Greetings and welcome to the Tenable Q4 2020 Earnings Conference Call. At this time, all participants are in a listen-only mode. A Q&A session will follow the formal presentation. If anyone should require operator assistance during the conference, please press star zero on your telephone keypad. As a reminder, this conference is being recorded. I would now like to turn the conference over to your host, Andrea DiMarco. Thank you, Operator, and thank you all for joining us on today's conference call to discuss Tenable's Q4 and Full Year 2020 Financial Results. With me on the call today are Amit Yoran, Tenable's Chief Executive Officer, and Steve Vintz, Chief Financial Officer. Prior to this call, we issued a press release announcing our financial results for the quarter and full year. You can find the press release on the IR website at tenable.com. Before we begin, let me remind you that we will make forward-looking statements during the course of this call, including statements relating to Tenable's guidance and expectations for the Q1 and Full Year 2021, growth and drivers in Tenable's business, changes in the threat landscape and security industry, and our competitive position in the market, growth in our customer demand and adoption for our solutions, Tenable's expectations regarding long-term profitability, the impact of COVID-19 on our business and on the global economy, and planned innovation and new products and services. These forward-looking statements involve risks and uncertainties, some of which are beyond our control, which could cause actual results to differ materially from those anticipated by these statements. You should not rely upon forward-looking statements as a prediction of future events. Forward-looking statements represent our management's beliefs and assumptions only as of today and should not be considered representative of our views as of any subsequent date. We disclaim any obligation to update any forward-looking statements or outlook. For further discussion of the material risks and other important factors that could affect our actual results, please refer to those contained in our most recent quarterly report on Form 10-Q and subsequent reports that we file with the SEC, which are available on the SEC website at sec.gov. In addition, during today's call, we will discuss non-GAAP financial measures. These non-GAAP financial measures are in addition to and not a substitute for or superior to measures of financial performance prepared in accordance with GAAP. There's a number of limitations related to the use of these non-GAAP financial measures versus their closest GAAP equivalent. Our earnings release that we issued today includes GAAP to non-GAAP reconciliations for these measures and is also available on the investor relations section of our website. I'll now turn the call over to Amit. Thank you, Andrea, and thank you all for joining us today. I'd like to start off by saying I'm incredibly proud of how our employees continue to respond as we navigate today's dynamic environment. Today, I'll highlight our strong Q4 results, our cloud security advancements, and some exciting channel expansions. But before I get into Q4, I'd like to comment on the current vulnerability management market and cybersecurity environment we find ourselves in. Through our dialogue with customers and partners, we see the strategic importance of vulnerability management rising rapidly. Enterprises continue to prioritize VM as the critical building block to understanding their cybersecurity risk. This is underpinning the strong adoption and demand we saw from our customers throughout the year. We added one of our highest number of new platform customers over this quarter, 460, and one of our highest number of new six-figure additions at 66. We also continue to see a healthy number of competitive displacements and continued optimism about the large greenfield opportunity in VM. About a third of our larger new platform adds came to us from greenfield accounts where they had no in-house organic VM capability. The SolarWinds breach further highlights the importance of VM and visibility across the entire environment. For many of our customers, Tenable's VM solution played a critical role in helping them discover, understand, and respond to emerging threats identified in the SolarWinds breach. Very quickly, they were able to identify exactly where they were running SolarWinds Orion platform. Within hours, our customers and our entire Tenable community could also identify where specific versions of SolarWinds were installed. In short, our customers could rapidly shift from the fear and doubt of high-profile headlines to clarity and confidence. Knowing the security of your systems and the state of your user account base are foundational. At Tenable, we believe that a continuous and complete understanding of assets, exposures, and risk are critical to good decision-making. Being prepared with accurate data and insights to help manage risk helps our customers confidently respond in times of crisis. Our risk-based approach prioritizes vulnerabilities so customers know where to focus first. While we play a critical role in reducing risk for a vast majority of breaches caused by known vulnerabilities, we also provide critical agility for new and emerging threats, including new zero-days. In both situations, our commitment to best-of-breed VM enables us to deliver value as a key differentiator and a key response mechanism for organizations. Being able to answer the fundamental questions such as, "How secure am I? How exposed am I? And what can I do to most efficiently reduce risk?" has never been more critical to the executive leadership. The right vulnerability management solution, strategically implemented, provides continuous understanding for enterprises to effectively measure and manage cyber risk and respond with confidence during times of crisis. In times of uncertainty, enterprises know they can rely on Tenable's focus and best-of-breed capabilities. Now, with all that said, we're very pleased with our results for the Q4. Our revenue grew 22% year over year. In addition