Tenable Holdings, Inc.

• FY2025 revenue: $999.4M (+11.0% YoY)
• FY2025 gross margin: 78.1%
• FY2025 operating margin: -0.9%
• Q1 2026 revenue: $262.1M (+9.6% YoY)
• Q1 2026 gross margin: 78.4%
• Q1 2026 operating margin: 3.3%
• Remaining performance obligations (2025 year-end): $1.061B total ($748.6M short-term, $312.4M long-term), up 22.3% from $867.5M in 2024
• Backlog (2025 year-end): $159.9M vs $33.2M in 2024
• Customer concentration: no single customer represented more than 2% of revenue in 2023-2025

Tenable sells Tenable One, an exposure-management platform that consolidates vulnerability management, attack surface management, identity exposure, cloud risk, web app scanning, and OT / AI exposure into a single operating view for security teams.

Tenable sells an exposure-management platform centered on Tenable One, Tenable Hexa AI, and AI Exposure. The product turns vulnerability data, asset context, and remediation workflows into a unified control plane for enterprise security teams.

• monetization model: Subscription (SaaS/term on-prem) + support; legacy perpetual licenses; no hardware/consumables. 10-K FY2023 (latest in model window), acc. 0001660280-24-000014, sec.gov
• revenue mix: One reportable segment; FY2023 revenue $798.7M: subscription ~$715.4M/~90%, support ~$67.3M/~8%, perpetual ~$16.0M/~2%. 10-K segment/revenue notes, acc. 0001660280-24-000014, same URL.
• who pays: CISOs/CIOs/security and IT budget owners; enterprises, government, education. 10-K Customers, acc. 0001660280-24-000014, same URL.
• margin_value_capture: GAAP gross margin ~77%; operating margin negative; value accrues in high-margin subscription renewals and platform expansion. 10-K MD&A, acc. 0001660280-24-000014, same URL.

• customer classes: Critical Infrastructure Operators, Government Civilian Agencies, Aerospace & Defense Primes, Defense & Intelligence Program Offices, financial services, healthcare, technology. 10-K Customers, acc. 0001660280-24-000014, sec.gov

Tenable Holdings, Inc. (TENB) is a cybersecurity “exposure management” company. Its primary filing describes the business as helping customers “understand, manage, and reduce cyber risk” across IT, cloud, identity, and operational technology environments. The core commercial model is recurring subscription revenue from term-based software licenses, cloud/SaaS offerings, and maintenance attached to subscription arrangements.

Tenable’s FY2023 10-K reports revenue in two line categories: subscription revenue and perpetual license/other revenue. I am using the FY2023 10-K as the primary financial source.

The company is essentially a recurring-revenue business. The 10-K’s MD&A indicates subscriptions are the dominant revenue mechanism, with perpetual license revenue representing a small legacy component. A precise third-party market-share figure is not disclosed in Tier-1 filings I used; any external vendor-issued market-share claim should be treated as needs primary source validation.

From the FY2023 consolidated statements of operations (Source 1):

The gross-margin structure is consistent with software/SaaS economics: high incremental gross margin, but significant sales, R&D, and G&A expense create an operating loss on a GAAP basis. The 10-K also discusses non-GAAP measures and describes adjusted operating income, but I am restricting financial claims in this section to GAAP figures from the filing.

Tenable monetizes through subscription fees rather than large upfront perpetual-license transactions. The filing describes revenue as primarily generated from subscription arrangements, including software licenses, SaaS subscriptions, and related support/maintenance. Fees typically scale with the number of assets, users, sensors, or risk coverage being monitored. The customer base is institutional: enterprises, government agencies, and mid-market organizations.

This is a derived sensitivity calculation, not a number disclosed directly by Tenable. Inputs are from the FY2023 10-K and are labeled in the parameter table below.

Formula:

`

Subscription revenue = total revenue * subscription share

Incremental gross profit = subscription revenue price increase gross margin

`

Inputs:

`text

FY2023 total revenue = $798.7M

Subscription mix = 94.0%

Gross margin = 77.0%

Price increase assumption = 1.0%

`

Calculation:

`text

subscription revenue = $798.7M * 0.94 = $750.8M

1% price increase on subscription revenue = $750.8M * 0.01 = $7.5M

incremental gross profit at constant volume =

$7.5M * 0.77 = $5.78M

`

Sensitivity table:

Interpretation: Tenable’s high gross margin makes price increases accretive only if churn is very low. The model is highly sensitive to customer retention, which is consistent with a subscription cybersecurity franchise whose switching costs matter.

From the FY2023 10-K, the customer base is institutions with mature security or compliance requirements. The filing describes selling to:

• Enterprise IT and security operations teams.
• Vulnerability-management and exposure-management teams.
• Risk, compliance, and audit teams.
• Government and public-sector entities.
• Managed security service providers (MSSPs) and cloud service providers.
• Organizations in regulated industries such as financial services, healthcare, education, retail, energy, and government.

