TENB · Research
Tenable Maps Every Weakness Agents Will Hunt. It Bought Back $516M of Stock on $81M of Owner Cash, and Borrowed the Difference
Tenable owns the exposure record and owner cash is finally positive, but growth is slowing toward 7%, the share count shrank 11.5% on convertible debt, and stockholders' equity turned negative.
- Owner cash after all capex and stock pay
- $81.1M
- Share buybacks
- $516.5M
- Dollar-based net expansion rate
- 107%
1. Verdict and what this piece answers
Verdict: watch. Tenable keeps the most complete map of what is broken inside a company: every server, laptop, cloud account, identity and, now, every model and agent tool, scored by how easily an attacker could use it.
That map is exactly what a superintelligence attacker would want and what a defender's agents will need to work from. The business finally pays its owners something.
Owner cash, meaning operating cash flow of $288.3M less $21.3M of equipment and capitalized software, less $185.9M of stock pay, was $81.1M for the twelve months ended Sep 30, 2026, our calculation [3][13]. That is the third year in a row of improvement, from -$4.2M in 2023.
The catch is what the company did with the balance sheet. Over the same twelve months Tenable bought back $516.5M of its own shares, more than six times the owner cash the business produced [3][13].
It paid for the gap with an $800M convertible note issued in September and by running down investments [6]. Stockholders' equity turned negative, at -$26.5M on Sep 30, 2026 [3].
Meanwhile growth keeps slowing: 9.5% in the third quarter, and the fourth-quarter guide of $277.0M to $280.0M is 6.3% to 7.5% above the same quarter of 2025, our calculation [3]
2. Rating metrics
| Metric | Value |
|---|---|
| R&D share of revenue | 22.4%, research and development expense of $223.7M on $999.4M of revenue, fiscal 2025, our calculation [13]. In the third quarter of 2026, R&D was $62.1M, 22.5% of revenue [3] |
| GAAP net margin | -3.6%, a net loss of $36.1M on $999.4M of revenue, fiscal 2025 [13]. The first nine months of 2026 turned positive: net income of $16.5M on $807.0M of revenue, 2.0% [3]. Fiscal 2025 included $14.6M of accelerated stock pay for the late chief executive [3] |
| API quality | 4 of 5, our scoring: a documented REST API with self-serve keys and a public changelog, a hosted MCP server exposing 90 tools to outside agent clients, list prices for entry products, and third-party integrations [1][14]. The official software kit, pyTenable, covers Python only, so the multi-language point is not met |
| Toll-gate score | 2 of 4 pass, 1 partial, 1 fail (section 2b) |
2b. Thesis and the toll-gate test
Tenable started with Nessus, a scanner that security teams have used for two decades to find unpatched software. Today the core product is Tenable One, a platform that pulls together vulnerability scanning, cloud configuration, web applications, operational technology, identity systems such as Active Directory and, since 2025, the models, data and agent tools a company uses [1].
The data feeds a research team that writes detection rules and scores which weaknesses attackers are actually using [1]. IDC has ranked Tenable first in device vulnerability and exposure management market share for eight straight years [3].
More than 40,000 customers use it, including about 65% of the Fortune 500 [1].
The bet is simple. Superintelligence agents, on both sides, will find and exploit weaknesses far faster than people can.
An attacker's agent will scan for the unpatched server; a defender's agent will need a trusted, current inventory of every asset and its weaknesses to decide what to fix first. Tenable wants to be that inventory, and in the third quarter it began running its own fleet of always-on agents that find critical exposures, start the fix and check that it worked, even when the security team is offline [3].
