Tenable Holdings Inc

Overview

We are a leading provider of exposure management solutions. Exposure management is an effective discipline for measuring, comparing and reducing cybersecurity risk in today's complex IT environments.

Organizations around the globe are accelerating their adoption of public and private cloud infrastructure, introducing internet-facing applications and embracing new identity management systems. The rapid adoption of these and other digital technologies is expanding the modern attack surface.

For most organizations, the modern attack surface includes:

•Complex and dynamic multi-cloud environments, which organizations are rapidly adopting even as they face a shortage of cloud security expertise;

•Identity and access management systems used to control machine identities, APIs and user privileges, which are vulnerable to misconfigurations that can open up attack pathways within an organization;

•An assortment of operational technology, or OT — such as industrial control systems, or ICS, and supervisory control and data acquisition, or SCADA, systems — which is increasingly internet-facing and is often linked to existing IT systems;

•Personal devices, including mobile phones and tablets, internet of things, or IoT, devices and other types of “shadow IT” used by employees, often without the knowledge of the IT and security teams; and

•Virtual machines, microservices, open-source code repositories, containers and other tools used by DevOps teams.

The complexity of the modern attack surface is a key driver behind the growing need for exposure management programs. Security teams are overwhelmed with the constant influx of data from the array of point solutions they are using to manage cloud assets, interconnected vulnerabilities, web applications, and identity systems. They are also challenged with effectively analyzing all that data to make informed, proactive decisions about which exposures represent the greatest risk to the organization.

The combination of all these factors presents cybersecurity teams with obstacles that reach beyond the scope of existing point tools. We see three distinct real-world challenges facing cybersecurity professionals that can be addressed with an exposure management program:

•Security programs today are reactive when they should be proactive;

•The attack surface isn’t siloed, but security programs often are; and

•There’s more data available than ever before, yet it’s difficult for security professionals to prioritize and apply the information in meaningful ways.

An exposure management program, underpinned by a technology platform such as our Tenable One Exposure Management Platform, or Tenable One, can help address these real-world problems. Successfully implemented, an exposure management platform allows organizations to:

•Gain comprehensive visibility across the modern attack surface;

•Anticipate threats and prioritize efforts to prevent attacks; and

•Communicate cyber risk to make better decisions.

In order to be effective, an exposure management platform must extend beyond traditional vulnerability management, which concentrates on the discovery and remediation of publicly disclosed Common Vulnerabilities and Exposures, or CVEs. The platform must include information about configuration issues, vulnerabilities and attack paths across a spectrum of assets and technologies — including cloud configurations and deployments, identity solutions, such as Active Directory; and web applications.

With these considerations in mind, we launched Tenable One in October 2022. Tenable One unifies a variety of data sources into a single exposure view to help organizations gain visibility, prioritize efforts and communicate cyber risks. Building on our existing products, Tenable One is designed to take advantage of the integrations that already exist with our partners and form the foundation of an exposure management program, alongside the other tools, such as endpoint detection and response, or EDR, and firewalls, and required business processes.

In 2023, 2022 and 2021 our total revenue was $798.7 million, $683.2 million and $541.1 million, respectively, representing year-over-year growth rates of 17% from 2022 to 2023 and 26% from 2021 to 2022. Our net loss was $78.3 million, $92.2 million and $46.7 million in 2023, 2022 and 2021, respectively. Our cash flows from operating activities were $149.9 million, $131.2 million and $96.8 million in 2023, 2022 and 2021, respectively.

Our Solutions

With Tenable One, organizations can translate technical data about assets, vulnerabilities and threats into clear business insights and actionable intelligence for security executives and practitioners. The platform combines the broad, industry leading, vulnerability coverage, spanning IT assets, cloud resources, containers, web apps and identity systems. Tenable One builds on the speed and breadth of vulnerability coverage from our research team of cybersecurity and data science experts, or Tenable Research, and adds aggregated exposure view analytics, guidance on mitigating attack pathways and a centralized asset inventory. Tenable One leverages artificial intelligence, or AI, and machine learning, or ML, to rapidly analyze and interpret vast data sets, deliver rapid prioritization of exposures and assets and the likelihood of exploit, deliver recommendations, and automates routine tasks and streamlines workflows. AI and ML improves vulnerability prioritization and the ability to accurately gauge the risk posed by identities and entitlements across cloud and on-premise environments.

