Tenable Bets on "Agentic" Security Platform as Exploit Windows Collapse to Negative Seven Days
Investor Day, New York — May 21, 2026
Tenable Holdings used its first Investor Day in five years to make a pointed argument to institutional investors: the company is no longer a vulnerability management vendor but rather an AI-era security platform designed to operate at machine speed. The event, held alongside its Exposure 2026 customer conference, introduced the general availability of Hexa, its agentic remediation engine, formalized a strategic partnership with Anthropic, and unveiled new pricing and packaging designed to accelerate migration from standalone VM products into the Tenable One platform. Investors walked away with a clearer picture of the growth algorithm — and the distance yet to travel.
The Exploit Window Has Gone Negative — and That Is the Core Thesis
The most striking data point of the day came not from a financial slide but from Tenable's own threat research. CTO Vlad — who joined five months ago from a decade at Microsoft Security — presented a chart tracking attacker speed since 2018. In 2018, the average time between patch availability and first observed exploitation in the wild was 63 days. By 2022 it was 32 days. Then something broke the trend. In 2023 it collapsed to five days. In 2024 it went to negative one. The most recent Google Mandiant report puts it at negative seven days — meaning adversaries are on average exploiting vulnerabilities a full week before a patch even exists. "The moment that line crossed zero, that's the moment the patch cycle basically stopped working," he said. The implication for Tenable's business case is direct: an industry built around finding and patching vulnerabilities is structurally inadequate in this environment, and a platform capable of orchestrated, automated remediation is no longer optional.
CEO Mark Thurmond reinforced the severity with a separate data point: more than 60% of organizations that suffered a breach or ransomware attack last year had a patch available for the exploited vulnerability but were unable to get it into production. The problem is not discovery. The problem is prioritization and speed of action. "More findings, more noise actually brings less clarity for our customers," he said. The number of CVEs has grown from roughly 18,000 in 2020 to more than 48,000 in 2025, a figure the company notes does not yet reflect the accelerant effect of frontier AI models actively scanning open-source code bases for vulnerabilities. Anthropic's Claude OPUS identified more than 500 vulnerabilities in open-source code in February. When Anthropic released Mythos in April it found thousands of software vulnerabilities dating back to 1999, 99% of which Anthropic said remained unpatched at disclosure.
Hexa Goes GA: The Platform's Body Is Now Attached to Its Brain
The centerpiece announcement was the general availability of Hexa, described internally as the "agentic engine" that sits atop Tenable One's exposure data fabric. In Eric's words — the Chief Product Officer who joined from Google's Chronicle integration — "if the sensor fabric is the senses and the exposure data fabric is the brain, Hexa is the body." The product was announced at RSA earlier this year and has been in early access with several dozen customers. It went GA the day before the Investor Day.
Hexa operates as a model-agnostic agentic harness currently running multiple Anthropic models in production, with additional models being evaluated in the lab. Eric was careful to frame the architecture: "There's quite a lot of IP in the tools exposed to the models, how the data is fed to the models, the context created, when you use one model versus another model, ensuring that the outcome the customer wanted when they said 'go do a thing' is actually the deterministic outcome that was created." The harness supports human-in-the-loop controls, role-based access, permission management, and audit trails — guardrails the company views as non-negotiable for enterprise deployment.
The product demos shown — though one video experienced technical difficulties mid-session — illustrated four use cases: attack path analysis connecting identity access to AI training data to model poisoning risk; automated scanning with dynamic asset tagging; automated patch deployment with Jira workflow integration; and identity quarantine based on high-severity attack scores with no identified owner. The fourth demo quarantined four Okta accounts in under 60 seconds. Eric described the market positioning bluntly: "Spreadsheets can't keep up. Only machine can fight the machine."