| Test | Result | Evidence |
|---|---|---|
| Owns the record | Pass | Tenable One holds the asset inventory, the vulnerability findings and the attack paths for each customer, built on two decades of research data [1]. The 10-K describes it as the single unified view of risk across asset types, and customers ingest third-party data into it [1]. Vulcan Cyber, bought in 2025, added more third-party data flows [1] |
| Owns the connection | Fail | Tenable scans and reads; it does not sit inline on traffic or on the device's execution path. Endpoint vendors with built-in vulnerability assessment, including CrowdStrike, and cloud platforms such as Palo Alto Networks and Wiz compete for the same data, and the 10-K names them [1] |
| Prices close to outcomes | Partial | Subscriptions and licenses are generally priced on the number of IP addresses or total IT assets monitored [1]. That is better than a per-seat price, because models, agent tools and cloud workloads become new assets to count. But nothing ties price to exposures closed or attacks prevented, and large buyers demand discounts as asset counts rise [1] |
| R&D on the gate vs features | Pass | R&D runs at 22% of revenue, capitalized software rose to $11.7M in nine months from $2.7M a year earlier, and the spending targets the gate: Apex Security for governing the models a company uses and builds, the autonomous remediation agents, the hosted MCP server and a vendor-neutral registry of security agents, skills and MCP servers launched in the third quarter [1][3][14] |
3. Growth
| Measure | Value | Change |
|---|---|---|
| Fiscal 2023 revenue | $798.7M | +16.9% [13] |
| Fiscal 2024 revenue | $900.0M | +12.7% [13] |
| Fiscal 2025 revenue | $999.4M | +11.0% [13] |
| Twelve months ended Sep 30, 2026 | $1,067.5M | Our calculation [3][13] |
| Q3 2026 revenue | $276.4M | +9.5% [3] |
| Q3 2026 subscription revenue | $254.6M | +9.6% [3] |
| Q3 2026 perpetual license and maintenance | $9.7M | -12.4% [3] |
| Q4 2026 revenue guide | $277.0M to $280.0M | +6.3% to +7.5%, our calculation [3][13] |
| Fiscal 2026 revenue guide | $1,084M to $1,087M | +8.5% to +8.8%, our calculation [3][13] |
| Remaining performance obligations, Sep 30, 2026 | $1,063.0M | +14.4%; long-term portion +21.5% [3] |
Growth has stepped down every year since 2022, from 26% in 2022 to 11% in 2025, and the fourth-quarter guide points to the slowest quarter in the company's public history [3][13]. Recurring revenue is 95% of the total [3].
The more hopeful number is remaining performance obligations, contracted revenue not yet recognized, which rose 14.4%, faster than revenue. The long-term portion grew 21.5%, a sign that customers are signing longer Tenable One contracts [3].
Some of that is a billing change: the 10-K says larger multi-year deals are moving to annual installment billing, which is why management stopped leaning on calculated current billings [1]. Backlog, meaning contracted amounts not yet billed, jumped to $159.9M at Dec 31, 2025 from $33.2M a year earlier [1].
Customers above $100,000 of annual contract value reached 2,236 at Jun 30, 2026, up 6%, and the company added 39 more in the third quarter
4. New products and shipping pace
The product cadence picked up after the leadership change. In 2025 Tenable bought Vulcan Cyber, which pulls findings from other security tools and ranks what to fix, and Apex Security, which governs how employees use outside models and how developers build their own [1].
The 10-K now lists a product that finds and scores risks from model use, such as sensitive data leaking into prompts, insecure configurations and excessive access, as the first item inside Tenable One [1].
In the third quarter of 2026 the company shipped four notable things [3]. First, an always-on fleet of agents inside Tenable One that find critical exposures, start remediation and verify fixes without a person in the loop.
Second, a view that uses Anthropic's Claude Mythos model to trace hidden attack paths and recommend how to break them. Third, CyberAgents Exchange, an open-source, vendor-neutral registry of security agents, skills, MCP servers and multi-agent playbooks.
Fourth, broader coverage of language models, MCP servers and agent tools as assets to be inventoried and scored. Separately, Tenable now hosts an MCP server that lets customers connect their own agent clients to 90 tools covering assets, vulnerabilities, scans and dashboards, with the user's existing permissions enforced [14].
The developer changelog shows releases every few days, and pyTenable shipped version 26.10.1 in October [14]. Capitalized software development cost rose more than fourfold in the first nine months of 2026, which supports the view that more engineering is going into new platform code rather than upkeep
5. Net revenue retention
Tenable measures net expansion as the annual recurring revenue of last year's customer cohort today, divided by that same cohort's recurring revenue a year ago, on a trailing twelve-month basis [1]. The rate slid from 111% to 106% over two years and ticked up to 107% in the third quarter, the first increase we can see in the filings.
One point is not a trend, but it is the right direction. The figure covers subscriptions and maintenance only, so it measures how much existing customers expand, not how many leave; Tenable does not disclose gross retention.
At 107%, most growth still has to come from new customers, which is expensive: sales and marketing ran at 37% of revenue in the third quarter [3].