Tenable One incorporates these Tenable products:

•Tenable Vulnerability Management: our cloud-delivered software-as-a-service, or SaaS, vulnerability management offering that provides organizations with a risk-based view of traditional and modern attack surfaces. Tenable Vulnerability Management is designed with views, workflows and dashboards to deliver a complete and continuous view of all assets, both known and previously unknown, and any associated vulnerabilities, internal and regulatory compliance violations, misconfigurations and other cybersecurity issues, prioritize these issues for remediation based on risk assessment and predictive analytics, and provide insightful remediation guidance.

•Tenable Cloud Security: Built on innovative cloud-native application protection platform (CNAPP) technology, and leading cloud infrastructure entitlement management (CIEM) acquired with Ermetic in October 2023, Tenable Cloud Security enables security teams to continuously assess the security posture of their cloud environments by maintaining a current view of cloud assets and identities to minimize exposure and enforce a least privilege approach at scale. Tenable Cloud Security provides cloud security teams the tools they need to apply security and compliance policies, prioritize security gaps and remediate risks that matter most across multi-cloud environments.

•Tenable Identity Exposure: our solution to secure Active Directory environments by enabling users to find and fix existing weaknesses before they are exploited and detect and respond to ongoing attacks in real time without the need to deploy agents or use privileged accounts.

•Tenable Web App Scanning: our easy-to-use, comprehensive and automated Vulnerability Scanning for modern web applications, which allows organizations to quickly configure and manage web app scans, enabling them to identify vulnerabilities and prioritize remediation.

•Tenable Lumin Exposure View: our measurement tool, which leverages our expansive knowledge base of assets and vulnerabilities coupled with data science insights, to help our customers objectively score, trend and benchmark cyber risk across their organizations, including by business unit or geography, for comparison and best practices. We believe this capability is critical to help security executives effectively translate technical information and communicate cybersecurity risk to a non-technical audience, including the C-suite and the board of directors, to enable them to make better strategic decisions on where to focus investment to maximize cybersecurity risk reduction.

•Tenable Attack Surface Management: our External Attack Surface Management solution continuously maps the internet, enabling security teams to discover connections to internet-facing assets so they can assess the cybersecurity posture of their entire external attack surface.

•Tenable Security Center: our on-premises Vulnerability Management offering that provides a risk-based view of an organization’s IT, security and compliance posture so organizations can quickly identify, investigate and prioritize their assets and vulnerabilities based on risk assessment and predictive analytics, and provide insightful remediation guidance.

•Tenable OT Security: our Operational Technology Security solution that provides threat detection, asset tracking, vulnerability management, and configuration control capabilities to protect OT environments, including industrial networks.

All of the above products, now available in Tenable One, continue to be offered as standalone solutions.

In addition, our Nessus product line is one of the most widely deployed vulnerability assessment solutions in the cybersecurity industry and underpins our enterprise platform. Since the introduction of Nessus in 1998, we have built and nurtured an extensive community of Nessus users. We continue to cultivate knowledge and affinity within this user base, which, when combined with our enterprise customers and Tenable Research, creates powerful network effects in the form of a continuous feedback loop of data and insights. We use these learnings to expand our assessment capabilities and coverage, continually optimize our solutions and inform our product strategy and innovation priorities. We believe these data and insights will also fuel and strengthen our benchmarking capabilities over time.

Nessus Expert adds Web App scanning capabilities, Infrastructure as Code, or IaC, scanning along with external attack surface discovery capabilities to identify all domains and subdomains that make up an organization’s external-facing attack surface. Nessus Expert enables users to programmatically detect cloud infrastructure misconfigurations and vulnerabilities in the design and build phases of the software development lifecycle and continuously discover and inventory an organization's internet-facing assets from an attacker's perspective.