to strong top-line growth, our profitability continues to expand as we saw improvements in the operating margin and generated attractive levels of free cash flow. These results reflect favorable demand dynamics, the strength of our product portfolio, and the compelling nature of our business model. With our enhanced product portfolio, we believe we're just getting started on the value that we can deliver to customers. A great example of this is a new six-figure cross-sell win in OT with a global manufacturing company. Now, this was an existing Tenable.io and Web Application Security customer that was looking for a converged IT OT system to reduce cost, improve visibility, and improve security. By running Tenable.io along with the web app security product and now OT, this customer is able to reduce cyber risk and protect their brand with a unified understanding of risk. In the Q4, we saw momentum starting to build in the platform adoption across product lines. With increasing demand for multiple products, we're exploring other, more natural cross-sell motions to make it easier for our customers to benefit from the full suite of capabilities. We continue to see strong demand among hybrid and cloud-first customers increasingly turning to us to help them secure their cloud environments. An excellent example of this is another six-figure win from a global pharmaceutical company that purchased our entire cloud security suite: Tenable.io, Web Application Security, Container Security, and Lumin. This existing Tenable.io customer completed an acquisition and needed visibility across the entire organization. The customer was originally a competitive displacement over a year ago and now, with this new acquisition, became a competitive replacement for a second time. This is a tribute to our long-standing relationship with customers and the superior capabilities and customer experience that we can deliver. In the end, our commitment to product innovation, focus on cloud, and mature prioritization capabilities drove the win. We also officially launched Frictionless Assessment globally for the Tenable.io in AWS Marketplace in the Q4. Frictionless Assessment continuously provides accurate visibility across all cloud-based assets via an easy-to-use, low-risk approach that delivers quick time to value. While it's very early, we believe there's significant opportunity for the adoption of Frictionless Assessment. Many of our customers want increased visibility into the state of their assets in the cloud due to the velocity of changes in these environments. We're seeing customers starting to use frictionless and already discussing opportunities for significant growth. These early indications are very positive, and we view this as an exciting opportunity to expand asset coverage and continue to deliver more value to customers using Tenable to secure their cloud deployments. In addition to our relentless focus on innovation and our commitment to our product portfolio, we continue to make significant investments in our go-to-market. While early in our development of MSSP relationships, we have laid the groundwork in our MSSP program that we believe will continue to fuel growth for years to come. We're already seeing early returns on these investments. Last year, we added over 150 new MSSP partnerships, bringing our MSSP partner count to over 350 globally. But more importantly, we're including many of the top global MSSPs in these numbers. We're excited about the momentum in this particular program and the broader progress we're making with our channel partners. We believe a best-of-breed strategy in VM and strong presence and capabilities to secure cloud environments, coupled with our go-to-market investments, will continue to fuel attractive growth and profitability. Heading into 2021, we plan to continue to invest, particularly in R&D and quota-bearing resources to drive innovation, increase our market leadership, and position Tenable for continued growth. I'll now turn the call over to Steve. Thanks, Amit. As Amit mentioned earlier, we are very pleased with our results for the Q4, highlighted by attractive top-line growth and impressive bottom-line results. I'll discuss our results for the quarter momentarily, but please note that first, all financial results we will discuss today are non-GAAP financial measures with the exception of revenue. As Andrea mentioned at the start of this call, GAAP to non-GAAP reconciliations may be found in our earnings release issued earlier today and posted on our website. Now, on to our results. Revenue for the quarter was $118.1 million, which represents 22% year-over-year growth. Revenue in the quarter exceeded the midpoint of our guided range by approximately $4 million. Our percentage of recurring revenue remained high at 94%, which is a result of our annual prepaid subscription model. Revenue for the full year was $440.2 million, which represents 24% growth year-over-year. Revenue in the quarter was driven by strong demand for both new and renewal business. In terms of new business, we had one of our best quarters ever as we added 460 new enterprise platform customers and 66 new, net new, six-figure customers in the quarter, which brings the total number of customers spending in excess of $100,000 annually to 837. Our investment in product innovation and go-to-market reach has continuously helped us deliver a healthy number of greenfield opportunities and competitive takeaways throughout the year, despite the pandemic, and this quarter was no different. So we are delighted with the velocity in which we are adding new customers in the quarter. We're also very pleased to see upside in our expansion business as customers adopted new modules and expanded asset coverage at a higher rate than what we saw earlier in the year. Of note is cross-sell as Lumin, Web Application Security, and OT, among others, experienced significant growth in the quarter. We attribute our success here to an increasingly complex threat environment that highlights the relevance of our Cyber Exposure offering, specifically a platform that delivers broad asset coverage, accurate