6. Free cash flow and owner cash
| Period | Operating cash flow | Equipment and capitalized software | Stock pay | Owner cash |
|---|---|---|---|---|
| Fiscal 2023 | $149.9M | $8.8M | $145.3M | -$4.2M [13] |
| Fiscal 2024 | $217.5M | $10.7M | $163.5M | $43.3M [13] |
| Fiscal 2025 | $266.8M | $16.6M | $191.8M | $58.4M [13] |
| Twelve months ended Sep 30, 2026 | $288.3M | $21.3M | $185.9M | $81.1M, our calculation [3][13] |
| Fiscal 2026 guide | $297.6M to $303.6M | $25.9M | $185.3M | $86.4M to $92.4M, our calculation [3] |
Owner cash has been positive for two full years and is on track for a third, at $86.4M to $92.4M on the company's own fiscal 2026 guide. Stock pay took 64.5% of operating cash flow over the last twelve months, down from 97% in 2023, our calculation [13].
That improvement is the core of the bull case: Tenable's own measure, unlevered free cash flow, was $69.4M in the third quarter, but most of it is still claimed by stock pay [3].
Two adjustments matter. First, operating cash flow is not flattered by prepayments.
Deferred revenue fell $35.9M in the first nine months of 2026 as more deals moved to annual billing, which lowered cash flow rather than raising it [1][3]. Second, interest income on corporate cash, guided at $11.8M for 2026, should come out under our standard [3].
That would leave owner cash near $70M. Cash interest paid on the old term loan ran $26.8M in 2025; the new notes carry 0.25%, so that cost should drop to about $2.0M a year from 2027, our calculation from the note terms [6]
7. Acquisitions
Cash paid for acquisitions was $196.2M in 2025 and none in the first nine months of 2026 [3][13]. Both deals were paid in cash from the balance sheet and together equal more than three years of owner cash at the 2025 level.
Goodwill is $697.9M and acquired intangible assets $94.9M, together 45% of total assets [3]. The September note offering lists acquisitions as a possible use of the remaining proceeds [6].
8. Risks and catalysts
Risks. Slowing growth: the fourth-quarter guide implies 6.3% to 7.5% growth, our calculation [3].
Competition: endpoint, cloud and platform vendors that already see the asset can add vulnerability assessment, and the 10-K names CrowdStrike, Palo Alto Networks, Wiz, Qualys and Rapid7 [1]. Pricing: asset-based pricing invites discounts as counts rise [1].
Leverage: $800M of convertible notes due Sep 15, 2031, negative stockholders' equity and a secured revolver that can spring to an earlier maturity if the notes are still large near their due date [6][7]. Dilution: the notes convert into about 17.8M shares, our calculation from the conversion rate, partly offset by capped calls [6].
Hosting: Tenable One runs on AWS [1].
Catalysts: the third quarter 10-Q, expected in early November 2026 (unconfirmed; the second quarter 10-Q followed results by six days) [2][3]; fourth quarter and fiscal 2026 results with the 2027 outlook, expected in early February 2027 (unconfirmed; the company has not announced the date as of Oct 31, 2026); whether net expansion holds at 107% or better (pending); first interest payment on the notes on Mar 15, 2027 (confirmed)
9. Valuation anchor and balance sheet
Owner cash has been positive in 2024, 2025 and the trailing twelve months, but fiscal 2026 is not yet complete, and 2022 and 2023 were negative [13]. Our standard needs three full positive years before a base value is set, so none is set here.
If fiscal 2026 lands inside the guide, that condition will be met in February 2027. The anchor to track is twelve-month owner cash, $81.1M today, our calculation.
| Item | Dec 31, 2025 | Sep 30, 2026 |
|---|---|---|
| Cash and cash equivalents | $187.8M | $317.4M [3] |
| Short-term investments | $214.4M | $177.9M [3] |
| Term loan, net | $354.2M | Repaid [3] |
| Convertible senior notes, net | None | $779.0M; $800.0M principal [3][6] |
| Deferred revenue, current and noncurrent | $899.3M | $863.4M [3] |
| Total stockholders' equity | $326.4M | -$26.5M [3] |
| Shares outstanding, issued less treasury | 118.5M | 104.9M, our calculation [3] |
The September financing changed the shape of the company [6][7]. Tenable sold $800.0M of 0.25% convertible senior notes due Sep 15, 2031, netting about $778.8M.
It spent $64.1M on capped calls, $170.5M buying back 5.3M shares from note investors at pricing, and $360.0M repaying the term loan in full [3][6]. In October it added an undrawn $400.0M secured revolving credit facility from JPMorgan Chase and others [7].