Our Technology Ecosystem

We have partnered and/or integrated with market leading technology companies to pioneer the industry’s first exposure management ecosystem to help organizations build resilient cybersecurity programs. Our ecosystem consists of a variety of third-party data import sources integrated into our platform offerings, as well as export of our data out to third-party IT systems. Our technology ecosystem connects disparate solutions and data to automate processes and accelerate an organization’s ability to understand, manage and reduce its cyber risk.

We integrate a variety of third-party data sources, including ticketing, configuration management databases, or CMDBs, and systems management, into our platform to augment our native data collection and help with analysis and remediation prioritization. Furthermore, our data is exported out to enrich third-party IT management and security systems.

Our Growth Strategy

Our objectives are to expand our market leadership in exposure management and to scale our business by capturing our large market opportunities in cloud identity and OT, while expanding our operating and free cash flow margins. To accomplish these objectives, we intend to:

•Continue to acquire new enterprise platform customers. We believe there is a substantial opportunity to increase adoption of our enterprise platform offerings. We have experienced growth in new enterprise platform customers due to improved product capabilities and investments in sales and marketing. We intend to continue to aggressively pursue new domestic and international customers by adding sales capacity and leveraging our network of channel partnerships around the world.

•Expand asset coverage within our customer base. We believe we have a significant opportunity to expand our relationships with our existing customers by targeting additional teams, business units or geographies, pursuing broad enterprise deployments and generally expanding our coverage of their network-connected assets and cross-selling new applications and solutions.

•Invest in our technology platform. We intend to continue to innovate, develop and broaden our exposure and traditional vulnerability management solutions, including expanding the coverage of emerging attack surfaces and asset types and the addition of analytical capabilities, to help our customers measure and manage their cyber exposure. As we collect more data and ingest more data from third-party sources, we believe our data set will become even more valuable over time, which will allow us to continue to develop new analytical products and capabilities to our existing product suite over time.

•Explore acquisition opportunities. We intend to acquire other businesses, technology and/or development personnel that will expand and enhance the functionality of our platform offerings.

Customers

We sell and market our enterprise platform offerings through our sales force that works closely with our channel partners, which includes a network of distributors and resellers, in developing sales opportunities. We use a two-tiered channel model whereby we sell our enterprise platform offerings to our distributors, which in turn sell to our resellers, which then sell to end users, which we call customers.

Our customers are located in over 170 countries and include organizations of all sizes and span a wide range of industries, including manufacturing, energy and industrials; technology, media and telecommunications; banking, insurance and finance; government, education and non-profit; healthcare; and retail and consumer.

At December 31, 2023, we had approximately 44,000 customers. At December 31, 2023 our customers included approximately 65% of the Fortune 500 and approximately 50% of the Global 2000 and large government agencies. In 2023, 2022 and 2021, no single customer represented more than 2% of our revenue.

Our sales strategy employs both a direct-touch approach through our sales force and a low-touch approach through sales closed by our channel partners and on our e-commerce website. Both direct-touch and channel-originated sales are fulfilled through our channel partnerships. Our sales and customer success renewal teams collaborate closely with our channel partners to prospect, manage and support our customers, developing and maintaining close relationships with all of our enterprise platform customers.

We sell to organizations of all sizes across a broad range of industries, with a specific focus on enterprise accounts. Our sales team is divided by customer size and geography, including the Americas; Europe, the Middle East and Africa, or EMEA; and Asia Pacific and Japan.

Our partner ecosystem provides us with a number of advantages, including increased in-bound registered sales leads, broader geographic reach and greater deal velocity. Our channel partners include distributors, value-added resellers, system integrators and managed security service providers.

