Tenable Holdings, Inc.
For the period ended Sep 30, 2026. Filed Nov 3, 2026.
View on SEC.govAbout this filing
A company's report for each of its first three quarters. The financial statements are not audited. It shows how the business has moved since the last annual report, and what management says changed.
Sep 30, 2026 · Filed Nov 3, 2026
TENB$42.13-4.6%Stored close · as of Nov 6, 2026
What changed in Risk Factors?
Read the current filingPrevious report: 10-Q
Period ended 2026-06-30; filed 2026-08-04.
0001660280-26-000035
Item 1A. Risk FactorsCurrent report: 10-Q
Period ended 2026-09-30; filed 2026-11-03.
0001660280-26-000054
Item 1A. Risk FactorsThe baseline is this issuer’s latest earlier reporting period of the same form that was filed before the current report. A previous 10-Q is a different quarter, not a year-over-year comparison. Amendments are excluded.
Compared 35 previous paragraphs and 90 current paragraphs.
25 unchanged; 10 reworded; 53 added; 0 removed; 0 previous and 2 current paragraphs rearranged.
Tables are not compared: 0 previous and 0 current tables excluded. Dates, whitespace, punctuation and numbering changes are ignored; changes to financial figures remain significant.
A changed paragraph is not evidence that risk increased or decreased. An unchanged paragraph does not establish that risk stayed the same.
Added paragraphs (53)
Current report
We face intense competition. If we do not continue to innovate and offer solutions that address the dynamic cybersecurity landscape, we may not remain competitive.
Current report
The market for cybersecurity solutions is fragmented, intensely competitive and constantly evolving. We compete with a range of established and emerging cybersecurity software and services vendors, as well as homegrown solutions. With the introduction of new technologies and market entrants, we expect the competitive environment to remain intense going forward. Our competitors include: vulnerability management and assessment vendors, including Qualys and Rapid7; diversified security software and services vendors; endpoint security vendors with nascent vulnerability assessment capabilities, including CrowdStrike; public cloud vendors and companies, such as Palo Alto Networks and Wiz (now a subsidiary of Google), that offer solutions for cloud security (private, public and hybrid cloud); and providers of point solutions that compete with some of the features present in our solutions. We also compete against internally-developed efforts that often use open source solutions.
Current report
Some of our actual and potential competitors have significant advantages over us, such as longer operating histories, significantly greater financial, technical, marketing or other resources, stronger brand and business user recognition, larger intellectual property portfolios, government certifications and broader global distribution and presence. In addition, our industry is evolving rapidly and is becoming increasingly competitive. Companies that are larger and more established than us are focusing on cybersecurity and could directly compete with us. For example, Microsoft has a vulnerability management offering and has continued to acquire security solutions for its cybersecurity platform. Smaller companies could also launch new products and services that we do not offer and that could gain market acceptance quickly. Advances in artificial intelligence may also lower the technical and resource barriers historically associated with developing cybersecurity solutions, which could make it easier for new and existing competitors to develop and bring competing offerings to market more quickly, and could also enable some customers to develop in-house tools to perform functions currently addressed by our solutions.
Current report
In addition, some of our larger competitors have substantially broader product offerings and can bundle competing products and services with other software offerings which customers may choose even if individual products have more limited functionality than our solutions. These competitors may also offer their products at a lower price, which could increase pricing pressure on our offerings and cause the average sales price for our offerings to decline. These larger competitors are also often better positioned to withstand any significant reduction in capital spending, and will therefore not be as susceptible to economic downturns. One component of our enterprise platform involves assessing Cyber Exposure in a public cloud environment. We are dependent upon the providers to allow our solutions to access their cloud offerings. If one or more cloud providers elected to offer exclusively their own cloud security product or otherwise eliminate the ability of our solutions to access their cloud on behalf of our customers, our business and financial results could be harmed.
Current report
Additionally, the cybersecurity market is characterized by very rapid technological advances, changes in customer requirements, frequent new product introductions and enhancements and evolving industry standards. Our success depends on continued innovation to provide features that make our solutions responsive to the cybersecurity landscape, including the shift to employees working from home or in hybrid environments and the increasing adoption by organizations of cloud or hybrid cloud architectures.
Current report
Developing new solutions and product enhancements is uncertain, expensive and time-consuming, and there is no assurance that such activities will result in significant cost savings, revenue or other expected benefits. If we spend significant time and effort on research and development and are unable to generate an adequate return on our investment, our business and results of operations may be materially and adversely affected. Further, we may not be able to successfully anticipate or adapt to changing technology or customer requirements or the dynamic threat landscape on a timely basis, or at all, which would impair our ability to execute on our business strategy. Our competitors may be able to respond more quickly and effectively than we can to new or changing opportunities, technologies, standards or customer requirements or new or evolving attacks by, or indicators of compromise that identify cyber bad actors.
Current report
Furthermore, our current and potential competitors may establish cooperative relationships among themselves or with third parties that may further enhance their resources and products and services offerings in the markets we address. In addition, current or potential competitors may be acquired by third parties with greater available resources, which may enable them to adapt more quickly to new technologies and customer needs, devote greater resources to the promotion or sale of their products and services, initiate or withstand substantial price competition, take advantage of other opportunities more readily or develop and expand their product and service offerings more quickly than we do. For all of these reasons, we may not be able to compete successfully against our current or future competitors.