results, and predictive analytics to help our customers understand and address the most critical vulnerabilities within their compute environments. This also benefited renewal business, which was strong in the quarter. This is reflected in our calculated current billings. CCB defined as the change in current deferred revenue plus revenue recognized in the quarter grew 20% year-over-year to $150.5 million, and overall, we are very pleased with our performance. As a reminder, CCB is a close but not perfect proxy of the underlying performance of the business and can be influenced by such factors as deal timing, early renewals, and multi-year prepaid deals, which have been impacted in the current economic environment. I'll now turn to expenses, which reflect considerable investment this year offset by operational efficiencies and, to a lesser extent, some pandemic-related savings. I'll start with gross margin, which was 84% this quarter, consistent with last quarter, and up from 82% last year. Gross margin for the full year was 84%, which is consistent with 2019. Our gross margin continues to be very healthy and reflects increased investment in our public cloud infrastructure. We continue to realize economies of scale related to the growing demand for our cloud-based Tenable.io platform. In short, investments in our public cloud platform have resulted in an increased spend on an absolute dollar basis, but with notably lower unit costs. Given the uptake for Lumen and other cloud-based offerings, we plan to make incremental investments that are expected to lower gross margins in 2021 by approximately 50 to 100 basis points. Let's turn to operating expenses. Sales and marketing was $50.8 million compared to $57.7 million in the Q4 last year and $48.2 million last quarter. Sales and marketing expense as a percent of revenue was 43%, which was consistent with last quarter and significantly improved from the 59% last year. As we've discussed on prior calls, we're very pleased with the leverage we've demonstrated to date in sales and marketing, which we attribute to a maturing sales force, a higher mix of channel and business from our two-tier distribution model, and better overall efficiency related to sales overhead in markets where we have critical mass. Sales and marketing expense increased sequentially due to higher commission expense, with seasonally higher sales as well as incremental investment in expanding our go-to-market efforts, such as areas including the channel, most notably ramping our MSSP business, which represents a compelling long-term opportunity for us. Looking ahead in 2021, we plan to make continued investments to expand both the sales organization and our channel efforts, which we believe will position us well for continued growth and success. R&D for the quarter was $20.4 million, consistent with the same period last year and down slightly compared to $21.2 million last quarter. As a percent of revenue, R&D expense was 17% compared to 21% in Q4 2019 and 19% last quarter. As a best-of-breed vendor, innovation remains a top priority for us. So additional investment to secure an increasingly complex attack surface via our cloud-based predictive analytics approach is anticipated in 2021 to extend our market leadership. G&A expense was $12.5 million compared to $12.6 million in the Q4 last year, which was also consistent with last quarter. As a percent of revenue, G&A expense was 11% this quarter, flat with last quarter and down from 13% in Q4 last year, which reflects our ability to more fully absorb public company costs and achieve greater efficiency and automation in many of our back-office functions. Income from operations was $15.4 million in Q4 compared to a loss of $11.1 million in Q4 last year and an income of $12.4 million last quarter. For the full year, non-GAAP income from operations was $25.8 million compared to a loss of $42.8 million in 2019, which was a $69 million improvement. Operating margin was positive 13% for Q4, compared to negative 11% for the Q4 last year and positive 11% last quarter. Operating margin was positive 6% for the full year compared to negative 12% for the full year 2019. All of this translated to significant EPS upside for the Q4 as our earnings per share was $0.13, which was $0.07 to $0.08 better than expected. Approximately half the beat was due to better-than-expected top-line results, and half was attributed to better cost management. For the full year, we generated $0.19 of earnings per share versus a loss of $0.42 last year. Now, let's turn to the balance sheet. We finished the year with $291.8 million in cash, cash equivalents, and short-term investments, an increase of approximately $80 million compared to December 31st, 2019. Total deferred revenue at December 31st, 2020, was $434.5 million, an increase of $71 million from last year, giving us a lot of visibility into revenue headed into 2021. Turning to cash flow, we achieved $16.7 million of positive free cash flow in the quarter. This compared favorably to a free cash flow burn of $13.5 million in Q4 last year. For the full year, we generated $44 million of free cash flow versus a burn of $31 million last year, which was a very notable $75 million improvement. With high recurring revenue, high gross margins, and high renewal rates, we are confident in our ability to generate attractive long-term margins. And despite the investment in the business and an anticipated return to a more normal travel and spend environment, we expect continued expansion in the free cash flow margin in 2021. With the results of the quarter behind us, I'd like to discuss our outlook for the Q1 and the full year 2021. Our assumption is the healthcare crisis will continue to create uncertainty and macro headwinds as many geographies are experiencing further restrictions and lockdowns. Although we have a very balanced and diversified customer base, approximately 10% of our business comes from industries that have been highly impacted by the pandemic, such as transportation, hospitality, and retail. As a result, our guidance assumes the crisis will continue to abate over the