENTS
(Unaudited)
1. Business and Summary of Significant Accounting Policies
Business Description
Tenable Holdings, Inc. (the “Company,” “we,” "us," or “our”) is a provider of exposure management solutions. Exposure management is an effective discipline for measuring, comparing and reducing cybersecurity risk in today's complex IT environments. Our solutions provide broad visibility into security issues such as vulnerabilities, misconfigurations, internal and regulatory compliance violations and other indicators of the state of an organization’s security across IT infrastructure and applications, cloud environments, Active Directory and industrial internet of things and operational technology environments.
Basis of Presentation
The consolidated statements are unaudited and should be read in conjunction with the consolidated financial statements and related notes included in our 2023 Annual Report on Form 10-K ("10-K") filed with the Securities and Exchange Commission on February 28, 2024. The consolidated financial statements have been prepared on a basis consistent with the audited annual consolidated financial statements included in the 10-K and, in the opinion of management, include all adjustments of a normal recurring nature necessary to fairly state our financial position, our results of operations, and cash flows.
The results for the three and nine months ended September 30, 2024 are not necessarily indicative of the operating results expected for the year ending December 31, 2024 or any other future period.
Use of Estimates
The preparation of consolidated financial statements in conformity with GAAP requires management to make estimates and assumptions that affect the amounts reported in the consolidated financial statements and accompanying notes. These estimates include, but are not limited to, the determination of the estimated economic life of perpetual licenses for revenue recognition, the estimated period of benefit for deferred commissions, the useful lives of long-lived assets, the fair value of acquired intangible assets, the valuation of stock-based compensation, the incremental borrowing rate for operating leases, and the valuation of deferred tax assets and investments. We base these estimates on historical experience and on various other assumptions that we believe to be reasonable. Actual results could differ significantly from these estimates.
Significant Accounting Policies
Our significant accounting policies are described in our 10-K. During the nine months ended September 30, 2024, there were no material changes to our significant accounting policies from those described in our 10-K.
Recently Issued Accounting Pronouncements
In November 2023, the Financial Accounting Standards Board (“FASB”) issued ASU 2023-07 - Segment Reporting (Topic 280): Improvements to Reportable Segment Disclosures, which requires public entities with a single reportable segment to provide all the disclosures required by this standard and all existing segment disclosures in Topic 280 on an interim and annual basis, including new requirements to disclose significant segment expenses that are regularly provided to the Chief Operating Decision Maker ("CODM") and included within the reported measure(s) of a segment's profit or
8
loss, the amount and composition of any other segment items, the title and position of the CODM, and how the CODM uses the reported measure(s) of a segment's profit or loss to assess performance and decide how to allocate resources. The guidance is effective for our annual period beginning January 1, 2025, and interim periods thereafter, applied retrospectively with early adoption permitted. We do not expect the adoption of this standard to have a material impact on our consolidated financial statements and disclosures.
In December 2023, the FASB issued ASU 2023-09 - Income Taxes (Topic 740): Improvements to Income Tax Disclosures, which requires public entities to provide greater disaggregation within their annual rate reconciliation, including new requirements to present reconciling items on a gross basis in specified categories, disclose both percentages and dollar amounts, and disaggregate individual reconciling items by jurisdiction and nature when the effect of the items meet a quantitative threshold. The guidance also requires disaggregating the annual disclosure of income taxes paid, net of refunds received, by federal (national), state, and foreign taxes, with separate presentation of individual jurisdictions that meet a quantitative threshold. The guidance is effective for our annual periods beginning January 1, 2025 on a prospective basis, with a retrospective option, and early adoption is permitted. Adopting this guidance will result in additional annual tax disclosures but will not impact our provision for income taxes, deferred tax assets or deferred tax liabilities.
2. Revenue
Disaggregation of Revenue
The following table presents a summary of revenue:
| Three Months Ended September 30, | Nine Months Ended September 30, | ||||||||||||||||||||||
| (in thousands) | 2024 | 2023 | 2024 | 2023 | |||||||||||||||||||
| Subscription revenue | $ | $ | $ | $ | |||||||||||||||||||
| Perpetual license and maintenance revenue | |||||||||||||||||||||||
| Professional services and other revenue | |||||||||||||||||||||||
| Revenue | $ | $ | $ | $ | |||||||||||||||||||
Concentrations
We sell and market our products and services through our field sales force that works closely with our channel partners, which includes a network of distributors and resellers, in developing sales opportunities. We use a two-tiered channel model whereby we sell our products and services to our distributors, which in turn sell to resellers, which then sell to end-users. Revenue derived through our channel network comprised 94 93 33 % and 34 % of revenue in the three and nine months ended September 30, 2024, respectively, and 36 32
Contract Balances
We generally bill our customers in advance and accounts receivable are recorded when we have the right to invoice the customer. Contract liabilities consist of deferred revenue and include customer billings and payments received in advance of performance under the contract. In the three months ended September 30, 2024 and 2023 and the nine months ended September 30, 2024 and 2023, we recognized revenue of $209.6 million, $185.9 million, $497.3 million and $430.8 million, respectively, that was included in the deferred revenue balance at the beginning of the respective periods.
Remaining Performance Obligations
At September 30, 2024, the future estimated revenue related to unsatisfied performance obligations was $771.6 million, of which $592.4 million is expected to be recognized as revenue over the next twelve months , and the remainder is expected to be recognized over the four years thereafter.
9
Deferred Commissions
The following summarizes the activity of deferred incremental costs of obtaining a contract:
| Three Months Ended September 30, | Nine Months Ended September 30, | ||||||||||||||||||||||
| (in thousands) | 2024 | 2023 | 2024 | 2023 | |||||||||||||||||||
| Beginning balance | $ | $ | $ | $ | |||||||||||||||||||
| Capitalization of contract acquisition costs | |||||||||||||||||||||||
| Amortization of deferred contract acquisition costs | ( | ( | ( | ( | |||||||||||||||||||
| Ending balance | $ | $ | $ | $ | |||||||||||||||||||
3. Cash Equivalents and Short-Term Investments
The following tables summarize the amortized cost, unrealized gain and loss and estimated fair value of cash equivalents and short-term investments:
| September 30, 2024 | |||||||||||||||||||||||
| (in thousands) | Amortized Cost | Unrealized Gain | Unrealized Loss | Estimated Fair Value | |||||||||||||||||||
| Cash equivalents | |||||||||||||||||||||||
| Money market funds | $ | $ | — | $ | — | $ | |||||||||||||||||
| U.S. Treasury and agency obligations | — | — | |||||||||||||||||||||
| Total cash equivalents | $ | $ | — | $ | — | $ | |||||||||||||||||
| Short-term investments | |||||||||||||||||||||||
| Commercial paper | $ | $ | $ | $ | |||||||||||||||||||
| Corporate bonds | |||||||||||||||||||||||
| Asset backed securities | ( | ||||||||||||||||||||||
| Yankee bonds | ( | ||||||||||||||||||||||
| U.S. Treasury and agency obligations | |||||||||||||||||||||||
| Total short-term investments | $ | $ | $ | ( | $ | ||||||||||||||||||
| December 31, 2023 | |||||||||||||||||||||||
| (in thousands) | Amortized Cost | Unrealized Gain | Unrealized Loss | Estimated Fair Value | |||||||||||||||||||
| Cash equivalents | |||||||||||||||||||||||
| Money market funds | $ | $ | — | $ | — | $ | |||||||||||||||||
| Total cash equivalents | $ | $ | — | $ | — | $ | |||||||||||||||||
| Short-term investments | |||||||||||||||||||||||
| Commercial paper | $ | $ | $ | ( | $ | ||||||||||||||||||
| Corporate bonds | ( | ||||||||||||||||||||||
| Asset backed securities | ( | ||||||||||||||||||||||
| Yankee bonds | ( | ||||||||||||||||||||||
| U.S. Treasury and agency obligations | ( | ||||||||||||||||||||||
| Total short-term investments | $ | $ | $ | ( | $ | ||||||||||||||||||
10
We considered the extent to which any unrealized losses on our short-term investments were driven by credit risk and other factors, including market risk, and if it is more-likely-than-not that we would have to sell the security before the recovery of the amortized cost basis. At September 30, 2024 and December 31, 2023, our unrealized losses were due to rising market interest rates compared to when the investments were initiated. We do not believe any unrealized losses represent credit losses, and it is unlikely we would sell the investments before we would recover their amortized cost basis.
The contractual maturities of our short-term investments are as follows:
| September 30, 2024 | December 31, 2023 | ||||||||||||||||||||||
| (in thousands) | Amortized Cost | Estimated Fair Value | Amortized Cost | Estimated Fair Value | |||||||||||||||||||
| Due within one year | $ | $ | $ | $ | |||||||||||||||||||
| Due between one and two years | |||||||||||||||||||||||
| Total short-term investments | $ | $ | $ | $ | |||||||||||||||||||
At September 30, 2024 and December 31, 2023, cash and cash equivalents included $5.9 million and $5.8 million, respectively, of restricted cash primarily related to collateral for our outstanding letters of credit.
4. Fair Value Measurements
We measure certain financial instruments at fair value using a fair value hierarchy. In the hierarchy, assets are classified based on the lowest level inputs used in valuation into the following categories:
•Level 1 — Quoted prices in active markets for identical assets and liabilities;
•Level 2 — Observable inputs including quoted market prices for similar assets and liabilities in active markets, quoted prices for identical assets and liabilities in inactive markets, or inputs that are corroborated by observable market data; and
•Level 3 — Unobservable inputs.
The following tables summarize assets that are measured at fair value on a recurring basis:
| September 30, 2024 | |||||||||||||||||||||||
| (in thousands) | Level 1 | Level 2 | Level 3 | Total | |||||||||||||||||||
| Cash equivalents | |||||||||||||||||||||||
| Money market funds | $ | $ | $ | $ | |||||||||||||||||||
| U.S. Treasury and agency obligations | |||||||||||||||||||||||
| Total cash equivalents | $ | $ | $ | $ | |||||||||||||||||||
| Short-term investments | |||||||||||||||||||||||
| Commercial paper | $ | $ | $ | $ | |||||||||||||||||||
| Corporate bonds | |||||||||||||||||||||||
| Asset backed securities | |||||||||||||||||||||||
| Yankee bonds | |||||||||||||||||||||||
| U.S. Treasury and agency obligations | |||||||||||||||||||||||
| Total short-term investments | $ | $ | $ | $ | |||||||||||||||||||
11
| December 31, 2023 | |||||||||||||||||||||||
| (in thousands) | Level 1 | Level 2 | Level 3 | Total | |||||||||||||||||||
| Cash equivalents | |||||||||||||||||||||||
| Money market funds | $ | $ | $ | $ | |||||||||||||||||||
| Total cash equivalents | $ | $ | $ | $ | |||||||||||||||||||
| Short-term investments | |||||||||||||||||||||||
| Commercial paper | $ | $ | $ | $ | |||||||||||||||||||
| Corporate bonds | |||||||||||||||||||||||
| Asset backed securities | |||||||||||||||||||||||
| Yankee bonds | |||||||||||||||||||||||
| U.S. Treasury and agency obligations | |||||||||||||||||||||||
| Total short-term investments | $ | $ | $ | $ | |||||||||||||||||||
Other Investments
Our investments in privately held securities, which are included in other assets on our consolidated balance sheets and classified as level 3, were as follows:
| (in thousands) | September 30, 2024 | December 31, 2023 | |||||||||
| Equity securities | $ | $ | |||||||||
| Debt and other securities | |||||||||||
| Total other investments | $ | $ | |||||||||
In May 2024, we recognized a $1.5 million gain on the conversion of our simple agreement for future equity ("SAFE") investment to an investment in preferred stock.
We did not have any liabilities measured and recorded at fair value on a recurring basis at September 30, 2024 and December 31, 2023.
5. Property and Equipment, Net
Property and equipment, net consisted of the following:
(in thousands) | September 30, 2024 | December 31, 2023 | |||||||||
Computer software and equipment | $ | $ | |||||||||
| Internally developed software | |||||||||||
Furniture and fixtures | |||||||||||
Leasehold improvements | |||||||||||
Total | |||||||||||
Less: accumulated depreciation and amortization | ( | ( | |||||||||
Property and equipment, net | $ | $ | |||||||||
Depreciation and amortization related to property and equipment was $3.6 million, $3.2 million, $10.0 million and $9.7 million in the three months ended September 30, 2024 and 2023 and the nine months ended September 30, 2024 and 2023, respectively.
12
In the nine months ended September 30, 2024, we recorded a $4.5 million impairment for furniture and fixtures and leasehold improvements. See Note 7 for additional information.