Current report
In addition, we maintain and promote an open-source community exchange, CyberAgents Exchange, which aggregates, indexes, and links to third-party AI agents, skills, Model Context Protocol (MCP) servers, and playbooks hosted on external repositories, such as GitHub. We do not control, fully audit, or maintain these third-party tools and cannot guarantee that they are secure, reliable, or non-infringing. Our indexing and promotion of these third-party tools could expose us to legal claims, including intellectual property infringement, data privacy, or product liability, and to reputational harm if an indexed component contains vulnerabilities, malicious code, or causes system compromise. Furthermore, our community terms may not provide enforceable indemnification from open-source developers, and associated risks may increase as the component listings expand.
Current report
If we do not generate sufficient cash flows, we may be unable to service all of our indebtedness.
Current report
To service our indebtedness, including the Convertible Senior Notes, we will require a significant amount of cash. Our ability to generate cash, make scheduled payments or refinance our debt obligations, including the Convertible Senior Notes, and to pay any cash amounts due upon conversion, repurchase or maturity of the Convertible Senior Notes, depends on our successful financial and operating performance, which may be affected by a range of economic, competitive and business factors, many of which are outside of our control and some of which are described elsewhere in the “Risk Factors” section of this report.
Current report
If our cash flows and capital resources are insufficient to fund our debt service obligations, or to repay any amounts outstanding under our Credit Agreement when it matures, or to pay the principal amount of and interest on our Convertible Senior Notes, including upon conversion, required repurchase or at maturity, we may have to undertake alternative financing plans, such as refinancing or restructuring our debt, selling assets or operations, reducing or delaying capital investments, or seeking to raise additional capital. We may not be able to refinance our debt, or any refinancing of our debt could be at higher interest rates and may require us to comply with more restrictive covenants that could further restrict our business operations. Our ability to implement successfully any such alternative financing plans will depend on a range of factors, including general economic conditions, the level of activity in capital markets generally, and the terms of our various debt instruments then in effect.
Current report
Covenants under our Credit Agreement may restrict our business and operations in many ways, and if we do not effectively manage our covenants, our financial condition and results of operations could be adversely affected.
Current report
Our Credit Agreement imposes various covenants that limit our ability and/or our restricted subsidiaries’ ability to, among other things:
Current report
• pay dividends or distributions, repurchase equity, prepay, redeem or repurchase certain debt, and make certain investments;
Current report
• incur additional debt and issue certain preferred stock;
Current report
• provide guarantees in respect of obligations of other persons;
Current report
• merge, consolidate with, or sell all or substantially all our assets to another person;
Current report
• designate subsidiaries as unrestricted subsidiaries; and
Current report
• prohibit certain restrictions on the ability of restricted subsidiaries to pay dividends or make other payments to us.
Current report
• place us at a competitive disadvantage compared to less leveraged competitors; and
Current report
If we are unable to successfully manage the limitations and decreased flexibility on our business due to our significant debt obligations, we may not be able to capitalize on strategic opportunities or grow our business to the extent we would be able to without these limitations.
Current report
Our failure to comply with any of the covenants could result in a default under the Credit Agreement, which could permit the administrative agent or the lenders to cause the administrative agent to declare the obligations outstanding under our Credit Agreement to be immediately due and payable or to exercise any remedies provided to the administrative agent, including proceeding against the collateral granted to secure our obligations under the Credit Agreement. An event of default under the Credit Agreement could also lead to a default under the terms of certain of our other agreements. Any such event of default or any exercise of rights and remedies by our creditors could seriously harm our business.
Current report
Our variable rate debt subjects us to interest rate risk that could cause our debt service obligations to increase significantly.
Current report
The indebtedness under our Credit Agreement is at variable rates of interest, which exposes us to interest rate risk. If interest rates increase, the debt service obligations on such indebtedness would increase even if the amount borrowed remains the same, and our net income and cash flows, including cash available for servicing our indebtedness, would correspondingly decrease. Certain of the variable rate indebtedness extended to us, including obligations under our Credit Agreement, uses the Secured Overnight Financing Rate, or SOFR, as a benchmark for establishing the interest rate. While we will continue to use SOFR, other factors may impact SOFR including factors causing SOFR to cease to exist, new methods of calculating SOFR to be established, or the use of an alternative reference rate(s). These consequences are not entirely predictable and could have an adverse impact on our financing costs, returns on investments, valuation of derivative contracts and our financial results.
Current report
Any failure to protect our proprietary technology and intellectual property rights could substantially harm our business and operating results.
Current report
Our success and ability to compete depend in part on our ability to protect our proprietary technology and intellectual property. To safeguard these rights, we rely on a combination of patent, trademark, copyright and trade secret laws and contractual protections in the United States and other jurisdictions, all of which provide only limited protection and may not now or in the future provide us with a competitive advantage.
