TENB 10-K & 10-Q changes, risk factors and insider trading

Some of our actual and potential competitors have significant advantages over us, such as longer operating histories, significantly greater financial, technical, marketing or other resources, stronger brand and business user recognition, larger intellectual property portfolios, government certifications and broader global distribution and presence. In addition, our industry is evolving rapidly and is becoming increasingly competitive. Companies that are larger and more established than us are focusing on cybersecurity and could directly compete with us. For example, Microsoft has a vulnerability management offering and has continued to acquire security solutions for theirits cybersecurity platform. Smaller companies could also launch new products and services that we do not offer and that could gain market acceptance quickly.

We sell cybersecurity products and, as a result, may be at increased risk of being a target of cyberattacks designed to penetrate our platform or internal systems, to compromise our data, alter or modify our source code, or to otherwise impede the performance of our products. Threats to information systems and data come from a variety of sources. In addition to computer “hackers,” threat actors, personnel (such as through theft or misuse, or other insider threat listed below), "hacktivists," organized criminal threat actors, sophisticated nation-states and nation-state-supported actors now engage and are expected to continue to engage in cyber-attacks. Nation-state actors and nation-state-supported actors may engage in such attacks for geopolitical reasons and in conjunction with military conflicts and defense activities, includingaround the ongoing conflict between Ukraine and Russia, the ongoing conflict in the Middle East, and rising tensions between China and Taiwan.world. During times of war and other major conflicts, we, third parties upon which we may rely, and our customers may be vulnerable to a heightened risk of these threats, including retaliatory cyber-attacks that could materially disrupt our systems and operations, supply chain, and ability to produce, sell and distribute our goods and services. We, our customers, and the third parties upon which we rely are subject to a variety of evolving threats, which are prevalent, continue to rise, and are increasingly difficult to detect. These threats include but are not limited to: social-engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks); credential harvesting; malicious code (such as virusesviruses, andworms, wormsand, increasingly, code injection in open source software); malware (including as a result of advanced persistent threat intrusions); denial-of-service attacks, credential stuffing; insider threats (including due to personnel misconduct, error or malicious activity); ransomware attacks; supply-chain attacks; software bugs; server malfunctions; software or hardware failures; loss of data or other information technology assets; adware; telecommunications failures; attacks enhanced or facilitated by artificial intelligence and other similar threats. In particular, ransomware attacks, including those from organized criminal threat actors, nation-states and nation-state supported actors, are becoming increasingly prevalent and severe and can lead to significant interruptions, delays, or outages in our operations, loss of data, loss of income, significant extra expenses to restore data or systems, reputational loss and the diversion of funds. To alleviate the financial, operational and reputational impact of a ransomware attack, it may be prudent to make extortion payments, but we may be unable to do so if, for example, applicable laws prohibit such payments.

If our third-party service providers or partners experience a security incident or other interruption or cause an extended outage or disruption to our systems, we could experience adverse consequences. It is possible that our customers and potential customers would hold us accountable for any security incident affecting our third-party service providers’ or partners' infrastructure or other interruption caused by our third-party service providers or partners that impacts our infrastructure. We may incur significant liability from those customers and from other third parties with respect to any such incident. Because our agreements with certain third-party service providers, such as AWS and Snowflake, limit their liability for damages, we may not be able to recover a material portion of our liabilities to our customers and third parties arising from issues with such third-party service providers, such as AWS and Snowflake, in the event of an incident affecting the third parties’ systems. Moreover, while we may be entitled to damages from third-party service providers if they fail to satisfy their privacy or security-related obligations to us or if they cause a disruption in our infrastructure, any award may be insufficient to cover our damages, or we may be unable to recover such reward. In addition, supply-chain attacks have increased in frequency and severity and there have been high-profile incidents of third-party service providers causing widespread disruptions in their customers' infrastructures due to errors in their SaaS offerings, such as the Windows outage caused by a flawed CrowdStrike software update that occurred in July 2024.offerings. We cannot guarantee that third parties’ infrastructure in our supply chain or our third-party partners’ supply chains have not been compromised or that errors by our third-party service providers won’t cause disruptions in our infrastructure.

The reliability and continuous availability of our solutions is critical to our success. We have experienced errors or defects in the past in connection with the release of new solutions and product upgrades, and we expect that these errors or defects will be found from time to time in the future in new or enhanced solutions after commercial release. For example, on December 31, 2024, we identified Nessus agents versions 10.8.0 and 10.8.1 going offline under certain conditions which impacted the availability of our Vulnerability Management and Security Center solutions for certain customers. Upon discovery of the incident, we developed and released a version 10.8.2 of our Nessus agent on January 2, 2025, which enabled affected customers to resolve the issue. Although the financial impacts of this incident have not been significant, similar incidents in the future could result in costs associated with service-level credits and loss of customer trust, which could have a material adverse effect on our business and financial performance. In addition, we use third parties to assist in the development of our products and these third parties could be a source of errors or defects. Some defects may cause our solutions to be vulnerable to attacks, cause them to fail to detect vulnerabilities, or temporarily interrupt customers’ networking traffic or operational technology environments, any of which may damage our customers’ business and could hurt our reputation.

We have incorporated and may in the future further incorporate AI technologies, including generative and other types of AI processes, algorithms, and technologiesAI, into certain of our products and services. ThisThese technologytechnologies isare subject to new and developing,developing regulatory frameworks and may generate output that is inaccurate or flawed or may not achieve market acceptance, which could result increate operational, financial, regulatory, and reputational harmrisks based on development practices or reliance on AI outputs that are inaccurate or flawed. These technologies may not achieve market acceptance and may pose other adverse consequences to our business.business, some of which we may not know or be able to quantify at this time.