The Anthropic Partnership Is Strategic, Not Just Transactional
CFO Stephen Vintz addressed head-on the investor question of whether frontier model companies represent an existential threat. His answer was deliberate and worth quoting at length. "The frontier model companies are not in the business of deploying scanners in a data center, dropping sensors on an OT network running on a power grid or a municipal water supply or an oil refinery. They're not in the business of auditing cloud configurations at 3:00 in the morning and then taking the support call. They haven't earned the right — not yet, and I say this in a very loving way — to be deployed on a domain controller at a Fortune 500 company. We have. It takes years of trust to build."
The partnership with Anthropic, formally announced during the conference, includes access to non-public models, joint research on agentic workflows, and collaboration on advancing attack path analysis and remediation orchestration. Tenable's data runs behind customer firewalls and is proprietary — it cannot be used to publicly train models. CFO Matt Brown confirmed in the Q&A that Tenable has a negotiated agreement with Anthropic covering spend across the company, including cost of sales for Hexa, and that the incremental uplift from platform conversion "more than pays for what it costs." Above included usage tiers, a pay-per-token model kicks in. The company also disclosed access to OpenAI's trusted access for cyber program, providing early model access for both product development and the research team.
New Pricing Creates a 6% to 60% Uplift — With Expansion as the Real Prize
The financial mechanics of the platform transition were spelled out in detail by Brown and new CRO Dino, who joined 70 days ago. New packaging launched in late April simplifies Tenable One into two tiers: Foundation and Advanced, with legacy standalone VM products remaining available but no longer the migration destination. Hexa is included in both tiers, with usage graduated by asset count and consumptive above included limits. Attack path analysis — which makes Hexa materially smarter — is exclusive to the Advanced tier.
The price uplift from standalone VM to Tenable One Foundation is 6%. From standalone VM to Tenable One Advanced it is 60%. Brown was explicit that the headline uplift is not the primary financial lever. "What we're expecting is that expansion becomes far easier once those VM customers are in Tenable One Foundation." Platform customers spend two to three times the annual contract value of non-platform customers, expand at double the rate, and have contract durations averaging 10% longer. Win rates in competitive bake-offs are also materially higher when leading with the platform.
Today, Tenable One represents slightly more than one-third of total revenue and is growing in the mid-teens. Non-platform revenue, roughly two-thirds of the business, is growing at mid-single digits. The company's 2029 target has platform revenue exceeding half of the total business, still growing mid-teens, with non-platform continuing at mid-single digits. The blended effect accelerates consolidated revenue growth from high single-digit in 2026 to high single-digit to low double-digit exiting 2029 — a 2 to 3 percentage point lift in the growth rate. The company is targeting Rule of 40 by 2029, with operating margins reaching approximately 28% and unlevered free cash flow margins at 31%, up from 24% and 27% respectively at the 2026 guidance midpoint.
The Installed Base Opportunity Is Enormous — and the Urgency Is Real
With over 40,000 customers, Tenable has a substantial installed base to harvest. Only one-third of enterprise customers currently have any footprint in Tenable One. The company has been explicit internally about accelerating migration — sellers receive accelerated compensation rates for Tenable One deals and aggressive channel incentive programs are in place. Dino framed the three go-to-market priorities for the remainder of the year as: land with Tenable One, migrate the VM base to Tenable One as fast as possible, and drive AI-powered efficiency in the sales motion itself.
Customer testimonials reinforced the platform narrative. A CISO from GEICO described using Tenable One to change his board conversation from CVE SLA tables to a ranked list of five exploitable risks with associated revenue impact. A security head from Munich Re described governing 149 legal entities with Tenable as a primary feeder into compliance reporting. A CISO from Vicat, the French cement multinational, described deploying Hexa in early access for four months, reducing tasks that previously consumed two to three analyst-days per month to 20 minutes, and integrating Tenable as the source of truth for orchestration across 50 security products spanning 13 countries.
One analyst from D.A. Davidson pressed on gross retention trends. Brown confirmed gross retention has been "remarkably stable" across recent quarters and that the net expansion rate, which has been declining, is beginning to show early signs of stabilization — a signal the company is watching carefully as platform mix increases.
