Tenable Holdings, Inc.

Moat: 3/5

Understandability: 4/5

Balance Sheet Health: 4/5

Tenable is a cybersecurity company specializing in exposure management solutions, primarily providing cloud-based services that help organizations gain visibility and prioritize their attack surfaces to mitigate risks.

Investor Relations Previous Earnings Calls

The moat, understandability, and balance sheet health scores reflect a conservative evaluation to ensure a margin of safety in any assessment.

Business Overview and Competitive Landscape

Tenable is a cybersecurity company that offers an Exposure Management platform, Tenable One, and is focused on helping organizations manage, measure and reduce their cyber risk. Its solutions provide visibility into organizations’ IT infrastructure, identifying vulnerabilities and misconfigurations across diverse environments, including IT, cloud and operational technologies (OT). This makes them a leader in the Exposure Management market by providing continuous visibility across the entire attack surface of their customers, enabling security and IT teams to manage vulnerabilities and misconfigurations to reduce the risks associated with cyber attacks.

Tenable offers a variety of products and services:

Tenable Vulnerability Management: cloud-delivered SaaS for identifying and prioritizing vulnerabilities.
Tenable Web App Scanning: cloud-delivered SaaS for scanning web applications for vulnerabilities.
Tenable Lumio: cloud-delivered SaaS for analyzing assets and attack paths.
Tenable Cloud Security: cloud-delivered SaaS to enable protection of cloud environments.
Tenable OT Security: On Premise application for specialized systems.
Tenable Attack Surface Management: a SaaS solution that provides visibility into external assets.

Tenable’s revenue model is primarily based on subscription fees, which makes its recurring revenue more reliable, and its key customers are organizations of all sizes across industries, including technology, government, healthcare, financial services and education.

The competitive landscape is complex, with several key players including Rapid7, Qualys, and Crowdstrike, but Tenable has differentiated itself through its focus on exposure management and its comprehensive view of cyber risk. However, these competitors are well established and also have strong enterprise-grade solutions. Moreover, the market is shifting to cloud native security, a market which is becoming increasingly competitive.

Financial Analysis

Tenable’s most recent quarterly report (Form 10-Q for the quarter ended September 30, 2024) shows several important aspects of its financial performance. The company has a recurring subscription revenue model, which makes its revenue streams more predictable.

Revenue: In Q3 2024, the revenue increased by 16% YoY, reaching $207.8 million from $179 million. This demonstrates steady growth in its core business of exposure management.

Subscription revenue comprised $195.2 million, which is the vast majority of the total revenue, as subscriptions represent 94% of the total revenue. This signifies how well the company has established its recurring revenues, a positive signal for a long-term growth company.
Professional services and other revenue increased 12% to $12.6 million, showing steady demand for its auxiliary services.
Profitability: The company’s gross profit is $177.4 million, demonstrating a stable gross profit margin of 77% and solid profitability of the core business of a software company. But, the operating loss was $21.7 million and net loss was $14.9 million for Q3 of 2024, showing a lack of profitability for the company. However, the company is focusing on acquiring new clients, so profitability may follow at a later stage.
While non-GAAP operating margin remained stable at 18% in Q3, the Non-GAAP net income was $34 million, showing the capacity of the business to maintain earnings once the initial growth investments are done.
Cash Flow: Free cash flow was negative at $14.2 million in the quarter ended September 2024. This highlights an important point that cash generation has to improve. While operating cash flow was positive at $66.5 million, investing cash flow was -$77.8 million, leading to a negative cash flow for the period. This is a noteworthy point that should be considered carefully.
However, there has been a lot of capital investments ($13.3 million in capital expenditures and $56.3 million in software development costs, partially offset by $15.6 million from the sale of short-term investments), so we can say that the company is heavily focused on growing its business right now, hence the negative FCF.
Balance Sheet: Tenable has a healthy balance sheet.
It has more current assets than current liabilities, which is a positive sign for liquidity. Current assets were $774 million as compared to current liabilities of $378 million.
Total assets were $1.58 billion as compared to total liabilities of $1.23 billion. This signals a reasonable level of debt. * However, it has to be noted that the goodwill and acquired intangibles make up a big portion of total assets, with them being equal to about $633 million combined. Intangible assets are harder to liquidate and provide less certainty in valuations.
Total shareholders’ equity was $356 million, down from the previous quarter, which is not a great sign and indicates that the company is consuming capital.
Debt was minimal, with a credit facility of $375 million having only a small fraction being utilized, implying good capital structure and flexibility.