summer, with modestly improving demand in the second half of the year. With this uncertainty in mind, we believe our business will remain resilient, giving us the confidence to provide an initial full-year outlook for calculated current billings today, which is something we have not provided since our call in February of last year. Recent security events, including SolarWinds breach, have the potential to create a more favorable spending environment for us this year, but the overall impact, if any, and timing are uncertain With that as a backdrop, for the Q1 of 2021, we currently expect revenue to be in the range of $118 million to 120 million, non-GAAP operating income to be in the range of $7 million to 9 million, non-GAAP net income to be in the range of $5 million to 7 million, assuming a provision for income taxes of $1.5 million, and non-GAAP diluted earnings per share to be in the range of $0.04 to $0.06 per share, assuming 115 million fully diluted weighted average shares outstanding. And for the full year 2021, we currently expect calculated current billing to be in the range of $565 million to 575 million, revenue to be in the range of $510 million to 515 million, non-GAAP operating income to be in the range of $40 million to 45 million, non-GAAP net income to be in the range of $30 million to 35 million, assuming a provision for income taxes of $6 million. Non-GAAP diluted earnings per share to be in the range of $0.26 to $0.30 a share, assuming 116 million fully diluted weighted average shares outstanding. In summary, we're very pleased with the results of the quarter, which gives us increasing confidence that we remain well-positioned to deliver compelling growth and profitability over the long term. And now, I'll turn the call back to Amit for some closing comments. Thanks, Steve. As I stated earlier in the call, recent security events have raised the profile of vulnerability management. SolarWinds shows that we can't rely on strong perimeter defenses and has highlighted the need for assessing devices across the entire enterprise. Our message has been very consistent. For Tenable, our core strength in VM has driven our success and aided in our natural expansion across the attack surface into improving the security posture of cloud and OT deployments. Our strengthening platform of capabilities positions us for long-term success as our customers shift to hybrid and cloud environments. We hope to see many of you virtually at the Goldman Sachs, Morgan Stanley, and Schwab Tech conferences in the coming weeks. We'd now like to open the call up for questions. At this time, we'll be conducting a question-and-answer session. If you'd like to ask a question, please press star one on your telephone keypad. A confirmation tone will indicate your line is in the question queue. You may press star two if you'd like to remove your question from the queue. And for participants using speaker equipment, it may be necessary to pick up your handset before pressing the star keys. One moment, please, while we poll for questions. And our first question comes from Brian Essex with Goldman Sachs. Brian, please state your question. Great. Thank you. Good afternoon, and thank you for taking the question. You guys have a nice set of results. Amit, nice progress on the service provider market, and I appreciate the color there. Maybe could you provide a little bit of incremental color in terms of the types of customers that you're attracting in that market, the dynamics of those deals, and how meaningful you expect that segment of the business to be from a mixed perspective? Yeah. I'll provide maybe some color and context. I think the service provider market is incredibly strategic. We see that market really going after a diverse set of customers. So the natural one which comes to mind is certainly the mid-market where a lot of organizations that don't have the in-house expertise gravitate toward managed security providers. And then we've also seen a noteworthy number of large enterprise customers which choose to use managed service providers, managed security providers as part of their ongoing security operations. So we really see it as a pretty important, pretty strategic route to market for us along both tracks. And we're early in those relationships, but seeing some early results and really excited about the opportunity that both of them represent for us. Got it. That's helpful. And maybe to follow up, can you maybe talk about the OT market? You noted a nice six-figure OT win. Given the, I guess, growing concern of state-sponsored attacks and how deep those might go from an operational perspective, I mean, how are you gaining, I guess, how does traction in that market look, and how meaningful do you think that might be over the next year or so? I think that is a market that we believe has very strong potential. There's no doubt that some of the most critical business operations occur in and on and rely on OT environments, and that OT is an increasingly critical part of business efficiency and fueling economic growth. So the awareness for OT security has grown rapidly in the last two to three years, and we've seen IT security programs and IT security leadership play an increasingly critical role in product selection and solution selection and providing security into corporate OT environments, which historically have been managed by different teams. So we feel like we have a real position of strength in understanding risk across IT and OT and the convergence of security regimes across both of those platforms. In terms of the potential for that market, I think Steve can do some analysis on asset numbers and industries and the breadth of industries that rely on OT, but I think there's a pretty substantial opportunity that we're going after there. Got it. Very helpful. Thank you very much. And our next question comes from Joshua Tilton with Berenberg Capital. Hey, guys. Thanks for taking my questions. Can you hear me? We can. Hi, Josh. Yes. Hey, guys. How are you? Just two quick ones for me. First, I believe last quarter, you guys mentioned that the renewal rate was 110%. I was just curious