The AI Attack Surface as an Incremental TAM — $35 Billion and Growing
Vintz updated Tenable's total addressable market estimate for the first time in several years. The company had previously cited approximately $30 billion for exposure management. It now adds a separate $35 billion for securing the AI threat vector — the infrastructure, agents, MCP servers, and AI applications proliferating across enterprise environments. In the last 30 days alone, Tenable found 457 million AI security findings across 7,000 customers in 57 countries. Seventy percent of enterprises, per Tenable's own cloud security report, have AI artifacts running without proper security oversight.
The CTO noted that the EU AI Act's next enforcement phase takes effect August 2, 2026, creating regulatory demand for auditable, reproducible AI outputs — a requirement that plays directly to Tenable's harness-and-guardrails architecture. He identified five trajectories he views as tailwinds: frontier LLM capability becoming baseline rapidly, agentic AI becoming table stakes for both attackers and defenders, regulatory demand for deterministic AI outputs, the agentic economy as the new attack surface, and contextual grounding becoming the most valuable layer in the AI security stack. "I don't think success will go to the one who has the smartest LLM," he said. "Success will be for those who can ground those AI agents in the right data, in the right context, orchestrate them with the right harness and build and run them with the right guardrails."
Financials: From $541 Million to $1 Billion — But the Next Phase Is Slower
Brown provided a five-year financial retrospective and forward framework. Revenue has grown from $541 million in 2021 to the 2026 guide midpoint of over $1 billion, a 15% CAGR. Operating income has expanded from $51 million at 9.4% margin in 2021 to an expected $257 million at 24% margin in 2026, a 15 percentage point improvement averaging 3 points per year. Unlevered free cash flow has more than tripled from $95 million to an expected $290 million, a 25% CAGR. The company has generated more than $1 billion in cumulative cash since 2021 and has leaned heavily into share repurchases. In Q1, it bought 6.1 million shares for $130 million. The diluted share count at end of Q1 was down 5% year-over-year and at its lowest level in over three years, with over $200 million remaining on the board authorization.
The forward targets are more modest than the historical track record. Revenue growth is guided to stabilize at high single-digit in 2026 before inflecting to high single-digit to low double-digit exiting 2029 — not an acceleration to double-digit growth in the near term. Operating margin improvement slows to approximately 1.5 points per year versus the prior 3 points. The company attributes this to deliberate reinvestment in sales capacity and platform development rather than structural constraint, though the deceleration from historical margin expansion will be a focus for investors parsing the Rule of 40 trajectory. When pressed by William Blair on whether faster growth was achievable, Brown's response was notable for its candor: "I don't think we need to get ahead of ourselves on where we think it's going."
Tenable Holdings Deep Dive
Business Model and Monetization
Tenable Holdings operates as a pure-play cybersecurity vendor focused primarily on vulnerability management and, increasingly, comprehensive exposure management. The core premise of the business is identifying, assessing, and prioritizing vulnerabilities across enterprise digital infrastructures, spanning from on-premises IT networks and operational technology to modern cloud environments and identity systems. Historically, the company generated revenue by selling software licenses for its foundational Nessus vulnerability scanner and its enterprise successors. Today, the monetization engine is driven almost entirely by a software-as-a-service subscription model, which yields a highly visible revenue stream where recurring revenue constitutes approximately 95% of the total mix.
The company employs a land-and-expand go-to-market strategy that targets enterprise security and IT operations teams. Tenable recently surpassed $1 billion in trailing twelve-month revenue, a milestone largely fueled by the aggressive upselling of its flagship Tenable One platform. Rather than charging customers on a rigid, per-module basis for cloud, identity, or operational technology security, Tenable transitioned in April 2026 to a flexible pricing model. This framework charges enterprises once per asset regardless of the number of sensors deployed on it, removing significant procurement friction and accelerating broad platform adoption. By lowering the barrier to deploy additional capabilities, the company successfully drives higher net revenue retention and larger initial deal sizes.