We have incorporated and may in the future further incorporate AI features in certain of our products and services, including ExposureAI and Tenable AI Assistant.Assistant and within Tenable One. The use of AI technologies, including generative AI processesprocesses, at scale is relatively new, and may lead to challenges, concerns and risks, including various privacy and security risks that are significant or that we may not be able to predict, especially if our use of these technologies in our products and services becomes more important to our operations over time. The technologies underpinning these features are in the early stages of commercial use and exist in an emerging regulatory environment,environment with heightened regulatory scrutiny, which presents regulatory, litigation, ethical, safety, reputational, operational and financial risks. AI in our products and services may be difficultcomplex to deploy successfully due to operational issues inherent to the nature of such technologies, including the availability, development, maintenance and operation of deep learning datasets. Additionally, if we do not have adequate rights to utilize the data or other materialsdatasets and content that our AI technologies depend on, we may face legal consequences for violating applicable laws, third-party intellectual property, privacy or other rights, or contracts to which we are a party.dependencies.

Uncertainty in the legal regulatory regime relating to AI and emerging ethical issues surrounding the use of AI may require significant resources to modify and maintain business practices to comply with U.S. and non-U.S. laws, the nature of which cannot be determined at this time. Existing laws and regulations may apply to us or our suppliers, vendors, partners and customers in new ways, and new laws and regulations may be instituted. Many U.S. and international governmental bodies and regulators have proposed, enacted or are in the process of developing, new regulations related to the use of AI and machine learning technologies.technologies, including the EU AI Act, Colorado AI Act, California Bot Disclosure Law, and Utah AI Policy Act, as well as regulations on certain high-risk automated decisions, such as those in the employment context. For example, the European Union authorities recently adopted a legal framework onEU AI regulation, the Artificial Intelligence Act, which applies beyond the European Union’s borders and establishes obligations for AI providers and those deploying AI systems.systems, Othersets out a risk-based framework that subjects certain AI technologies to numerous compliance obligations, such as transparency, conformity and risk assessment, monitoring and human oversight requirements. Under the EU AI Act, non-compliant companies may be subject to administrative fines of up to 35 million Euros or 7% of a company's total worldwide annual turnover for the preceding financial year, whichever is higher. Certain of our activities subject us to the EU AI Act and other U.S. and non-U.S. laws governing AI or data processed in connection with AI. We expect other jurisdictions may adopt similar or potentially more restrictive laws, which may render the use of such technologies challenging. The final form of these may impose obligations related to our development, offering and use of AI technologies and expose us to increased risk of regulatory enforcement and litigation. We may have to amend our business practices, contractual arrangements, and services to comply with such obligations.

AnyOur customers deploy AI technologies in their environments where the AI technologies may encounter sensitive information (including confidential, competitive, proprietary, or personal data) thator weour customers may input sensitive information into aour third-partyAI-powered generativeofferings, regardless of any prohibitions in our terms of service. Any sensitive information that our AI platformtechnologies ingest could be leaked or disclosed to others,others. Additionally, many of our AI technologies are powered by third-party AI providers, which may heighten the risk of inadvertent or unwanted disclosure of sensitive information, including if sensitive information is used to train the third parties’party's AI model. Additionally, where an AI model ingests personal data and makes connections using such data, those technologies may reveal other personal or sensitive information generated by the model. This could create legal or contractual liability for us in light of the model's ability to output sensitive information.

Our AI technology features may also generate output that is misleading, insecure, inaccurate, harmful or otherwise flawed. Agentic AI solutions may compound those risks by taking or implementing actions or outputs, which themselves may be based on flawed outputs, that further increase the risk of misleading, insecure, inaccurate, harmful or otherwise flawed outcomes. This risk extends to our enterprise operations, as employee use of unvetted third-party agentic AI solutions, such as browser plug-ins or other automated applications, could result in actions being taken without adequate human review or monitoring. Such unauthorized automated actions could, for example, lead to the inadvertent disclosure or modification of corporate data or other sensitive information, flawed communications to customers or partners, or the creation of unintended legal or financial obligations on behalf of the company. Our customers or others may rely on or use such misleading, insecure, harmful or otherwise flawed content to their detriment, which may harm our brand, reputation, business or customers, cause competitive harm or expose us to legal liability. For example, AI algorithms use machine learning and predictive analytics which may be insufficient or of poor quality and reflect inherent biases and could lead to flawed, biased, and inaccurate results. Deficient or inaccurate recommendations, forecasts, or analyses that generative AI applications assist in producing could lead to customer rejection or skepticism of our products, affect our reputation or brand, and negatively affect our financial results. Further, unauthorized use or misuse of AI by our employees or others may result in disclosure of confidential company and customer data, reputational harm, privacy law violations and legal liability. Our use of generative AI may also lead to novel and urgent cybersecurity risks, including those related to personal data, which may adversely affect our operations and reputation.reputation, and these risks likely are compounded by our use of agentic AI.

We believe that developing and maintaining widespread awareness of our brand in a cost-effective manner is critical to achieving widespread acceptance of our enterprise platform and attracting new customers. Brand promotion activities may not generate customer awareness or increase revenue and, even if they do, any increase in revenue may not offset the expenses we incur in maintaining and promoting our brand. If we fail to successfully promote and maintain our brand, or if we incur substantial expenses, we may fail to attract or retain customers necessary to realize a sufficient return on our brand-building efforts, or to achieve the widespread brand awareness that is critical for broad customer adoption of our solutions.

The timing of sales of our offerings is difficult to forecast because of the length and unpredictability of our sales cycle, particularly with large enterprises and with respect to certain of our solutions. We sell our solutions primarily to IT departments that are managing a growing set of user and compliance demands, including with respect to AI, which has increased the complexity of customer requirements to be met and confirmed during the sales cycle and prolonged our sales cycle. Our average sales cycle with an enterprise customer is approximately four months, although unfavorable macroeconomic conditions and the extent to which we continue to enter into larger deals, could result in longer average sales cycles. Further, the length of time that potential customers devote to their testing and evaluation, contract negotiation and budgeting processes varies significantly, depending on the size of the organization and nature of the product or service under consideration. Macroeconomic uncertainty, including foreign exchange rates, inflation, disruptions in access to bank deposits or lending commitments due to bank failures and uncertainty about economic stability, and concerns about economic recessions in the United States or other major markets, have and could continue to impact the budgets and purchasing decisions and processes of certain of our customers and prospective customers, some of whom have added additional controls on expenditures and require additional internal approvals of expenditures, even if relatively small in dollar amount, all of which could lengthen our average sales cycle. In addition, we might devote substantial time and effort to a particular unsuccessful sales effort, and as a result, we could lose other sales opportunities or incur expenses that are not offset by an increase in revenue, which could harm our business.