Current report
At September 30, 2026, we had 55 issued patents and 22 patent applications pending in the United States relating to our technology. We cannot assure you that any patents will issue from any patent applications, that patents that issue from such applications will give us the protection that we seek or that any such patents will not be challenged, invalidated or circumvented. Any patents that may issue in the future from our pending or future patent applications may not provide sufficiently broad protection and may not be enforceable in actions against alleged infringers. Obtaining and enforcing software patents in the United States is becoming increasingly challenging. Any patents we have obtained or may obtain in the future may be found to be invalid or unenforceable in light of recent and future changes in the law. We have registered the “Tenable” and “Nessus,” and our Tenable logo in the United States and certain other countries. We have registrations and/or pending applications for additional trademarks; however, we cannot assure you that any future trademark registrations will be issued for pending or future applications or that any registered trademarks will be enforceable or provide adequate protection of our proprietary rights. While we have copyrights in our software, we do not typically register such copyrights with the Copyright Office. This failure to register the copyrights in our software may preclude us from obtaining statutory damages for infringement under certain circumstances. We also license software from third parties for integration into our software, including open source software and other software available on commercially reasonable terms. We cannot assure you that such third parties will maintain such software or continue to make it available.
Current report
In order to protect our unpatented proprietary technologies and processes, we rely on trade secret laws and confidentiality and invention assignment agreements with our employees, consultants, strategic partners, vendors and others. Despite our efforts to protect our proprietary technology and trade secrets, unauthorized parties may attempt to misappropriate, copy, reverse engineer or otherwise obtain and use them. In addition, others may independently discover our trade secrets, in which case we would not be able to assert trade secret rights, or develop similar technologies and processes. Further, several agreements may give customers limited rights to access portions of our proprietary source code, and the contractual provisions that we enter into may not prevent unauthorized use or disclosure of our proprietary technology or intellectual property and may not provide an adequate remedy in the event of unauthorized use or disclosure of our proprietary technology or intellectual property rights. Moreover, policing unauthorized use of our technologies, trade secrets and intellectual property is difficult, expensive and time-consuming, particularly in foreign countries where the laws may not be as protective of intellectual property rights as those in the United States and where mechanisms for enforcement of intellectual property rights may be weak. To the extent that we expand our activities outside of the United States, our exposure to unauthorized copying and use of our solutions and proprietary information may increase. We may be unable to determine the extent of any unauthorized use or infringement of our solutions, technologies or intellectual property rights.
Current report
There can be no assurance that the steps that we take will be adequate to protect our proprietary technology and intellectual property, that others will not develop or patent similar or superior technologies, solutions or services, or that our trademarks, patents, and other intellectual property will not be challenged, invalidated or circumvented by others. Furthermore, effective trademark, patent, copyright, and trade secret protection may not be available in every country in which our software is available or where we have employees or independent contractors. In addition, the legal standards relating to the validity, enforceability, and scope of protection of intellectual property rights in internet and software-related industries are uncertain and still evolving.
Current report
In addition, our employees use generative AI tools in certain circumstances to perform portions of their work. Although we maintain internal governance controls designed to regulate employee use of generative AI tools, these controls or employee adherence to them may fail to prevent the inadvertent, improper, or unauthorized input of information that is proprietary, confidential or sensitive, including trade secrets, into AI systems in a manner that results in unauthorized disclosure or loss of confidentiality. Many generative AI tools are provided by third-party vendors, and we may have limited ability to control or verify how information submitted by employees is processed, stored, retained, or used by such providers, including whether such information may be incorporated into model training or otherwise accessed or disclosed. Any failure to adequately prevent the disclosure or misuse of our proprietary or confidential information, whether due to employee error, inadequate controls, evolving AI system functionality, or third-party practices, could result in the loss of trade secret protection and the disclosure of confidential information related to our inventions and product candidates, which could preclude us from obtaining patents covering disclosed inventions and product candidates, all of which could adversely affect our business.
Current report
In order to protect our intellectual property rights, we may be required to spend significant resources to monitor and protect these rights. Litigation brought to protect and enforce our intellectual property rights could be costly, time-consuming and distracting to management and could result in the impairment or loss of portions of our intellectual property. Furthermore, our efforts to enforce our intellectual property rights may be met with defenses, counterclaims and countersuits attacking the validity and enforceability of our intellectual property rights. Our failure to secure, protect and enforce our intellectual property rights could seriously adversely affect our brand and adversely impact our business.
Current report
Future sales of substantial amounts of our common stock in the public markets by us or our stockholders, or the perception that such sales might occur, could reduce the price that our common stock might otherwise attain.
Current report
Sales of a substantial number of shares of our common stock in the public market by us or our stockholders, or the perception that these sales might occur, could depress the market price of our common stock, impair our ability to raise capital through the sale of additional equity securities and make it more difficult for you to sell your common stock at a time and price that you deem appropriate. Further, the number of new shares of our common stock issued by us in connection with raising additional capital in connection with a financing, acquisition, investment or otherwise could result in substantial dilution to our existing stockholders. The conversion of some or all of the Convertible Senior Notes may also dilute the ownership interests of our stockholders. Upon conversion of the Convertible Senior Notes, we will pay cash up to the aggregate principal amount of the notes to be converted, but we have the option to pay or deliver, as the case may be, cash, shares of our common stock, or a combination of cash and shares of our common stock in respect of the remainder, if any, of our conversion obligation in excess of the aggregate principal amount of the Convertible Senior Notes being converted. If we elect to settle the remainder, if any, of our conversion obligation in excess of the aggregate principal amount of the Convertible Senior Notes being converted in shares of our common stock or a combination of cash and shares of our common stock, any sales in the public market of our common stock issuable upon such conversion could adversely affect prevailing market prices of our common stock. In addition, the existence of the Convertible Senior Notes may encourage short selling by market participants because the conversion of the Convertible Senior Notes could be used to satisfy short positions, or anticipated conversion of the Convertible Senior Notes into shares of our common stock could depress the price of our common stock.