Products and Services
The company's product portfolio represents a structural evolution from point-in-time scanning to continuous risk quantification. At the foundation is Nessus, the industry-standard vulnerability assessment tool that provides the scanning technology underpinning the broader suite. For mid-market and enterprise deployments, Tenable Vulnerability Management offers a cloud-delivered solution that aggregates scan data, while Tenable Security Center serves highly regulated organizations requiring strictly on-premises data residency.
The strategic centerpiece of the portfolio is Tenable One, an integrated exposure management platform that aggregates telemetry from across the entire attack surface. Tenable One synthesizes data from traditional IT endpoints, cloud infrastructure via Tenable Cloud Security, operational technology via Tenable OT Security, and active directories via Tenable Identity Exposure. By centralizing this disparate data, the platform provides security teams with a unified Vulnerability Priority Rating that contextualizes the severity of a flaw based on external threat intelligence and internal asset criticality. Tenable One has become the primary growth engine for the firm, accounting for 41% of all new business generated in the first quarter of 2026.
Customers, Competitors, and Suppliers
Tenable serves a diverse customer base of approximately 43,000 organizations globally, penetrating over 60% of the Fortune 500 and 40% of the Global 2000. Due to the historical ubiquity of the Nessus scanner, the company enjoys an exceptionally strong footprint within large federal government agencies and highly regulated financial institutions. Its primary supplier dependencies are concentrated on top-tier public cloud infrastructure providers, notably Amazon Web Services, which host the compute and storage resources required for the company's software-as-a-service environments.
The competitive landscape is sharply bifurcated between legacy pure-play vulnerability management peers and diversified cybersecurity platform giants. In the pure-play arena, Tenable competes directly with Qualys and Rapid7. Qualys defends its position through its highly profitable TruRisk platform and strong agent-based architecture, while Rapid7 has recently reoriented its focus around managed detection and response and its Exposure Command platform. However, the more formidable competitive vector comes from platform consolidators like Palo Alto Networks, CrowdStrike, and Microsoft. These vendors are aggressively bundling vulnerability management into their broader endpoint detection and cloud security suites, betting that enterprises will sacrifice best-of-breed analytical depth for single-agent platform simplicity.
Market Share and Industry Dynamics
Tenable operates from a position of definitive market leadership in its core domain. According to recent industry data, Tenable commands a 26.6% market share in the worldwide device vulnerability and exposure management market, establishing a wide moat over Qualys at 17.3% and Rapid7 at 12.5%. This core market represents a total addressable market of roughly $2.6 billion, but Tenable's addressable opportunity is expanding rapidly as the industry shifts from siloed vulnerability scanning to continuous exposure management, a category management projects will grow within a broader $300 billion cybersecurity market in 2026.
The defining structural dynamic of the current cybersecurity industry is the platformization trend. Chief Information Security Officers are under immense pressure to consolidate vendor sprawl, leading to a demonstrable preference for unified suites over specialized point solutions. This dynamic triggered intense pressure on pure-play security vendors in early 2026, as the market priced in the risk that vulnerability management would be absorbed by endpoint and network security giants. Conversely, a counter-cyclical opportunity is emerging via artificial intelligence. As threat actors deploy generative models to automate exploit development and discover zero-day vulnerabilities at unprecedented scale, the sheer volume of exposures is overwhelming enterprise patching cadences. This machine-speed threat landscape necessitates specialized, highly scalable prioritization engines, structurally favoring the deepest and most granular data sets over superficial bundled scanners.
Competitive Advantages
Tenable's primary competitive advantage is rooted in its proprietary data scale and analytical maturity. The Tenable One platform processes telemetry from 1.5 billion unique assets and analyzes over 150 billion exposures. This massive data lake trains the machine learning models underlying the company's Vulnerability Priority Rating, allowing Tenable to accurately filter the noise of tens of thousands of theoretical vulnerabilities down to the fraction of a percent that are actively weaponized and reachable within a specific customer environment. Competitors attempting to casually bundle vulnerability scanning struggle to replicate the predictive accuracy generated by this volume of historical and real-time exploit data.