In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, data privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act), and other similar laws (e.g., wiretapping laws). Numerous U.S. states have enacted comprehensive privacy laws that impose certain obligations on covered businesses, including providing specific disclosures in privacy notices and affording residents with certain rights concerning their personal data. As applicable, such rights may include the right to access, correct, or delete certain personal data, and to opt-out of certain data processing activities, such as targeted advertising, profiling, and automated decision-making. The exercise of these rights may impact our business and ability to provide our products and services. Certain states also impose stricter requirements for processing certain personal data, including sensitive information, such as conducting data privacy impact assessments. These state laws allow for statutory fines for noncompliance. For example, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, or collectively, the CCPA, imposes obligations on covered businesses to provide specific disclosures in privacy notices and honor requests of California residents to exercise certain rights related to their personal data. The CCPA applies to personal data of consumers, business representatives and employees who are California residents and provides for fines for noncompliance (up to $7,500 per intentional violations.violation). Further, the CCPA allows private litigants affected by certain data breaches to recover significant statutory damages. Similar laws have been passed or are being considered in several other states, as well as at the federal and local levels, and we expect more states to pass similar laws in the future. These developments may further complicate compliance efforts and may increase legal risk and compliance costs for us, the third parties with whom we work, and our customers.

Our employees and personnel use generative AI technologies to perform their work, and the disclosure and use of personal data in generative AI technologies isare subject to various privacy laws and other privacy obligations. Governments have passed and are likely to pass additional laws regulating generative AI. Our use of this technology could result in additional compliance costs, regulatory investigations and actions, and lawsuits. If we are unable to use generative AI, it could make our business less efficient and result in competitive disadvantages.

Additionally, under various privacy laws and other obligations, we may be required to provide certain notices and obtain consents to process certain types of personal data. For example, some of our data processing practices may be challengedsubject to challenges or lawsuits under data privacy and communications laws, including inwiretapping relationlaws, toif ourwe useshare ofconsumer information with third parties through various methods, such as chatbot and session replay providers.providers, or via third-party marketing pixels. These practices may be subject to increased challenges by class action plaintiffs. Our inability or failure to obtain consent for these practices could result in adverse consequences.consequences, including class action litigation and mass arbitration demands.

Outside the United States, an increasing number of laws, regulations, and industry standards govern data privacy and security. For example, the European Union’s General Data Protection Regulation, or EU GDPR, and the United Kingdom’s GDPR, or UK GDPR, impose strict requirements for processing the personal data of individuals. Violations of these obligations carry significant potential consequences. For example, under the EU GDPR, government regulators may impose temporary or definitive bans on processing, as well as fines of up to €20 million or 4% of the annual global revenue, whichever is greater. In addition, new EU and UK regulations or legislative actions regarding data privacy and security (together with applicable industry standards) may be proposed or enacted, such as the EU's Digital Operational Resilience Act and its second Network and Information Security Directive, which may increase our costs of doing business, and non-compliance with such laws and regulations, as applicable to us, may lead to significant administrative fines. We have an internal data privacy function that oversees and supervises our compliance with data privacy laws, including EU and UK data protection regulationsregulations, but,but despite our efforts, we may fail, or be perceived to have failed, to comply. Canada's Personal Information Protection and Electronic Documents Act, or PIPEDA, and various related provincial laws, Canada's Anti-Spam Legislation, or CASL, and Brazil's General Data Protection Law (Law No. 13,709/2018), or Lei Geral de Proteção de Dados Pessaois,Pessoais, or LGPD, may apply to our operations. The LGPD broadly regulates processing personal data of individuals in Brazil and imposes compliance obligations and penalties comparable to those of the EU GDPR. Additionally, we also target customers in Asia and may be subject to new and emerging data privacy regimes in Asia, including China's Personal Information Protection Law, Japan's Act on the Protection of Personal Information, and Singapore's Personal Data Protection Act.

Our success is dependent in part upon establishing and maintaining relationships with a variety of channel partners that we utilize to extend our geographic reach and market penetration. We typically use a two-tiered, channel model whereby we sell our products and services to our distributors, who in turn sell to our resellers, who then sell to our end users, who we call customers. We anticipate that we will continue to rely on this two-tiered sales model in order to help facilitate sales of our offerings as part of larger purchases in the United States and to grow our business internationally. In 2024,2025, 20232024 and 2022,2023, we derived 94%, 93%94% and 92%,93%, respectively, of our revenue from sales through channel partners, and the percentage of revenue derived from channel partners may continue to increase in future periods. Ingram Micro, Inc.,one aof distributor,our distributors, accounted for 34%,32%, 36%34% and 38%36% of our revenue in 2024,2025, 20232024 and 2022,2023, respectively, and 29%27% of our accounts receivable at December 31, 20242025 and 32%29% at December 31, 2023.2024. Our agreementsreliance withon these channel partners also means that any significant interruption to their systems could harm our channelbusiness. partners,For includingexample, oura agreementmajor withdistributor experiencing a significant operational failure or cybersecurity incident, such as the recent ransomware attack that impacted Ingram Micro, arecould non-exclusivedisrupt their ability to take orders and dodistribute notproducts. prohibitAny themsuch frominterruption workingcould withnegatively our competitors or offering competing solutions, and some of our channel partners may have more established relationships with our competitors. Similarly, our channel partners have no obligations to renew their agreements with us on commercially reasonable terms or at all, and certain of the agreements governing these relationships may be terminated by either party at any time, with no or limited notice. For example, our agreement with Ingram Micro allows Ingram Micro to terminate the agreement in their discretion upon 30 days’ written notice to us. If our channel partners choose to place greater emphasis on products of their own or those offered by our competitors or as a result of an acquisition, competitive factors or other reasons do not continue to market and sell our solutions in an effective manner or at all,affect our ability to growsell and distribute our businessproducts through that partner, which could materially and selladversely impact our solutions,business, particularlyfinancial in key international markets, may be adversely affected. In addition, our failure to recruit additional channel partners, or any reduction or delay in their sales of our solutionsposition, and professional services, including as a result of economic uncertainty, legal or regulatory actions, such as government investigations or law enforcement activities, impacting their business, or conflicts between channel sales and our direct sales and marketing activities may harm our results of operations. Finally, even if we are successful, our relationships with channel partners may not result in greater customer usage of our solutions and professional services or increased revenue.