6. Acquisitions, Goodwill and Intangible Assets
Business Combinations
In June 2024, we acquired Eureka Security, Inc. ("Eureka"), a provider of data security posture management ("DSPM") for cloud environments. Adding Eureka's DSPM capabilities to our solutions provides customers a view into their organization's cloud data security footprint, fight policy drift and misconfigurations that put data at risk, and enables customers to continuously improve their security posture over time. We acquired 100 % of Eureka's equity through a share purchase agreement for total cash consideration of $29.2 million, net of $0.4 million cash acquired.
Cash consideration, net of cash acquired, was preliminarily allocated as follows:
(in thousands) | Eureka | ||||
| Intangible assets | $ | ||||
| Goodwill | |||||
| Other current liabilities, net | ( | ||||
Total purchase price | $ | ||||
We allocated $6.9 million to Eureka's proprietary technology with an estimated useful life of 5 years.
We are still finalizing the allocation of the purchase price for Eureka, which may change as additional information becomes available around working capital and income taxes.
The results of operations of Eureka are included in our consolidated statements of operations from the acquisition date and were not material. Pro forma results of operations are not presented as they are not material to the consolidated statement of operations.
In general and administrative expense, we recognized $0.4 million, $4.6 million, $1.3 million and $4.7 million of acquisition-related transaction costs in the three months ended September 30, 2024 and 2023, and the nine months ended September 30, 2024 and 2023, respectively.
Goodwill and Acquired Intangible Assets
The changes in the carrying amount of goodwill are as follows:
| (in thousands) | |||||
| Balance at December 31, 2023 | $ | ||||
| Acquired goodwill | |||||
| Balance at September 30, 2024 | $ | ||||
The excess purchase consideration over the fair value of acquired assets and liabilities is recorded as goodwill. The acquired goodwill reflects the synergies we expect from marketing and selling new capabilities from Eureka to our customers. Acquired goodwill is generally not tax deductible.
13
Acquired intangible assets subject to amortization are as follows:
| September 30, 2024 | December 31, 2023 | ||||||||||||||||||||||||||||||||||
| (in thousands) | Gross Carrying Amount | Accumulated Amortization | Net Carrying Amount | Gross Carrying Amount | Accumulated Amortization | Net Carrying Amount | |||||||||||||||||||||||||||||
| Acquired technology | $ | $ | ( | $ | $ | $ | ( | $ | |||||||||||||||||||||||||||
| Trade name | ( | ( | |||||||||||||||||||||||||||||||||
| $ | $ | ( | $ | $ | $ | ( | $ | ||||||||||||||||||||||||||||
Amortization of acquired intangible assets was $5.0 million, $3.0 million, $14.4 million and $9.2 million in the three months ended September 30, 2024 and 2023, and the nine months ended September 30, 2024 and 2023, respectively. At September 30, 2024, our acquired intangible assets are expected to be amortized over an estimated remaining weighted average period of 5.5 years.
At September 30, 2024, estimated future amortization of acquired intangible assets is as follows:
(in thousands) | |||||
Year ending December 31, | |||||
2024(1) | $ | ||||
| 2025 | |||||
| 2026 | |||||
| 2027 | |||||
| 2028 | |||||
Thereafter | |||||
Total | $ | ||||
_______________
(1) Represents the three months ending December 31, 2024.
7. Leases
We have operating leases for office facilities. The components of lease expense were as follows:
| Three Months Ended September 30, | Nine Months Ended September 30, | ||||||||||||||||||||||
(in thousands) | 2024 | 2023 | 2024 | 2023 | |||||||||||||||||||
Operating lease cost(1) | $ | $ | $ | $ | |||||||||||||||||||
_______________
(1) Excludes sublease income.
Rent expense for short-term leases in the three and nine months ended September 30, 2024 and 2023 was not material.
In June 2024, we executed a sublease for of a portion of our corporate headquarters through February 2032 and recognized $4.5 million of restructuring expense related to the associated impairment of leasehold improvements and furniture and fixtures. Sublease income, which is recorded as a reduction of rent expense, was $0.4
Supplemental information related to leases was as follows:
| September 30, 2024 | December 31, 2023 | ||||||||||
Operating leases | |||||||||||
Weighted average remaining lease term | |||||||||||
Weighted average discount rate | |||||||||||
14
| Three Months Ended September 30, | Nine Months Ended September 30, | ||||||||||||||||||||||
(in thousands) | 2024 | 2023 | 2024 | 2023 | |||||||||||||||||||
| ROU assets obtained in exchange for lease obligations | |||||||||||||||||||||||
Operating leases | $ | $ | $ | $ | |||||||||||||||||||
Maturities of operating lease liabilities at September 30, 2024 were as follows:
(in thousands) | |||||
Year ending December 31, | |||||
2024(1) | $ | ||||
| 2025 | |||||
| 2026 | |||||
| 2027 | |||||
| 2028 | |||||
Thereafter | |||||
Total lease payments | |||||
Less: Imputed interest | ( | ||||
Total | $ | ||||
_______________
(1) Represents the three months ending December 31, 2024.
Operating lease payments in the table above do not include $0.9 million, $1.7 million, $1.8 million, $1.9 million and $6.4 million of sublease payments we expect to receive in 2025, 2026, 2027, 2028 and thereafter, respectively.
In October 2024, we entered into a new lease in Tel Aviv, Israel. The new lease term is 7 years and the future lease payments are expected to be $19.4 million.
8. Debt
Credit Agreement
In July 2021, we entered into a credit agreement ("Credit Agreement") which is comprised of:
•a $375.0 million senior secured term loan facility ("Term Loan"); and
•a $50.0 million senior secured revolving credit facility ("Revolving Credit Facility").
The table below summarizes the carrying value of the Term Loan:
| (in thousands) | September 30, 2024 | ||||
| Term loan | $ | ||||
| Less: Unamortized debt discount and issuance costs | ( | ||||
| Term loan, net of issuance costs | |||||
Less: Term loan, net, current (1) | ( | ||||
| Term loan, net of issuance costs (net of current portion) | $ | ||||
(1) Term loan, net current is included in other current liabilities on our consolidated balance sheets.
The Term Loan bears interest at a rate of 2.75 % per annum over the Secured Overnight Financing Rate ("SOFR"), subject to a 0.50 % floor, plus a credit spread adjustment depending on the interest period. The Term Loan is being amortized at 1 % per annum in equal quarterly installments until the final payment of $350.6 million on the July 7, 2028 maturity date.
15
Our Term Loan is recorded at its carrying value. At September 30, 2024, the fair value of our Term Loan was approximately $364.2 million. In the fair value hierarchy, our Term Loan is classified as Level 2 as it is traded in less active markets.
The maturities of the Term Loan at September 30, 2024 were as follows:
(in thousands) | |||||
Year ending December 31, | |||||
2024(1) | $ | ||||
| 2025 | |||||
| 2026 | |||||
| 2027 | |||||
| 2028 | |||||
Total | $ | ||||
_______________
(1) Represents the three months ending December 31, 2024.
We may be subject to mandatory Term Loan prepayments related to the excess cash flow provisions. These prepayments would only be required if our first lien net leverage ratio (as defined in our Credit Agreement) exceeds 3.5 at the end of each year. At September 30, 2024, our first lien net leverage ratio was 1.00 .
At September 30, 2024, we had $0.2 million of standby letters of credit outstanding under our Revolving Credit Facility related to one of our operating leases. At September 30, 2024, we were in compliance with the covenants under the Credit Agreement.
9. Commitments and Contingencies
Commitments
In December 2023, we entered into a contract with Microsoft for cloud services from February 2024 through January 2027. Under the terms of the contract we committed to spend €28.5 million. If we do not meet our commitment by the end of the term, we will be required to pay the difference. As of September 30, 2024, we have spent €5.1 million of our commitment.
In July 2024, we entered into a new contract with Amazon Web Services, Inc. ("AWS") for cloud services, in which we committed to spend $59.7 million, $77.6 million and $93.0 million in years one, two and three, respectively, for a total commitment of $230.3 million from August 2024 to July 2027. As of September 30, 2024, we have spent $10.0 million of our first year commitment.
Letters of Credit
At September 30, 2024, we had $5.7 million of standby letters of credit related to our grant agreements with the State of Maryland and our operating leases.
16
10. Stock-Based Compensation
Stock-based compensation expense included in the consolidated statements of operations was as follows:
| Three Months Ended September 30, | Nine Months Ended September 30, | ||||||||||||||||||||||
| (in thousands) | 2024 | 2023 | 2024 | 2023 | |||||||||||||||||||
| Cost of revenue | $ | $ | $ | $ | |||||||||||||||||||
| Sales and marketing | |||||||||||||||||||||||
| Research and development | |||||||||||||||||||||||
| General and administrative | |||||||||||||||||||||||
| Total stock-based compensation expense | $ | $ | $ | $ | |||||||||||||||||||
A summary of the unrecognized stock-based compensation expense related to unvested stock at September 30, 2024 is presented below:
| Unrecognized Stock-Based Compensation Expense (in thousands) | Estimated Weighted Average Period (in years) | ||||||||||
| Restricted stock units ("RSUs") | $ | ||||||||||
| Performance stock units ("PSUs") | |||||||||||
| Restricted stock | |||||||||||
| 2018 Employee Stock Purchase Plan ("2018 ESPP") | |||||||||||
Restricted Stock, RSUs and PSUs
A summary of our restricted stock, RSU and PSU activity is presented below:
| Restricted Stock | RSUs | PSUs | |||||||||||||||||||||||||||||||||
(in thousands, except for per share data) | Number of Shares | Weighted Average Grant Date Fair Value | Number of Shares | Weighted Average Grant Date Fair Value | Number of Shares | Weighted Average Grant Date Fair Value | |||||||||||||||||||||||||||||
| Unvested balance at December 31, 2023 | $ | $ | $ | ||||||||||||||||||||||||||||||||
Granted | |||||||||||||||||||||||||||||||||||
Performance adjustment(1) | ( | ||||||||||||||||||||||||||||||||||
Vested | ( | ( | ( | ||||||||||||||||||||||||||||||||
Forfeited | ( | ( | |||||||||||||||||||||||||||||||||
| Unvested balance at September 30, 2024 | |||||||||||||||||||||||||||||||||||
_______________
(1) Represents adjustments due to the achievement of predefined financial performance targets.
In January 2024, under the evergreen provision in our 2018 Equity Incentive Plan we reserved an additional 5.9 million shares of our common stock. At September 30, 2024, there were 26.0 million shares available for grant under the plan.
17
Stock Options
A summary of our stock option activity is presented below:
(in thousands, except for exercise prices and years) | Number of Shares | Weighted Average Exercise Price | Weighted-Average Remaining Contractual Term (in years) | Aggregate Intrinsic Value | |||||||||||||||||||
| Outstanding at December 31, 2023 | $ | $ | |||||||||||||||||||||
Exercised | ( | ||||||||||||||||||||||
Forfeited/canceled | — | ||||||||||||||||||||||
| Outstanding and exercisable at September 30, 2024 | |||||||||||||||||||||||
2018 Employee Stock Purchase Plan
In the nine months ended September 30, 2024, employees purchased 498,890 shares of our common stock at a weighted average price of $32.60 per share, resulting in $16.3 million of cash proceeds. At September 30, 2024, there was $1.6 million of employee contributions to the 2018 ESPP included in accrued compensation.
The fair value of the 2018 ESPP purchase rights was estimated on the offering or modification dates using a Black-Scholes option-pricing model and the following assumptions:
| Nine Months Ended September 30, | |||||||||||
| 2024 | 2023 | ||||||||||
| Expected term (in years) | |||||||||||
| Expected volatility | |||||||||||
| Risk-free interest rate | |||||||||||
| Expected dividend yield | |||||||||||
Under the evergreen provision in our 2018 ESPP, in January 2024 we reserved an additional 1.8 million shares of our common stock. At September 30, 2024, there were 10.0 million shares reserved for issuance under our 2018 ESPP.
11. Income Taxes
In the nine months ended September 30, 2024, the provision for income taxes included $5.6 million of income taxes in foreign jurisdictions in which we conduct business, $2.6 million of discrete items primarily related to withholding taxes on sales to customers and $2.5 million of Base Erosion and Anti-Abuse Tax.
In the nine months ended September 30, 2023, the provision for income taxes included $4.3 million of income taxes in foreign jurisdictions in which we conduct business and $2.8 million of discrete items primarily related to withholding taxes on sales to customers, partially offset by $0.2 million of deferred tax benefits related to the acquisition of Alsid SAS.