if you guys could comment on what it was in this quarter. I think the commentary and your prepared remarks kind of suggest that it was positive. And then also, what numbers baked into the guidance that you gave for 2021? Hi, Josh. This is Steve. Well, first, we did comment in the quarter that upsell was notably strong this quarter, really on the backs of higher asset coverage as well as higher cross-sells. One of the best quarters ever for us in terms of cross-sell. So we're very pleased with the level of upsell this quarter. This is a positive development after several quarters of moderation earlier in the year. We don't manage the business to a single metric. We know that in terms of opportunities, pipeline can vary between opportunities from new customers as well as upsell opportunities from existing customers, and the number that we disclose in the filing is on an LTM basis, so the good news is we saw notable uptake in upsell this year, really on the backs of high renewal rates, strong cross-sell, and we think that bodes well headed into 2021. I think in terms of 2021 more broadly, we're assuming that the demand environment is largely the same and with no notable changes from what we saw this year. The one thing that I will say is the takeaway here is, look, we're very pleased with our results in the Q4. We saw outperformance in both the top line and the bottom line. CCB growth was 20%. Revenue growth was 22%, better than expected, both the top line and the bottom line. Customer demand underpinning all this was strong, as Amit mentioned earlier, and to my comments earlier, we had 460 new enterprise platform customers. It's one of our best quarters ever. And in fact, it was our best quarter ever for landing new large deals. That said, looking ahead in 2021, there's still a lot of uncertainty out there for macro as we head into the year. Many governments and countries are imposing further lockdowns and restrictions. Our guidance assumes just more broadly, notwithstanding the renewal rates and expansion rates, that the crisis will continue but abate over time, sometime in the summer, with modestly improving demand in the second half of the year. And overall, we're pleased with the results of the quarter, and it gives us confidence as we head into 2021. Yeah. That was very helpful, and then I guess kind of just to confirm a little bit on what you said, for 2021, you're baking in no change to the demand environment, but you also mentioned that the recent attack kind of brings the importance of VM into light, so should we view the billing guidance as conservative since it's not taking in any incremental demand from the recent attack, or is it just too early to see any meaningful change, if any? It's more the latter. Specifically in relation to CCB, it's important to note that first, we haven't provided a full-year guide to CCB in over a year since February of our last call. We feel like today's guidance is appropriate. It certainly reflects the uncertainty of the macro. The fact that we're providing this guide now is certainly a clear indication of our increasing confidence in the business. Again, we are factoring some of the uncertainty related to the macro, but we're also not considering any tailwinds from the recent SolarWinds breach, which are difficult to predict. We think that has the potential to lead to better spending environments in 2021, but we view the guidance today for CCB really as a good starting point. The fundamentals of our business are very strong, and we look forward to updating you throughout the year. All right. Thank you very much. I really appreciate the color. And our next question is from Hamza Fodderwala with Morgan Stanley. Hey, guys. Thank you for taking my question. Just a couple from me. The first is on the SolarWinds impact, you mentioning sort of the rising priority of VM. Can you maybe talk a little bit about, for Amit, to what degree is it maybe starting to influence pipeline or perhaps getting brought up in customer conversations? And then I have a follow-up. Yeah. It's definitely become an important part of our customer conversations. And I think we saw that almost immediately as the news began breaking, where even going back with the FireEye breach and even before the SolarWinds, as each data point comes out on one of these high-profile breaches, first question corporate leadership are asking is, "Am I exposed? Are we at risk? Are we secure? What are we doing about it?" And so being able to, for the IT security team, to be able to, in near real time, say, "Look, all of the attack tools which were part of the red team kit that was stolen from FireEye, we already checked for those, and here's where we stand from an exposure perspective." Or when the SolarWinds supply chain breach came up, being able to say, "Here's exactly where we're running SolarWinds Orion, and within that, here's the version of SolarWinds Orion," and be able to have that very immediate certainty to understand the level of exposure and/or where the incident response teams can start swinging into action. So it's an important part of risk management and being proactively improving your security, but in time of crisis, having a mature VM program just provides the agility for incident responders to move with much greater certainty and much more rapidly. So it became an immediate part of the conversation right away. And I think, as Steve said, we're just early in the process and in the cycles to be able to quantify and say, "Here's how we believe it will impact pipeline development and our expectations for 2021." But customer engagement around it has been high. Got it. Got it. And then just to follow up for Steve, so you managed the business pretty well during the worst of the pandemic, right? Current billing has been accelerating 20% plus over the past couple of quarters. You mentioned sort of record number of net new enterprise customer adds, accelerated pace of share gains. I'm wondering how that kind of jives with the deceleration implied in the 2021 outlook. I respect that there's still some conservatism around the pandemic, but obviously, those headwinds