A portion of our revenue is generated from subscriptions and perpetual licenses sold to governmental entities in the United States. Additionally, many of our current and prospective customers, such as those in the financial services, energy, insurance and healthcare industries, are highly regulated and may be required to comply with more stringent regulations in connection with subscribing to and implementing our enterprise platform. Selling licenses to these entities can be highly competitive, expensive and time-consuming, often requiring significant upfront time and expense without any assurance that we will successfully complete a sale. Governmental demand and payment for our enterprise platform may also be impacted by public sector budgetary cycles and funding authorizations, withthe fundingoperational stability of federal agencies, and the prioritization of cybersecurity and digital infrastructure initiatives. Funding reductions or delaysdelays, including those resulting from a U.S. government shutdown, reductions or eliminations of agency operating budgets or deprioritization of cybersecurity digital infrastructure related initiatives would adversely affectingaffect public sector demand for our enterprise platform. For example, the U.S. presidential administration's priorities and actions to reduce government spending, including, but not limited to, those previously driven by the Department of Government Efficiency, may impact the availability of funding for U.S. government customers as a result of the elimination of departments and personnel. These actions may lead to elongated sales cycles and procurement decisions and could result in fewer contract opportunities or reduced funding for existing initiatives, all of which would adversely affect our business and financial performance. In addition, governmental entities have the authority to terminate contracts at any time for the convenience of the government, which creates risk regarding revenue anticipated under our existing government contracts.

Some of our revenue is derived from contracts with U.S. government entities, as well as subcontracts with higher-tier contractors and customers who receive government funding. As a result, we are subject to federal contracting regulations, including the Federal Acquisition Regulation, or the FAR. Under the FAR, certain types of contracts require pricing that is based on estimated direct and indirect costs, which are subject to change. The new U.S. presidential administration’s commitment to reduce government spending, may impact availability of funding for U.S. government customers, generally, as well as eliminate departments and/or personnel who rely on our products which could adversely affect our business and financial performance.

In connection with our U.S. government contracts, we may be subject to government audits and review of our policies, procedures, and internal controls for compliance with contract terms, procurement regulations, and applicable laws. In certain circumstances, if we do not comply with the terms of a contract or with regulations or statutes, we could be subject to contract termination or downward contract price adjustments or refund obligations, could be assessed civil or criminal penalties, or could be debarred or suspended from obtaining future government contracts for a specified period of time. Any such termination, adjustment, sanction, debarment or suspension could have an adverse effect on our business.

Any such termination, adjustment, sanction, debarment or suspension could have an adverse effect on our business. Moreover, as a U.S. government contractor, we maintain plans to ensure compliance with nondiscriminationapplicable legal and regulatorycontractual requirements forrelated qualifiedto employees on the basis of gender, race, disability and veteran status.nondiscrimination. Consequently, we may be subject to executive orders and regulatory changes affecting various aspects of our operations, including compliance with nondiscrimination plans.operations. Any required elimination or modification of such plans in response to new or changes to existing executive orders or legal or contractual requirements could pose challenges in hiring or retaining employees and may lead to other adverse operational impacts. Failure to comply with these requirements could expose us to administrative, civil, or criminal liabilities, including fines, penalties, repayments or suspension or debarment from eligibility fromfor future U.S. government contracts. Further, as a U.S. government contractor, we are subject to an increased risk of investigations, criminal prosecution, civil fraud,fraud claims, whistleblower lawsuits and other legal actions and liabilities as compared to solely private sector commercial companies.

•failure to predict market demand accurately, including changes in demand as a result of macroeconomic trends, in terms of functionality and to supply offerings that meetsmeet this demand in a timely fashion;

We have acquired products, technologies and businesses from other parties, such as ourrecent acquisitionacquisitions discussed in Note 6 of Vulcan Cyber Ltd., or Vulcan Cyber, which we announced in January 2025, our Juneconsolidated 2024financial acquisition of Eureka Security, Inc., or Eureka, and our October 2023 acquisition of Ermetic, Ltd., or Ermetic,statements, and we expect to expand our current business by acquiring additional businesses or technologies in the future. Acquisitions involve many risks, including the following:

In addition, Vulcan Cyber, Eureka and Ermetic and other companies we have recently acquired principally operate in Israel and the Regionalregional conflict in the Middle East may also have the effect of heightening the risks identified above.

We are subject to risks associated with our investments in private companies,companies and private equity funds, including partial or complete loss of invested capital, and significant changes in the fair value of this portfolio could adversely impact our financial results.

We have invested, and may continue to invest, in private companies and private equity or venture capital funds, where we do not have the ability to exercise significant influence over results.results or investment decisions. Investments in private companies and limited partnerships are inherently risky. The companies in which we investinvest, or the companies held within the portfolios of funds in which we are a limited partner, are often early stage private companies focused on cybersecurity innovation, artificial intelligence, and suchother emerging technologies. Such companies may still be developing technologies or products with limited cash to support the development, marketing and sales of their technologies or products. These companies may have no or limited revenues, may not be or ever become profitable, may not be able to secure additional private financing to fund their operations, or their technologies, services, or products may not be successfully developed or introduced to the market. If any company in which we investinvest, or the funds in which we participate, fails, we could lose all or part of our investment in that company. In addition, if we determine that any of our investments in such companies or funds have experienced a decline in value, we will recognize an expense to adjust the carrying value to its estimated fair value. For example, in 2023 we recognized $5.6 million of impairment loss related to our investments. Negative changes in the estimated fair value of our investments in private companies and funds could have an adverse effect on our results of operations and financial condition.