Current report
In addition, we have filed registration statements on Form S-8 under the Securities Act registering the issuance of shares of common stock subject to options and other equity awards issued or reserved for future issuance under our equity incentive plans. Shares registered under these registration statements, and under additional registration statements on Form S-8 that we may file to register additional shares of common stock pursuant to provisions of our equity incentive plans that provide for an automatic increase in the number of shares reserved and available for issuance each year, are available for sale in the public market subject to vesting arrangements and exercise of options and the restrictions of Rule 144 under the Securities Act in the case of our affiliates.
Current report
We may not have the ability to raise the funds necessary to settle conversions of the notes in cash, to repay the notes at maturity or to repurchase the notes upon a fundamental change, and our future debt may contain limitations on our ability to pay cash upon conversion or repurchase of the notes.
Current report
Holders of the Convertible Senior Notes have the right, subject to certain conditions, to require us to repurchase all or any portion of their Convertible Senior Notes upon the occurrence of a fundamental change at a fundamental change repurchase price equal to 100% of the principal amount of the Convertible Senior Notes to be repurchased, plus accrued and unpaid interest to, but excluding, the fundamental change repurchase date. Upon maturity of the Convertible Senior Notes, we must pay the principal amount of the Convertible Senior Notes plus accrued and unpaid interest in cash, unless the Convertible Senior Notes have been previously repurchased, redeemed or converted. In addition, upon conversion of the Convertible Senior Notes, we will be required to make cash payments for each $1,000 in principal amount of Convertible Senior Notes converted of at least the lesser of $1,000 and the sum of the daily conversion values. However, we may not have enough available cash or be able to obtain financing at the time we are required to make repurchases of Convertible Senior Notes surrendered therefor or pay cash with respect to Convertible Senior Notes being converted. In addition, our future debt may prohibit us from making any cash payments upon the conversion of the Convertible Senior Notes or upon repurchase of the Convertible Senior Notes in connection with a fundamental change. Our ability to repurchase the Convertible Senior Notes or to pay cash upon conversions or at maturity of the Convertible Senior Notes may also be limited by law or by regulatory authority. Our failure to repurchase Convertible Senior Notes at a time when the repurchase is required by the indenture governing the Convertible Senior Notes or to pay any cash payable on future conversions or at maturity of the Convertible Senior Notes as required by the indenture governing the Convertible Senior Notes would constitute a default under such indenture. A default under the indenture governing the Convertible Senior Notes or the fundamental change itself could also lead to a default under agreements governing our existing or future indebtedness. If the repayment of the related indebtedness were to be accelerated after any applicable notice or grace periods, we may not have sufficient funds to repay the indebtedness and repurchase the Convertible Senior Notes or make cash payments upon conversions thereof.
Showing the first 40 of 53 passages. Open the source sections for the rest.
Reworded paragraphs (10)
Previous wording
Remote work and use of remote devices has increased risks to our information technology systems and data, as more of our personnel utilize network connections, computers and devices outside of our premises or network, including working at home, while in transit and in public locations. Future or past business transactions, such as acquisitions or integrations, could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities' systems and technologies. Furthermore, we may discover security issues that were not identified during due diligence of such acquired or integrated entities, and it may be difficult to integrate other companies into our information technology environment and security program.
Current wording
Remote work and use of remote devices have increased risks to our information technology systems and data, as more of our personnel utilize network connections, computers and devices outside of our premises or network, including working at home, while in transit and in public locations. Future or past business transactions, such as acquisitions or integrations, could expose us to additional cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated entities' systems and technologies. Furthermore, we may discover security issues that were not identified during due diligence of such acquired or integrated entities, and it may be difficult to integrate other companies into our information technology environment and security program.
Previous wording
We rely on third-party service providers and technologies to operate critical business systems, including processing confidential and sensitive information, including, without limitation, cloud-based infrastructure, data center facilities, encryption and authentication technology, employee email and other functions. We also rely on third-party service providers to provide other products, services, or otherwise, to operate our business and elements of our infrastructure, including endpoints. Our ability to monitor these third parties' information security practices is limited, and these third parties may not have adequate information security measures in place. Additionally, software errors or vulnerabilities in these third-party technologies could result in significant disruptions to our information technology systems, leading to downtime, data loss, or compromised data integrity. Our use of generative AI technologies may increase the risks associated with open source software and other third-party components, including where such technologies retrieve or recommend malicious or vulnerable code from public repositories or other third-party sources that may be used without appropriate review.
