Tenable Holdings Inc

Except for the risk factors disclosed below, there have been no material changes to the risk factors disclosed in Part 1, Item 1A. "Risk Factors" of our Form 10-K for the year ended December 31, 2023 filed with the United States Securities and Exchange Commission ("SEC") on February 28, 2024. Our business is subject to risks and events that, if they occur, could adversely affect our financial condition and results of operations and trading price of our securities. In addition to the other information set forth in this Form 10-Q, you should carefully consider the factors described in Part I, Item 1A. “Risk Factors” of our Form 10-K for the year ended December 31, 2023. We may disclose additional changes to risk factors or disclose additional factors from time to time in our future filings with the SEC. Additional risks and uncertainties not presently known to us or that we currently deem immaterial also may impair our business operations.

We have incorporated and may in the future further incorporate generative and other types of artificial intelligence, or AI, processes, algorithms, and technologies into certain of our products and services. This technology is new and developing, and may generate output that is inaccurate or flawed or may not achieve market acceptance, which could result in operational, financial, regulatory, and reputational harm and other adverse consequences to our business.

We have incorporated and may in the future further incorporate AI features in certain of our products and services, including ExposureAI and Tenable AI Assistant. The use of generative AI processes at scale is relatively new, and may lead to challenges, concerns and risks that are significant or that we may not be able to predict, especially if our use of these technologies in our products and services becomes more important to our operations over time. The technologies underpinning these features are in the early stages of commercial use and exist in an emerging regulatory environment, which presents regulatory, litigation, ethical, reputational, operational and financial risks. AI in our products and services may be difficult to deploy successfully due to operational issues inherent to the nature of such technologies, including the development, maintenance and operation of deep learning datasets. Additionally, if we do not have adequate rights to utilize the data or other materials and content that our AI technologies depend on, we may face legal consequences for violating applicable laws, third-party intellectual property, privacy or other rights, or contracts to which we are a party.

Uncertainty in the legal regulatory regime relating to AI and emerging ethical issues surrounding the use of AI may require significant resources to modify and maintain business practices to comply with U.S. and non-U.S. laws, the nature of which cannot be determined at this time. Existing laws and regulations may apply to us or our suppliers, vendors, partners and customers in new ways, and new laws and regulations may be instituted. Many U.S. and international governmental bodies and regulators have proposed, or are in the process of developing, new regulations related to the use of AI and machine learning technologies. For example, the European Union authorities have concluded a provisional agreement on AI regulation, the Artificial Intelligence Act (“AI Act”), which will apply beyond the European Union’s borders and which will establish obligations for AI providers and those deploying AI systems. Other jurisdictions may adopt similar or potentially more restrictive laws, which may render the use of such technologies challenging. The final form of these may impose obligations related to our development, offering and use of AI technologies and expose us to increased risk of regulatory enforcement and litigation.

Our AI technology features may also generate output that is misleading, insecure, inaccurate, harmful or otherwise flawed. Our customers or others may rely on or use such misleading, insecure, harmful or otherwise flawed content to their detriment, which may harm our brand, reputation, business or customers, cause competitive harm or expose us to legal liability. For example, AI algorithms use machine learning and predictive analytics which may be insufficient or of poor quality and reflect inherent biases and could lead to flawed, biased, and inaccurate results. Deficient or inaccurate recommendations, forecasts, or analyses that generative AI applications assist in producing could lead to customer rejection or skepticism of our products, affect our reputation or brand, and negatively affect our financial results. Further, unauthorized use or misuse of AI by our employees or others may result in disclosure of confidential company and customer data, reputational harm, privacy law violations and legal liability. Our use of generative AI may also lead to novel and urgent cybersecurity risks, including related to personal data, which may adversely affect our operations and reputation.

The nature of our business requires the application of complex accounting rules and regulations and public reporting and corporate governance requirements. If there are significant changes in current principles, financial reporting standards, interpretations or public reporting and corporate governance requirements, or if our estimates or judgments relating to our critical accounting policies or reporting or governance requirements prove to be incorrect, we may experience unexpected financial reporting fluctuations or increased compliance costs and strain on our resources and our results of operations could be adversely affected.

The accounting rules and regulations that we must comply with are complex and subject to interpretation by the Financial Accounting Standards Board, the SEC, and various bodies formed to promulgate and interpret appropriate accounting principles. In addition, many companies’ accounting disclosures are being subjected to heightened scrutiny by regulators and the public. Further, the accounting rules and regulations are continually changing in ways that could impact our financial statements.

The preparation of financial statements in conformity with generally accepted accounting principles in the United States, or U.S. GAAP, requires management to make estimates and assumptions that affect the amounts reported in the consolidated financial statements and accompanying notes. We base our estimates on historical experience and on various other assumptions that we believe to be reasonable under the circumstances, as provided in the section of this report titled “Management’s Discussion and Analysis of Financial Condition and Results of Operations.” Significant assumptions and estimates used in preparing our consolidated financial statements include the determination of the estimated economic life of perpetual licenses for revenue recognition, the estimated period of benefit for deferred commissions, useful lives of long-lived assets, the valuation of stock-based compensation, the incremental borrowing rate for operating leases, and the valuation of deferred tax assets. Our results of operations may be adversely affected if our assumptions change or if actual circumstances differ from those in our assumptions, which could cause our results of operations to fall below the expectations of securities analysts and investors, resulting in a decline in the trading price of our common stock.

As a public company, we are also subject to the reporting and corporate governance requirements of the Exchange Act, the listing requirements of the Nasdaq Stock Market and other applicable securities rules and regulations, including the Sarbanes-Oxley Act and the Dodd-Frank Wall Street Reform and Consumer Protection Act. Compliance with these rules and regulations increases our legal and financial compliance costs, makes some activities more difficult, time-consuming or costly and increases demand on our systems and resources.

Additionally, we regularly monitor our compliance with applicable financial reporting standards and SEC and applicable listing standard requirements and review new pronouncements, drafts and interpretations thereof that are relevant to us. We might be required to change our accounting policies, alter our operational policies and implement new or enhance existing systems, or we may be required to restate our published financial statements, as a result of new standards or requirements, changes to existing standards or requirements and changes in their interpretation. Such changes to existing standards or requirements or changes in their interpretation may have an adverse effect on our reputation, business, financial position and profit, or cause an adverse deviation from our revenue and operating profit target, which may negatively impact our financial results. Additionally, we may incur substantial professional fees and expend significant management efforts, and we may need to hire additional staff with the appropriate experience and compile systems and processes necessary to adopt these new standards and disclosure or governance requirements.

For example, a number of climate disclosure regulations have been enacted, including the Corporate Sustainability Reporting Directive, the State of California's climate disclosure legislation, and most recently the SEC's climate-related disclosure requirements. These rules may require disclosure on climate-related risks, risk management, governance and targets, and may require the company to calculate and disclose greenhouse gas emissions data and obtain assurance reports on these disclosures. Ongoing compliance with these regulations is expected to be challenging and will heighten the compliance risks identified above. Additionally, our failure or perceived failure to comply with these disclosure requirements could lead to regulatory investigations, litigation, reputational harm, and other adverse business consequences.

In addition, in July 2023, the SEC adopted rules requiring the disclosure of information about a material cybersecurity incident on Form 8-K within four business days of determining that the incident is material, unless the US Attorney General concludes that such a disclosure would pose a substantial risk to national security or public safety. These rules also require disclosures describing the processes used to identify, assess and manage cybersecurity risks, management's role in assessing and managing material risks from cybersecurity threats and the board of directors' role in overseeing cybersecurity risks.