18
12. Net Loss Per Share
The following table sets forth the computation of basic and diluted net loss per share:
| Three Months Ended September 30, | Nine Months Ended September 30, | ||||||||||||||||||||||
| (in thousands, except per share data) | 2024 | 2023 | 2024 | 2023 | |||||||||||||||||||
| Net loss | $ | ( | $ | ( | $ | ( | $ | ( | |||||||||||||||
| Weighted-average shares used to compute net loss per share, basic and diluted | |||||||||||||||||||||||
| Net loss per share, basic and diluted | $ | ( | $ | ( | $ | ( | $ | ( | |||||||||||||||
The following potentially dilutive securities have been excluded from the diluted per share calculations because they would have been antidilutive:
| September 30, | |||||||||||
| (in thousands) | 2024 | 2023 | |||||||||
| RSUs | |||||||||||
| Stock options | |||||||||||
| Shares to be issued under the 2018 ESPP | |||||||||||
| PSUs | |||||||||||
| Restricted stock | |||||||||||
| Total | |||||||||||
13. Geographic Information
We operate as one operating segment. Our Chief Executive Officer, who is our CODM, reviews financial information on a consolidated basis for purposes of making operating decisions, allocating resources and evaluating financial performance.
Revenue by region, based on the address of the end user as specified in our subscription, license or service agreements, was as follows:
| Three Months Ended September 30, | Nine Months Ended September 30, | ||||||||||||||||||||||
| (in thousands) | 2024 | 2023 | 2024 | 2023 | |||||||||||||||||||
| The Americas | $ | $ | $ | $ | |||||||||||||||||||
| Europe, Middle East and Africa | |||||||||||||||||||||||
| Asia Pacific | |||||||||||||||||||||||
| Revenue | $ | $ | $ | $ | |||||||||||||||||||
Customers located in the United States accounted for 54 55
19
Our property and equipment, net by geographic area is summarized as follows:
| (in thousands) | September 30, 2024 | December 31, 2023 | |||||||||
| United States | $ | $ | |||||||||
| International | |||||||||||
| Property and equipment, net | $ | $ | |||||||||
20
Item 2. Management's Discussion and Analysis of Financial Condition and Results of Operations
The following discussion and analysis of our financial condition and results of operations should be read in conjunction with (1) our consolidated financial statements and related notes included elsewhere in this Quarterly Report on Form 10-Q, or this Form 10-Q, and (2) our consolidated financial statements, related notes and management's discussion and analysis of financial condition and results of operations in our Annual Report on Form 10-K for the year ended December 31, 2023, or the 10-K, filed with the Securities and Exchange Commission on February 28, 2024. This Form 10-Q contains forward-looking statements within the meaning of Section 27A of the Securities Act of 1933, as amended, or the Securities Act, and Section 21E of the Securities Exchange Act of 1934, as amended, or the Exchange Act. These statements are often identified by the use of words such as “anticipate,” “believe,” “continue,” “could,” “estimate,” “expect,” “intend,” “may,” “plan,” “project,” “will,” “would” or the negative or plural of these words or similar expressions or variations. Such forward-looking statements are subject to a number of risks, uncertainties, assumptions and other factors that could cause actual results and the timing of certain events to differ materially from future results expressed or implied by the forward-looking statements. Factors that could cause or contribute to such differences include, but are not limited to, those identified herein, and those discussed in the section titled “Risk Factors,” set forth in Part I, Item IA of the 10-K, in Part II, Item 1A of this Form 10-Q and in our other filings with the SEC. You should not rely upon forward-looking statements as predictions of future events. Furthermore, such forward-looking statements speak only as of the date of this report. Except as required by law, we undertake no obligation to update any forward-looking statements to reflect events or circumstances after the date of such statements.
Overview
We are a leading provider of exposure management solutions. Exposure management is an effective discipline for measuring, comparing and reducing cybersecurity risk in today's complex IT environments.
Our Tenable One Exposure Management Platform, or Tenable One, unifies a variety of data sources into a single exposure view to help organizations gain visibility, prioritize efforts and communicate cyber risks. Building on our existing products, Tenable One is designed to take advantage of the integrations that already exist with our partners and form the foundation of an exposure management program, alongside the other tools, such as endpoint detection and response and firewalls, and required business processes.
With Tenable One, organizations can translate technical data about assets, vulnerabilities and threats into clear business insights and actionable intelligence for security executives and practitioners. The platform combines broad, industry-leading vulnerability coverage, spanning IT assets, cloud resources, containers, web apps and identity systems. Tenable One builds on the speed and breadth of vulnerability coverage from Tenable Research and adds aggregated exposure view analytics, guidance on mitigating attack pathways and a centralized asset inventory.
Tenable One incorporates Tenable Vulnerability Management, Tenable Web App Scanning, Tenable Lumin, Tenable Cloud Security, Tenable Identity Exposure, Tenable Attack Surface Management, Tenable Security Center and Tenable OT Security. All of these products are also offered as standalone solutions, alongside Nessus.
Our platform offerings are primarily sold on a subscription basis with a one-year term. Our subscription terms are generally not longer than three years. These offerings are typically prepaid in advance. To a lesser extent, we recognize revenue ratably for perpetual licenses and the related ongoing maintenance.
We sell and market our products and services through our field sales force that works closely with our channel network of distributors, resellers and managed security service providers (MSSPs), in developing sales opportunities. We typically use a two-tiered channel model whereby we sell our enterprise platform offerings to our distributors, who in turn sell to our resellers, who then sell to end users, who we call customers.
21
Financial Highlights
Below are our key financial results:
| Three Months Ended September 30, | Nine Months Ended September 30, | ||||||||||||||||||||||
| (in thousands, except per share data) | 2024 | 2023 | 2024 | 2023 | |||||||||||||||||||
| Revenue | $ | 227,088 | $ | 201,529 | $ | 664,290 | $ | 585,404 | |||||||||||||||
| Loss from operations | (2,083) | (7,913) | (19,831) | (37,814) | |||||||||||||||||||
| Net loss | (9,211) | (15,565) | (38,169) | (56,636) | |||||||||||||||||||
Net loss per share, basic and diluted | (0.08) | (0.13) | (0.32) | (0.49) | |||||||||||||||||||
| Net cash provided by operating activities | 54,607 | 42,411 | 136,357 | 111,350 | |||||||||||||||||||
| Purchases of property and equipment | (733) | (201) | (1,924) | (1,299) | |||||||||||||||||||
| Capitalized software development costs | (1,163) | (1,894) | (5,930) | (4,707) | |||||||||||||||||||
Recurring revenue, which includes revenue from subscription arrangements for software (both recognized ratably over the subscription term and upon delivery) and cloud-based solutions and maintenance associated with perpetual licenses, represented 96% of revenue in the three and nine months ended September 30, 2024 and 95% of revenue in the three and nine months ended September 30, 2023.
Key Operating and Financial Metrics
To supplement our consolidated financial statements, which are prepared and presented in accordance with GAAP, we use and monitor the following operating and financial metrics, which include non-GAAP financial measures, to understand and evaluate our core operating and financial performance.
Calculated Current Billings
We use the non-GAAP measure of calculated current billings, which we believe is a key metric to measure our periodic performance. Given that most of our customers pay in advance, we typically recognize a majority of the related revenue ratably over time. We use calculated current billings to measure and monitor our ability to provide our business with the working capital generated by upfront payments from our customers.
Calculated current billings consists of revenue recognized in a period plus the change in current deferred revenue in the corresponding period. We believe that calculated current billings, which excludes deferred revenue for periods beyond twelve months in a customer’s contractual term, more closely correlates with annual contract value. Variability in total billings, depending on the timing of large multi-year contracts and the preference for annual billing versus multi-year upfront billing, may distort growth in one period over another.
Calculated current billings may vary from period-to-period for a number of reasons, and therefore has a number of limitations as a quarter-to-quarter or year-over-year comparative measure. Calculated current billings in any one period may be impacted by the timing and amount of new sales transactions, the timing and amount of renewal transactions, including early renewals, the mix of the amount of subscriptions and perpetual licenses, and the timing of billing professional services, as well as the timing and amount of multi-year prepaid contracts, all of which could favorably or unfavorably impact quarter-to-quarter and year-over-year comparisons. For example, an increasing number of large sales transactions, for which the timing has and will continue to vary, may occur in quarters subsequent to or in advance of those that we anticipate. Additionally, our calculation of calculated current billings may be different from other companies that report similar financial measures. Because of these and other limitations, you should consider calculated current billings along with revenue and our other GAAP financial results.
22
The following table presents a reconciliation of revenue, the most directly comparable financial measure calculated in accordance with GAAP, to calculated current billings:
| Three Months Ended September 30, | Nine Months Ended September 30, | ||||||||||||||||||||||
| (in thousands) | 2024 | 2023 | 2024 | 2023 | |||||||||||||||||||
| Revenue | $ | 227,088 | $ | 201,529 | $ | 664,290 | $ | 585,404 | |||||||||||||||
| Deferred revenue (current), end of period | 583,940 | 518,372 | 583,940 | 518,372 | |||||||||||||||||||
Deferred revenue (current), beginning of period(1) | (562,587) | (495,199) | (580,887) | (502,115) | |||||||||||||||||||
| Calculated current billings | $ | 248,441 | $ | 224,702 | $ | 667,343 | $ | 601,661 | |||||||||||||||
_______________
(1) Deferred revenue (current), beginning of period for the nine months ended September 30, 2024 includes $0.1 million related to acquired deferred revenue.
Free Cash Flow
We use the non-GAAP measure of free cash flow, which we define as GAAP net cash flows from operating activities reduced by purchases of property and equipment and capitalized software development costs. We believe free cash flow is an important liquidity measure of the cash (if any) that is available, after purchases of property and equipment and capitalized software development costs, for investment in our business and to make acquisitions. We believe that free cash flow is useful as a liquidity measure because it measures our ability to generate cash.
Our use of free cash flow has limitations as an analytical tool and you should not consider it in isolation or as a substitute for an analysis of our results under GAAP. First, free cash flow is not a substitute for net cash flows from operating activities. Second, other companies may calculate free cash flow or similarly titled non-GAAP financial measures differently or may use other measures to evaluate their performance, all of which could reduce the usefulness of free cash flow as a tool for comparison. Additionally, the utility of free cash flow is further limited as it does not reflect our future contractual commitments and does not represent the total increase or decrease in our cash balance for a given period. Because of these and other limitations, you should consider free cash flow along with net cash provided by operating activities and our other GAAP financial measures.
The following table presents a reconciliation of net cash provided by operating activities, the most directly comparable financial measure calculated in accordance with GAAP, to free cash flow:
| Three Months Ended September 30, | Nine Months Ended September 30, | ||||||||||||||||||||||
| (in thousands) | 2024 | 2023 | 2024 | 2023 | |||||||||||||||||||
| Net cash provided by operating activities | $ | 54,607 | $ | 42,411 | $ | 136,357 | $ | 111,350 | |||||||||||||||
| Purchases of property and equipment | (733) | (201) | (1,924) | (1,299) | |||||||||||||||||||
| Capitalized software development costs | (1,163) | (1,894) | (5,930) | (4,707) | |||||||||||||||||||
Free cash flow(1) | $ | 52,711 | $ | 40,316 | $ | 128,503 | $ | 105,344 | |||||||||||||||
_______________
(1) Free cash flow for the periods presented was impacted by:
| Three Months Ended September 30, | Nine Months Ended September 30, | ||||||||||||||||||||||
| (in thousands) | 2024 | 2023 | 2024 | 2023 | |||||||||||||||||||
| Cash paid for interest and other financing costs | $ | (8,055) | $ | (7,843) | $ | (23,505) | $ | (26,786) | |||||||||||||||
| Employee stock purchase plan activity | (3,653) | (2,236) | (6,283) | (2,507) | |||||||||||||||||||
| Acquisition-related expenses | (663) | (571) | (1,326) | (830) | |||||||||||||||||||
| Restructuring | (492) | — | (5,911) | — | |||||||||||||||||||
23
Customer Metrics
We believe that our customer base provides a significant opportunity to expand sales of our enterprise platform offerings. We define an enterprise platform customer as a customer that has licensed Tenable One, Tenable Vulnerability Management, Tenable Cloud Security, Tenable Identity Exposure, Tenable OT Security or Tenable Security Center for an annual amount of $5,000 or greater. New enterprise platform customers represent new customer logos during the periods presented and do not include customer conversions from Tenable Nessus Expert to enterprise platforms. The following tables summarize key components of our customer base:
| Three Months Ended September 30, | |||||||||||||||||
| 2024 | 2023 | Change (%) | |||||||||||||||
| Number of new enterprise platform customers added in period | 386 | 386 | —% | ||||||||||||||
| September 30, | |||||||||||||||||
| 2024 | 2023 | Change (%) | |||||||||||||||
Number of customers with $100,000 and greater in annual contract value at end of period | 1,853 | 1,565 | 18% | ||||||||||||||
Dollar-Based Net Expansion Rate
Our dollar-based net expansion rate reflects both our customer retention and ability to drive additional sales to our existing customers. Our dollar-based net expansion rate has historically fluctuated and is expected to continue to fluctuate on a quarterly basis as a result of a number of factors, including existing customers' satisfaction with our solutions, existing customer retention, the pricing of our solutions, the availability of competing solutions and the pricing thereof, and the timing of customer renewals. In addition, our sales pipeline opportunities vary from quarter to quarter between new customers and expansion from existing customers, and we do not prioritize one over the other to maximize the dollar-based net expansion rate.
