Tenable (TENB) 2026 年第三季法說會：Tenable One 帶動成長並上調財測指引

重點摘要

• 2026 財年第三季營收年增 9.5% 至 2.764 億美元，其中經常性營收佔總營收的 95%。
• Tenable One 佔新業務的比例達到創紀錄的 59%，高於 2026 財年第二季的 50% 和 2025 財年第三季的 39%。該平台在本季結束時擁有超過 5,000 名客戶。
• 淨美元擴展率從第二季的 106% 上升至 107%，連續第二個季度增長。當期計算帳單金額 (CCB) 增長 9%。
• Non-GAAP 營業利益率年擴增 380 個基點至 27.1%，無槓桿自由現金流成長 18.7% 至 6,940 萬美元。
• Tenable 上調了 2026 財年全年的營收、Non-GAAP 營業利益、淨利和稀釋後每股盈餘 (EPS) 指引。管理層預計第四季 CCB 成長將略有改善，淨美元擴展率將保持在 107%。
• 管理層將 AI 驅動的曝險成長、Tenable One 遷移和 Hexa AI 的採用列為主要需求驅動因素，但表示要量化 PHP to Shell 漏洞的商業影響還為時過早。

核心財務數據

業務與營運表現

Tenable One 是主要的成長引擎。該平台在新業務中的占比創下新高，而從獨立漏洞管理產品進行遷移則支撐了更高的交易規模和淨美元擴展率。管理層表示，本季有數百名漏洞管理客戶過渡到 Tenable One。

該公司報告了 Tenable One 新客戶增長最亮眼的一個季度，超過一半的客戶選擇了 Advanced 套裝。管理層表示，平台客戶產生的平均客戶價值是獨立 SKU 客戶的兩倍，而從 Nessus 升級至平台的客戶付費約為 Nessus 客戶的 15 倍。

Hexa AI 促進了平台的採用。自 6 月以來，Hexa 已評估了超過 20 億個資產與發現。據 Tenable 稱，使用 Hexa 的客戶解決的關鍵曝險是同類客戶的 2 到 3 倍。更高的使用率也帶動了額外擴充容量的使用，但管理層表示，主要的營收效益來自於客戶升級至 Tenable One，特別是 Advanced 級別。

該公司還將 Hexa 擴展為可協同作戰的代理程式（Agent）集群，能夠識別曝險、統籌修復並驗證修復結果。Tenable 推出了跨廠商的 Cyber Agents Exchange，並表示其已在一筆將代理型 AI 列為採購要求的競爭性金融服務交易中發揮了影響力。

來自端點安全廠商的競爭活動依然存在，但管理層表示 Tenable 的勝率有所提升。公司將勝出歸因於更廣泛的資產涵蓋範圍、漏洞精準度、攻擊路徑分析、Hexa AI 以及整合多種安全工具的能力。

營運技術（OT）安全全球需求依然強勁。管理層特別強調了美國聯邦、州和地方市場的成長勢頭，包括與關鍵基礎設施和水處理系統相關的需求。

管理層指引

管理層預計第四季 CCB 成長將較 9% 略微提高，淨美元擴展率將保持在 107%。公司還預計毛利率將維持在歷史 80% 出頭的區間。

Tenable 表示，更強勁的營運表現、債務再融資效益以及第三季一次性稅收優惠，支撐了更高的全年獲利展望。該稅收優惠使 Non-GAAP 淨利增加 330 萬美元，稀釋後 EPS 增加 0.03 美元。

資本配置

Tenable 透過發行可轉換公司債籌集了 8 億美元。公司利用所得款項償還了現有的 B 期定期貸款，進行了封頂買權（capped call）交易（上限價格為 64.06 美元），並以 1.705 億美元庫藏股回購了 530 萬股。

此外，該公司在第三季單獨以 5,300 萬美元回購了 150 萬股。今年截至目前，公司已以約 24.93 美元的均價回購了 1,820 萬股，總金額約 4.54 億美元。截至季末，Tenable 在現有授權下仍剩餘 5,400 萬美元的回購額度。

再融資將債務到期日延長至 2031 年 9 月。Tenable 還於 10 月 13 日完成了 4 億美元的旋轉信用貸款協議，提升了其流動性能力。

風險與關注焦點

• 管理層表示，由於該漏洞是在本季末披露的，因此要量化 PHP to Shell 對未來業務的影響還為時過早。
• AI 正透過模型、代理程式（Agent）和 MCP 伺服器加速漏洞發現並擴大攻擊面，進而提高客戶修復需求的敏捷度與複雜性。
• Tenable 繼續面臨大型平台廠商、傳統漏洞管理提供者和新進者的競爭。管理層表示，第三季競爭環境未發生重大變化。
• 聯邦需求仍受制於預算時程和潛在的持續授權法案（continuing resolution）。管理層指出，根據選舉結果，目前的持續授權法案可能會延長至 1 月。
• 營收落後於預訂額（bookings）及其他領先指標，因此更強勁的新業務和商機管道（pipeline）活動可能不會立即轉化為呈報的營收成長。

分析師問答集錦

Tenable One 採用率：管理層表示，成長來自新客戶、獨立漏洞管理客戶的轉換，以及舊版 Tenable One SKU 的遷移。大型客戶越來越多地採用多種資產類型和 Advanced 級別功能。

定價與 Hexa 使用率：Tenable 計劃保留基於資產的定價方式，而不是按掃描頻率計費（後者可能會抑制使用意願）。Hexa 容量已包含在平台套裝中，當客戶超過其配額時，可購買擴充 SKU。

PHP to Shell：在該漏洞披露後，Hexa 提示詞（prompt）使用量激增多達五倍。管理層報告網路研討會參與人數和網站流量均有所增加，但強調由於時間關係，該事件對第三季業績影響微乎其微。

利潤率：管理層表示，Hexa 使用量的增加目前並未對毛利率構成壓力，因為使用該功能需要升級平台，而超過套件限制的額外使用量將單獨變現。

成長軌跡：管理層對 Tenable 的長期目標表達了信心，理由是更強勁的新業務、預訂額、商機轉化率和平台採用率。公司未提供 2026 財年第四季和全年之外的額外營收指引。

完整財報電話會議紀錄

---

完整財報電話會議逐字稿

管理層陳述

Operator

Greetings, and welcome to the Tenable Q3 2026 Earnings Conference Call. [Operator Instructions] As a reminder, this conference is being recorded. It is now my pleasure to introduce your host, Erin Karney, Vice President, Investor Relations. Thank you. You may begin.