Furthermore, our ability to liquidate an investment in a private company or an interest in a private equity fund will typically depend on a liquidity event, such as a private equity financing, a public offering or acquisition, as no public market currently exists for such securities. Our interests in private funds are generally subject to significant transfer restrictions and may require us to remain invested for the life of the fund, which may extend for ten years or more. We may not be able to dispose of these investments on favorable terms or at all.

To service our indebtedness, we will require a significant amount of cash. Our ability to generate cash, make scheduled payments or to refinance our debt obligations depends on our successful financial and operating performance, which may be affected by a range of economic, competitive and business factors, many of which are outside of our control and some of which are described elsewhere in the “Risk Factors” section of this report.

The global economy, including credit and financial markets, recently experienced extreme volatility and disruptions, including severely diminished liquidity and credit availability, declines in consumer confidence, declines in economic growth, increases in unemployment rates, inflation, interest rate fluctuationsfluctuations, increased global trade barriers, and uncertainty about economic stability. For example, in recent years the high rates of inflation, high interest rates and concerns about an economic recession in the United States or other major markets resulted in widespread unemployment, economic slowdown and extreme volatility in the capital markets. In 2022 and 2023, the Federal Reserve raised interest rates multiple times in response to concerns about inflation.inflation and maintained those levels throughout 2024. While the Federal Reserve decreased interest rates in 2024,2025, interest rates remain highelevated and the Federal Reserve is not expectedrelative to significantlyrecent decreasehistorical interest rates in the immediate future.lows. Higher interest rates, coupled with reduced government spending and volatility in financial markets, including with respect to foreign exchange, may increase economic uncertainty and affect consumer spending. For example, during periods with a relatively strong U.S. dollar, our products are more expensive for existing and prospective international customers, which has impacted, and could in the future could impact, the budgets and purchasing decisions of certain of our existing and prospective international customers.

If the equity and credit markets deteriorate, including as a result of political unrest or war, it may make any necessary debt or equity financing more difficult to obtain in a timely manner or on favorable terms, more costly or more dilutive. Increased inflation rates can adversely affect us by increasing our costs, including labor and employee benefit costs. In addition, higher inflation could also could increase our customers’ operating costs, which could result in reduced budgets for our customers, longer sales cycles and potentially less demand for our products. Any significant increases in inflation and related increaseincreases in interest rates could have a material adverse effect on our business, results of operations and financial condition.

The following discussion and analysis of our financial condition and results of operations should be read in conjunction with our consolidated financial statements and related notes included elsewhere in this Annual Report on Form 10-K, or this Form 10-K. This Form 10-K contains forward-looking statements within the meaning of Section 27A of the Securities Act of 1933, as amended, or the Securities Act and Section 21E of the Securities Exchange Act of 1934, as amended, or the Exchange Act. These statements are often identified by the use of words such as “anticipate,” “believe,” “continue,” “could,” “estimate,” “expect,” “intend,” “may,” “plan,” “project,” “will,” “would” or the negative or plural of these words or similar expressions or variations. Such forward-looking statements are subject to a number of risks, uncertainties, assumptions and other factors that could cause actual results and the timing of certain events to differ materially from future results expressed or implied by the forward-looking statements. Factors that could cause or contribute to such differences include, but are not limited to, those identified herein, and those discussed in the section titled “Risk Factors,” set forth in Part I, Item 1A of this Form 10-K and in our other filings with the SEC. You should not rely upon forward-looking statements as predictions of future events. Furthermore, such forward-looking statements speak only as of the date of this report. Except as required by law, we undertake no obligation to update any forward-looking statements to reflect events or circumstances after the date of such statements.

We are athe leading provider of exposure management solutions. Exposure management is thean evolutionincreasingly ofcritical category that extends foundational vulnerability management,management advancingcapabilities to advance risk assessment and prioritization across the entire attack surface – from IT infrastructure toand cloud environments to critical infrastructure.infrastructure and AI. Tenable unifies security visibility, insight and action across this attack surface, equipping modern organizations to exposequickly identify and close the cybersecurity gaps that erode business value, reputation and trust.

Tenable OneOne, is anour AI-powered exposure management platform thatplatform, gives enterprises a single, unified view of risk across all types of assets and attack pathways. The platform combines broad, industry-leading vulnerability coverage, spanning IT assets, cloud resources, containers, web appsapps, identity systems, third-party connectors and identityAI-related systems. Tenable One builds on the speedassets and breadth of vulnerability coverage from our research team of cybersecurity and data science experts, or Tenable Research, and adds aggregated exposure view analytics, guidance on mitigating attack pathways and a centralized asset inventory. It leverages AI, and machine learning, or ML, rapidly analyzing and interpreting vast data sets to pinpoint priority weaknesses and high-risk attack paths, deliver recommendations and automate routine tasks.workloads.

Our platform offeringssolutions are primarily sold on a subscription basis with a one-year term.term, but are increasingly being sold with longer contractual durations. Our subscription terms are generally not longer than three years. These offeringssubscriptions are typically prepaidinvoiced in advance.advance at the beginning of the term, however multi-year subscriptions are increasingly being invoiced annually in installments.

Recurring revenue, which includes revenue from subscription arrangements for software (both recognized ratably over the subscription term and upon delivery) and cloud-based solutions and maintenance associated with perpetual licenses, represented 96% of revenue in 2025 and 2024 and 95% of revenue in 2023 and 2022.2023.