Our dollar-based net expansion rate is evaluated on a last twelve months, or LTM, basis, and is calculated as follows:
•Denominator: To calculate our dollar-based net expansion rate as of the end of a reporting period, we first determine the annual recurring revenue, or ARR, from all active subscriptions (both revenue recognized ratably over the subscription term and upon delivery) and maintenance from perpetual licenses as of the last day of the same reporting period in the prior year. This represents recurring payments that we expect to receive in the next 12-month period from the cohort of customers that existed on the last day of the same reporting period in the prior year.
•Numerator: We measure the ARR for that same cohort of customers representing all subscriptions and maintenance from perpetual licenses based on customer orders as of the end of the reporting period.
We calculate dollar-based net expansion rate by dividing the numerator by the denominator.
The following table presents our dollar-based net expansion rate:
| September 30, | |||||||||||
| 2024 | 2023 | ||||||||||
| Dollar-based net expansion rate | 108 | % | 111 | % | |||||||
Non-GAAP Income from Operations and Non-GAAP Operating Margin
We use non-GAAP income from operations along with non-GAAP operating margin as key indicators of our financial performance. We define these non-GAAP financial measures as their respective GAAP measures, excluding the effects of stock-based compensation, acquisition-related expenses, restructuring expenses, costs related to the intra-entity asset transfers resulting from the internal restructuring of legal entities and amortization of acquired intangible assets. Acquisition-related expenses include transaction and integration expenses, as well as costs related to the intercompany
24
transfer of acquired intellectual property. Restructuring expenses include non-ordinary course severance, employee related benefits and other charges.
We believe that these non-GAAP financial measures provide useful information about our core operating results over multiple periods. There are a number of limitations related to the use of the non-GAAP financial measures as compared to GAAP loss from operations and operating margin, including that non-GAAP income from operations and non-GAAP operating margin exclude stock-based compensation expense, which has been, and will continue to be, a significant recurring expense in our business and an important part of our compensation strategy.
The following table presents a reconciliation of loss from operations, the most directly comparable financial measure calculated in accordance with GAAP, to non-GAAP income from operations, and operating margin, the most directly comparable financial measure calculated in accordance with GAAP, to non-GAAP operating margin:
| Three Months Ended September 30, | Nine Months Ended September 30, | ||||||||||||||||||||||
| (dollars in thousands) | 2024 | 2023 | 2024 | 2023 | |||||||||||||||||||
| Loss from operations | $ | (2,083) | $ | (7,913) | $ | (19,831) | $ | (37,814) | |||||||||||||||
| Stock-based compensation | 41,684 | 36,835 | 122,801 | 108,812 | |||||||||||||||||||
| Acquisition-related expenses | 360 | 4,598 | 1,284 | 4,728 | |||||||||||||||||||
| Restructuring | — | — | 6,070 | — | |||||||||||||||||||
| Amortization of acquired intangible assets | 5,014 | 3,055 | 14,443 | 9,208 | |||||||||||||||||||
| Non-GAAP income from operations | $ | 44,975 | $ | 36,575 | $ | 124,767 | $ | 84,934 | |||||||||||||||
| Operating margin | (1) | % | (4) | % | (3) | % | (6) | % | |||||||||||||||
| Non-GAAP operating margin | 20 | % | 18 | % | 19 | % | 15 | % | |||||||||||||||
Non-GAAP Net Income and Non-GAAP Earnings Per Share
We use non-GAAP net income, which excludes stock-based compensation, acquisition-related expenses, restructuring expenses and amortization of acquired intangible assets, as well as the related tax impacts, and the tax impact and related costs of intra-entity asset transfers resulting from the internal restructuring of legal entities as well as deferred income tax benefits recognized in connection with acquisitions, to calculate non-GAAP earnings per share. We believe that these non-GAAP measures provide important information because they facilitate comparisons of our core operating results over multiple periods.
25
The following table presents a reconciliation of net loss and net loss per share, the most comparable financial measures calculated in accordance with GAAP, to non-GAAP net income and non-GAAP earnings per share:
| Three Months Ended September 30, | Nine Months Ended September 30, | ||||||||||||||||||||||
| (in thousands, except for per share amounts) | 2024 | 2023 | 2024 | 2023 | |||||||||||||||||||
| Net loss | $ | (9,211) | $ | (15,565) | $ | (38,169) | $ | (56,636) | |||||||||||||||
| Stock-based compensation | 41,684 | 36,835 | 122,801 | 108,812 | |||||||||||||||||||
Tax impact of stock-based compensation(1) | 1,528 | (1,207) | 1,626 | 1,046 | |||||||||||||||||||
Acquisition-related expenses(2) | 360 | 4,598 | 1,284 | 4,728 | |||||||||||||||||||
Restructuring(2) | — | — | 6,070 | — | |||||||||||||||||||
Amortization of acquired intangible assets(3) | 5,014 | 3,055 | 14,443 | 9,208 | |||||||||||||||||||
| Tax impact of acquisitions | (52) | (48) | (130) | (161) | |||||||||||||||||||
| Non-GAAP net income | $ | 39,323 | $ | 27,668 | $ | 107,925 | $ | 66,997 | |||||||||||||||
| Net loss per share, diluted | $ | (0.08) | $ | (0.13) | $ | (0.32) | $ | (0.49) | |||||||||||||||
| Stock-based compensation | 0.35 | 0.32 | 1.04 | 0.94 | |||||||||||||||||||
Tax impact of stock-based compensation(1) | 0.01 | (0.01) | 0.01 | 0.01 | |||||||||||||||||||
Acquisition-related expenses(2) | 0.01 | 0.04 | 0.01 | 0.04 | |||||||||||||||||||
Restructuring(2) | — | — | 0.05 | — | |||||||||||||||||||
Amortization of acquired intangible assets(3) | 0.04 | 0.02 | 0.12 | 0.08 | |||||||||||||||||||
| Tax impact of acquisitions | — | — | — | — | |||||||||||||||||||
Adjustment to diluted earnings per share(4) | (0.01) | (0.01) | (0.03) | (0.02) | |||||||||||||||||||
| Non-GAAP earnings per share, diluted | $ | 0.32 | $ | 0.23 | $ | 0.88 | $ | 0.56 | |||||||||||||||
| Weighted-average shares used to compute GAAP net loss per share, diluted | 119,169 | 115,954 | 118,466 | 114,967 | |||||||||||||||||||
| Weighted-average shares used to compute non-GAAP earnings per share, diluted | 123,288 | 121,473 | 123,206 | 120,273 | |||||||||||||||||||
________________
(1) The tax impact of stock-based compensation is based on the tax treatment for the applicable tax jurisdictions.
(2) The tax impact of acquisition-related expenses and restructuring are not material.
(3) The tax impact of the amortization of acquired intangible assets is included in the tax impact of acquisitions.
(4) An adjustment to reconcile GAAP net loss per share, which excludes potentially dilutive shares, to non-GAAP earnings per share, which includes potentially dilutive shares.
Components of Our Results of Operations
Revenue
We generate revenue from subscription arrangements for our software and cloud-based solutions, perpetual licenses, maintenance associated with perpetual licenses and professional services. We begin to recognize revenue when control of our software or services is transferred to the customer, which for sales made through our channel network is typically concurrent with the transfer to the end user.
Our subscription arrangements generally have annual or multi-year contractual terms to use our software or cloud-based solutions, including ongoing software updates during the contractual period. For software subscriptions that are dependent on ongoing software updates and the ability to identify the latest cybersecurity vulnerabilities, revenue is recognized ratably over the subscription term given the critical utility provided by the ongoing updates that are released through the contract period. When the critical utility of our software does not depend on ongoing updates, we recognize
26
revenue attributable to the license at the time of delivery and the revenue attributable to the maintenance and support ratably over the contract period.
Our perpetual licenses are generally sold with one or more years of maintenance, which includes ongoing software updates. Given the critical utility provided by the ongoing software updates and updated ability to identify network vulnerabilities included in maintenance, we combine the perpetual license and the maintenance into a single performance obligation. Perpetual license arrangements generally contain a material right related to the customer’s ability to renew maintenance at a price that is less than the initial license fee. We apply a practical alternative to allocating a portion of the transaction price to the material right performance obligation and estimate a hypothetical transaction price which includes fees for expected maintenance renewals based on the estimated economic life of perpetual license contracts. We allocate the transaction price between the cybersecurity subscription provided in the initial contract and the material right related to expected contract renewals based on the hypothetical transaction price. We recognize the amount allocated to the combined license and maintenance performance obligation over the initial contractual period, which is generally one year. We recognize the amount allocated to the material right over the expected maintenance renewal period, which begins at the end of the initial contractual term and is generally four years. We have estimated the five-year economic life of perpetual license contracts based on historical contract attrition, expected renewal periods, the lifecycle of our technology and other factors. This estimate may change over time.
Professional services and other revenue is primarily comprised of advisory services and training related to the deployment and optimization of our products. These services do not result in significant customization of our products. Professional services and other revenue is recognized as the services are performed.
We have historically experienced, and expect in the future to experience, seasonality in entering into agreements with customers. We typically enter into a significantly higher percentage of agreements with new customers, as well as renewal agreements with existing customers, in the third and fourth quarters of the year. The increase in customer agreements in the third quarter is primarily attributable to U.S. government and related agencies, and the increase in the fourth quarter is primarily attributable to large enterprise account buying patterns typical in the software industry. The ratable nature of our subscription revenue makes this seasonality less apparent in our overall financial results. We expect longer purchasing and approval phases of our sales cycle to continue throughout 2024.
Cost of Revenue, Gross Profit and Gross Margin
Cost of revenue includes personnel costs related to our technical support group that provides assistance to customers, including salaries, benefits, bonuses, payroll taxes, stock-based compensation and any ordinary course severance. Cost of revenue also includes cloud infrastructure costs, the costs related to professional services and training, depreciation, amortization of acquired and developed technology, hardware costs and allocated overhead costs, which consist of information technology, facilities and insurance.
We intend to continue to invest additional resources in our cloud-based platform and customer support team as we grow our business. The level and timing of investment in these areas could affect our cost of revenue in the future.
Gross profit, or revenue less cost of revenue, and gross margin, or gross profit as a percentage of revenue, have been and will continue to be affected by various factors, including the timing of our acquisition of new customers and our renewals of and follow-on sales to existing customers, the costs associated with operating our cloud-based platform, the extent to which we expand our customer support team and the extent to which we can increase the efficiency of our technology and infrastructure through technological improvements.
We expect our gross profit to increase in absolute dollars but our gross margin may fluctuate from period to period depending on the interplay of all of these factors, particularly as it relates to cloud infrastructure costs, as we expect revenue from our cloud-based subscriptions to increase as a percentage of revenue.
Operating Expenses
Our operating expenses consist of sales and marketing, research and development, general and administrative and restructuring expenses. Personnel costs are the most significant component of operating expenses and consist of
27
salaries, benefits, bonuses, payroll taxes, stock-based compensation and ordinary course severance. Operating expenses also include depreciation and amortization as well as allocated overhead costs, including IT and facilities costs.
Sales and Marketing
Sales and marketing expense consists of personnel costs, sales commissions, marketing programs, travel and entertainment, expenses for conferences, meetings and events and allocated overhead costs. We capitalize sales commissions, including related fringe benefit costs, and recognize the expense over an estimated period of benefit, which ranges between three and four years for subscription arrangements and five years for perpetual license arrangements. Sales commissions on contract renewals are capitalized and amortized ratably over the contract term, with the exception of contracts with renewal periods that are one year or less, in which case the incremental costs are expensed as incurred. Sales commissions on professional services arrangements are expensed as incurred as the contractual periods of these arrangements are generally less than one year.
We intend to continue to make investments in our sales and marketing teams to increase revenue, further penetrate the market and expand our global customer base. We expect our sales and marketing expense to increase in absolute dollars annually and to be our largest operating expense category for the foreseeable future. However, as our revenue increases, we expect our sales and marketing expense to decrease as a percentage of our revenue over the long term. Our sales and marketing expense may fluctuate from period to period due to the timing and extent of these expenses, including sales commissions, which may fluctuate depending on the mix of sales and related expense recognition.
Research and Development
Research and development expense consists of personnel costs, software used to develop our products, travel and entertainment, consulting and professional fees for third-party development resources as well as allocated overhead. Our research and development expense supports our efforts to continue to add capabilities to our existing products and enable the continued detection of new network vulnerabilities.
We expect our research and development expense to continue to increase annually in absolute dollars for the foreseeable future as we continue to invest in research and development efforts to enhance the functionality of our cloud-based platform. However, we expect our research and development expense to decrease as a percentage of our revenue over the long term, although our research and development expense may fluctuate from period to period due to the timing and extent of these expenses.