have been around, and if anything, should, based on your commentary, be improving in the back half of this year. So maybe, is there anything else that you're kind of being a little bit more conservative on, whether it be sales productivity or anything else? That's it for me. Yes. Thanks for your question. So by every measure possible, we had a strong print in the Q4 and delivered it with our results, as we talked about. But that said, we're not going to track with the results for one quarter, for an entire year, for this year. Keep in mind, we are a global business. We transact sales in over 160 countries. We have feet on the street in 30 countries. We try not to look at our business monolithically, and instead, different segments of countries and different sectors of the economy are different faces, really, of the pandemic. Some countries are imposing further lockdowns and restrictions, which does create a little more uncertainty in some of those geos, while others are a more steady state, and so for us, I think we take all that into consideration when we provide a guide. The good news is we have a business model that's high recurring revenue, high gross margins, high renewal rates. It gives us a lot of visibility going into the year, but it is early in the year, and there still is a lot of uncertainty, and we're not factoring any V-shaped recovery or any changes here in broader market dynamics that would change the business short-term. Amit talked about SolarWinds and its potential impact on the company. Obviously, it has the potential to create some tailwinds for us, but with regard to the Q4 in particular, it was something that played out late in the quarter. A lot of the opportunities in the pipeline were dialed in. Deals were slated to close. We're actively having conversations with our customers and our partners to determine what the opportunity is, if any, and what the potential impact is here in terms of timing. So overall, all this is really factored into our calculus when we give the guidance, again, reinstating CCB guidance, something that we haven't done in over a year. We feel this is a good early guide for us and a good starting point, and it certainly gives us the strength of the Q4 results, gives us momentum on that headed into the year. Thank you very much. And our next question comes from Sterling Auty with JP Morgan. Yeah. Thanks. Hi, guys. So coming into 2020, in the beginning of 2020, it was pretty clear that, at least the commentary and the results, your margin performance was really good, and you said you'd focus on that, and we've seen really good margin results throughout 2020. But the growth rate has decelerated through the year. And now, am I reading it correct? It sounds like with the commentary around investment for both R&D, quota carrying, and sales and marketing, that perhaps now, with the growth rate decelerating, that the focus is shifting back to invest to hopefully stabilize or maybe re-accelerate growth, but it's going to take a couple of quarters for those investments to pay off. Is that the right read, or am I missing it? Hi, Sterling. This is Steve. Look, I think that is a fair characterization and inference in our guide. We have a lot of confidence in the market. I think we have more conviction now than we did certainly a couple of quarters ago. We weren't sure what to expect headed into the pandemic. I think CCB growth was like 20% plus in Q1, and then in Q2, I think it was like 13%. We talked about some timing differences of deals and how that played out, and then it was over 20% in Q3, and then we're delayed to report 20% in the Q4. So we feel really good about the fundamentals of our business. We're adding customers at a very high rate, transacting larger deals. I think we'd be remiss if we didn't highlight the investment opportunities and the opportunities for us really to generate long-term attractive top-line growth. So the investments in go-to-market, investments in product are all paramount. We certainly want to run for growth, want to have the opportunity for growth despite the uncertainty with the macro. And we think the investments that we've talked about today and outlined today give us the best chance for that. At the same time, our guidance certainly implies expanding operating margins. We had a lot of leverage in the business this year. Sales and marketing as a percent of revenue came down from, I think, close to 60% for the full year 2019 to something in the low 40% range in the Q4 of 2020. And so there's a lot of leverage in the business. We talked about the improvement in free cash flow. We even talked about in the call that despite these investments, we expect the free cash flow margins to improve this year. So we're trying to strike the right balance. We're certainly a big believer in the market. We think these investments give us the opportunity to lean in on growth, but at the same time, be efficient and continue to drive leverage on the bottom line. Okay. And then one follow-up. Amit, there's been news reports that maybe a couple of the cybersecurity vendors may have had either some sort of breach or exposure with all the happenings over the last month or so. Is that actually opening up opportunity to gain market share or an increased opportunity for you guys, or is that not part of the conversation you're seeing? I do know that customers and prospects, I should say the market more broadly, places greater emphasis on security and the vendor and supply chain risk management, greater emphasis and value on that than they have in previous periods, I think, highlighted by SolarWinds and some of the high-profile security company breaches. I don't know that I would translate it directly into saying there's an opportunity. It represents a greater opportunity for displacement for us, but certainly, our stance in terms of best-of-breed provider and quality provider plays as a tailwind, and obviously, no security program is perfect, but we do invest in our security and have continued to do so. Understood. Thank you. and our next question comes from Andrew Nowinski with D.A. Davidson. Great. Thank you for taking