Our marketing efforts focus on cultivating brand awareness and leveraging our track record of innovation in exposure management to expand into new markets. We are focused on building demand across all segments with a specific emphasis on our enterprise customers and delivering tailored marketing programs for security executives, functional managers, security practitioners, managed service providers and consultants. Our marketing efforts are also designed to create a broad community and establish the Tenable brand as a trusted resource of credible educational information. We provide a variety of educational resources for cybersecurity practitioners and leaders, as well as cloud security teams, DevOps teams, OT practitioners and identity and access management practitioners, including a community forum where customers can ask questions of our experts and their peers. We execute marketing programs targeted at new customer acquisition, customer retention and cross-selling and up-selling of products across our platform.

We continue to invest substantial resources in research and development to enhance our platform offerings by developing new features, functionality, and applications. Our engineering expertise combines extensive security product development experience with individuals who possess deep cloud and user interface design backgrounds.

Our Tenable Research team is staffed by cybersecurity, cloud and data science experts who deliver exposure management intelligence, data science insights, alerts and security advisories. Our Tenable Research Team has developed AI-based research tools to help improve efficiency and effectiveness in processes such as reverse engineering, code debugging, web app security and visibility into cloud-based tools. Frequent updates from Tenable Research ensure the latest vulnerability checks, zero-day research, and configuration benchmarks are available within our exposure management solutions.

We believe ongoing and timely development of new products and features is imperative to maintaining our competitive position. We continue to invest in development of our solutions across our global research and development team.

Backlog

We define backlog as contractually committed orders to be invoiced under our existing agreements that are not included in deferred revenue on our consolidated balance sheets. We expect the amount of backlog to change from period to period due to the timing of billings for our solutions and professional services. At December 31, 2023 and 2022, we had backlog of $23.4 million and $14.7 million, respectively. We expect the majority of the backlog at December 31, 2023 to be invoiced within the following 12 months.

Competition

The market for cybersecurity solutions is fragmented, intensely competitive and constantly evolving. We compete with a range of established and emerging cybersecurity software and services vendors, as well as homegrown solutions. With the introduction of new technologies and market entrants, we expect the competitive environment to remain intense going forward. Our competitors include: vulnerability management and assessment vendors, including Qualys and Rapid7; diversified security software and services vendors; endpoint security vendors with vulnerability assessment capabilities, including CrowdStrike; public cloud vendors and companies, such as Palo Alto Networks and Wiz, that offer solutions for cloud security (private, public and hybrid cloud); and providers of point solutions that compete with some of the features present in our solutions. Many organizations also choose to build their own solutions in-house, often using open-source code rather than purchasing external solutions, and we compete against these internally-developed efforts as well.

We believe that the principal competitive factors affecting the market for cybersecurity solutions include product functionality, breadth and depth of offerings, flexibility of delivery models, ease of deployment and use, integration capabilities such as open APIs and scalability, uptime and performance. We believe that our suite of solutions generally competes favorably with respect to these factors and may serve as a complement to the solutions offered by our competitors in some cases. Some of our more established actual and potential competitors have greater name recognition, longer operating histories, more established customer relationships, larger marketing budgets and significantly greater resources than we do. In addition, as our market grows and rapidly changes, we expect it will continue to attract new competitors, including companies that are larger and more established than us and smaller emerging companies, which could introduce new products and services.

Intellectual Property

Our success depends in part upon our ability to protect our core technology and intellectual property. We rely on a combination of trade secrets, copyrights, patents and trademarks, as well as contractual protections, to establish and protect our intellectual property rights and protect our proprietary technology.

At December 31, 2023, we had 38 issued patents and 21 patent applications pending in the United States. Our issued patents expire between 2027 and 2042 and cover our network scanning, monitoring and analysis technologies and additional features of our platform offerings. At December 31, 2023, we had 20 registered trademarks in the United States. We view our copyrights, trade secrets and know-how as a significant component of our intellectual property assets.

We also license certain software from third parties for integration into our solutions, including open source software and other software available on commercially reasonable terms. We cannot assure you that such third parties will maintain such software or continue to make it available.