General and Administrative
General and administrative expense consists of personnel costs for our executive, finance, legal, human resources and administrative departments. Additional expenses include travel and entertainment, professional fees, insurance, allocated overhead and acquisition-related expenses.
We expect our general and administrative expense to continue to increase in absolute dollars and decrease as a percentage of our revenue over the long term, although our general and administrative expense may fluctuate from period to period due to the timing and extent of these expenses.
Restructuring
Restructuring expenses consist of non-ordinary course severance, employee related benefits and other charges to reorganize business operations.
Interest Income, Interest Expense and Other Income (Expense), Net
Interest income consists of income earned on cash and cash equivalents and short-term investments. Interest expense consists primarily of interest expense in connection with our Term Loan, unused commitment fees on our Revolving Credit Facility, and letter of credit fees. Other income (expense), net consists primarily of foreign currency
28
remeasurement and transaction gains and losses and any realized and unrealized gains and losses, including impairment losses and gains related to our non-marketable investments.
Provision for Income Taxes
Provision for income taxes consists of income taxes in all foreign jurisdictions in which we conduct business and the related withholding taxes on sales with customers. We have recorded deferred tax assets for which a full valuation allowance has been provided, including net operating loss carryforwards and tax credits. We expect to maintain this full valuation allowance for the foreseeable future as it is more likely than not that some or all of those deferred tax assets may not be realized based on our history of losses.
Results of Operations
The following tables set forth our consolidated results of operations for the periods presented:
| Three Months Ended September 30, | Nine Months Ended September 30, | ||||||||||||||||||||||
| (in thousands) | 2024 | 2023 | 2024 | 2023 | |||||||||||||||||||
| Revenue | $ | 227,088 | $ | 201,529 | $ | 664,290 | $ | 585,404 | |||||||||||||||
Cost of revenue(1) | 50,499 | 45,754 | 148,229 | 134,774 | |||||||||||||||||||
| Gross profit | 176,589 | 155,775 | 516,061 | 450,630 | |||||||||||||||||||
| Operating expenses: | |||||||||||||||||||||||
Sales and marketing(1) | 99,083 | 94,759 | 300,037 | 289,750 | |||||||||||||||||||
Research and development(1) | 48,020 | 37,052 | 136,896 | 113,080 | |||||||||||||||||||
General and administrative(1) | 31,569 | 31,877 | 92,889 | 85,614 | |||||||||||||||||||
| Restructuring | — | — | 6,070 | — | |||||||||||||||||||
| Total operating expenses | 178,672 | 163,688 | 535,892 | 488,444 | |||||||||||||||||||
| Loss from operations | (2,083) | (7,913) | (19,831) | (37,814) | |||||||||||||||||||
| Interest income | 5,989 | 7,662 | 17,587 | 19,323 | |||||||||||||||||||
| Interest expense | (8,148) | (8,119) | (24,333) | (23,208) | |||||||||||||||||||
| Other income (expense), net | 359 | (6,502) | (858) | (7,993) | |||||||||||||||||||
| Loss before income taxes | (3,883) | (14,872) | (27,435) | (49,692) | |||||||||||||||||||
| Provision for income taxes | 5,328 | 693 | 10,734 | 6,944 | |||||||||||||||||||
| Net loss | $ | (9,211) | $ | (15,565) | $ | (38,169) | $ | (56,636) | |||||||||||||||
_______________
(1) Includes stock-based compensation expense as follows:
| Three Months Ended September 30, | Nine Months Ended September 30, | ||||||||||||||||||||||
| (in thousands) | 2024 | 2023 | 2024 | 2023 | |||||||||||||||||||
| Cost of revenue | $ | 3,216 | $ | 3,011 | $ | 9,486 | $ | 8,542 | |||||||||||||||
| Sales and marketing | 15,941 | 15,805 | 47,517 | 46,622 | |||||||||||||||||||
| Research and development | 12,435 | 9,242 | 35,395 | 27,871 | |||||||||||||||||||
| General and administrative | 10,092 | 8,777 | 30,403 | 25,777 | |||||||||||||||||||
| Total stock-based compensation expense | $ | 41,684 | $ | 36,835 | $ | 122,801 | $ | 108,812 | |||||||||||||||
29
Comparison of the Three Months Ended September 30, 2024 and 2023
Revenue
The following table presents the increase in revenue:
| Three Months Ended September 30, | Change | ||||||||||||||||||||||
| (dollars in thousands) | 2024 | 2023 | ($) | (%) | |||||||||||||||||||
| Subscription revenue | $ | 208,554 | $ | 183,268 | $ | 25,286 | 14 | % | |||||||||||||||
| Perpetual license and maintenance revenue | 11,769 | 12,200 | (431) | (4) | % | ||||||||||||||||||
| Professional services and other revenue | 6,765 | 6,061 | 704 | 12 | % | ||||||||||||||||||
| Revenue | $ | 227,088 | $ | 201,529 | $ | 25,559 | 13 | % | |||||||||||||||
The increase in revenue of $25.6 million included $25.5 million from existing customers at October 1, 2023, and an increase from new customers of $0.1 million. U.S. revenue increased $11.2 million, or 10%. International revenue increased $14.4 million, or 16%.
Cost of Revenue, Gross Profit and Gross Margin
| Three Months Ended September 30, | Change | ||||||||||||||||||||||
| (dollars in thousands) | 2024 | 2023 | ($) | (%) | |||||||||||||||||||
| Cost of revenue | $ | 50,499 | $ | 45,754 | $ | 4,745 | 10 | % | |||||||||||||||
| Gross profit | 176,589 | 155,775 | 20,814 | 13 | % | ||||||||||||||||||
| Gross margin | 78 | % | 77 | % | |||||||||||||||||||
The increase in cost of revenue of $4.7 million was primarily due to:
•a $2.0 million increase in amortization of acquired intangibles;
•a $0.9 million increase in third-party cloud infrastructure costs;
•a $0.7 million increase in professional fees;
•a $0.5 million increase in depreciation and amortization expense;
•a $0.3 million increase in subscription costs; and
•a $0.2 million increase in allocated overhead.
Operating Expenses
Sales and Marketing
| Three Months Ended September 30, | Change | ||||||||||||||||||||||
| (dollars in thousands) | 2024 | 2023 | ($) | (%) | |||||||||||||||||||
| Sales and marketing | $ | 99,083 | $ | 94,759 | $ | 4,324 | 5 | % | |||||||||||||||
The increase in sales and marketing expense of $4.3 million was primarily due to:
•a $1.6 million increase in expenses for demand generation programs, including advertising, sponsorships and brand awareness efforts;
•a $1.5 million increase in sales commissions;
•a $1.1 million increase in personnel costs; and
•a $0.6 million increase in allocated overhead; partially offset by
30
•a $0.3 million decrease in selling expenses.
Research and Development
| Three Months Ended September 30, | Change | ||||||||||||||||||||||
| (dollars in thousands) | 2024 | 2023 | ($) | (%) | |||||||||||||||||||
| Research and development | $ | 48,020 | $ | 37,052 | $ | 10,968 | 30 | % | |||||||||||||||
The increase in research and development expense of $11.0 million was primarily due to:
•a $9.3 million increase in personnel costs, largely associated with an increase in headcount and a $3.2 million increase in stock-based compensation;
•a $0.8 million increase in allocated overhead;
•a $0.3 million increase in software subscription costs; and
•a $0.2 million increase in travel and meeting costs.
General and Administrative
| Three Months Ended September 30, | Change | ||||||||||||||||||||||
| (dollars in thousands) | 2024 | 2023 | ($) | (%) | |||||||||||||||||||
| General and administrative | $ | 31,569 | $ | 31,877 | $ | (308) | (1) | % | |||||||||||||||
The decrease in general and administrative expense of $0.3 million was primarily due to:
•a $4.2 million decrease in acquisition-related expenses; and
•a $1.2 million decrease in allocated overhead; partially offset by
•a $2.6 million increase in professional fees; and
•a $2.1 million increase in personnel costs, including a $1.3 million increase in stock-based compensation.
Interest Income, Interest Expense and Other Income (Expense), Net
| Three Months Ended September 30, | Change | ||||||||||||||||||||||
| (dollars in thousands) | 2024 | 2023 | ($) | (%) | |||||||||||||||||||
| Interest income | $ | 5,989 | $ | 7,662 | $ | (1,673) | (22) | % | |||||||||||||||
| Interest expense | (8,148) | (8,119) | (29) | — | % | ||||||||||||||||||
| Other income (expense), net | 359 | (6,502) | 6,861 | (106) | % | ||||||||||||||||||
The $1.7 million decrease in interest income was due to a decrease in short-term investments and lower interest rates in the three months ended September 30, 2024. Interest expense was flat quarter-over-quarter. The $6.9 million increase in other income (expense), net was primarily due to a $5.0 million impairment loss on one of our SAFE investments in the prior year and a $1.8 million increase in gains due to foreign exchange rates.
Provision for Income Taxes
| Three Months Ended September 30, | Change | ||||||||||||||||||||||
| (dollars in thousands) | 2024 | 2023 | ($) | (%) | |||||||||||||||||||
| Provision for income taxes | $ | 5,328 | $ | 693 | $ | 4,635 | 669 | % | |||||||||||||||
31
In the three months ended September 30, 2024, the provision for income taxes included:
•$3.5 million of income taxes in foreign jurisdictions in which we conduct business;
•$1.0 million of discrete items primarily related to withholding taxes on sales to customers; and
•$0.8 million related to Base Erosion and Anti-Abuse Tax.
In the three months ended September 30, 2023, the provision for income taxes included:
•$0.6 million of discrete items primarily related to withholding taxes on sales to customers; and
•$0.1 million of income taxes in foreign jurisdictions in which we conduct business.
Comparison of the Nine Months Ended September 30, 2024 and 2023
Revenue
The following table presents the increase in revenue:
| Nine Months Ended September 30, | Change | ||||||||||||||||||||||
| (dollars in thousands) | 2024 | 2023 | ($) | (%) | |||||||||||||||||||
| Subscription revenue | $ | 608,727 | $ | 531,133 | $ | 77,594 | 15 | % | |||||||||||||||
| Perpetual license and maintenance revenue | 35,941 | 36,535 | (594) | (2) | % | ||||||||||||||||||
| Professional services and other revenue | 19,622 | 17,736 | 1,886 | 11 | % | ||||||||||||||||||
| Revenue | $ | 664,290 | $ | 585,404 | $ | 78,886 | 13 | % | |||||||||||||||
The increase in revenue of $78.9 million included $76.7 million from existing customers at October 1, 2023, and an increase from new customers of $2.2 million. U.S. revenue increased $34.6 million, or 11%. International revenue increased $44.3 million, or 17%.
Cost of Revenue, Gross Profit and Gross Margin
| Nine Months Ended September 30, | Change | ||||||||||||||||||||||
| (dollars in thousands) | 2024 | 2023 | ($) | (%) | |||||||||||||||||||
| Cost of revenue | $ | 148,229 | $ | 134,774 | $ | 13,455 | 10 | % | |||||||||||||||
| Gross profit | 516,061 | 450,630 | 65,431 | 15 | % | ||||||||||||||||||
| Gross margin | 78 | % | 77 | % | |||||||||||||||||||
The increase in cost of revenue of $13.5 million was primarily due to:
•a $5.2 million increase in amortization of intangible assets due to acquired intangible assets;
•a $4.0 million increase in third-party cloud infrastructure costs;
•a $1.9 million increase in professional fees;
•a $0.9 million increase in personnel costs, primarily in stock-based compensation;
•a $0.6 million increase in allocated overhead;
•a $0.4 million increase in subscription costs; and
•a $0.4 million increase in depreciation expense.
32
Operating Expenses
Sales and Marketing
| Nine Months Ended September 30, | Change | ||||||||||||||||||||||
| (dollars in thousands) | 2024 | 2023 | ($) | (%) | |||||||||||||||||||
| Sales and marketing | $ | 300,037 | $ | 289,750 | $ | 10,287 | 4 | % | |||||||||||||||
The increase in sales and marketing expense of $10.3 million was primarily due to:
•a $5.6 million increase in expenses for demand generation programs, including advertising, sponsorships and brand awareness efforts;
•a $3.4 million increase in sales commissions;
•a $2.6 million increase in allocated overhead; and
•a $0.7 million increase in selling expenses; partially offset by
•a $1.8 million decrease in personnel costs, largely associated with a decrease in headcount.
Research and Development
| Nine Months Ended September 30, | Change | ||||||||||||||||||||||
| (dollars in thousands) | 2024 | 2023 | ($) | (%) | |||||||||||||||||||
| Research and development | $ | 136,896 | $ | 113,080 | $ | 23,816 | 21 | % | |||||||||||||||
The increase in research and development expense of $23.8 million was primarily due to:
•a $16.8 million increase in personnel costs, including a $7.5 million increase in stock-based compensation;
•a $2.3 million increase in allocated overhead;
•a $1.7 million increase in third-party cloud infrastructure costs;
•a $0.6 million increase in travel and meeting costs;
•a $0.6 million decrease in tax credits; and
•a $0.6 million increase in software subscription costs.