the questions, and congrats on a nice quarter. I just want to go back to one of your comments about the greenfield opportunity. I'm trying to better understand really how nascent your market opportunity is. I know you said about a third of those 460 new adds were greenfield this quarter, which I think is similar to what you said last quarter, but do you think that's reflective of the broader market opportunity, meaning one-third of the companies out there have nothing for VM? How do you think that will change at the end of calendar 2021? Because I think many people believe that after the Equifax breach, most enterprises deployed some sort of VM solution, and therefore, the bear thesis suggests that most of your growth would have to come from vendor displacements. Just wondering how you're thinking about or how we should think about that nascent opportunity. Yeah. I guess I'll be careful making assumptions about rational behavior in the security community. One would assume, and coming into Tenable about four years ago, when I first started getting exposed to the data, was shocked when the team would come back and say, "Hey, this quarter, about a third, sometimes as high as 40%, sometimes as low as 25%," but pretty consistently, about a third of our new large enterprise transactions are coming to us from greenfield, meaning they're not using Tenable at all. They're not using any of our primary competitors. They're not even using Nessus. They have no organic VM program capability. They're literally relying on an annual audit or assessment from a PwC from Big Four or some other security consultancy as their enterprise understanding of cyber risk, which I thought was complete lunacy back then, and as the market has continued to mature, that continues to be the case where we're seeing a lot of new adoption, about a third of the larger enterprise transactions coming to us from organizations that still, entering 2021 or the Q4 of 2020, have had no organic VM capability, so that greenfield, we do talk about competitive displacements and growth through increased asset coverage in our existing customer base, new asset types, and the like, but there is a very healthy amount of greenfield that remains in this market. We try to highlight that through calling out the amount of Greenfield that we're landing, through calling out the number of new customers landing onto our enterprise platforms every quarter, and trying to be fairly transparent about it. In this quarter, 460 is, I think, one of our best quarters ever. Okay. That's great. Thank you so much for that. Just a quick clarification as well. Your sales and marketing expenses modestly increased quarter over quarter and year over year in Q4 here, and you demonstrated very good leverage, operating leverage in calendar 2020. I'm just wondering how much the SolarWinds attack factored into your decision to increase investments for the coming year, or if that's something you had planned regardless of the breach. I think that's just one of many factors that goes into kind of us running the company. We look at broader market and competitive dynamics, and we also look at some of the secular trends in the market, so I think our results more broadly in the Q4 gave us confidence to invest. The rate in which we're adding new customers certainly underscores that, our ability to transact larger deals, certainly the progress on competitive takeaways, our best-of-breed focus. We have a lot of confidence in this market. It gives us the confidence to invest more so, certainly, in 2021 than what we did in 2020, and we believe there's a compelling long-term opportunity here, so yeah, I think it's a combination of a lot of things, not just any one thing specifically, but just really reflects the broader enthusiasm and confidence we have now in our ability to execute, but also in the backdrop of the broader market opportunity. That's great. Keep up the good work, guys. Thanks. Thank you. And our next question comes from Jonathan Ho with William Blair. Hi. Good afternoon. Just wanted to start out. I think you had some commentary around multi-product cross-sell motions and maybe reducing some of the friction there. Can you talk about maybe what you're doing with some of your programs and whether there's any significant opportunities that you see around further driving that cross-sell motion? Yeah, Jonathan. Great question and observation about some of the talk track earlier. We believe that there are tremendous opportunities for value creation for our customers and some of the products. Specifically, as you look at container security, as you look at frictionless assessment, as you look at IO and some of the things that we're doing around cloud security, coming up with packaging that makes more sense or lowers the web application security, all aspects of cloud security, making it easier for customers to embrace cloud security capabilities or the things that we would have traditionally looked at and said, "Hey, we have to do a cross-sell here between this product and that product," and now saying, "You know what? Can we create a value for customers in how these products work together? We identify something. Can it automatically trigger a different method of assessment that makes more sense, can give more detailed answers for customers, as well as the packaging that would go along with that and sort of ease the amount of work, if you will, that's required to move customers between and across product lines?" So we're working on some of that with some of our early access customers, and excited about the opportunity to do so. Got it. Got it. And just as a quick follow-up, just given the change in administration and some early leanings towards potentially increasing cybersecurity spend on the government side, can you talk about what you're seeing there in terms of government spending, and do you expect that to be, I guess, an above-average growth vertical this year? Or given 2020 was the year of the vulnerability for U.S. Fed, with some of that brought forward, I'm just trying to get a sense of what you're thinking. Yeah. Well, I think every year is the year