Key Operating and Financial Metrics

Calculated current billings consists of revenue recognized in a period plus the change in current deferred revenue in the corresponding period. We believe that calculated current billings, which excludes deferred revenue for periods beyond twelve months in a customer’s contractual term, more closely correlates with annual contract value. Variability in total billings, depending on the timing of large multi-year contracts and the preference for annual billing versus multi-year upfront billing, may distort growth in one period over another.

The following table presents calculated current billings, including a reconciliation of revenue, the most directly comparable financial measure calculated in accordance with GAAP, to calculated current billingsGAAP:

We have historically experienced, and expect in the future to experience, seasonality in entering into agreements with customers. We typically enter into a significantly higher percentage of agreements with new customers, as well as renewal agreements with existing customers, in the third and fourth quarters of the year. The increase in customer agreements in the third quarter is primarily attributable to U.S. government and related agencies, and the increase in the fourth quarter is primarily attributable to large enterprise account buying patterns typical in the software industry. We anticipate that these historical trends may be impacted by current macroeconomic conditions and U.S. policy decisions related to the funding of government agencies and the imposition of tariffs which may lengthen purchasing and approval phases of our sales cycle in 2026. The ratable nature of our subscription revenue makes this seasonality less apparent in our overall financial results. We expect longer purchasing and approval phases of our sales cycle to continue in 2025.

Our operating expenses consist of sales and marketing, research and development, general and administrative and restructuring expenses. Personnel costs are the most significant component of operating expenses and consist of salaries, benefits, bonuses, payroll taxes, stock-based compensation and ordinary course severance. Operating expenses also include depreciation and amortization as well asamortization, allocated overhead costs, including IT and facilities costs.costs, as well as acquisition-related expenses.

Sales and marketing expense consists of personnel costs, sales commissions, marketing programs, travel and entertainment, expenses for conferences, meetings and events andevents, allocated overhead costs.costs and acquisition-related expenses. We capitalize sales commissions, including related fringe benefit costs, and recognize the expense over an estimated period of benefit, which ranges between three and four years for subscription arrangements and five years for perpetual license arrangements. Sales commissions on contract renewals are capitalized and amortized ratably over the contract term, with the exception of contracts with renewal periods that are one year or less, in which case the incremental costs are expensed as incurred. Sales commissions on professional services arrangements are expensed as incurred as the contractual periods of these arrangements are generally less than one year.

We intend to continue to make investments in our sales and marketing teams to increase revenue, further penetrate the market and expand our global customer base. We expect our sales and marketing expense to increase in absolute dollars annually and to be our largest operating expense category for the foreseeable future. However, as our revenue increases, we expect our sales and marketing expense to decrease as a percentage of our revenue in 20252026 and over the long term. Our sales and marketing expense may fluctuate from period to period due to the timing and extent of these expenses, including sales commissions, which may fluctuate depending on the mix of sales and related expense recognition.

Research and development expense consists of personnel costs, software used to develop our products, travel and entertainment, consulting and professional fees for third-party development resources as well asresources, allocated overhead.overhead and acquisition-related expenses. Our research and development expense supports our efforts to continue to add capabilities to our existing products and enable the continued detection of new network vulnerabilities.

We expect our research and development expense to continue to increase annually in absolute dollars for the foreseeable future as we continue to invest in research and development efforts to enhance the functionality of our cloud-basedexposure management platform. However, we expect our research and development expense to decrease as a percentage of our revenue over the long term, although our research and development expense may fluctuate from period to period due to the timing and extent of these expenses.

We expect our general and administrative expense to continue to increase in absolute dollars and decrease as a percentage of our revenue over the long term, although our general and administrative expense may fluctuate from period to period due to the timing and extent of these expenses. WeIn expect2025, our general and administrative expensesexpense inincluded Q1$15.5 2025million to increase sequentially, primarily due toof termination benefits, including cash compensation and accelerated equity award vesting, related to the passing of our former Chairman and Chief Executive Officer.

Restructuring expenses consist of non-ordinary course severance, employee related benefits and other charges to reorganize business operations. In the three months ended December 31, 2025, we recorded $3.1 million of restructuring expense for non-ordinary course severance and employee-related benefits. We expect to record approximately $5.0 million in restructuring expense in the year ended December 31, 2026.

Interest Income, Interest Expense and Other Expense,Income (Expense), Net

Interest income consists of income earned on cash and cash equivalents and short-term investments. Interest expense consists primarily of interest expense in connection with our Term Loan, unused commitment fees on our senior secured revolving credit facility, or Revolving Credit Facility, and letter of credit fees. Other expense,income (expense), net consists primarily of foreign currency remeasurement and transaction gains and losses and any realized and unrealized gains and losses, including impairment losses and gains related to our non-marketableinvestments investments.in privately held securities.

Provision for income taxes consists of income taxes in all jurisdictions in which we conduct business and the related withholding taxes on sales with customers. We have recorded deferred tax assets for which a full valuation allowance has been provided, including net operating loss carryforwards and tax credits. We expect to maintain this full valuation allowance for the foreseeable future as it is more likely than not that some or all of those deferred tax assets may not be realized based on our history of losses. The valuation allowance is subject to change based on our ability to generate future taxable income. We will continue to evaluate the realization of deferred tax assets to determine changes to valuation allowance in future periods.

•a $1.7$3.9 million increase in personnel costs, including a $1.4$1.0 million increase in stock-based compensation; and

•a $1.1$2.4 million increase in depreciation and amortization;amortization.

•a $7.6$10.3 million decreaseincrease in personnel costs, net ofincluding a $1.4$6.1 million increase in stock-based compensation; and

•a $0.4$4.5 million decreaseincrease in depreciationsales expense.commissions;

•a $21.3$34.9 million increase in personnel costs, largely associated with an increase in headcount, including aan $10.4$8.9 million increase in stock-based compensation; and

•a $2.9$3.0 million increase in allocated overhead expenses;expenses.