Current wording
We rely on third-party service providers and technologies to operate critical business systems, including processing confidential and sensitive information, including, without limitation, cloud-based infrastructure, data center facilities, encryption and authentication technology, employee email and other functions. We also rely on third-party service providers to provide other products, services, or otherwise, to operate our business and elements of our infrastructure, including endpoints. Our ability to monitor these third parties' information security practices is limited, and these third parties may not have adequate information security measures in place. Additionally, software errors or vulnerabilities in these third-party technologies could result in significant disruptions to our information technology systems, leading to downtime, data loss, or compromised data integrity. Our use of generative AI technologies may increase our cybersecurity risks, including the likelihood that our products or systems are specifically targeted with cyberattacks aimed at exploiting, exfiltrating, or replicating the capabilities of restricted frontier AI models, such as Mythos or other frontier models that are not generally available, as well as risks associated with open source software and other third-party components, including where such technologies retrieve or recommend malicious or vulnerable code from public repositories or other third-party sources that may be used without appropriate review.
Previous wording
If our third-party service providers or partners experience a security incident or other interruption or cause an extended outage or disruption to our systems, we could experience adverse consequences. It is possible that our customers and potential customers would hold us accountable for any security incident affecting our third-party service providers’ or partners' infrastructure or other interruption caused by our third-party service providers or partners that impacts our infrastructure. We may incur significant liability from those customers and from other third parties with respect to any such incident. Because our agreements with certain third-party service providers, such as AWS and Snowflake, limit their liability for damages, we may not be able to recover a material portion of our liabilities to our customers and third parties arising from issues with such third-party service providers, such as AWS and Snowflake, in the event of an incident affecting the third parties’ systems. Moreover, while we may be entitled to damages from third-party service providers if they fail to satisfy their privacy or security-related obligations to us or if they cause a disruption in our infrastructure, any award may be insufficient to cover our damages, or we may be unable to recover such reward. In addition, supply-chain attacks have increased in frequency and severity and there have been high-profile incidents of third-party service providers causing widespread disruptions in their customers' infrastructures due to errors in their SaaS offerings. We cannot guarantee that third parties’ infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised or that errors by our third-party service providers won’t cause disruptions in our infrastructure.
Current wording
If our third-party service providers or partners experience a security incident or other interruption or cause an extended outage or disruption to our systems, we could experience adverse consequences. It is possible that our customers and potential customers would hold us accountable for any security incident affecting our third-party service providers’ or partners' infrastructure or other interruption caused by our third-party service providers or partners that impacts our infrastructure. We may incur significant liability from those customers and from other third parties with respect to any such incident. Because our agreements with certain third-party service providers, such as AWS and Snowflake, limit their liability for damages, we may not be able to recover a material portion of our liabilities to our customers and third parties arising from issues with such third-party service providers, such as AWS and Snowflake, in the event of an incident affecting the third parties’ systems. Moreover, while we may be entitled to damages from third-party service providers if they fail to satisfy their privacy or security-related obligations to us or if they cause a disruption in our infrastructure, any award may be insufficient to cover our damages, or we may be unable to recover such award. In addition, supply-chain attacks have increased in frequency and severity and there have been high-profile incidents of third-party service providers causing widespread disruptions in their customers' infrastructures due to errors in their SaaS offerings. We cannot guarantee that third parties’ infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised or that errors by our third-party service providers will not cause disruptions in our infrastructure.
Previous wording
The reliability and continuous availability of our solutions is critical to our success. We have experienced errors or defects in the past in connection with the release of new solutions and product upgrades, and we expect that these errors or defects will be found from time to time in the future in new or enhanced solutions after commercial release. For example, on December 31, 2024, we identified Nessus agents versions 10.8.0 and 10.8.1 going offline under certain conditions which impacted the availability of our Vulnerability Management and Security Center solutions for certain customers. Upon discovery of the incident, we developed and released a version 10.8.2 of our Nessus agent on January 2, 2025, which enabled affected customers to resolve the issue. Although the financial impacts of this incident have not been significant, similar incidents in the future could result in costs associated with service-level credits and loss of customer trust, which could have a material adverse effect on our business and financial performance. In addition, we use third parties to assist in the development of our products and these third parties could be a source of errors or defects. Some defects may cause our solutions to be vulnerable to attacks, cause them to fail to detect vulnerabilities, or temporarily interrupt customers’ networking traffic or operational technology environments, any of which may damage our customers’ business and could hurt our reputation.
Current wording
The reliability and continuous availability of our solutions is critical to our success. We have experienced errors or defects in the past in connection with the release of new solutions and product upgrades, and we expect that these errors or defects will be found from time to time in the future in new or enhanced solutions after commercial release. For example, on December 31, 2024, we identified Nessus agents versions 10.8.0 and 10.8.1 going offline under certain conditions which impacted the availability of our Vulnerability Management and Security Center solutions for certain customers. Upon discovery of the incident, we developed and released version 10.8.2 of our Nessus agent on January 2, 2025, which enabled affected customers to resolve the issue. Although the financial impacts of this incident have not been significant, similar incidents in the future could result in costs associated with service-level credits and loss of customer trust, which could have a material adverse effect on our business and financial performance. In addition, we use third parties to assist in the development of our products and these third parties could be a source of errors or defects. Some defects may cause our solutions to be vulnerable to attacks, cause them to fail to detect vulnerabilities, or temporarily interrupt customers’ networking traffic or operational technology environments, any of which may damage our customers’ business and could hurt our reputation.