Erin Karney

Thank you, operator, and thank you all for joining us on today's conference call to discuss Tenable's third quarter financial results. With me on the call today are Co-Chief Executive Officers, Steve Vince and Mark Thurman and Chief Financial Officer, Matt Brown.

Prior to this call, we issued a press release announcing our financial results for the quarter. You can find the press release on our IR website at tenable.com. We will make forward-looking statements during the course of this call, including statements relating to our guidance and expectations for the fourth quarter and full year 2026 and growth and drivers in our business, changes in the threat landscape in the security industry, particularly regarding AI security, the expected impact of Frontier AI models on accelerated vulnerability discovery and the shift to preemptive security. The expected size, durability and growth of the market opportunity created by the shift to AI-driven exposure management.

Our competitive position in the market growth in customer demand for and adoption of our solutions, including the impact of new pricing and packaging models, the expansion of Tenable One, including a genetic AI security orchestration through Hexa AI and planned AI exposure coverage across third-party models, the expected growth, adoption and role of our cyber agents Exchange and the Agentic security ecosystem the expected benefits of our strategic partnerships with Frontier AI Labs, our ongoing research and development investment, our capital allocation strategy, including share repurchases and our future results of operations and financial position.

These forward-looking statements involve risks and uncertainties, some of which are beyond our control, which could cause actual results to differ materially from those anticipated by these statements. You should not rely upon forward-looking statements as a prediction of future events. Forward-looking statements represent our beliefs and assumptions only as of today and should not be considered representative of our views as of any subsequent date, and we disclaim any obligation to update any forward-looking statements or outlook. For a further discussion of the material risks and other important factors that could affect our actual results please refer to those contained in our most recent annual report on Form 10-K and subsequent reports that we file with the SEC.

Today's discussion includes non-GAAP financial measures. These non-GAAP financial measures are in addition to and not a substitute for or superior to measures of financial performance prepared in accordance with GAAP. There are a number of limitations related to the use of these non-GAAP financial measures versus their closest GAAP equivalent. Additionally, please see our press release for reconciliations of GAAP to non-GAAP financial measures that we discuss today.

I'll now turn the call over to Steve.

Stephen Vintz

Thanks, Erin. We delivered excellent results in the third quarter. On our last call, we discussed the increasing momentum in our business and this quarter, we are very pleased to see that momentum start to translate into acceleration. What excites me most are the leading indicators, which show inflection and signal durability of growth ahead. Our net dollar expansion rate accelerated to 107%, up from 106% in Q2, which is the first time in over four years, we've seen acceleration in the expansion rate for two consecutive quarters. Tenable One reached a record 59% of new business, up from 50% in Q2.

Average Tenable One deal sizes year-over-year rose for the second straight quarter driven by the pricing and packaging we introduced earlier this year, and CCB accelerated to 9% growth in the third quarter. These results demonstrate that we're delivering what customers need most, which is the ability to see and act on risk across the entire environment at to speed this new era demands and no force is shaping that more than AI.

Before we dive into the product updates for the quarter, I want to touch upon PHP to Shell, the critical vulnerability disclosed last week. Earlier this year, we said AI would surface more vulnerabilities and exposures faster that's playing out now. PHP runs nearly everywhere in the enterprise, including web applications, cloud workloads, containers and legacy systems. The vulnerability is the headline, but the risk goes beyond the vulnerabilities themselves. Organizations need to find effective instances, including those they may not know about and understand how they connect the misconfigurations, credentials and critical systems.

Following PHP to shelf disclosure, customers turn to Hexa and we've seen from volume increase dramatically by as much as 5x. Beyond Hexa, customers have been turning to Tenable as a trusted partner during this critical time. And we've been working closely with them to ensure they can leverage the full power of the platform to reduce their exposure. CHP is a real-time example of our broader shift in the market, and that is AI is reshaping the attack surface faster than most organizations can respond. This is more than a moment. It's a mandate and a structural shift for enterprises.

As a result, every enterprise is adopting AI in every model, every agent, every MCP server they deploy creates new exposures. Meanwhile, attackers are using Frontier AI to find weaknesses faster, and we're now witnessing the early automation of exploit development. The risk extends well beyond CVEs, and we believe this is a powerful demand catalyst for exposure management and a significant growth opportunity for Tenable.

As I outlined last quarter, winning and exposure management requires three capabilities, understanding every exposure, prioritizing what matters most and acting with speed and confidence to reduce risk. As frontier models become widely available, intelligence itself becomes abundant. The differentiator is putting it to work safely. That's the tenable advantage. Decades of exposure intelligence, deep visibility across the attack surface and an AI harness that keeps agents acting safely with human oversight and an audit trail.

In this quarter, we significantly expanded what that platform can do across all three. In September, we announced that we're bringing entropic Claude ethos into Tenable One. This expands our partnership with entropic beyond Project Glass wing. Our first capability powered by cloud methods, Tenable One adversary view lets security teams see their environment through the eyes of an attacker. Every time Tenable assesses a system. We learn what's running on it, how it's configured, who can access it and what it connects to.

Adversary view applies methods to that telemetry to reason like an attacker. It sees how low signal exposures can be chained together to reach critical systems, then recommend the specific fixes that break those chains. It's a compelling example of how we're turning Frontier AI into differentiated capabilities designed to keep customers ahead of emerging threats.