We control access to and use of our proprietary software and other confidential information through the use of internal and external controls, including contractual protections with employees, contractors, customers and partners, and our software is protected by U.S. and international copyright and trade secret laws. Despite our efforts to protect our trade secrets and proprietary rights through intellectual property rights, licenses and confidentiality and invention assignment agreements, unauthorized parties may still attempt to copy, reverse engineer, misappropriate or otherwise obtain and use our software and technology. In addition, we intend to continue to expand our international operations, and effective patent, copyright, trademark and trade secret protection may not be available or may be limited in foreign countries.

Government Regulation

Various federal, state and foreign legislative and regulatory bodies have legislation pending that could affect our business.

In the ordinary course of our business, we process personal information. Accordingly, we are, or may become, subject to numerous data privacy and security obligations, including federal, state, local, and foreign laws, regulations, guidance, and industry standards related to data privacy and security. Such obligations may include, without limitation, the Federal Trade Commission Act, the California Consumer Privacy Act of 2018, or the CCPA, the Colorado Privacy Act, Virginia’s Consumer Data Protection Act, the Connecticut Privacy Act, the Utah Consumer Privacy Act, the European Union’s General Data Protection Regulation 2016/679, or EU GDPR, the EU GDPR as it forms part of the United Kingdom law by virtue of section 3 of the European Union (Withdrawal) Act of 2018, or UK GDPR, and the ePrivacy Directive.

Like other U.S.-based IT security products, our products are subject to U.S. export control laws and regulations, specifically the Export Administration Regulations, or EAR, U.S. economic and trade sanctions regulations and applicable foreign government import, export and use requirements. These laws prohibit or restrict the export of our products and services to certain countries, regions, governments, entities or persons subject to trade restrictions. For more information on the potential impacts of government regulations affecting our business, see “Risk Factors” included under Part I, Item 1A.

Human Capital

At December 31, 2023, we had 1,999 employees, including 898 employees located outside of the United States. None of our U.S. employees are represented by a labor union or covered by a collective bargaining agreement. Certain international employees are subject to collective bargaining agreements in connection with local labor laws. We have not experienced any work stoppages, and we consider our relations with our employees to be good.

We believe in upholding a core set of values for our entire global workforce:

•One Tenable: We work together and we win together. We are part of one Tenable team - employees, customers, partners and other stakeholders.

•Deliver Results: We set high goals, take bold risks, measure honestly and deliver results that exceed expectations.

•We Care: We are committed to our work, our customers, our colleagues and our communities. We speak candidly and we always do the right thing.

•What We Do Matters: The work that we do makes a difference in the world.

Our key human capital objectives are to attract, retain, engage, reward and develop our highly talented existing and future employees, while cultivating a diverse and inclusive workforce and culture to achieve exceptional business results. We strive to be a career destination where employees from all backgrounds are welcome and empowered, are treated with fairness and respect, can make a difference, and have the opportunity to grow.

Compensation, Benefits and Talent Development

We provide robust compensation and benefits packages to attract and retain our employees. We aim to incentivize our employees by aligning a portion of their compensation with the overall success of our business. In addition to base salary, our total rewards packages include annual bonuses, equity awards, an employee stock purchase plan, retirement plans, and health and wellness benefits. Equity awards of restricted stock units that vest over time are granted to new hires and to most employees on an annual basis. Eligible employees can participate in our employee stock purchase plan, in which employees may contribute a percentage of their compensation to purchase shares of our common stock at a discount. Our health and wellness benefits include medical and life insurance, paid time off, family leave, and employee assistance programs. We are committed to a structured hybrid workplace strategy which both allows flexibility and recognizes the value of in-person collaboration and community.

We promote and support employee development and organizational effectiveness by providing high-quality learning and development programs as well as tuition assistance programs. These programs are designed to meet individual, team and organizational needs and objectives, enabling our workforce to grow professionally and increase their impact to the business.