Previous wording
We have incorporated and expect to continue to incorporate and further expand our use of AI features in certain of our products and services, including ExposureAI, Tenable AI Assistant and Hexa AI within Tenable One. The use of AI technologies, including generative AI processes, at scale is relatively new, and may lead to challenges, concerns and risks, including various privacy and security risks that are significant or that we may not be able to predict, especially if our use of these technologies in our products and services becomes more important to our operations over time. The technologies underpinning these features are in the early stages of commercial use and exist in an emerging regulatory environment with heightened regulatory scrutiny, which presents regulatory, litigation, ethical, safety, reputational, operational and financial risks. AI in our products and services may be complex to deploy successfully due to operational issues inherent to the nature of such technologies, including the availability, development, maintenance and operation of deep learning datasets and third-party dependencies.
Current wording
We have incorporated and expect to continue to incorporate and further expand our use of AI features in certain of our products and services, including ExposureAI, Tenable AI Assistant and Hexa AI within Tenable One. The use of AI technologies, including generative AI processes, at scale is relatively new, and may lead to challenges, concerns and risks, including various privacy and security risks that are significant or that we may not be able to predict or control, especially if our or our customers' use of these technologies in our products and services becomes more important to our operations over time. The technologies underpinning these features are in the early stages of commercial use and exist in an emerging regulatory environment with heightened regulatory scrutiny, which presents regulatory, litigation, ethical, safety, reputational, operational and financial risks. AI in our products and services may be complex to deploy successfully due to operational issues inherent to the nature of such technologies, including model misalignment or the availability, development, maintenance and operation of deep learning datasets and third-party dependencies.
Previous wording
Our AI technology features may also generate output that is misleading, insecure, inaccurate, harmful or otherwise flawed. Agentic AI solutions may compound those risks by taking or implementing actions or outputs, which themselves may be based on flawed outputs, that further increase the risk of misleading, insecure, inaccurate, harmful or otherwise flawed outcomes. This risk extends to our enterprise operations, as employee use of third-party agentic AI solutions, such as browser plug-ins or other automated applications, could result in actions being taken without adequate human review or monitoring. Such unauthorized automated actions could, for example, lead to the inadvertent disclosure or modification of corporate data or other sensitive information, flawed communications to customers or partners, or the creation of unintended legal or financial obligations on behalf of the company. Our customers or others may rely on or use such misleading, insecure, harmful or otherwise flawed content to their detriment, which may harm our brand, reputation, business or customers, cause competitive harm or expose us to legal liability. For example, AI algorithms use machine learning and predictive analytics which may be insufficient or of poor quality and reflect inherent biases and could lead to flawed, biased, and inaccurate results. Deficient or inaccurate recommendations, forecasts, or analyses that generative AI applications assist in producing could lead to customer rejection or skepticism of our products, affect our reputation or brand, and negatively affect our financial results. Further, unauthorized use or misuse of AI by our employees or others may result in disclosure of confidential company and customer data, reputational harm, privacy law violations and legal liability. Our use of generative AI may also lead to novel and urgent cybersecurity risks, including those related to personal data, which may adversely affect our operations and reputation, and these risks likely are compounded by our use of agentic AI.
Current wording
Our AI technology features may also generate output that is misleading, insecure, inaccurate, harmful or otherwise flawed. Agentic AI solutions may compound those risks by taking or implementing actions or outputs, which themselves may be based on flawed outputs, that further increase the risk of misleading, insecure, inaccurate, harmful or otherwise flawed outcomes. This risk extends to our enterprise operations, as employee use of third-party agentic AI solutions, such as browser plug-ins or other automated applications, could result in actions being taken without adequate human review or monitoring. Such unauthorized automated actions could, for example, lead to the inadvertent disclosure or modification of corporate data or other sensitive information, flawed communications to customers or partners, or the creation of unintended legal or financial obligations on behalf of the company. Our customers or others may rely on or use such misleading, insecure, harmful or otherwise flawed content to their detriment, which may harm our brand, reputation, business or customers, cause competitive harm or expose us to legal liability. For example, AI algorithms use machine learning and predictive analytics which may be insufficient or of poor quality and reflect inherent biases and could lead to flawed, biased, and inaccurate results. Deficient or inaccurate recommendations, forecasts, or analyses that generative AI applications assist in producing could lead to customer rejection or skepticism of our products, affect our reputation or brand, and negatively affect our financial results.
Previous wording
While AI features are presently increasing in popularity, we have no assurance that our AI technologies will continue to be accepted and sought by customers. The development of generative and agentic AI technologies is complex, and there are technical challenges associated with achieving the desired level of accuracy, efficiency, and reliability. The algorithms and models utilized in generative or agentic AI systems may have limitations, including biases, errors, or inability to handle certain data types or scenarios. Furthermore, there is a risk of system failures, disruptions, or vulnerabilities that could compromise the integrity, security or privacy of the generated content. These limitations or failures could result in reputational damage, legal liabilities, or loss of customer confidence, which, in turn, could result in lower than anticipated demand from customers to adapt our AI features. We have, and will continue, to dedicate significant resources to developing and deploying generative, agentic, or other AI features in our products and services, without assurances that we will, or will continue to, see customer demand and market conditions to support those investments.
