Tenable says it beat every metric it had guided for the third quarter, lifted its full-year outlook and refinanced its debt with an $800m convertible note sale. For UK security buyers the more useful signal is in the detail: growth is leaning on existing customers moving onto the Tenable One platform, while new customer additions slipped.
What happened
Tenable, the US exposure management vendor behind Nessus and the Tenable One platform, published its results for the quarter to 30 September 2026 on 28 October. Revenue came in at $276.4m, a rise of 9.5% on the same period last year. Non-GAAP earnings per share reached $0.63, up from $0.42, and comfortably ahead of the analyst consensus of $0.51 reported by Goldesel. Non-GAAP operating margin rose to 27.1% from 23.3%, although the GAAP figure was a much thinner 6.0%.
The company raised its guidance for 2026. It now expects full-year revenue of $1.084bn to $1.087bn and non-GAAP earnings per share of $2.16 to $2.19. For the fourth quarter it is guiding to revenue of $277m to $280m. Co-CEO Steve Vintz said the business had delivered “an excellent third quarter, exceeding every one of our guided metrics”.
Alongside the numbers, Tenable confirmed it had closed an upsized $800m offering of convertible senior notes and put in place a new $400m secured revolving credit facility.
The detail
Strip away the headline beat and the shape of the business becomes clearer. According to an analysis of the filing by Finsee, Tenable’s dollar-based net expansion rate, which measures how much more existing customers spend year on year, rose to 107% from 106%. It is the second consecutive quarterly improvement. Co-CEO Mark Thurmond framed it as customers “moving from conversation to commitment” with Tenable One.
The weaker side of the picture is new business. Finsee calculates that Tenable signed 413 new enterprise platform customers in the quarter, around 5.5% fewer than a year earlier. Short-term remaining performance obligations, the contracted revenue due over the next twelve months, grew 11.7% to $747.2m, a little slower than the 12.3% recorded in the second quarter. The midpoint of fourth-quarter guidance implies revenue growth of roughly 7%.
Profit has risen faster than sales because costs have been held down and the share count reduced. Finsee notes that sales and marketing, research and development and administrative spending all fell as a share of revenue, and that Tenable spent $223.8m on buybacks during the quarter. The convertible proceeds were used to clear a $360m term loan that was due in 2028, buy capped calls to limit dilution and repurchase 5.3 million shares for $170.5m. Cash and short-term investments climbed to $495.3m.
On product, the quarter was dominated by AI. Finsee reports that Tenable integrated Anthropic’s Claude Mythos model into Tenable One Adversary View for attack path analysis, launched an open-source registry of security AI agents called CyberAgents Exchange, and extended its Hexa AI engine with agents intended to find exposures, coordinate remediation and check fixes with limited human involvement. The release itself gives no revenue figures for these features.
Why it matters for UK organisations
Vulnerability and exposure management is one of the most widely bought security categories in the UK, from FTSE groups and NHS trusts down to managed service providers scanning on behalf of small firms working towards Cyber Essentials. Results like these tell buyers where their supplier is putting its effort, and that has consequences at renewal time.
The clearest message is that growth is coming from upselling the installed base rather than winning new logos. If you hold standalone scanning licences, expect your account team to push hard towards the platform bundle. That may suit some organisations, but it should be decided on what you will actually use.
The market backdrop matters too. In the same week, Fortinet and F5 both beat forecasts and still saw their shares fall sharply, with 24/7 Wall St arguing that investors now reward only accelerating growth and sustained margins. Vendors under that kind of pressure tend to lean on price rises, bundling and multi-year commitments. UK procurement teams, many of whom buy in sterling against dollar list prices, should factor that into budgets for 2027.
Finally, the move to AI agents that can coordinate remediation raises governance questions that UK boards and auditors will ask. Anything that changes configurations or opens tickets automatically needs clear change control, logging and accountability, particularly for organisations that will fall within the scope of the Cyber Security and Resilience Bill.
Expert view
In my experience, the organisations that get real value from exposure management tools are not the ones with the most modules, but the ones with a dependable asset inventory and a remediation process that people actually follow. When we test environments that run mature scanning platforms, we still regularly find internet-facing services nobody knew were there and critical findings that have sat in a dashboard for months.
I am cautiously positive about the AI direction. Attack path modelling is genuinely useful for showing which of thousands of findings an adversary could chain into something serious, and that is the conversation boards understand. My concern is with agents that act on their own. A remediation agent operating outside working hours is only as safe as the guard rails around it, and I would want to see those tested before letting one near production systems.
The financial picture is reassuring for anyone worried about supplier stability. Paying off the 2028 loan and building a near half-billion-dollar cash position removes an obvious risk. The trade-off is that a vendor managing for margin and buybacks may be less inclined to discount, so negotiate early.
What to do now
- Review your renewal date and terms. If you renew in the next six months, start talks now, ask for multi-year price protection and get any platform migration incentives in writing.
- Map what you actually use. Before accepting a bundle, list which capabilities your team uses weekly. Pay for coverage you will operate, not for features that look good in a demonstration.
- Fix the asset inventory first. Exposure scoring is only meaningful if you know what you own. This underpins the Cyber Essentials requirements for secure configuration and security update management.
- Set rules for AI-driven remediation. Agree what any automated agent may change, who approves it, how it is logged and how it is rolled back, and pilot it on non-production systems first.
- Measure time to fix, not number of findings. Track how quickly critical and high-risk exposures are closed, in line with the 14-day patching expectation in Cyber Essentials.
- Keep an exit option. Make sure scan data and asset records can be exported in a usable format so you are not locked in if pricing moves against you.
Bottom line
Tenable’s third quarter was strong on profit, cash and balance sheet repair, and its customers are buying more of the platform. New customer growth is softer, and the wider security market is under pressure from investors who want more than a simple beat. For UK buyers that combination points to firmer pricing and a determined push towards bundles, so this is a good moment to be clear about what you need and to negotiate accordingly.
Sources
- SEC: Tenable Holdings Form 8-K, third quarter 2026 financial results
- Finsee: Tenable (TENB) Q3 2026 earnings review
- Goldesel: Tenable Holdings Aktie: Q3 übertrifft Erwartungen, Jahresausblick steigt
- 24/7 Wall St.: First F5, now Fortinet: Wall Street has stopped paying security stocks for beating earnings