We also expanded tenable Hexa AI, our Gentek engine for Tenable One. Hexa now works as a coordinated fleet of agents that continuously identify critical exposures orchestrate remediation and Verify fixes, even when security teams are offline. Since June, Hexa has evaluated more than two billion assets and findings which enable Hexa users to resolve more critical and high-severity vulnerability detections per month than match peers, and patch actively exploited vulnerability faster.

Tenable Hexa AI saves security practitioners time and resources, enabling them to reclaim analyst capacity, maintain always on defense and dramatically reduce mean time to remediation. Importantly, Hexa is model agnostic. It works with leading frontier and open weight model so customers benefit as those models improve, while our harness keeps every action grounded in validated exposure data.

Finally, we launched the cyber agents exchange, the industry's first open source vendor-agnostic registry first cybersecurity, AI agents and skills. It's AI inspector pairs open AI chat GPT cyber models with tenable researchers to vet community built components before enterprises deploy them but in Tenable's data and expertise at the center of trusted gentex security.

Cybersecurity used to be about detecting en triage threats. Today, it determines how fast the world can adopt AI. As a result, security is no longer a line item inside IT. It's becoming its own business function with a budget tied to business risk and growth. We believe Tenable is uniquely positioned to lead in this AI era, and the momentum we are seeing today gives us confidence in the durability of growth ahead.

With that said, Mark will now walk you through how the momentum we are seeing is showing up with our customers. Mark?

Mark Thurmond

Thanks, Steve. Before I jump into the quarter, I want to touch on what we're seeing in the field and how we've responded to PHP. Tenable research closely tracked the situation as it evolves. We provided constant updates to help educate and prepare customers so they were ready to act. We ship plug-ins overnight and kicked off a series of customer webinars. Attendance has been off the charts.

Moving on to the quarter. The shift that Steve described is showing up in how customers are buying. Last quarter, we said conversations were turning into action. This quarter, pipe build is turning to conversion. We saw clear signs that customers are adding incremental budget to their exposure management programs with Tenable One, both with new lands and existing customers. Q3 was our best quarter ever for Tenable One new logos with more than half of the new logos landing on our advanced package.

At the same time, existing customers are broadening their commitment to Tenable One, and many of our largest deals this quarter were vulnerability management customers converting to the full platform. Platform expansion was the primary driver of our acceleration in net dollar expansion rate and average deal size. When customers consolidate onto Tenable One, they bring more asset types, and more of their attack surface with them. We see two primary factors behind the increased demand for Tenable One. First, Customers need a comprehensive platform with a broad set of capabilities to manage risk in a post Mythos environment. And those capabilities are only available in the new Tenable One packages.

Second, our pricing and packaging continues to make the path to the platform easier. As a result, we ended the quarter with more than 5,000 customers on Tenable One. Bulk pricing tiers are doing what we design them to do. The foundation tier gives customers a simple way to start on the platform and grow overtime. The Advanced tier gives organizations facing the most acute AI era risk, the broadest set of capabilities from day one. And it is clear that AI capabilities are pulling customers deeper into the platform. We're hearing directly from customers about how Tenable Hexa AI is changing the way their teams work.

Tasks, that used to take weeks are now getting done in hours. Analysis that once to days of exports and scripts now take minutes. Some customers are building their first automated routine on day one, and others are connecting their own agents to Hexa to drive remediation. Customers using HEXA resolved 2x to 3x more critical exposures across all affected asset types in their environment than comparable customers. The common thread is that security teams are spending less time gathering information and more time reducing risk, essentially letting the same security team do the work of a much larger one. And the more they use it, the better the results with our largest and most complex customers seeing the biggest gains.

Let me bring these trends to life with three customer examples from the quarter, a couple of which we believe were mythos-driven expansions. A global industrial leader selected Tenable One over a leading endpoint security platform provider and a competitive evaluation. Despite the competitors' aggressive bundling strategy, the customer chose Tenable One for its superior asset discovery broader exposure visibility, Hexa Agentic AI capabilities and being able to consolidate multiple security tools into a single platform. This example reinforces our competitive advantage as customers look for a more comprehensive approach to exposure management in the post Mythos era.

And another example, a Fortune 100 global technology leader significantly expanded its investment in Tenable One through a multimillion-dollar agreement, extending its deployment to the full platform. The customer was one of our largest VM deployments with millions of assets across business units and geographies. They are expanding with Tenable One to consolidate security capabilities simplify operations and manage exposure at enterprise scale. We are deepening strategic relationships and driving substantial platform expansion within our installed base.

And finally, a global software company expanded its Tenable contract by nearly $1 million with our cloud security offering, providing differentiated capabilities over a leading endpoint security platform provider. The customer is also adopting Hexa AI capabilities with early indications of time savings. Our comprehensive platform and AI-driven innovation is driving larger deals with additional asset coverage.

Together, these wins reflect the trends we saw throughout the quarter. These trends include AI-driven urgency for exposure management and meaningful expansion, specifically with our VM customers upgrading to Tenable One. There was also a strong adoption of Tenable One with the new customers, along with major competitive wins.

Additionally, Steve mentioned our cyber agents exchange. Beyond advancing the broader cybersecurity community, the exchange is also demonstrating commercial value. We are already seeing a strong response, particularly considering it was introduced in August. A great example of what we've seen was a Tenable One win at a financial services company. The Cyber Agents exchange helped influence this competitive deal where genetic AI was a key purchasing requirement. We're also seeing the exchange become an important point of engagement with enterprise customers reinforcing the differentiation of Hexa AI and Tenable One. We believe the exchange positions Tenable to play a central role in the emerging Agentic security ecosystem, creating new opportunities to drive platform adoption as this market develops.