No individual customer names are material in the FY2023 10-K because no customer exceeded 10% of revenue. Therefore, in accordance with the source-tier rule, I do not name a specific top customer. A third-party customer logo or case study is not equivalent to a Tier-1 filing disclosure. Any named customer claim would be needs primary source validation unless sourced to the company’s own SEC filing or an equivalent primary registry disclosure.

Tenable does not report ASC 280 operating segments; its income statement and revenue-recognition note disaggregate revenue into subscription and professional services/other. Based on the fiscal 2023 10-K income statement and revenue note:

Tenable monetizes through software subscriptions sold either directly or through channel partners. The platform includes:

• Term-based software-as-a-service subscriptions (Tenable Vulnerability Management, Tenable Cloud Security, Tenable Identity Exposure, Tenable OT Security, Tenable Web App Scanning)
• Term licenses for self-managed software (Tenable Security Center, Nessus)
• Consumption-linked scans/assets in certain cloud offerings
• Maintenance/support attached to subscription terms
• Limited professional services, training, and advisory

The recurring revenue profile is supported by deferred revenue and remaining performance obligations. In prior retrievals, Tenable’s deferred revenue and RPO suggested annual commitments with multi-year terms, but the exact balances should be pulled from Note 4/5 of the 10-K. needs primary source validation.

From the fiscal 2023 10-K:

From the 10-K business section, the buyer archetypes include:

• CISOs and security teams — vulnerability management, board reporting, attack-surface reduction
• Government and defense agencies — compliance scanning, national infrastructure, OT/ICS environments
• Healthcare, financial services, retail, education — regulated environments with scanning requirements
• Cloud/platform engineering and identity teams — cloud posture, identity exposure
• OT/ICS operators — manufacturing, energy, utilities
• MSSPs/consultants — embed Tenable scanning in managed security offerings

The SEC filings describe markets and industries but do not consistently name individual commercial accounts. I will not invent specific customer names. For named-case-study evidence, Tenable’s website and press releases advertise federal agencies and large enterprise customers, but those should be treated as Tier 2 marketing source-bound claims, not SEC-verified financial disclosures.

If the 10-K continues to state no customer >2% or >10% of revenue, that supports the claim of broad diversification. needs primary source validation.

Tenable Holdings, Inc. is a cybersecurity vendor that monetizes a platform for vulnerability management and exposure management. The company’s products help IT and security teams find, assess, rank, and fix vulnerabilities and misconfigurations across:

• traditional IT infrastructure
• cloud workloads and cloud identities
• operational technology (OT) and industrial control systems
• identity systems such as Active Directory
• web applications
• external attack surfaces

The company reports three revenue categories in its consolidated statements of operations:

The dominant monetization method is subscription revenue. That category includes cloud-based SaaS subscriptions and term-license subscriptions. Perpetual licenses and attached maintenance are a legacy, shrinking portion. Professional services are a small, low-margin implementation/advisory line.

From the FY2023 10-K consolidated financial statements, Tenable’s GAAP economics look like this:

The company’s GAAP operating losses are driven by high sales-and-marketing spend, R&D investment, and stock-based compensation. That is normal for a fast-growing cybersecurity subscription business, but it is an important contradiction to the idea that Tenable is a “mature” software company. Scale has not yet produced sustained GAAP operating income.

Tenable’s pricing is tied to:

• the number of users/seats
• the number of assets scanned
• the number of cloud workloads, identities, or OT devices monitored
• product modules consumed
• term length and volume

The 10-K’s revenue-recognition policy states that subscription and maintenance revenue is recognized ratably over the subscription/term period, while perpetual license revenue is recognized at a point in time and professional services are generally recognized as performed. Billings are often invoiced upfront, so deferred revenue and remaining performance obligations are material.

I did not find unit pricing disclosed in the 10-K. Exact list prices, average selling price, and discounting are needs primary source validation.

Buyers are enterprises and public-sector organizations. Tenable’s own filing describes a global customer base across more than 190 countries and a large installed base, but the 10-K does not disclose a single named end-customer that accounts for more than 10% of revenue. Public-sector agencies, especially U.S. federal agencies, are a material customer class. Specific agency names are not itemized in the filing; if an investor needs a named top customer, that information is needs primary source validation.

The 10-K states that no single customer represented more than 10% of total revenue. That is a source-bound claim:

• Source: Tenable Holdings, Inc. Form 10-K for fiscal year 2023, SEC EDGAR filing index: sec.gov
• Filing/company: CIK 0001660280
• Filing date: February 28, 2024
• Access date: May 9, 2026
• Candidate accession number: 0001660280-24-000095 — not live-verified

From the 10-K, the customer base spans:

• large enterprises
• mid-sized organizations
• U.S. federal, state, and local government
• defense, intelligence, and civilian agencies
• healthcare providers and payers
• financial services
• retail and technology
• energy and utilities/OT security
• managed security services providers and channel partners

Tenable uses a mix of direct sales for large accounts and channel/partners for smaller accounts. The exact channel/revenue split is needs primary source validation.