Except for the risk factors disclosed below, there have been no material changes to the risk factors disclosed in Part 1,I, Item 1A. "Risk Factors" of our Form 10-K for the year ended December 31, 2025 filed with the United States Securities and Exchange Commission ("SEC") on February 27, 2026. Our business is subject to risks and events that, if they occur, could adversely affect our financial condition and results of operations and trading price of our securities. In addition to the other information set forth in this Form 10-Q, you should carefully consider the factors described in Part I, Item 1A. “Risk Factors” of our Form 10-K for the year ended December 31, 2025. We may disclose additional changes to risk factors or disclose additional factors from time to time in our future filings with the SEC. Additional risks and uncertainties not presently known to us or that we currently deem immaterial also may impair our business operations.

We rely on third-party service providers and technologies to operate critical business systems, including processing confidential and sensitive information, including, without limitation, cloud-based infrastructure, data center facilities, encryption and authentication technology, employee email and other functions. We also rely on third-party service providers to provide other products, services, or otherwise, to operate our business and elements of our infrastructure, including endpoints. Our ability to monitor these third parties' information security practices is limited, and these third parties may not have adequate information security measures in place. Additionally, software errors or vulnerabilities in these third-party technologies could result in significant disruptions to our information technology systems, leading to downtime, data loss, or compromised data integrity. Our use of generative AI technologies may increase the risks associated with open source software and other third-party components, including where such technologies retrieve or recommend malicious or vulnerable code from public repositories or other third-party sources that may be used without appropriate review.

We have incorporated and mayexpect into thecontinue futureto incorporate and further incorporateexpand our use of AI technologies, including generative AI, into certain of our products and services. These technologies are subject to new and developing regulatory frameworks and may create operational, financial, regulatory, and reputational risks based on development practices or reliance on AI outputs that are inaccurate or flawed. These technologies may not achieve market acceptance and may pose other adverse consequences to our business, some of which we may not know or be able to quantify at this time.

We have incorporated and mayexpect into thecontinue futureto incorporate and further incorporateexpand our use of AI features in certain of our products and services, including ExposureAI andExposureAI, Tenable AI Assistant and Hexa AI within Tenable One. The use of AI technologies, including generative AI processes, at scale is relatively new, and may lead to challenges, concerns and risks, including various privacy and security risks that are significant or that we may not be able to predict, especially if our use of these technologies in our products and services becomes more important to our operations over time. The technologies underpinning these features are in the early stages of commercial use and exist in an emerging regulatory environment with heightened regulatory scrutiny, which presents regulatory, litigation, ethical, safety, reputational, operational and financial risks. AI in our products and services may be complex to deploy successfully due to operational issues inherent to the nature of such technologies, including the availability, development, maintenance and operation of deep learning datasets and third-party dependencies.

Uncertainty in the legal regulatory regime relating to AI and emerging ethical issues surrounding the use of AI may require significant resources to modify and maintain business practices to comply with U.S. and non-U.S. laws, the nature of which cannot be determined at this time. Existing laws and regulations may apply to us or our suppliers, vendors, partners and customers in new ways, and new laws and regulations may be instituted. Many U.S. and international governmental bodies and regulators have proposed, enacted or are in the process of developing, new regulations related to the use of AI and machine learning technologies, including the EU AI Act, Colorado AI Act, California Bot Disclosure Law, and Utah AI Policy Act, as well as regulations on certain high-risk automated decisions, such as those in the employment context. For example, the EU AI Act, which applies beyond the European Union’s borders and establishes obligations for AI providers and those deploying AI systems, sets out a risk-based framework that subjects certain AI technologies to numerous compliance obligations, such as transparency, conformity and risk assessment, monitoring and human oversight requirements. Under the EU AI Act, non-compliant companies may be subject to administrative fines of up to 35 million Euros or 7% of a company's total worldwide annual turnover for the preceding financial year, whichever is higher. Certain of our activities subject us to the EU AI Act and other U.S. and non-U.S. laws governing AI or data processed in connection with AI. We expect other jurisdictions may adopt similar or potentially more restrictive laws, which may render the use of such technologies challenging. The final form of these may impose obligations related to our development, offering (including import and export thereof) and use of AI technologies and expose us to increased risk of regulatory enforcement and litigation. We may have to amend our business practices, contractual arrangements, products and/or services to comply with such obligations. In addition to formal legislation, governmental authorities may take enforcement or administrative actions that restrict the use of specific AI technologies. For example, federal agencies have designated Anthropic as a supply chain risk.risk, a designation Anthropic has challenged in ongoing federal litigation and whose ultimate scope and enforceability remains uncertain. This or similar enforcement or administrative actions or changes in export controls, trade sanctions or other regulatory restrictions impacting AI technologies and frontier models could result in prohibitions on the use of Anthropic's and/or other frontier AI models in our solutions. Such actions could force us to decouple or replace integrated technologies on short notice, resulting in significant engineering costs, service disruptions, and the loss of critical product functionality.

Our AI technology features may also generate output that is misleading, insecure, inaccurate, harmful or otherwise flawed. Agentic AI solutions may compound those risks by taking or implementing actions or outputs, which themselves may be based on flawed outputs, that further increase the risk of misleading, insecure, inaccurate, harmful or otherwise flawed outcomes. This risk extends to our enterprise operations, as employee use of unvetted third-party agentic AI solutions, such as browser plug-ins or other automated applications, could result in actions being taken without adequate human review or monitoring. Such unauthorized automated actions could, for example, lead to the inadvertent disclosure or modification of corporate data or other sensitive information, flawed communications to customers or partners, or the creation of unintended legal or financial obligations on behalf of the company. Our customers or others may rely on or use such misleading, insecure, harmful or otherwise flawed content to their detriment, which may harm our brand, reputation, business or customers, cause competitive harm or expose us to legal liability. For example, AI algorithms use machine learning and predictive analytics which may be insufficient or of poor quality and reflect inherent biases and could lead to flawed, biased, and inaccurate results. Deficient or inaccurate recommendations, forecasts, or analyses that generative AI applications assist in producing could lead to customer rejection or skepticism of our products, affect our reputation or brand, and negatively affect our financial results. Further, unauthorized use or misuse of AI by our employees or others may result in disclosure of confidential company and customer data, reputational harm, privacy law violations and legal liability. Our use of generative AI may also lead to novel and urgent cybersecurity risks, including those related to personal data, which may adversely affect our operations and reputation, and these risks likely are compounded by our use of agentic AI.