And finally, a word on why we're winning. We compete with large platform vendors with legacy vulnerability management providers and with new entrants. What we are seeing in the field is that customers are selecting tenable for the breadth and depth of our exposure data, our multiple asset types, advanced prioritization and for a harness, they can trust to act in their live environments. This is all showing up in our win-back reports and competitive displacements.

Now with that, I'll turn the call over to Matt to discuss our financial results.

Matthew Brown

Thanks, Mark. The product innovations and competitive wins that Steve and Mark just spoke about translated to excellent results in the third quarter. Tenable One represented an all-time high percentage of new business driving third quarter results above the high end of the range for every metric we guided to. And we are once again raising our full year outlook, reflecting the growing momentum we're seeing in the business.

Let's dive into the details. Revenue for the quarter was $276.4 million, representing growth of 9.5% year-over-year. The year-over-year growth in revenue as well as outperformance relative to guidance was driven by strong expansion within existing accounts and underpinned by continued strength in renewals. Our percentage of recurring revenue remained high at 95% for the quarter. We had a record quarter for Tenable One with 59% of new business coming from the platform, a new milestone. Up from 50% in the prior quarter and 39% in Q3 of last year.

As Steve discussed, we continue to make platform enhancements in Q3 and including equipping security teams with autonomous agentic capabilities with Hexa AI and bringing Anthropic's Claude Mythos for frontier cyber reasoning in adversary view. Advancements like these are helping accelerate the adoption of Tenable One with new and existing customers. We added 413 new enterprise customers in the quarter. And added 39 net new six-figure accounts. With the continued shift towards Tenable One, average deal sizes are increasing, which helps drive new six-figure account annual contract value up 18% year-over-year.

Our net dollar expansion rate increased for the second quarter in a row to 107%, up from 106% in the prior quarter. The continued acceleration reflects the same demand in the business and was driven by strong expansion and renewal business. Non-GAAP gross margin was 81.5% for the quarter compared to 81.6% in Q3 2025 and within our typical historical range of low 80s over the past couple of years.

Non-GAAP income from operations for the quarter was $74.9 million or 27.1% of revenue compared to $58.9 million or 23.3% of revenue in Q3 2025, an increase of 380 basis points. Growth in profitability in the quarter highlights our ability to steadily increase margins while investing significantly in product development and sales capacity. Non-GAAP earnings per share for the quarter was $0.63, compared to $0.42 in Q3 2025, an increase of $0.21. The improvement year-over-year reflects the growth in profitability and also includes a onetime discrete tax benefit that increased earnings per share by $0.03.

Turning to the balance sheet. We generated $69.4 million of unlevered free cash flow during the quarter, compared to $58.5 million in Q3 2025, an increase of 18.7% and ended the quarter with cash and short-term investments of $495.3 million. During the quarter, we raised $800 million in a convertible note offering, using the proceeds to pay off our existing term loan B enter into a capped call transaction with a cap price of $64.06 per share and repurchased 5.3 million shares for $170.5 million.

In addition, on October 13, we closed a revolving line of credit, giving us access to $400 million in additional liquidity. The net result is overwhelmingly positive. We pushed out the maturity of our debt to September 2031, reduced our shares outstanding, expanded our liquidity capacity and added $186 million in cash to our balance sheet, all at a significantly lower overall cost of capital.

In addition to the shares we repurchased in connection with the convertible notes, we repurchased 1.5 million shares for $53 million during the quarter, and have $54 million remaining on our current share repurchase authorization as of the end of the quarter. In total, so far this year, we've repurchased 18.2 million shares for approximately $454 million, reflecting an average repurchase price of $24.93. Our repurchase program remains an active pillar of our capital allocation strategy. Reflecting our view that returning capital to shareholders through buybacks represents an effective use of our free cash flow, given the underlying strength of the business.

Turning to the financial outlook for Q4 and full year 2026. Given the continued strength we've seen through Q3, we are raising our full year 2026 guidance range for revenue to $1.084 billion to $1.087 billion, representing a year-over-year increase of 8.6% at the midpoint. For Q4, we expect revenue to be in the range of $277 million to $280 million, representing a year-over-year increase of 6.9% at the midpoint.

We are also raising our full year 2026 guidance range for non-GAAP operating income to $270 million to $273 million or 25.0% of revenue at the midpoint which is a year-over-year increase of 310 basis points. We expect non-GAAP income from operations for Q4 to be in the range of $67.1 million to $70.1 million or 24.6% of revenue at the midpoint. The outperformance we drove an operating income so far this year along with the favorable impact to interest income and expense in Q4 as a result of our debt refinancing is driving significant incremental upside to net income and earnings per share for the year.

In addition, the onetime tax benefit we realized in Q3 drove a benefit of $3.3 million to net income and $0.03 to earnings per share. As a result, we are raising our full year 2026 guidance range for non-GAAP net income to $250 million to $253 million, representing a year-over-year increase of 29.4% at the midpoint. We expect non-GAAP net income for Q4 to be in the range of $63.6 million to $66.6 million representing a year-over-year increase of 13.6% at the midpoint.

Due to the increase in non-GAAP net income, we are raising our full year 2026 guidance range for non-GAAP diluted earnings per share to a range of $2.16 to $2.19 representing a year-over-year increase of $0.59 at the midpoint. We expect non-GAAP diluted earnings per share for Q4 to be in the range of $0.56 to $0.58 per share, representing a year-over-year increase of $0.09 at the midpoint.

Before I open it up to Q&A, I want to thank the entire Tenable team for another excellent quarter of steady execution. We are looking forward to closing out the year strong. With that, we are happy to open the call up for questions. Operator?

Operator

[Operator Instructions] The first question is from Mike Cikos from Needham & Company.

分析師問答

Michael Cikos

Congratulations on the strong results here. Great to see the net dollar expansion and the nine handle on that CCB growth. First question for Steve, if I could. But I think the key metric to me that stood out in your prepared remarks was the 5,000-plus Tenable One customers you have today? And really, I'm thinking it was probably a year ago where the company was citing just 3,000. So you've seen a meaningful uptick as far as that pool of Tenable One customers you're touching.