Current wording
While AI features are presently increasing in popularity, we have no assurance that our AI technologies or associated services and offerings will continue to be accepted and sought by customers. The development of generative and agentic AI technologies is complex, and there are technical challenges associated with achieving the desired level of accuracy, efficiency, and reliability. The algorithms and models utilized in generative or agentic AI systems may have limitations, including biases, errors, or inability to handle certain data types or scenarios. Furthermore, there is a risk of system failures, disruptions, or vulnerabilities that could compromise the integrity, security or privacy of the generated content. These limitations or failures could result in reputational damage, legal liabilities, or loss of customer confidence, which, in turn, could result in lower than anticipated demand from customers to adopt our AI features. We have, and will continue, to dedicate significant resources to developing and deploying generative, agentic, or other AI features in our products and services, without assurances that we will, or will continue to, see customer demand and market conditions to support those investments.
Previous wording
We rely, and likely will continue to rely, on third parties to support our use of AI in our products and services. Our ability to offer AI-powered products and services may be adversely impacted if any of our third-party AI providers, or other AI-related third-party vendors, develops or deploys AI tools that are unlawful, unreliable, unsecure, or unavailable. If we cannot use third-party AI, or that use is restricted, our business may be less efficient or we may be at a competitive disadvantage, which could adversely affect our business, financial condition, customer loyalty, and reputation.
Current wording
We rely, and likely will continue to rely, on third parties to support our use of AI in our products and services. Our ability to offer AI-powered products and services may be adversely impacted if any of our third-party AI providers, or other AI-related third-party vendors, develops or deploys AI tools that are unlawful, unreliable, unsecure, unavailable, limited to certain jurisdictions, subject to national security restrictions, or are the subject of successful cybersecurity attacks. If we cannot use third-party AI, that use is restricted, or our competitors and/or customers use AI technologies more effectively than we do, our business may be less efficient or we may be at a competitive disadvantage, which could adversely affect our business, financial condition, customer loyalty, and reputation.
Previous wording
A portion of our revenue is generated from subscriptions and perpetual licenses sold to governmental entities in the United States. Additionally, many of our current and prospective customers, such as those in the financial services, energy, insurance and healthcare industries, are highly regulated and may be required to comply with more stringent regulations in connection with subscribing to and implementing our enterprise platform. Selling licenses to these entities can be highly competitive, expensive and time-consuming, often requiring significant upfront time and expense without any assurance that we will successfully complete a sale. Governmental demand and payment for our enterprise platform may also be impacted by public sector budgetary cycles, funding authorizations and budget shortfalls, the operational stability of government agencies, and the prioritization of cybersecurity and digital infrastructure initiatives. Funding reductions or delays, including those resulting from a U.S. government shutdown, reductions or eliminations of agency operating budgets or deprioritization of cybersecurity digital infrastructure related initiatives would adversely affect public sector demand for our enterprise platform. For example, the U.S. presidential administration's priorities and actions to reduce government spending, including, but not limited to, those previously driven by the Department of Government Efficiency, may impact the availability of funding for U.S. government customers as a result of the elimination of departments and personnel. These actions may lead to elongated sales cycles and procurement decisions and could result in fewer contract opportunities or reduced funding for existing initiatives, all of which would adversely affect our business and financial performance. In addition, governmental entities have the authority to terminate contracts at any time for the convenience of the government, which creates risk regarding revenue anticipated under our existing government contracts.
Current wording
A portion of our revenue is generated from subscriptions and perpetual licenses sold to governmental entities in the United States. Additionally, many of our current and prospective customers, such as those in the financial services, energy, insurance and healthcare industries, are highly regulated and may be required to comply with more stringent regulations in connection with subscribing to and implementing our enterprise platform. Selling licenses to these entities can be highly competitive, expensive and time-consuming, often requiring significant upfront time and expense without any assurance that we will successfully complete a sale. Governmental demand and payment for our enterprise platform may also be impacted by public sector budgetary cycles, funding authorizations and budget shortfalls, the operational stability of government agencies, and the prioritization of cybersecurity and digital infrastructure initiatives. Funding reductions or delays, including those resulting from a U.S. government shutdown, reductions or eliminations of agency operating budgets or deprioritization of cybersecurity digital infrastructure related initiatives, would adversely affect public sector demand for our enterprise platform. For example, shifts in the U.S. government's spending priorities and any future actions to reduce government spending may impact the availability of funding for U.S. government customers as a result of the elimination of departments and personnel. These actions may lead to elongated sales cycles and procurement decisions and could result in fewer contract opportunities or reduced funding for existing initiatives, all of which would adversely affect our business and financial performance. In addition, governmental entities have the authority to terminate contracts at any time for the convenience of the government, which creates risk regarding revenue anticipated under our existing government contracts.