A portion of our revenue is generated from subscriptions and perpetual licenses sold to governmental entities in the United States. Additionally, many of our current and prospective customers, such as those in the financial services, energy, insurance and healthcare industries, are highly regulated and may be required to comply with more stringent regulations in connection with subscribing to and implementing our enterprise platform. Selling licenses to these entities can be highly competitive, expensive and time-consuming, often requiring significant upfront time and expense without any assurance that we will successfully complete a sale. Governmental demand and payment for our enterprise platform may also be impacted by public sector budgetary cyclescycles, funding authorizations and fundingbudget authorizations,shortfalls, the operational stability of federalgovernment agencies, and the prioritization of cybersecurity and digital infrastructure initiatives. Funding reductions or delays, including those resulting from a U.S. government shutdown, reductions or eliminations of agency operating budgets or deprioritization of cybersecurity digital infrastructure related initiatives would adversely affect public sector demand for our enterprise platform. For example, the U.S. presidential administration's priorities and actions to reduce government spending, including, but not limited to, those previously driven by the Department of Government Efficiency, may impact the availability of funding for U.S. government customers as a result of the elimination of departments and personnel. These actions may lead to elongated sales cycles and procurement decisions and could result in fewer contract opportunities or reduced funding for existing initiatives, all of which would adversely affect our business and financial performance. In addition, governmental entities have the authority to terminate contracts at any time for the convenience of the government, which creates risk regarding revenue anticipated under our existing government contracts.

The following discussion and analysis of our financial condition and results of operations should be read in conjunction with (1) our consolidated financial statements and related notes included elsewhere in this Quarterly Report on Form 10-Q, or this Form 10-Q, and (2) our consolidated financial statements, related notes and management's discussion and analysis of financial condition and results of operations in our Annual Report on Form 10-K for the year ended December 31, 2025, or the 10-K, filed with the Securities and Exchange Commission, or the SEC, on February 27, 2026. This Form 10-Q contains forward-looking statements within the meaning of Section 27A of the Securities Act of 1933, as amended, or the Securities Act, and Section 21E of the Securities Exchange Act of 1934, as amended, or the Exchange Act. These statements are often identified by the use of words such as “anticipate,” “believe,” “continue,” “could,” “estimate,” “expect,” “intend,” “may,” “plan,” “project,” “will,” “would” or the negative or plural of these words or similar expressions or variations. Such forward-looking statements are subject to a number of risks, uncertainties, assumptions and other factors that could cause actual results and the timing of certain events to differ materially from future results expressed or implied by the forward-looking statements. Factors that could cause or contribute to such differences include, but are not limited to, those identified herein, and those discussed in the section titled “Risk Factors,” set forth in Part I, Item IA1A of the 10-K, in Part II, Item 1A of this Form 10-Q and in our other filings with the SEC. You should not rely upon forward-looking statements as predictions of future events. Furthermore, such forward-looking statements speak only as of the date of this report. Except as required by law, we undertake no obligation to update any forward-looking statements to reflect events or circumstances after the date of such statements.

Recurring revenue, which includes revenue from subscription arrangements for software (both recognized ratably over the subscription term and upon delivery) and cloud-based solutions and maintenance associated with perpetual licenses, represented 95% of revenue in the three months ended June 30, 2026 and 96% of revenue in the three months ended MarchJune 31,30, 2025 and the six months ended June 30, 2026 and 2025.

We typically experience seasonality in customer agreement volumes, entering into a significantly higher percentage of new and renewal agreements in the third and fourth quarters of the year. The increase in the third quarter is primarily driven by U.S. government and related agencies, and the increase in the fourth quarter reflects typical large enterprise buying patterns in the software industry. Although the ratable nature of our subscription revenue lessens the financial impact, these historical trends may be impacted by macroeconomic conditions and U.S. policy decisions, which may lengthen purchasing and approval phases of our sales cycle in 2026.cycle.

(2) Stock-based compensation in the threesix months ended MarchJune 31,30, 2025 includes $14.6 million of expense related to the accelerated vesting of equity awards for our former Chairman and Chief Executive Officer.

Comparison of the Three Months Ended MarchJune 31,30, 2026 and 2025

The increase in revenue included an increase of $24.8$23.3 million from existing customers as of AprilJuly 1, 2025, partially offset by a decrease of $1.9$2.1 million in revenue from new customers. U.S. revenue increased $9.5$7.3 million, or 7%.6%. International revenue increased $13.4$13.9 million, or 12%.

•a $0.8$1.4 million increase in professionalpersonnel services.costs; and

•a $2.3$2.4 million increase in personnel costs, including a $0.8$0.9 million increase in stock-based compensation; and

•a $1.3$2.4 million increase in sales commissions,commissions; partially offset by

•a $0.5$1.7 million increasedecrease in expenses for demand generation programs, including advertising, sponsorships, and brand awareness efforts; partially offset byand

•a $1.0$1.5 million increase in allocated overhead; partially offset by

•a $1.2$0.7 million decreaseincrease in acquisition-relatedthird-party expenses.cloud infrastructure costs; and

•a $13.2$12.8 million decrease in personnel costs, including a $12.9 million decrease in stock-based compensationcosts primarily related to the accelerated vesting of equity awards for our former Chairman and Chief Executive Officer in the threesix months ended MarchJune 31,30, 2025; and

•a $2.3$3.6 million decrease in acquisition-related expenses.expenses; and

Restructuring in the threesix months ended MarchJune 31,30, 2026 included non-ordinary course severance and employee related benefits.