I would just love to get a better sense. Can you help us segment Tenable One customers, like how many are coming from existing customers adopting Tenable One versus new logos to the platform?

Operator

Management your line is open.

One moment while we reconnect the speakers. [Technical Difficulty]

Thanks, everyone, for your patience. We're just reconnecting the speakers while they dial back in. Thanks for your patience.

All right. You can go ahead. You are now reconnected.

Mark Thurmond

All right. Hopefully, everyone can hear us. We have absolutely no idea. We got disconnected. I'm not sure. Mike, are you there? .

Michael Cikos

I am. Can you hear me, okay?

Mark Thurmond

Yes, I can hear you, fine. I'll kind of give you the answer to your question. We have literally no clue what happened. The line just dropped. So but listen, in regard to the momentum that we saw in Tenable One, it was across multiple different aspects. So a, we had an incredible quarter in regard to net new logos landing on Tenable One. So we had 1413 new logos, a significant portion of those new logos were Tenable One. We also saw a huge conversion from our standalone VM installed base, hundreds of VM customers transitioned over to Tenable One, which was outstanding.

And then we saw a conversion also from our legacy Tenable One onto the new SKU. So every measurement that we track to drive new logo in regard to Tenable One were record-setting quarters. So multiple fronts, multiple competitive wins. That was one of the key drivers of why we had such a successful quarter. Tenable One, absolutely crushed it in Q3.

Michael Cikos

That's great to hear, Mark. And just a quick follow-up here. I just wanted to tackle the customer examples that you had given as well. Great to hear how HEXA is winning out and Tenable One is really gaining momentum with these enterprise companies. I'm just curious, could you speak to the competition versus those endpoint vendors? And I'm just trying to get a better sense, are they coming up more in these ad bats or do you see them becoming more competitive with their bundling strategy. It sounds like the win rates are unaffected, but I'm just curious to what degree they're actually showing up in these bids.

Mark Thurmond

Yes. No, no. Listen, they're out there, and we didn't see any change whatsoever from a competitive dynamic in Q3. We did see our win rates improve and increase. And I think it's because our channel and our sellers are extremely efficient now on selling Tenable One, right? So we will position stand-alone, if need be, but the majority of all of our seller interactions and reseller interaction are Tenable One. and our compete level is extremely strong. As you highlighted, one of the customer wins we talked about was against the very large endpoint player.

And we won based on the depth and breadth of the platform all of the different asset types, which is a huge differentiator in Tenable One, also our accuracy within finding and identifying vulnerabilities, not having false positives. And then you put on top of it now. My Hexa has become a really big driver. It is a huge differentiator. We demo it, we position it on all of our new business, but also it's a big driving force to get VM customers in our installed base and our legacy T1 customers onto the new SKU. So you kind of combine all of that, and we're in just a very, very good compete level right now in regard to T1.

Operator

The next question is from Rudy Kessinger from D.A. Davidson.

Rudy Kessinger

Again, some other Mike, congrats on the improvement in some of the metrics here. Firstly, I'm curious as takes back. One of the questions I get from a lot of investors is just with its and increase in the number of vulnerabilities being discovered, wouldn't customers be scanning more frequently? And how might that impact the results for a company like Tenable. You mentioned TECO with PHP, 5x increase in usage in some instances. Historically, you guys have priced on a per asset basis. I guess as you look forward, as your customers are scanning more frequently, they're patching more frequently, is there any opportunity to maybe evolve the pricing on some of your core VM scanning products in conjunction with HEXA to capture more of that usage in terms of revenue?

Stephen Vintz

This is Steve. Yes, as we've talked about our pricing and packaging has evolved considerably. But one of the big highlights in the quarter was ASPs. So this quarter, we saw the expansion rate tick up. The selling prices increased and we also saw CCB consequently increase as well. And so we are having success expanding with our customers. The pricing and packaging plays a major role here. One of the big reasons why is because of Hexa. And as a result of PHP, more customers turn to Hexa prompt volume increased.

And we're also selling Hexa packs back into our base. So we've seen the pricing evolve here. Yes, it's an asset-based pricing model will continue to charge that way, but we're also charging based on volume. We don't want to do it based on the number of scans. We don't want to discourage usage. But if you look at PHP to Shell, because that's really where your question originated. It's a clear signal of where the market is going. right? And it signals two things.

First is scale. It took the industry 26 years to record over 300,000 CBEs. That's the cumulative total to date since the number of CVs has been initially recorded many, many years ago. And that's the number CBs at the start of the year. This year alone, there's been 90,000 new CEEs that's been published. This month alone, to date, been 15,000 new CVs. So the velocity is clearly increasing here.

And second, PHP to shell clearly shows the challenge goes well beyond just the vulnerability itself. Yes, that's the headline. But it's more about the underlying exposure it creates in your environment. And PHP is everywhere as we all know, and nearly every organization has exposure here. And reportedly, and this is recently attackers are starting to change PHP to Shell together with other flaws to now access and compromise identity systems. So the threat is evolving is moving beyond remote code execution and that's where exposure management comes in. That's why it's more important now than ever before. We will see more events like this, not for, and that's why customers are turning to Tenable, as Mark highlighted earlier.

Rudy Kessinger

Okay. Got it. Super helpful. And then secondly, I appreciate the color on that key win versus run the endpoint vendors and the competitive cover. One of the questions I also get is, you guys have said you see those endpoint vendors more so in Tier 2 and 3 assets. Can you share any kind of figures when you evaluate your customer base, what percent of the assets that you guys are projecting are Tier 1 versus Tier 2 or Tier 3 assets?