General and Administrative
| Nine Months Ended September 30, | Change | ||||||||||||||||||||||
| (dollars in thousands) | 2024 | 2023 | ($) | (%) | |||||||||||||||||||
| General and administrative | $ | 92,889 | $ | 85,614 | $ | 7,275 | 8 | % | |||||||||||||||
The increase in general and administrative expense of $7.3 million was primarily due to:
•a $7.7 million increase in personnel costs, including a $4.6 million increase in stock-based compensation;
•a $4.1 million increase in professional fees;
•a $0.8 million increase in software subscription costs; and
•a $0.6 million increase in travel and meeting costs; partially offset by
•a $3.5 million decrease in acquisition-related expenses; and
•a $2.2 million decrease in allocated overhead.
33
Restructuring
| Nine Months Ended September 30, | Change | ||||||||||||||||||||||
| (dollars in thousands) | 2024 | 2023 | ($) | (%) | |||||||||||||||||||
| Restructuring | $ | 6,070 | $ | — | $ | 6,070 | 100 | % | |||||||||||||||
Restructuring includes a $4.5 million non-cash impairment of leasehold improvements and furniture and fixtures that was recorded in connection with the sublease of a portion of our headquarters and $1.6 million in non-ordinary course severance and employee related benefits.
Interest Income, Interest Expense and Other Expense, Net
| Nine Months Ended September 30, | Change | ||||||||||||||||||||||
| (dollars in thousands) | 2024 | 2023 | ($) | (%) | |||||||||||||||||||
| Interest income | $ | 17,587 | $ | 19,323 | $ | (1,736) | (9) | % | |||||||||||||||
| Interest expense | (24,333) | (23,208) | (1,125) | 5 | % | ||||||||||||||||||
| Other expense, net | (858) | (7,993) | 7,135 | (89) | % | ||||||||||||||||||
The $1.7 million decrease in interest income was due to a decrease in short-term investments. Interest expense increased $1.1 million due to an increase in the interest rate on our Term Loan. Other expense, net decreased $7.1 million primarily due to a $5.0 million impairment loss on one of our SAFE investments in the prior year, a $1.5 million gain on conversion of our SAFE investment in the current year and a $0.6 million decrease in foreign exchange losses.
Provision for Income Taxes
| Nine Months Ended September 30, | Change | ||||||||||||||||||||||
| (dollars in thousands) | 2024 | 2023 | ($) | (%) | |||||||||||||||||||
| Provision for income taxes | $ | 10,734 | $ | 6,944 | $ | 3,790 | 55 | % | |||||||||||||||
In the nine months ended September 30, 2024, the provision for income taxes included:
•$5.6 million of income taxes in foreign jurisdictions in which we conduct business;
•$2.6 million of discrete items primarily related to withholding taxes on sales to customers; and
•$2.5 million related to Base Erosion and Anti-Abuse Tax.
In the nine months ended September 30, 2023, the provision for income taxes included:
•$4.3 million income taxes in foreign jurisdictions in which we conduct business; and
•$2.8 million of discrete items primarily related to withholding taxes on sales to customers; partially offset by
•$0.2 million of deferred tax benefits related to our acquisition of Alsid SAS.
Liquidity and Capital Resources
At September 30, 2024, we had $312.2 million of cash and cash equivalents, which consisted of bank deposits, money market funds and U.S. Treasury and agency obligations, and $236.2 million of short-term investments, which consisted of commercial paper, asset backed securities, U.S. Treasury and agency obligations and corporate and Yankee bonds.
Since our inception, we have primarily financed our operations through cash provided by operations, including payments received from customers using our software products and services. Prior to our IPO, we did not raise any primary institutional capital, and the proceeds of our Series A and Series B redeemable convertible preferred stock
34
financings were used to repurchase shares of capital stock from former stockholders. We have generated significant operating losses as reflected by our accumulated deficit of $863.2 million at September 30, 2024.
We typically invoice our customers annually in advance and, to a lesser extent, multi-years in advance. Therefore, a substantial source of our cash is from such prepayments, which are included in deferred revenue on our consolidated balance sheets. Deferred revenue consists primarily of the unearned portion of billed fees for our subscriptions and perpetual licenses, which is subsequently recognized as revenue in accordance with our revenue recognition policy. At September 30, 2024, we had deferred revenue of $747.5 million, of which $583.9 million was recorded as a current liability and is expected to be recognized as revenue in the next 12 months, provided all other revenue recognition criteria are met.
Our principal uses of cash in recent periods have been funding our operations, expansion of our sales and marketing and research and development activities, investments in infrastructure, acquiring complementary businesses and technology, and repurchasing shares of our common stock. In June 2024, we acquired Eureka Security, Inc., or Eureka, for approximately $29 million in cash. We may in the future enter into arrangements to acquire or invest in other complementary businesses, services and technologies, including intellectual property rights.
We expect to continue incurring operating losses in the near term. Even though we generated positive cash flows from operations and free cash flow in the nine months ended September 30, 2024, we may not be able to sustain these cash flows. We believe that our existing cash and cash equivalents and short-term investments will be sufficient to fund our operating and capital needs for at least the next 12 months and for the foreseeable future. Our future capital requirements will depend on many factors, including our revenue growth rate, subscription renewal activity, the timing and extent of spending to support further infrastructure and research and development efforts, the timing and extent of additional capital expenditures to invest in new and existing office spaces, the expansion of sales and marketing and international operating activities, any acquisitions of complementary businesses and technologies, the timing of our introduction of new product capabilities and enhancements of our platform and the continuing market acceptance of our platform. It may be necessary to seek additional equity or debt financing to fund our operating and capital needs. In the event that financing is required from outside sources, we may not be able to raise it on terms acceptable to us or at all. If we are unable to raise additional capital when desired, or if we cannot expand our operations or otherwise capitalize on our business opportunities because we lack sufficient capital, our business, operating results and financial condition would be adversely affected.
Stock Repurchase Plan
In November 2023, our Board of Directors authorized the repurchase of up to $100 million of our common stock. Through September 30, 2024, we have purchased a total of 1.5 million shares for $64.9 million. In October 2024, our Board of Directors increased the repurchase authorization by $200 million.
Term Loan and Revolving Credit Facility
In July 2021, we entered into a credit agreement, or the Credit Agreement, which is comprised of a $375.0 million Term Loan and a $50.0 million Revolving Credit Facility, with a $15.0 million letter of credit sublimit. The Term Loan bears interest at a rate of 2.75% per annum over SOFR, subject to a 0.50% floor, plus a credit spread adjustment depending on the interest period.
From January to September 2024, interest rates on our Term Loan have been between 8.11% and 8.22%. The Term Loan is being amortized at 1% per annum in equal quarterly installments until the final payment of $350.6 million on the July 7, 2028 maturity date. We may be subject to mandatory Term Loan prepayments related to the excess cash provisions in the Credit Agreement if our first lien net leverage ratio (as defined in the Credit Agreement) exceeds 3.5. At September 30, 2024, our first lien net leverage ratio was 1.00.
The Revolving Credit Facility bears interest at a rate, depending on first lien net leverage, ranging from 2.00% to 2.50% over SOFR and matures on July 7, 2026. We pay a commitment fee during the term ranging from 0.25% to 0.375% per annum of the average daily undrawn portion of our Revolving Credit Facility. At September 30, 2024, we were in compliance with the covenants and had $0.2 million of standby letters of credit outstanding under the Revolving Credit Facility.
35
Cash Flows
The following table summarizes our cash flows for the periods presented:
| Nine Months Ended September 30, | |||||||||||
| (in thousands) | 2024 | 2023 | |||||||||
| Net cash provided by operating activities | $ | 136,357 | $ | 111,350 | |||||||
| Net cash (used in) provided by investing activities | (27,099) | 19,619 | |||||||||
| Net cash (used in) provided by financing activities | (31,744) | 16,043 | |||||||||
| Effect of exchange rate changes on cash and cash equivalents and restricted cash | (2,439) | (2,562) | |||||||||
| Net increase in cash and cash equivalents and restricted cash | $ | 75,075 | $ | 144,450 | |||||||
Operating Activities
Our largest source of cash provided by operating activities is cash collections from sales of our products and services, as we typically invoice our customers in advance. Our primary uses of cash are employee compensation costs, third-party cloud infrastructure and other software subscription costs, demand generation expenditures and general corporate costs.
Investing Activities
Net cash used in investing activities increased by $46.7 million, primarily due to a $29.2 million increase in cash paid for acquisitions, an $18.0 million net decrease in sales of short-term investments and a $1.2 million increase in capitalized software development costs, partially offset by $3.5 million in proceeds from our SAFE investments in the nine months ended September 30, 2024.
Financing Activities
Net cash used in financing activities increased by $47.8 million, primarily due to the repurchase of common stock under our stock repurchase program of $50.0 million, partially offset by a $2.4 million increase in proceeds from the exercise of stock options.
Contractual Obligations
We have certain contractual obligations for future payments. Refer to Note 7 to our consolidated financial statements for our required operating lease payments and Note 9 for our required payments to Microsoft and AWS for cloud services.
At September 30, 2024, there were no other material changes in our contractual obligations and commitments from those disclosed in our 10-K.
Critical Accounting Policies and Estimates
Our financial statements are prepared in accordance with GAAP. The preparation of these financial statements requires us to make estimates and assumptions that affect the reported amounts of assets, liabilities, revenue and expenses, as well as related disclosures. We evaluate our estimates and assumptions on an ongoing basis. Our estimates are based on historical experience and various other assumptions that we believe to be reasonable under the circumstances. Our actual results could differ from these estimates.
There have been no material changes to our critical accounting policies and estimates as described in our 10-K.
Item 3. Quantitative and Qualitative Disclosures about Market Risk
We are exposed to market risks in the ordinary course of our business, including interest rate, foreign currency exchange and inflation risks.
36
Interest Rate Risk
At September 30, 2024, we had $312.2 million of cash and cash equivalents, which consisted of cash deposits, money market funds and U.S. treasury and agency securities. We also had $236.2 million of short-term investments, which consisted of commercial paper, asset backed securities, U.S. treasury and agency securities and corporate and Yankee bonds. Our investments are carried at their fair market values with cumulative unrealized gains or losses recorded as a component of accumulated other comprehensive (loss) income within stockholders' equity. The primary objectives of our investment activities are the preservation of capital, the fulfillment of liquidity needs and the fiduciary control of cash and investments. We do not enter into investments for trading or speculative purposes. Interest-earning instruments carry a degree of interest rate risk; however, a hypothetical 10% change in interest rates during any of the periods presented would not have had a material impact on our financial statements.
In July 2021, we entered into the Credit Agreement comprised of a $375.0 million Term Loan and a $50.0 million Revolving Credit Facility. From January to September 2024, interest rates on our Term Loan have been between 8.11% and 8.22%. In October and November 2024, the Term Loan has an interest rate of 7.71% and 7.55%, respectively. A one percentage point increase in the rate would not have had a material impact on our financial statements.
Foreign Currency Exchange Risk
Substantially all of our sales contracts are denominated in U.S. dollars, with a limited number of contracts denominated in foreign currencies, including foreign denominated leases. A portion of our operating expenses are incurred outside the United States, denominated in foreign currencies and subject to fluctuations due to changes in foreign currency exchange rates, particularly changes in the Euro, British Pound, Australian dollar, Israeli New Shekel, Indian Rupee and Brazilian Real. Strengthening of the U.S. dollar compared to other currencies could result in lower international sales as our products would seem more expensive and could result in lower international operating costs as the U.S. dollar is the functional currency for all of our international subsidiaries. Additionally, fluctuations in foreign currency exchange rates may cause us to recognize remeasurement and transaction gains (losses) in our consolidated statements of operations. As the impact of foreign currency exchange rates has not been material to our historical operating results, we have not entered into derivative or hedging transactions, but we may do so in the future if our exposure to foreign currencies becomes more significant.
Inflation Risk
While we do not believe that inflation has had a material effect on our business, results of operations, or financial condition through September 30, 2024, our costs, specifically employee-related and third-party cloud infrastructure costs, may become subject to significant inflationary pressures, and our inability or failure to fully offset such higher costs could harm our business, results of operations, or financial condition.