Previous wording
Further, governmental and highly regulated entities often require contract terms that differ from our standard customer arrangements, including terms that can lead to those customers obtaining broader rights in our solutions than would be expected under a standard commercial contract and terms that can allow for early termination. The U.S. government will be able to terminate any of its contracts with us either for its convenience or if we default by failing to perform in accordance with the contract schedule and terms. Termination for convenience provisions would generally enable us to recover only our costs incurred or committed, settlement expenses, and profit on the work completed prior to termination. Termination for default provisions do not permit these recoveries and would make us liable for excess costs incurred by the U.S. government in procuring undelivered items from another source. Contracts with governmental and highly regulated entities may also include preferential pricing terms. In the United States, federal government agencies may promulgate regulations, and the President may issue executive orders, requiring federal contractors to adhere to different or additional requirements after a contract is signed. If we do not meet applicable requirements of law or contract, we could be subject to significant liability from our customers or regulators. Even if we do meet these requirements, the additional costs associated with providing our enterprise platform to government and highly regulated customers could harm our operating results. Moreover, changes in the underlying statutory and regulatory conditions that affect these types of customers could harm our ability to efficiently provide them access to our enterprise platform and to grow or maintain our customer base. In addition, engaging in sales activities to foreign governments introduces additional compliance risks, including risks specific to anti-bribery regulations, including the U.S. Foreign Corrupt Practices Act of 1977, as amended, or the FCPA, the U.K. Bribery Act 2010 and other similar statutory requirements prohibiting bribery and corruption in the jurisdictions in which we operate. Further, in some jurisdictions we may be required toobtain government certifications, which may be costly to maintain and, if we lost such certifications in the future or if such certification requirements changed, would restrict our ability to sell to government entities until we have attained such certifications. Furthermore, our ability to maintain or expand our business with government customers depends on our continued ability to comply with rapidly evolving restrictions on the use of and rights to certain artificial intelligence models, features, or output, such as those which may evolve from draft acquisition regulations and supplements clauses, such as Proposed GSAR Clause 552.239-700; proposed updates to NIST frameworks; and/or supply chain security designations, such as recent federa…
Excerpt shortened here; the source contains the full paragraph.
Current wording
Termination for default provisions do not permit these recoveries and would make us liable for excess costs incurred by the U.S. government in procuring undelivered items from another source. Contracts with governmental and highly regulated entities may also include preferential pricing terms. In the United States, federal government agencies may promulgate regulations, and the President may issue executive orders, requiring federal contractors to adhere to different or additional requirements after a contract is signed. If we do not meet applicable requirements of law or contract, we could be subject to significant liability from our customers or regulators. Even if we do meet these requirements, the additional costs associated with providing our enterprise platform to government and highly regulated customers could harm our operating results. Moreover, changes in the underlying statutory and regulatory conditions that affect these types of customers could harm our ability to efficiently provide them access to our enterprise platform and to grow or maintain our customer base. In addition, engaging in sales activities to foreign governments introduces additional compliance risks, including risks specific to anti-bribery regulations, including the U.S. Foreign Corrupt Practices Act of 1977, as amended, or the FCPA, the U.K. Bribery Act 2010 and other similar statutory requirements prohibiting bribery and corruption in the jurisdictions in which we operate. Further, in some jurisdictions we may be required to obtain government certifications, which may be costly to maintain and, if we lost such certifications in the future or if such certification requirements changed, would restrict our ability to sell to government entities until we have attained such certifications. Furthermore, our ability to maintain or expand our business with government customers depends on our continued ability to comply with rapidly evolving restrictions on the use of and rights to certain artificial intelligence models, features, or output, such as those which may evolve from draft acquisition regulations and supplements clauses, such as Proposed GSAR Clause 552.239-700; proposed updates to NIST frameworks; and/or supply chain security designations, such as recent federal actions identifying specific third-party AI providers and models as supply chain risks. Any future adverse regulatory designation against our third-party AI providers could require us to rapidly re-engineer our solutions at significant cost, disrupt existing government contracts, or disqualify us from future solicitations. Future changes to acquisition regulations and NIST frameworks could require us to alter what rights we grant in the use of our products, what intellectual property rights we grant customers, how we track code generation, and how humans are in the loop for code review and approval.
Rearranged current paragraphs (2)
Current report — wording carried from elsewhere
Further, although we maintain internal AI governance frameworks, policies, and oversight protocols designed to regulate employee adoption and use of AI tools across our business, including in product development, testing, and customer support, we cannot guarantee that employees will strictly adhere to these controls. Ineffective governance, policy non-compliance, or gaps in employee oversight could result in software defects or security vulnerabilities within our code base, deficient or unreliable customer support guidance, or the unauthorized use or misuse of AI resulting in disclosure of confidential company and customer data, reputational harm, privacy law violations and legal liability. Our use of generative AI may also lead to novel and urgent cybersecurity risks, including those related to personal data, which may adversely affect our operations and reputation, and these risks likely are compounded by our use of agentic AI.
Current report — wording carried from elsewhere
Further, governmental and highly regulated entities often require contract terms that differ from our standard customer arrangements, including terms that can lead to those customers obtaining broader rights in our solutions than would be expected under a standard commercial contract and terms that can allow for early termination. The U.S. government will be able to terminate any of its contracts with us either for its convenience or if we default by failing to perform in accordance with the contract schedule and terms. Termination for convenience provisions would generally enable us to recover only our costs incurred or committed, settlement expenses, and profit on the work completed prior to termination.