Stephen Vintz

Yes. Most are Tier 1. I mean, to some degree, there's Tier 2 and Tier 3. We have an asset-based pricing model. As we all know, the rail risk here in the AI era is not a single CBE. It's not a single misconfiguration or just access entitlements is the changing together of all those things into a critical attack path that leads to your most important data. And that's what exposure management is all about. So a lot of it is Tier 1 assets.

So that's why the selling prices are higher. That's why we're having success this year is because we're selling more assets. Customers are turning to us as they look and place more AI agents and models and applications in their environment. They're turning to Tenable to help secure and assess more of that because it expands the attack surface. So we've seen no change in competitive dynamics Mark mentioned, and our competitive positioning is very strong as our results would indicate.

Operator

The next question is from Jonathan Ho from William Blair.

Jonathan Ho

Congratulations on the strong quarter. One thing I wanted to better understand as customers start to shift from planning to buying, can you help us understand how much of the growth that you saw this quarter was driven from asset expansion versus upsell of the product versus just completely buying new products. If you could give us maybe some type of breakdown that would help us understand the different drivers that are there?

Mark Thurmond

Yes. I'll tell you, it really came from both. I mean this was one of the most balanced quarters that we have seen and really all the different fronts over executed and delivered, right? So we saw significant expansion in the installed base. And one of the big trends we saw was some of our largest VM customers converting to Tenable One. So we've been working with some of these customers for close to nine months to get them to convert, and we saw that conversion happen in Q3 with a lot of big global Fortune 1000, Fortune 500 companies moving from VM to T1. So great expansion there.

We also saw it within the midrange commercial space. with customers wanting to leverage Hexa because they didn't have as big of security teams and wanted to automate a bunch of use cases and be able to use genic AI to get more leverage and get more productivity out of the smaller teams they had. So we saw really good execution there. And then as we hit on, right, our net new logo count was outstanding. And then as I highlighted, the percentage of new logos that came in through T1 was outstanding. So really, it was across the board.

Jonathan Ho

Fantastic. And then just as a quick follow-up. With Tenable One adoption, can you help us understand this can serve as potentially a steppingstone for broader adoption of the more advanced versions of Tenable One as well as eat -- but does it also expand the types of assets that you can cover for customers. Just want to see what you've seen with customers as they've adopted Tenable One and what that road map looks like once you've gotten them onto the platform?

Mark Thurmond

Yes, you bet. I mean, what we see, and Matt covers this quite a bit in regard to the expansion in regard to the margin and the ASPs we see in our deals. When you move up to especially advanced you're usually looking at two, three, sometimes four different asset types. You're also leveraging a much more advanced attack path analysis capability, which a lot of the customers want now. And obviously, you're getting significantly more tokens to run Hexa AI. And then our prioritization is extremely clean when you look at what we're doing from an advanced package.

So it's multiple layers in regard to what we're doing. But we're landing the majority of our Tenable One, when you look at the new logos and you look at the expansion and significant coming in on advanced compared to foundation.

Operator

The next question is from Roger Boyd from UBS.

Roger Boyd

Congrats on the nice results. Good to see pipeline conversion starting to tick up. for Steve or Mark, just on PHP for Shell. Can you remind us what impact LogfordJay had on your business? I know it's a little hard to parse out, but was in some way a tailwind. And how do you see that situation may be comparable to what's going on with PHP for Shell in terms of that driving interest and very clearly helping the HEC volumes?

Stephen Vintz

Well, over the years, we've seen a number of threats and breaches. And some have had an impact and others have not. And with regard to LOG, I think at a first surface in Q4 of 2021, we saw the expansion rate inflect higher than I think in the subsequent quarter in -- that was Q4 of 2021 and then Q1 of '22. We also saw the growth rate expand and new business strength.

And look, as we look at PHP to Shell here, our first area of focus is really supporting our customers some time of need. It's too early to quantify right now, the impact it will have on our business. But clearly, we're spending a lot of time with customers. Engagement with customers has never been better. We're seeing a record impact on the number of attendees for webinars and web traffic is all up and all the early signals are there. But look, security teams are bare right now, trying to figure out what this means for them internally, and that takes time.

So our focus is making sure that we're providing the support and the resourcing necessary to help them assess risk. I think what it also signals is that exposure management is center stage here in the midst of all these AI-enabled threats and AI-enabled attacks, and AI-driven exposures. So we see a good durable tailwind of growth for Tenable in the quarters and weeks to come. And I think the results in the quarter are an early sign of us.

o PHP had little impact in the quarter just given the timing, of course, but what's driving the momentum and the inflection of the business today is what we've talked about since the early part of the year, which is Mythos is creating not a moment, but it's creating certainly a mandate for us to go out and expand with customers, transact new business, close larger deals. And as a result, exposure management is becoming more strategically relevant to our customers.

Roger Boyd

Got it. Makes total sense. And then maybe just a follow-up for Matt. Really strong margin performance in the quarter. as well as the increase to the guide for the full year. Any considerations you can give us just around gross margin as you move forward? I know Steve mentioned that you're including a lot of Hexa capacity into Tenable One packages. But when you see prompt volume go up 5x, to what degree does that maybe impact kind of your gross margin visibility?

Matthew Brown

Yes. Thanks for the question. So gross margins were 81.5% or so. That's in line with our historical range at the low 80s expect that it will probably remain about there. HEXA is not putting pressure on our gross margins because in order to get access to Hexa, customers need to upgrade into the platform, which is a huge pull than for customers to upgrade. And you've heard us say it many times now on this call, Tenable One was a record for us this quarter. Hexa was a big part of that.

And so once customers are into the platform, their upgrade and the price increase and the value that they get along with the value that we receive sort of pays for that Hexa usage. Once customers have run out of their allotment within the platform, there's an add-on SKU that protects us from a margin perspective. And so while we're encouraging more and more usage in HEXA because we think it provides very, very valuable insights, customers ultimately pay for that once they run out of their allocated amounts within their package.