A secondary moat exists in the form of high switching costs and deep workflow integration. Tenable's solutions are rarely standalone dashboards; they are deeply wired into enterprise IT service management systems, continuous integration and continuous deployment pipelines, and automated patching workflows. Furthermore, in government and highly regulated sectors, Tenable is often codified into strict compliance and audit frameworks, making the procedural cost of ripping and replacing the platform substantially higher than the raw software licensing savings a bundled competitor might offer.
New Products and Disruptive Technologies
In response to the rapid acceleration of AI-generated threats, Tenable introduced Tenable Hexa AI in May 2026. Built in collaboration with advanced large language models, Hexa AI functions as an agentic orchestration engine embedded within the Tenable One platform. Instead of merely presenting security analysts with a static dashboard of prioritized risks, Hexa AI operates as a mission control for complex workflows, utilizing autonomous agents to orchestrate remediation across IT, cloud, and identity environments at machine speed. This shifts the product value proposition directly from risk identification to automated risk resolution.
The broader cybersecurity industry is witnessing a disruptive transition toward this exact type of agentic artificial intelligence. Competitors are rapidly arming themselves in this domain, evidenced by Palo Alto Networks launching Cortex AgentiX and Rapid7 acquiring Kensile Security to build autonomous security operation centers. The structural threat to Tenable is that if autonomous remediation architectures mature faster outside of its ecosystem, the center of gravity could shift away from the exposure management platform to the remediation orchestration platform. Tenable's defensive execution with Hexa AI is therefore vital, ensuring that the engine calculating the risk remains the same engine dictating the autonomous remediation response.
Management Track Record
The executive leadership team has navigated a deeply challenging and transformative period over the past eighteen months. Following the tragic passing of long-time visionary Chief Executive Officer Amit Yoran in January 2025, the Board of Directors appointed Steve Vintz, the former Chief Financial Officer, and Mark Thurmond, the former Chief Operating Officer, as permanent Co-CEOs. Despite the sudden and difficult transition, the Co-CEOs have executed a clinically precise operational strategy that prioritized platform expansion and rigorous margin discipline.
Under Vintz and Thurmond, Tenable has engineered a massive profitability inflection. Non-GAAP operating margins expanded from 9.4% in 2021 to a guided 24.0% for fiscal 2026. Simultaneously, unlevered free cash flow margins have scaled to an expected 27.0%, representing roughly $290 million in absolute cash generation this year. Management recently laid out highly credible mid-term targets for 2029 at their May 2026 Investor Day, pointing to 28% operating margins and 31% unlevered free cash flow margins alongside high-single to low-double-digit revenue growth. Furthermore, the strategic hire of Chief Technology Officer Vlad Korsunsky from Microsoft in 2026 signals a serious commitment to defending the product moat against platform vendors and leading the transition into agentic AI security.
The Scorecard
Tenable Holdings remains the undisputed market leader in a critical, albeit maturing, sub-sector of the cybersecurity landscape. The transition from legacy vulnerability scanning to comprehensive exposure management via the Tenable One platform has successfully expanded the company's wallet share within its massive installed base of 43,000 customers. While the structural trend of platform consolidation orchestrated by endpoint and network security giants poses a legitimate threat to standalone vendors, Tenable's defense is fortified by an unparalleled data asset spanning 1.5 billion assets and 150 billion exposures. This depth allows for predictive prioritization and automated remediation routing that broad-based platform bundles currently cannot replicate.
Financially, the company presents a highly resilient profile characterized by disciplined cost management and exceptional cash conversion. The Co-CEO structure has proven adept at balancing the required research and development investments for agentic AI with a commitment to sustained margin expansion. With clear visibility toward 31% unlevered free cash flow margins by 2029 and a highly sticky product suite deeply embedded into enterprise compliance frameworks, the business model is heavily insulated against transient macroeconomic shocks. The recent rollout of Tenable Hexa AI positions the company to capture upside from the very AI-driven threat acceleration that initially challenged the legacy software market, cementing its relevance in the next era of autonomous security operations.