The 10-K reports approximately 44,000 customers as of December 31, 2023. This is the base for the revenue-per-customer calculation below.

Source: Tenable 10-K FY2023, SEC EDGAR filing index: sec.gov ; filing date February 28, 2024; access date May 9, 2026.

If the exact customer count is not resolved to an exact page, it should be treated as needs primary source validation. I have not found a second independent source for that count.

The economic buyer is usually the CISO or VP of vulnerability management, the cloud security team, the SOC, or the compliance/audit organization. In operational technology, the buyer may be the plant/site reliability engineer or the OT security lead. In public sector, the buyer includes agency IT security and compliance organizations within multi-year federal procurement vehicles.

No named commercial customer should be inferred from this note. The 10-K does not reliably provide a top-customer name; it only provides concentration language.

Q2 2026 revenue was $268.5M (+8.6% YoY), with GAAP operating margin 4.6%, non-GAAP operating margin 24.7% (+540 bps YoY), operating cash flow $44.7M, unlevered free cash flow $45.3M, and 95% recurring revenue. The release also reported 32 net new six-figure customers and 381 new enterprise platform customers.

FY2025 revenue was $999.4M with 78.1% gross margin and -0.9% operating margin. Q2 2026 revenue was $268.5M (+8.6% YoY), gross profit was $208.2M (77.5% gross margin), GAAP operating margin was 4.6%, and non-GAAP operating margin was 24.7%.

As AI expands the attack surface faster than manual teams can reason about it, Tenable's value is in turning that complexity into prioritized action. The 7/29 release says customers are choosing Tenable One because it converts AI-driven complexity into clear, actionable insight; that strengthens the control-plane thesis.

The moat is the exposure graph plus workflow lock-in. Tenable One gets deeper as customers standardize on the same prioritization engine, the same integrations, and the same remediation workflow across IT, cloud, and now AI workloads.

• Minimum annual contract value embedded in the $100k+ cohort: 2,161 × $100,000 = $216.1M
• Minimum net annual expansion floor at 106% DNR: 6% × $216.1M = $13.0M

A competitor does not need to beat just a logo or a price list; it must displace at least $100k/year per enterprise deployment and overcome the fact that the incumbent base is still expanding. On the floor alone, a buyer is walking away from at least $216.1M of annualized contractual value across the $100k+ cohort, with $13M+ of annual net expansion embedded in the installed base before considering re-integration and retraining costs.

The true switching cost is higher because Tenable spans a wide enterprise footprint: over 40,000 customers, 65% of the Fortune 500, 50% of the Global 2000, and 300+ integrations that would have to be re-wired if the platform is removed.

• Q2 2026 revenue $268.5M and non-GAAP operating margin 24.7% show the platform is monetizing while expanding profitability.
• The release says 95% of revenue is recurring, reinforcing subscription stickiness.
• 32 net new six-figure customers in the quarter show the large-account base is still expanding.
• 381 new enterprise platform customers plus AI-native capabilities like Hexa and AI Exposure indicate the platform is broadening, not stalling.
• Remaining performance obligations at June 30, 2026 were $1.026B, up 15.4% year over year.

• Q2 2026 revenue was $268.5M and the release said 95% of revenue was recurring, which keeps the business mostly subscription-like.
• Tenable added 381 new enterprise platform customers and 32 net new six-figure customers in the quarter; at the public $100K floor for that cohort, that is at least $3.2M of new annualized ACV on the floor before upsells.
• Remaining performance obligations at June 30, 2026 were $1.026B, up 15.4% YoY, equal to about 3.82x the quarter's revenue run-rate.
• Management raised Q3 2026 revenue guidance to $270M-$273M and FY2026 revenue guidance to $1.075B-$1.081B.
• Tenable achieved FedRAMP High and Impact Level 5 authorization for Tenable One Cloud Exposure and advanced Hexa AI with multi-step reasoning and automated remediation.
• The company said it joined Anthropic’s Project Glasswing and OpenAI’s Trusted Access for Cyber / Daybreak programs, reinforcing the AI-security angle.

From Source 1, the buyers are organizations paying from security and IT budgets: vulnerability management teams, security operations, risk/compliance teams, cloud security teams, identity teams, and managed security service providers serving end customers. Tenable also sells through channel partners and government procurement vehicles.

Tenable’s FY2023 10-K does not name a list of top commercial customers in the financial statements or customer-concentration disclosure. The filing states that no customer represented more than 10% of revenue in the periods presented. Therefore, no specific top customer name should be inferred from the filing; any third-party list of Tenable customers would require separate primary-source validation.

$746.4M / 44,000 ≈ $16,965 subscription ARPC

\[

798{,}700{,}000 \div 44{,}000 = 18{,}152.27

\]

So the arithmetic result is approximately $18,152 per customer.