Operator

The next question is from Adam Borg from Stifel Financial.

Benjamin Goldberg

This is Ben Goldberg on for Adam Borg over at Stifel. Just double clicking on that add-on SKU you just mentioned. So I know you mentioned it last quarter, did you kind of see that increase this quarter given the stronger Heco volumes? Is that recognized ratably or on a consumption basis?

Mark Thurmond

Yes. We did see a tick up this quarter. But for us, the main draw really is in moving folks into the platform and specifically into advanced where they're allowed a pretty significant volume for Hexa usage. We think that's a large reason why 3/4 of customers are opting to go of our new business are opting to go into Tenable One Advance. So in terms of being a sort of a revenue growth driver for us, which I think is probably what you're getting to, the revenue growth driver really comes in the form of the platform, which is we're really happy to see. -- come through this quarter, and we expect that trend to continue.

Operator

The next question is from Joseph Gallo from Jefferies.

William Bellamy

This is Liam Bellamy on for Joe Gallo. You described OT security is very strong globally last quarter, particularly in Fed, and we've seen several tax on critical infrastructure in recent months. Is OTI gaining further momentum within Fed? And is it becoming a repeatable cross-sell motion across the broader commercial installed base?

Stephen Vintz

Yes, it is. And yes, we were very, very happy with the results we saw in Q3 for OT globally. So it is continuing to gain momentum. And specifically in federal, was an outstanding quarter for OT, not only within the federal government, which played a very large role but also in the state and local business. When you look at for instance, like Watershed in Texas and all of the different critical infrastructure and water treatment plant issues, we saw really good adoption of OT in state and local. So Yes, happy with the adoption, not just here in the U.S. but globally for OT and definitely was a highlight of our federal business in Q3.

William Bellamy

That's great to hear. And just a quick follow-up. I think it's becoming clear that patching is the most important aspect and the competitive differentiator in EM. Can you talk through where you are in that product journey I know the ambition is fully autonomous patching, but when can that come to fruition?

Mark Thurmond

Sure. So first, just a reminder of what exposure management is because it's very different than Vulnerability Management. Vulnerability Management is the discovery of CVs and the output of which is a report and it's often sold to a frontline security manager or maybe even a Pentastar Exposure management is very different to the outgrowth of vulnerability management and assessment into solving a much bigger problem and it's really predicated on three things.

Number one, identify all your exposures across a wide range of domains. Number two, prioritize what's truly at risk. And then three remediate and confirmed the fix actually reached the production environment. I mean that's exposure management and some capabilities we have natively in the platform to be able to address the fix. Others, we integrate with third parties to help orchestrate the fix. And we want to do that in a very seamless way with our customers. So sometimes we're leveraging APIs and MCP. Other times, we're doing it natively ourselves. But the key takeaway here is we'll continue to go deeper and wider on remediation, number one.

Number two, the mandate for us has evolved. It's no longer about finding problems. We're about fixing problems, that's what exposure management is about. And that's why Hexa, which is part of our Agentacarnass is so important because it sits on top of our VAS exposure data fabric and data fabric that's been built over the last 20 years and Data Fabric that, a lot of this exposure data sits behind the Garden firewall. It's not publicly available and is also that's tied to our vast sensor network that feeds at raw telemetry data.

So that differentiation, that's what gives us the ability to help our customers address AI threats and move that machine speed because that's what this environment demands. And remediation and orchestration is a big part of it. And so we're happy with how we're serving customers today and look for deeper and wider capabilities there.

Operator

The next question is from Patrick Colville from Scotiabank. .

Conner Weed

This is Conor Weed on for Patrick Colville. Congrats on the quarter, it was nice to see that 9.5% revenue growth. And in terms of the full year guide, I was wondering if you could provide more color on what you are seeing in the business and the pipeline to give the confidence for the magnitude of that raise there?

Matthew Brown

Yes. This is Matt. So Yes, we're really happy with the quarter and our ability to raise the full year guide and not just for revenue but really across the board. And part of what gives us that confidence in order to do that was the performance that we saw in Q3, but also the pipeline growth that we're seeing in Q4. You mentioned the revenue growth that we saw in Q3. We also talked about CCB growth at 9%. We think that probably ticks up slightly in Q4, and that's giving us confidence to be able to raise the guide for revenue in Q4 as well. So yes, we're happy with what we're seeing in momentum in the business and our ability to take up the numbers from the top line all the way down to the bottom.

Operator

The next question is from Meta Marshall from Morgan Stanley.

Abhishek Murli

This is Abhishek Murli on for to Marshall. Congrats on a great quarter. I was just curious if we could follow up a little bit on the federal aspect. Any sort of quantification or commentary on how much that contributed to the upside outside of the OT piece? And then any sort of broader sort of feedback or commentary on what you're seeing in terms of the federal landscape overall?

Stephen Vintz

Yes. As we have major market leadership in federal across a wide range of three-letter federal agencies. We're pleased with the results of our federal business this quarter. It was strong. And the one thing I will say here is that we've seen, if you look more broadly at the U.S. federal space, we've seen a wave of new security policy drop over the last six months. We believe that policy will ultimately be a tailwind for Tenable. The federal government is moving towards a preemptive risk-based security model. So we believe Tenable is in the right category at the right time. We're working directly with CISA. We're part of the CDC with regard to response for our PHP to shell we're participating in Gold Eagle which is the AI Securities vulnerability clearinghouse.

We participated in the launch event for Project Watershed 250, which is what Mark talked about earlier, working directly with the NCD National Cybersecurity Director, Texas Governor and other Digitalis, on those lines. So we expect big things in the U.S. federal space. We know we have an election coming up. Cybersecurity is a bipartisan issue. It will have bipartisan support. We expect budgets to be strong here. Perhaps with a divided government depending on the election, we'll see a CR, but we're in one now. That could likely extend into January. That's nothing new to cyber, nothing new to Tenable. And so we expect to continue to take in share in the U.S. public sector space. and that would also separately include state and local as Mark mentioned.