Diversity and Inclusion

We seek to cultivate a diverse and inclusive workforce and environment to achieve exceptional business results. When we value and celebrate differences, we drive more innovation and grow closer to our customers, partners, and communities. We strive to be a career destination where employees from all backgrounds are welcomed, treated with fairness and respect, empowered to make a difference, and provided opportunities to grow.

We undertake numerous efforts to increase diversity in our employee population and to foster a culture of fairness and belonging through a number of measures in our recruiting, engagement, retention, and outreach practices. Our dedicated Diversity & Inclusion Council and Employee Resource Groups – along with our committed leaders and managers – strive to attract and hire employees who bring broad diversity of background, thought and style into the company and foster a sense of inclusion to make them want to stay. To support these initiatives, we build partnerships within our communities to support organizations and events that strive for greater representation of women and underrepresented minorities in cybersecurity, hold inclusion training and offer targeted development opportunities to assist with career advancement.

Environmental Stewardship

We care deeply about the places where we live and work. Our Board and management team recognize that we have a role to play in environmental stewardship. We believe that environmentally responsible operating practices are important to generating value for our stockholders, being a good partner with our customers and being a good employer to our employees.

Our energy consumption and usage within data centers is an important component of our day-to-day operations of our business. We outsource our data center needs to Amazon Web Services, or AWS. AWS, in addition to carefully choosing data center locations to mitigate environmental risk, has a long-term commitment to use 100% renewable energy. Aside from data center needs, greenhouse gas emissions and water and energy usage are not material factors in the day-to-day operations of our business. However, we believe that we can still play a part through environmentally sound practices.

Tenable headquarters is a LEED Certified Gold for Core Construction. In addition, we have taken the following actions to enable environmental stewardship:

• Implemented recycling in our offices;

• Offer biodegradable to-go boxes to reduce food waste;

• Have a strict policy for disposing of hardware; and

• Transitioned to a travel portal that provides detail on our carbon footprint.

Tenable and our employees have donated time and money to important environmental causes, such as healthy waterways and other clean-up efforts, recycling, carbon footprint mitigation and protection of threatened wildlife.

Financial Information and Segments

See Note 1 and Note 13 to our consolidated financial statements in this Annual Report on Form 10-K for segment and geographical information.

Corporate Information

Tenable Network Security, Inc., our predecessor, was incorporated under the laws of the State of Delaware in 2002. Tenable Holdings, Inc. was incorporated in Delaware in October 2015. In November 2015, Tenable Network Security, Inc. was merged into a wholly owned subsidiary and in 2017 was renamed as Tenable, Inc.

Our principal executive offices are located at 6100 Merriweather Drive, Columbia, Maryland 21044. Our telephone number is (410) 872-0555. Our website address is www.tenable.com. The information contained on, or that can be accessed through, our website is not incorporated by reference, and you should not consider any information contained on, or that can be accessed through, our website as part of this Annual Report on Form 10-K.

“Tenable,” “Nessus,” the Tenable logo and other trademarks or service marks of Tenable Holdings, Inc. appearing in this Annual Report on Form 10-K are the property of Tenable Holdings, Inc. This Annual Report on Form 10-K contains additional trade names, trademarks and service marks of others, which are the property of their respective owners. Solely for convenience, trademarks and trade names referred to in this Annual Report on Form 10-K may appear without the ® or TM symbols.

Available Information

Our Annual Report on Form 10-K, Quarterly Reports on Form 10-Q, Current Reports on Form 8-K, Proxy Statement, and amendments to reports filed pursuant to Sections 13(a) and 15(d) of the Exchange Act, are available for download free of charge from our investor relations website https://investors.tenable.com after we file them with the Securities and Exchange Commission, or the SEC. The SEC’s website https://www.sec.gov contains reports, proxy and information statements, and other information regarding issuers that file electronically with the SEC.

The contents of any website referred to in this Form 10-K are not intended to be incorporated into this Annual Report on Form 10-K or in any other report or document we file with the SEC.