Net debt, excluding investment securities under our standard, is $482.6M, our calculation.
10. Superintelligence angle
Mixed, leaning tailwind. Superintelligence makes finding weaknesses cheap for attackers, so the value of knowing your own weaknesses first goes up.
Every model, MCP server and agent tool a company adds is a new asset to inventory and, under Tenable's asset pricing, a new unit to bill [1][3]. The hosted MCP server and the vendor-neutral agent registry put Tenable's data where outside agents can use it, which is the right instinct for a record owner [3][14].
The headwind: the same tools let platform vendors that already see the asset, on the endpoint or in the cloud, add good-enough vulnerability scoring cheaply, and Tenable's growth has slowed while that capability spread [1][13]. The company's own fleet of remediation agents could move it from scoring risk to fixing it, which would justify outcome pricing, but nothing in the filings prices it that way yet.
11. Leadership and control
Tenable has had two co-chief executives since the founding chief executive, Amit Yoran, took medical leave in December 2024; he died on Jan 3, 2025 [9]. The board named Stephen Vintz, then chief financial officer since 2014, and Mark Thurmond, then chief operating officer since 2020, as interim co-chief executives, and made the arrangement permanent on Apr 16, 2025 [10].
Both joined the board on May 14, 2025 [12]. Vintz is a certified public accountant who was chief financial officer of Vocus before Tenable; Thurmond ran operations at Turbonomic and sales at Qlik and Dell EMC [4].
Matthew Brown, formerly chief financial officer of Altair Engineering, became chief financial officer on Aug 21, 2025 [11]. Arthur Coviello, the former RSA chief, has chaired the board since January 2025 [4].
Charles Bell, a Microsoft executive vice president who ran its security, compliance and identity business until February 2026, joined the board on Oct 5, 2026, expanding it to 11 [8].
There is no controlling holder and one class of stock. Vanguard holds 13.1%, BlackRock 9.2% and Ameriprise 5.6%; directors and executive officers as a group hold 1.7% [4].
12. Questions for the owner and predictions
Questions for the owner. First, why use convertible debt to buy back $516.5M of stock in a year when the business produced $81.1M of owner cash?
Second, will Tenable price its remediation agents on exposures closed rather than assets counted? Third, what is gross retention, and how much of the 107% net expansion comes from price rather than more assets?
Fourth, conviction on a 1 to 5 scale: our view is 3. The record is real, owner cash is positive and rising, and the cost of debt is low, but growth is slowing toward single digits and the buyback is borrowed.
Predictions to register: fourth quarter 2026 revenue lands at or above $280.0M, the top of the guide (55%); net expansion is 107% or higher at Dec 31, 2026 (55%); fiscal 2026 owner cash, as we define it, lands between $80M and $100M (70%); fiscal 2027 revenue guide calls for growth below 8% (60%); the company draws on the revolver or issues more debt to fund buybacks by Sep 30, 2027 (25%).
Data gaps and filing notes. The third quarter 10-Q had not been filed as of Oct 31, 2026, so third quarter figures come from the earnings release.
Two figures in that release do not reconcile. The loss on extinguishment of debt is $2.4M in the cash flow statement but $2.6M in the non-GAAP reconciliation and the full-year guide [3].
And the second quarter 10-Q said the buyback authorization totaled $700M with $592.4M used through Jun 30, 2026, yet third quarter buybacks of $223.8M would bring the total to about $816M; the release does not disclose a new authorization or say whether the $170.5M bought from note investors sat outside the program [2][3]. We expect the 10-Q to resolve both.
The company also does not disclose gross retention or annual recurring revenue in dollars.
Stock Profiles & Comparable Companies
TENB Stock Profile →More Published Research
View All →Intuit Owns the Books and Tax Returns Agents Must Work From, and Its Owner Cash Doubled in Two Years
Intuit holds the QuickBooks ledger and the TurboTax return for millions of customers, already charges by the result, and kept $6.56B for owners in fiscal 2026, but its customer base grew only 3%.
Veeva Owns the Regulated Records Drug Agents Must Write To, but Salesforce Is Fighting It for the Sales Desk
Veeva holds the validated clinical, safety and quality records of drug development and kept $1.14B for owners after stock pay over the last year, but its move off the Salesforce platform has opened its CRM business to Salesforce.