Operator

The next question is from Rob Owens from Piper Sandler.

Robbie Owens

Great. Maybe you can help me a little bit parse the delta between your net enterprise adds as I look at that year-over-year versus these record new logo Tenable One quarter that you just have?

Matthew Brown

Yes, Rob, I can take that. One of the dynamics, and I mentioned it in my prepared remarks that we're seeing is we're happy that we added 413 new enterprise customers. But the dynamic that I think is driving value even more is actually the value that the larger customers are bringing. So we saw new six-figure annual account value, contract value go up 18% year-on-year, which is really showing that customers are not only moving to the platform. They're moving to the platform, spending more and expanding once they're there, too. So our larger customers are spending more, which is great.

In addition to that, you could sort of take your pick on the top line metrics that we saw for the quarter. It wasn't just the revenue growth. it was the expansion in our net dollar retention rate moving from 106% to 107%. So another quarter of expansion there. Of course, there was the record 59% of new business Tenable One. That was a big deal, too. but it's also things like CRPO, that grew 12%. CCB growth was 9%. So 95% recurring revenue kind of across the board when you look at the top line metrics, it was just a really, really strong quarter.

Robbie Owens

Great. And last quarter, you spoke to that expansion rate, potentially being flat to up and it's great that it improves another point quarter-over-quarter. How are you thinking about the fourth quarter from here? And was there any dynamic that helped that from the Fed here in the third quarter? Or are you seeing that kind of across the board in terms of expansion?

Matthew Brown

Yes. I expect that the 107% probably stays remains intact in Q4. and Fed helped contribute in Q3. And I think Fed will do well again in Q4, but we're expecting that rate to hold steady at 107%.

Operator

The next question is from Josh Tilton from Wolfe Research.

Joshua Tilton

Guys, can you hear me? .

Operator

Yes, we can.

Joshua Tilton

Awesome. I have two questions, and I've been bouncing around on a bunch of calls, so I apologize if people asked this already. But my first question is just I believe in the quarter, there was a point where you guys made a flip or a switch to the Hexa product that kind of enable customers to do more of these continuous autonomous workflows like basically really get real value from the product. And I guess my question is, what have you seen from a usage perspective within Hexa in the customer base since you made this switch? And if there are any customers that have really been using it, like how are they addressing their token limits and what are they doing with tokens if they've reached their limit?

And then my second follow-up question, probably more for Matt, is just we have these long-term targets out there. I think they call for an improvement in the revenue growth back to the double-digit range at some point. not asking for guidance here, but we're going to get an outlook for next year. And I'm trying to understand, are we going to start to see the trajectory of revenue growth trend towards that double-digit range next year? Or is this more that inflection happens as we get closer to the long-term target here?

Stephen Vintz

Josh, this is Steve. I'll take the first part of the question with regard to perhaps a document in use cases. Something we talked about, something we launched recently was Hexa now has a coordinated fleet of AI agents that continuously identify critical exposures and orchestrate fixes, so you don't have to come in and prompt every time that you want to be able to take an action and you want to be able to remediate and take effects.

So that's a huge productivity boost for security teams who are trying to do more perhaps with less in a heightened threat environment, where there's more applications and agents and the attack surface is expanding.

Customers are using Hexa to resolve their most critical balls. I mean, we saw a dramatic increase in the number of usage, the number of customers that are using Hexa and the number of customers and the usage within those customer cohorts. So that's what's exciting about Hexa. What used to take hours or should I say days now gets done in hours and sometimes even minutes. And customers can build automated routines. And the right way to think about HEC is really twofold. Number one is helping solve the treasury, automating workflow, a major pain point for customers, security teams and reducing the amount of cycle time that it takes to help understand, assess and analyze an environment and then more importantly, go out and just get stuff done.

That's a big part of the value prop for Hexa. And again, these are things that we can do natively within the platform to reduce risk, but also integrating with other security providers because no security company can fix everything.

Matthew Brown

And Josh, I'll answer your second question. So we feel really good about our long-term targets. What we feel good about, in particular, though, is the leading indicators, and you saw a lot of those in the quarter, and I think we're going to continue to see those new business growth is performing really, really well. Bookings are fantastic. And revenue follows. I mean we know that revenue lags a little bit. So as we look out a couple of years, of course, we feel good about the midterm targets that we put out there. But right now, we're focusing on some of the underlying leading indicators in the business.

Operator

The next question is from Rich Poland from Wells Fargo.

Richard Poland

I guess just one quick one around the Tenable One uplift. It's great to see the continued success there. And I'm curious if you mentioned a lot of the ACV expansion related to Tenable One and just kind of the shift over to the platform there. I guess if we put a finer point on it, I think the like-for-like uplift you've talked about in the past is somewhere in the realm of 25% plus when it's on the advanced side. I'm curious, is that something that you think you guys are starting to see realized now? Or would you say the focus is more on getting people over to the platform first and then you could worry about the potential uplift over time?

Mark Thurmond

Yes. It's actually a little bit of both because we see increasingly brand-new customers are coming directly into the platform, and they're spending more. Average customer value is double in the platform what it is versus stand-alone SKUs. And if you look at -- you forget about our Nessus product, but Nessus actually serves as an on-ramp to the platform as well. We're seeing Nessus customers not only upgrading into some other stand-alone SKUs but also directly to the platform. And those customers are -- platform customers are paying 15x with what Neste's customers are paying. So there is a meaningful on-ramp when you're going from Nessus into stand-alone SKUs or from stand-alone SKUs into the platform.

Once they're there, they're also expanding usage, which is another way that they can increase value. So yes, we're really happy with the motion of moving folks into the platform and then once they're expanding.

Operator

This concludes the question-and-answer session as well as the teleconference today. You may disconnect your lines at this time. Thank you for your participation.