Item 4. Controls and Procedures
Evaluation of Disclosure Controls and Procedures
We maintain “disclosure controls and procedures,” as defined in Rule 13a-15(e) and Rule 15d-15(e) under the Exchange Act, that are designed to ensure that information required to be disclosed by a company in the reports that it files or submits under the Exchange Act is recorded, processed, summarized and reported, within the time periods specified in the SEC’s rules and forms. Disclosure controls and procedures include, without limitation, controls and procedures designed to ensure that information required to be disclosed by a company in the reports that it files or submits under the Exchange Act is accumulated and communicated to our management, including our principal executive and principal financial officers, as appropriate to allow timely decisions regarding required disclosure.
Our management, with the participation of our Chief Executive Officer and Chief Financial Officer, has evaluated the effectiveness of our disclosure controls and procedures (as defined in Rules 13a-15(e) and 15d-15(e) under the Exchange Act ), as of the end of the period covered by this Form 10-Q. Based on such evaluation, our Chief Executive Officer and Chief Financial Officer have concluded that at September 30, 2024, our disclosure controls and procedures were effective to provide reasonable assurance that the information required to be disclosed by us in this Form 10-Q was (a) reported
37
within the time periods specified by SEC rules and regulations, and (b) communicated to our management, including our Chief Executive Officer and Chief Financial Officer, to allow timely decisions regarding any required disclosure.
Changes in Internal Control Over Financial Reporting
There were no changes in our internal control over financial reporting identified in management’s evaluation pursuant to Rules 13a-15(d) or 15d-15(d) of the Exchange Act during the period covered by this Form 10-Q that materially affected, or are reasonably likely to materially affect, our internal control over financial reporting.
Inherent Limitations on Effectiveness of Internal Controls
In designing and evaluating the disclosure controls and procedures, management recognizes that any controls and procedures, no matter how well designed and operated, can provide only reasonable, not absolute, assurance of achieving the desired control objectives. In addition, the design of disclosure controls and procedures must reflect the fact that there are resource constraints and that management is required to apply judgment in evaluating the benefits of possible controls and procedures relative to their costs. Our management, including our Chief Executive Officer and Chief Financial Officer, believes that our disclosure controls and procedures and internal control over financial reporting are designed to provide reasonable assurance of achieving their objectives and are effective at the reasonable assurance level. However, our management does not expect that our disclosure controls and procedures or our internal control over financial reporting will prevent all errors and all fraud.
38
PART II. OTHER INFORMATION
Item 1. Legal Proceedings
From time to time, we may be subject to legal proceedings and claims in the ordinary course of business. We are not presently a party to any legal proceedings that, if determined adversely to us, would individually or taken together have a material adverse effect on our business, results of operations, financial condition or cash flows. We have received, and may in the future continue to receive, claims from third parties asserting, among other things, infringement of their intellectual property rights. Future litigation may be necessary to defend ourselves, our partners and our customers by determining the scope, enforceability and validity of third-party proprietary rights, or to establish our proprietary rights. The results of any current or future litigation cannot be predicted with certainty, and regardless of the outcome, litigation can have an adverse impact on us because of defense and settlement costs, diversion of management resources and other factors.
Item 1A. Risk Factors
Except for the risk factors disclosed below, there have been no material changes to the risk factors disclosed in Part 1, Item 1A. "Risk Factors" of our Form 10-K for the year ended December 31, 2023 filed with the United States Securities and Exchange Commission ("SEC") on February 28, 2024. Our business is subject to risks and events that, if they occur, could adversely affect our financial condition and results of operations and trading price of our securities. In addition to the other information set forth in this Form 10-Q, you should carefully consider the factors described in Part I, Item 1A. “Risk Factors” of our Form 10-K for the year ended December 31, 2023. We may disclose additional changes to risk factors or disclose additional factors from time to time in our future filings with the SEC. Additional risks and uncertainties not presently known to us or that we currently deem immaterial also may impair our business operations.
Our brand, reputation and ability to attract, retain and serve our customers are dependent in part upon the reliability and accuracy of our data, solutions, infrastructure and those of third parties upon which we rely. If our information technology systems or data, or those of third parties upon which we rely, are or were compromised or disrupted, or if our solutions fail to detect vulnerabilities or incorrectly detect vulnerabilities, or if they contain undetected errors or defects, we could experience adverse consequences.
In the ordinary course of our business, we collect, store, use, transmit, disclose or otherwise process proprietary, confidential, and sensitive information, including personal data, intellectual property, and trade secrets.
We sell cybersecurity products and, as a result, may be at increased risk of being a target of cyberattacks designed to penetrate our platform or internal systems, to compromise our data, alter or modify our source code, or to otherwise impede the performance of our products. Threats to information systems and data come from a variety of sources. In addition to computer “hackers,” threat actors, personnel (such as through theft or misuse), "hacktivists," organized criminal threat actors, sophisticated nation-states and nation-state-supported actors now engage and are expected to continue to engage in cyber-attacks. Nation-state actors and nation-state-supported actors may engage in such attacks for geopolitical reasons and in conjunction with military conflicts and defense activities, including the ongoing conflict between Ukraine and Russia, the ongoing conflict in the Middle East, and rising tensions between China and Taiwan. During times of war and other major conflicts, we, third parties upon which we may rely, and our customers may be vulnerable to a heightened risk of these threats, including retaliatory cyber-attacks that could materially disrupt our systems and operations, supply chain, and ability to produce, sell and distribute our goods and services. We, our customers, and the third parties upon which we rely are subject to a variety of evolving threats, which are prevalent, continue to rise, and increasingly difficult to detect. These threats include but are not limited to: social-engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks); credential harvesting; malicious code (such as viruses and worms); malware (including as a result of advanced persistent threat intrusions); denial-of-service attacks, credential stuffing; personnel misconduct or error; ransomware attacks; supply-chain attacks; software bugs; server malfunctions; software or hardware failures; loss of data or other information technology assets; adware; telecommunications failures; attacks enhanced or facilitated by artificial intelligence and other similar threats. In particular, ransomware attacks, including those from organized criminal threat actors, nation-states and nation-state supported actors, are becoming increasingly prevalent and severe and can lead to significant interruptions, delays, or outages in our operations, loss of data, loss of income, significant extra expenses to restore data or systems, reputational
39
loss and the diversion of funds. To alleviate the financial, operational and reputational impact of a ransomware attack, it may be necessary to make extortion payments, but we may be unable to do so if, for example, applicable laws prohibit such payments.
Additionally, we are incorporated into the supply chain of a large number of companies worldwide and, as a result, if our solutions are compromised, a significant number or, in some instances, all of our customers and their data could be simultaneously affected. The potential liability and associated consequences we could suffer as a result of such a large-scale event could be catastrophic and result in irreparable harm.
The increased prevalence of remote work and use of remote devices has increased risks to our information technology systems and data, as more of our employees utilize network connections, computers and devices outside of our premises or network, including working at home, while in transit and in public locations. Furthermore, future or past business transactions, such as acquisitions or integrations, could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities' systems and technologies. Furthermore, we may discover security issues that were not identified during due diligence of such acquired or integrated entities, and it may be difficult to integrate other companies into our information technology environment and security program.
We rely on third-party service providers and technologies to operate critical business systems, including processing confidential and sensitive information, including, without limitation, cloud-based infrastructure, data center facilities, encryption and authentication technology, employee email and other functions. We also rely on third-party service providers to provide other products, services, or otherwise, to operate our business and elements of our infrastructure, including endpoints. Our ability to monitor these third parties' information security practices is limited, and these third parties may not have adequate information security measures in place. Additionally, software errors or vulnerabilities in these third-party technologies could result in significant disruptions to our information technology systems, leading to downtime, data loss, or compromised data integrity.
If our third-party service providers experience a security incident or other interruption or cause an extended outage or disruption to our systems, we could experience adverse consequences. It is possible that our customers and potential customers would hold us accountable for any security incident affecting our third-party service providers’ infrastructure or other interruption caused by our third-party service providers that impacts our infrastructure. We may incur significant liability from those customers and from other third parties with respect to any such incident. Because our agreements with certain third-party service providers, such as Amazon Web Services, or AWS, limit their liability for damages, we may not be able to recover a material portion of our liabilities to our customers and third parties arising from issues with such third-party service providers, such as AWS, in the event of an incident affecting the third parties’ systems. Moreover, while we may be entitled to damages from other third-party service providers if they fail to satisfy their privacy or security-related obligations to us or if they cause a disruption in our infrastructure, any award may be insufficient to cover our damages, or we may be unable to recover such reward. In addition, supply-chain attacks have increased in frequency and severity and there have been high-profile incidents of third-party service providers causing widespread disruptions in their customers' infrastructures due to errors in their SaaS offerings, such as the Windows outage caused by a flawed CrowdStrike software update that occurred in July of 2024. We cannot guarantee that third parties’ infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised or that errors by our third-party service providers won’t cause disruptions in our infrastructure.
While we have implemented security and technology measures designed to protect against security incidents or other interruptions, there can be no assurance that these measures will be effective. We have experienced, and may in the future experience, disruptions, outages, and other performance problems due to a variety of factors, including infrastructure changes, deliberate or unintentional human or software defects and configuration errors (including by third parties), capacity constraints, fraud or security incidents. We take steps designed to detect, mitigate and remediate vulnerabilities and defects and configuration errors in our information technology systems (such as our hardware and software, including that of third parties upon which we rely) and in our software applications, products and services. We may not, however, be able to detect and remediate all such vulnerabilities, defects or configuration errors on a timely basis. For example, we have identified certain vulnerabilities in our information systems and software applications, and we take steps designed to mitigate the risks associated with known vulnerabilities. Despite our efforts, there can be no assurance that these vulnerability, defect and configuration error mitigation measures will be completely effective. Further,
40
we may experience delays in developing and deploying remedial measures and patches designed to address any such identified vulnerabilities, defects or configuration errors.
Any of these or similar threats could cause a security incident or other interruption that can result in unauthorized, unlawful, or accidental acquisition, modification, destruction, loss, alteration, encryption, disclosure of, or access to our proprietary, confidential, and sensitive information or our information technology systems, or those of the third parties upon whom we rely. A security incident or other interruption could disrupt our ability (and that of third parties upon whom we rely) to provide our solutions. In some instances, we or our third-party service providers may not be able to identify the cause or cause of these security incidents or performance problems within an acceptable period of time. If our solutions are unavailable or if our customers are unable to access features of our solutions within a reasonable amount of time or at all, our business could be adversely affected. In addition, if any of the third-party providers we use were to experience or cause a significant or prolonged outage or security incident, our business could be adversely affected. We may expend significant resources or modify our business activities to try to protect against security incidents. Certain data privacy and security obligations may require us to implement and maintain specific security measures, industry-standard or reasonable security measures to protect our information technology systems and proprietary, confidential, and sensitive information, including personal data.
Data protection requirements may also require us to notify relevant stakeholders of security incidents, including affected individuals, partners, collaborators, customers, regulators, law enforcement agencies and others. Such disclosures are costly, and the disclosures or failure to comply with such requirements could lead to adverse consequences.
Additionally, even if we have issued or otherwise made patches or information for vulnerabilities in our software applications, products or services, our customers may be unwilling or unable to deploy such patches and use such information effectively and in a timely manner. Vulnerabilities could be exploited and result in a security incident.
If we, our customers, or a third party upon which we rely, experience or cause a security incident or other interruption, or are perceived to have experienced or caused a security incident or other interruption, we may experience adverse consequences, such as government enforcement actions (for example, investigations, fines, penalties, audits, and inspections); additional reporting obligations and/or oversight; restrictions on processing information (including personal data); litigation (including class claims); indemnification obligations; negative publicity; reputational harm; monetary fund diversions; interruptions of our operations (including availability of data); financial loss (including by issuing credits to our customers); diversion of management attention; and other similar harm. Security incidents or other disruptions and attendant consequences may cause customers to stop using our solutions (including by not renewing their purchases of our solutions), deter new customers from using our solutions, and negatively impact our ability to grow and operate our business.
There can be no assurance that any limitations or exclusions of liabilities in our contracts would be enforceable or adequate or would otherwise protect us from liabilities or damages if we fail to comply with data protection requirements related to information security or security incidents. We cannot be sure that our insurance coverage will be adequate or otherwise protect us from or adequately mitigate liabilities or damages with respect to claims, costs, expenses, litigation, fines, penalties, business loss, data loss, regulatory actions or other impacts arising out of security incidents.
In addition, we face unique risks as a SaaS company, particularly in light of our business model. If our solutions fail to detect vulnerabilities in our customers’ cybersecurity infrastructure, including for remote devices, or if our solutions fail to identify new and increasingly complex methods of cyberattacks, our business may suffer and our customers' businesses may be damaged, including by interrupting their networking traffic or operational technology environments. There is no guarantee that our solutions will detect all vulnerabilities or threats in our customers' systems, especially in light of the rapidly changing security landscape to which we must respond. Additionally, our solutions may falsely detect vulnerabilities or threats that do not actually exist. For example, our solutions rely on information provided by an active community of users who contribute information about new exploits, attacks and vulnerabilities. If the information from these third parties is inaccurate, the potential for false indications of vulnerabilities or threats increases. These false positives, while typical in the industry, may impair the perceived reliability of our offerings. Additionally, our business depends upon the appropriate and successful implementation of our product by our customers. If our customers fail to use our solutions according to our specifications, our customers may suffer a security incident on their own systems or other
41
adverse consequences. Even if such an incident is unrelated to our security practices, it could result in our incurring significant economic and operational costs in investigating, remediating, and implementing additional measures to further protect our customers from their own vulnerabilities.