Recent Concerns and Controversies

Tenable’s management has been focused on expanding its cloud presence while also navigating macroeconomic headwinds. In the recent earnings call, management highlighted challenges and opportunities regarding their security offerings:

The company acknowledged seeing more competition and longer deal cycles in the marketplace.
They focused on the company’s strength in cloud security and mentioned positive results.
Management noted strong recurring revenues and expanding profitability in a non-GAAP basis.
They expect a potential rebound in the tech sector, with higher spend in cyber security.

In their annual report, the company listed “data security incidents” as a potential risk to the business. The company has faced a few cybersecurity related incidents, which included a hack of some of its cloud infrastructure, that did not result in serious data compromises, but exposed some data to a third party. This emphasizes the importance of cybersecurity in their business and shows a very big external risk for the company.

Moat Analysis

Switching costs: The company benefits from solid switching costs, once its platform is deeply embedded into the clients’ systems, which makes changing providers quite complicated, and can have major operational disruption. Clients have invested a lot in setting up the infrastructure and the workflows, switching from Tenable to a competitor would mean losing all those investments and doing those things again.
Network effects: While less obvious, the network effects of cloud are in play, as the company has its own cloud infrastructure to perform all the operations, the data coming in from its users can be used by its platform to improve and offer better solutions for more new customers. This network effects helps scale the services and makes them faster. Also, if the cloud-based business works with a set of customers, there is always a possibility that existing customers may provide network to the company for a more wider market.
Intangible assets: The company’s brand recognition is reasonably strong in the sector, especially in the vulnerability management segment. Also, it has some patents and has proprietary technology, though these things can be challenged and replaced by competitors in the long term. There is not enough evidence to state that Tenable has a superior tech which makes other companies unable to compete, so it doesn’t constitute a sustainable competitive advantage at the moment.
Cost advantages: Tenable does not have any cost advantage. It has to invest heavily in R&D, marketing and maintaining its network. This is a highly competitive market where companies are innovating and increasing their business capabilities. However, Tenable has a good client base and a recurring revenue model that has proved its consistency.
Overall Moat Assessment: Based on above analysis, Tenable has a “Narrow” moat, because it has meaningful switching costs, and a little network effects that provides some competitive advantage and stickiness of its client base. But it doesn’t have a brand or technological moat that will provide long term sustainable competitive advantage. Its business is not a “winner-take-all” type business, where other players are completely unable to operate. It also operates in a highly competitive market, with competitors continually innovating.

Legitimate Risks to the Moat and Business Resilience

Technological Disruption: New technologies from competitors can make its software obsolete and replace the need for its core offerings.
Competition: Given that this is a well established sector, competitors may lower their pricing and gain market share from Tenable.
Data Breaches: Data breaches of its users can hurt the trust in its platform and result in loss of customers.
Cyber Regulation: Changes in privacy and security laws, both domestic and international can increase the operating costs for Tenable.

Tenable’s business, however, is resilient because:

There is a growing demand in cyber security, which will lead to a growing market.
Its existing user base provides a consistent stream of cash-flow.
Its cloud subscription model is flexible and can grow as the customers grow.
It has expertise and industry know-how, along with access to its customer network and market access.
It is a established player in the space with many existing client relations.

Understandability: 4 / 5

The business is relatively easy to understand as it revolves around providing security software to companies, with a subscription business model. However, diving deeper into the product offerings, the cloud-based platforms, different SaaS solutions and financial reports requires additional research, which is why I give it a 4, instead of a 5.

Balance Sheet Health: 4 / 5

Tenable has a reasonably healthy balance sheet. Although it has minimal debt and good liquidity, it has a relatively low share-holders equity, and high level of intangible assets. Furthermore, its FCF is negative and profitability is not as strong. It needs to focus on improving profitability and generating free cash flows, while also managing its balance sheet wisely.