The reliability and continuous availability of our solutions is critical to our success. We have experienced errors or defects in the past in connection with the release of new solutions and product upgrades, and we expect that these errors or defects will be found from time to time in the future in new or enhanced solutions after commercial release. In addition, we use third parties to assist in the development of our products and these third parties could be a source of errors or defects. Some defects may cause our solutions to be vulnerable to attacks, cause them to fail to detect vulnerabilities, or temporarily interrupt customers’ networking traffic or operational technology environments, any of which may damage our customers’ business and could hurt our reputation.
As a result of any of the risks associated with our SaaS business, we may experience adverse consequences. We may also be subject to liability claims for damages related to errors or defects in our solutions.
We have incorporated and may in the future further incorporate generative and other types of artificial intelligence, or AI, processes, algorithms, and technologies into certain of our products and services. This technology is new and developing, and may generate output that is inaccurate or flawed or may not achieve market acceptance, which could result in operational, financial, regulatory, and reputational harm and other adverse consequences to our business.
We have incorporated and may in the future further incorporate AI features in certain of our products and services, including ExposureAI and Tenable AI Assistant. The use of generative AI processes at scale is relatively new, and may lead to challenges, concerns and risks that are significant or that we may not be able to predict, especially if our use of these technologies in our products and services becomes more important to our operations over time. The technologies underpinning these features are in the early stages of commercial use and exist in an emerging regulatory environment, which presents regulatory, litigation, ethical, reputational, operational and financial risks. AI in our products and services may be difficult to deploy successfully due to operational issues inherent to the nature of such technologies, including the development, maintenance and operation of deep learning datasets. Additionally, if we do not have adequate rights to utilize the data or other materials and content that our AI technologies depend on, we may face legal consequences for violating applicable laws, third-party intellectual property, privacy or other rights, or contracts to which we are a party.
Uncertainty in the legal regulatory regime relating to AI and emerging ethical issues surrounding the use of AI may require significant resources to modify and maintain business practices to comply with U.S. and non-U.S. laws, the nature of which cannot be determined at this time. Existing laws and regulations may apply to us or our suppliers, vendors, partners and customers in new ways, and new laws and regulations may be instituted. Many U.S. and international governmental bodies and regulators have proposed, or are in the process of developing, new regulations related to the use of AI and machine learning technologies. For example, the European Union authorities recently adopted a legal framework on AI regulation, the Artificial Intelligence Act (“AI Act”), which applies beyond the European Union’s borders and establishes obligations for AI providers and those deploying AI systems. Other jurisdictions may adopt similar or potentially more restrictive laws, which may render the use of such technologies challenging. The final form of these may impose obligations related to our development, offering and use of AI technologies and expose us to increased risk of regulatory enforcement and litigation.
Our AI technology features may also generate output that is misleading, insecure, inaccurate, harmful or otherwise flawed. Our customers or others may rely on or use such misleading, insecure, harmful or otherwise flawed content to their detriment, which may harm our brand, reputation, business or customers, cause competitive harm or expose us to legal liability. For example, AI algorithms use machine learning and predictive analytics which may be insufficient or of poor quality and reflect inherent biases and could lead to flawed, biased, and inaccurate results. Deficient or inaccurate recommendations, forecasts, or analyses that generative AI applications assist in producing could lead to customer rejection or skepticism of our products, affect our reputation or brand, and negatively affect our financial results. Further, unauthorized use or misuse of AI by our employees or others may result in disclosure of confidential company and customer data, reputational harm, privacy law violations and legal liability. Our use of generative AI may also lead to novel and urgent cybersecurity risks, including related to personal data, which may adversely affect our operations and reputation.
42
The nature of our business requires the application of complex accounting rules and regulations and public reporting and corporate governance requirements. If there are significant changes in current principles, financial reporting standards, interpretations or public reporting and corporate governance requirements, or if our estimates or judgments relating to our critical accounting policies or reporting or governance requirements prove to be incorrect, we may experience unexpected financial reporting fluctuations or increased compliance costs and strain on our resources and our results of operations could be adversely affected.
The accounting rules and regulations that we must comply with are complex and subject to interpretation by the Financial Accounting Standards Board, the SEC, and various bodies formed to promulgate and interpret appropriate accounting principles. In addition, many companies’ accounting disclosures are being subjected to heightened scrutiny by regulators and the public. Further, the accounting rules and regulations are continually changing in ways that could impact our financial statements.
The preparation of financial statements in conformity with generally accepted accounting principles in the United States, or U.S. GAAP, requires management to make estimates and assumptions that affect the amounts reported in the consolidated financial statements and accompanying notes. We base our estimates on historical experience and on various other assumptions that we believe to be reasonable under the circumstances, as provided in the section of this report titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations.” Significant assumptions and estimates used in preparing our consolidated financial statements include the determination of the estimated economic life of perpetual licenses for revenue recognition, the estimated period of benefit for deferred commissions, useful lives of long-lived assets, the valuation of stock-based compensation, the incremental borrowing rate for operating leases, and the valuation of deferred tax assets. Our results of operations may be adversely affected if our assumptions change or if actual circumstances differ from those in our assumptions, which could cause our results of operations to fall below the expectations of securities analysts and investors, resulting in a decline in the trading price of our common stock.
As a public company, we are also subject to the reporting and corporate governance requirements of the Exchange Act, the listing requirements of the Nasdaq Stock Market and other applicable securities rules and regulations, including the Sarbanes-Oxley Act and the Dodd-Frank Wall Street Reform and Consumer Protection Act. Compliance with these rules and regulations increases our legal and financial compliance costs, makes some activities more difficult, time-consuming or costly and increases demand on our systems and resources.
Additionally, we regularly monitor our compliance with applicable financial reporting standards and SEC and applicable listing standard requirements and review new pronouncements, drafts and interpretations thereof that are relevant to us. We might be required to change our accounting policies, alter our operational policies and implement new or enhance existing systems, or we may be required to restate our published financial statements, as a result of new standards or requirements, changes to existing standards or requirements and changes in their interpretation. Such changes to existing standards or requirements or changes in their interpretation may have an adverse effect on our reputation, business, financial position and profit, or cause an adverse deviation from our revenue and operating profit target, which may negatively impact our financial results. Additionally, we may incur substantial professional fees and expend significant management efforts, and we may need to hire additional staff with the appropriate experience and compile systems and processes necessary to adopt these new standards and disclosure or governance requirements.
For example, a number of climate disclosure regulations have been enacted, including the Corporate Sustainability Reporting Directive, the State of California's climate disclosure legislation, and most recently the SEC's climate-related disclosure requirements. These rules may require disclosure on climate-related risks, risk management, governance and targets, and may require the company to calculate and disclose greenhouse gas emissions data and obtain assurance reports on these disclosures. Ongoing compliance with these regulations is expected to be challenging and will heighten the compliance risks identified above. Additionally, our failure or perceived failure to comply with these disclosure requirements could lead to regulatory investigations, litigation, reputational harm, and other adverse business consequences.
In addition, in July 2023, the SEC adopted rules requiring the disclosure of information about a material cybersecurity incident on Form 8-K within four business days of determining that the incident is material, unless the US Attorney General concludes that such a disclosure would pose a substantial risk to national security or public safety. These rules
43
also require disclosures describing the processes used to identify, assess and manage cybersecurity risks, management's role in assessing and managing material risks from cybersecurity threats and the board of directors' role in overseeing cybersecurity risks.
We rely on our third-party channel partner network of distributors and resellers to generate a substantial amount of our revenue.
Our success is dependent in part upon establishing and maintaining relationships with a variety of channel partners that we utilize to extend our geographic reach and market penetration. We typically use a two-tiered,channel model whereby we sell our products and services to our distributors, who in turn sell to our resellers, who then sell to our end users, who we call customers. We anticipate that we will continue to rely on this two-tiered sales model in order to help facilitate sales of our offerings as part of larger purchases in the United States and to grow our business internationally. In the nine months ended September 30, 2024 and 2023, we derived 94% and 93%, respectively, of our revenue from subscriptions and perpetual licenses sold through channel partners, and the percentage of revenue derived from channel partners may continue to increase in future periods. Ingram Micro, Inc., a distributor, accounted for 34% and 36% of our revenue in the nine months ended September 30, 2024 and 2023, respectively, and 32% of our accounts receivable at September 30, 2024 and December 31, 2023. Our agreements with our channel partners, including our agreement with Ingram Micro, are non-exclusive and do not prohibit them from working with our competitors or offering competing solutions, and some of our channel partners may have more established relationships with our competitors. Similarly, our channel partners have no obligations to renew their agreements with us on commercially reasonable terms or at all, and certain of the agreements governing these relationships may be terminated by either party at any time, with no or limited notice. For example, our agreement with Ingram Micro allows Ingram Micro to terminate the agreement in their discretion upon 30 days’ written notice to us. If our channel partners choose to place greater emphasis on products of their own or those offered by our competitors or as a result of an acquisition, competitive factors or other reasons do not continue to market and sell our solutions in an effective manner or at all, our ability to grow our business and sell our solutions, particularly in key international markets, may be adversely affected. In addition, our failure to recruit additional channel partners, or any reduction or delay in their sales of our solutions and professional services, including as a result of economic uncertainty, legal or regulatory actions, such as government investigations or law enforcement activities, impacting their business, or conflicts between channel sales and our direct sales and marketing activities may harm our results of operations. Finally, even if we are successful, our relationships with channel partners may not result in greater customer usage of our solutions and professional services or increased revenue.
Item 2. Unregistered Sales of Equity Securities and Issuer Purchases of Equity Securities
Unregistered Sales of Equity Securities
None.
Use of Proceeds
None.
Issuer Purchases of Equity Securities
None.
Items 3, 4 and 5 are not applicable and have been omitted.
44
Item 6. Exhibits
The following is a list of Exhibits filed as part of this Quarterly Report on Form 10-Q:
| Exhibit Number | Description | Location | ||||||||||||
| 3.1 | Previously filed as Exhibit 3.1 to the Company's Current Report on Form 8-K (File No. 001-38600) on July 30, 2018 | |||||||||||||
| 3.2 | Previously filed as Exhibit 3.1 to the Company's Current Report on Form 8-K (File No. 001-38600) on November 15, 2023 | |||||||||||||
| 4.1 | Previously filed as Exhibit 4.1 to the Company's Registration Statement on Form S-1 (File No. 333-226002) on July 16, 2018 | |||||||||||||
| 31.1 | Filed herewith | |||||||||||||
| 31.2 | Filed herewith | |||||||||||||
| 32.1* | Furnished herewith | |||||||||||||
| 101.SCH | Inline XBRL Taxonomy Extension Schema Document | |||||||||||||
| 101.CAL | Inline XBRL Taxonomy Extension Calculation Linkbase Document | |||||||||||||
| 101.DEF | Inline XBRL Taxonomy Extension Definition Linkbase Document | |||||||||||||
| 101.LAB | Inline XBRL Taxonomy Extension Label Linkbase Document | |||||||||||||
| 101.PRE | Inline XBRL Taxonomy Extension Presentation Linkbase Document | |||||||||||||
| 104 | Cover Page Interactive Data File (formatted as Inline XBRL with applicable taxonomy extension information contained in Exhibits 101.SCH, 101.CAL, 101.DEF, 101.LAB and 101.PRE) | |||||||||||||
________________
(*) This certification is deemed not filed for purposes of Section 18 of the Securities Exchange Act of 1934, as amended, or otherwise subject to the liability of that section, nor shall it be deemed incorporated by reference into any filing under the Securities Act of 1933, as amended, or the Securities Exchange Act of 1934, as amended.
45
SIGNATURES
Pursuant to the requirements of the Securities Exchange Act of 1934, the registrant has duly caused this report to be signed on its behalf by the undersigned thereunto duly authorized.
| TENABLE HOLDINGS, INC. | |||||||||||
| Date: | November 5, 2024 | By: | /s/ Amit Yoran | ||||||||
| Amit Yoran | |||||||||||
| Chairman and Chief Executive Officer | |||||||||||
| (On Behalf of the Registrant and as Principal Executive Officer) | |||||||||||
| Date: | November 5, 2024 | By: | /s/ Stephen A. Vintz | ||||||||
| Stephen A. Vintz | |||||||||||
| Chief Financial Officer | |||||||||||
| (Principal Financial Officer and Principal Accounting Officer) | |||||||||||
46