of increased vulnerability, increased risk, and increased exposure, and certainly, it was true in the federal market in 2020. There was a lot of confusion, if you will, in the final days of the last administration. You saw a lot of changeover, a lot of thrashing of senior leadership positions, not limited to, but especially from our perspective in the cyber domain and the cyber ranks. And so there's the opportunity, I think, for the incoming administration to place the priority on cyber, bring in strong leadership, and implement increased or enhancements to program and potentially even launch new programs and new initiatives to reduce federal cybersecurity risk. There certainly is the awareness in the administration. We know that there's already been a sort of $10 plus billion proposal put out there, as well as cyber being an important part of the early administration dialogue. So as Steve said, we're in the early periods here, and we'll wait to see how this plays out, but there certainly is the potential for good growth in the federal market as a result of that. And we have an exceptionally strong position in the federal cybersecurity market, and 2020 will continue to be a strong year for us in that market. Great. Thank you. And our next question comes from Rob Owens with Piper Sandler. Yeah. Good afternoon, guys. Just one relatively quick one for me, I guess. Amit, could you talk a little bit about where customer conversations are around containers and container security? And we've got the CSPM market, the cloud workload protection markets. Are they looking for these technologies from a single vendor? And with all the noise out there, and obviously, it's a big land grab at this point, where are points of leverage in your mind in terms of who might win in these markets? Thanks. Yeah. And I don't think, unless I'm mistaken, I would be shocked if there were any one particular winner in these markets. It depends on who the buyer is, what the use case, what they're trying to achieve. And in many cases, enterprises are using cloud in very different ways, not only SaaS and cloud-based infrastructure, DevOps environments, web applications. There's just a whole lot of. There's no one cloud. There's a lot of different uses, a lot of different ways customers engage in their adoption of cloud. From our perspective, we are not trying to go out and say, "We're going to be a soup-to-nuts cloud security vendor provider. We're going to do every aspect of cloud security for you." We think there's going to be a very rich ecosystem of solutions out there, some coming from attack detection response companies, some coming from infrastructure protection companies, some coming from the cloud infrastructure vendors themselves, embedding capability into the cloud. And so from our perspective, we're engaging with our current users in the current use case that we help them solve and address and just expanding that into cloud. And so by that, I mean we're helping them really with this business of assessing the security of their cloud environment. We're not protecting cloud environments. We're not doing all the attack detection and other aspects and tightening down of cloud configurations and other things. It's really about, "How do I assess the security of my cloud workload and the assets that are in that cloud?" And we have a number of ways to do that, whether it's through IO and with frictionless assessment through our cloud-native connectors, whether it's through the web application capability, through the container inspection capability, and a number of other techniques. So from our perspective, it's still this question, "How at risk am I? How secure am I?" And really expanding that visibility that they rely on us for into these new cloud paradigms. And it seemed to be, I think, Q4 was a quarter where we saw increased adoption of those cloud security products. And so we tried to call some of that out earlier on the call. Great. Thank you. And our next question is from Daniel Ives with Wedbush Securities. Yeah. Thanks. So just sort of follow-ups to some other questions and to summarize. When you think about what we're seeing on the federal side with the $9 to 10 billion incremental SolarWinds hack, those tailwinds, could we say that that additional area in terms of cybersecurity spend that you're not factoring into your guidance? Just to be clear. Yeah. I think that's a fair characterization. We certainly know that there is a compelling opportunity in Fed, as Amit called out earlier. Obviously, the potential for a better spending environment more broadly for SolarWinds. But the timing of that and the impact of that, if any, is really hard to assess at this point. So yeah, I think our guidance certainly reflects some broader uncertainty without those potential opportunities. Correct. Okay. Awesome. And then just to follow up to that, so given this pie that's now there in terms of on the cybersecurity side, specifically on the federal, then Beltway wanted to get approved, but then also post-SolarWinds, are you doing anything differently internally from a block and tackle to make sure these opportunities, especially where you guys sit within the Beltway, that you could capture? Or is it just the traditional sort of Tenable execution model? Than ks. Well, we're very focused on the execution model, helping customers in time of crisis, being there for them, interacting with them, giving them the insights that we have into the challenges that we're seeing. Obviously, we help them in their environments, but what we're seeing more broadly across the community are important, giving them the accuracy and the confidence so that when they're reporting issues or that there are no issues, that they're doing so from a position of strength. So I think first and foremost, that traditional execution aspect of our customer relationship remains the most important thing. And then we do engage with policymakers and others trying to educate and inform them on, "Hey, what are the key issues and what are the right approaches to dealing with these issues?" And so we have spoken with folks regarding the SolarWinds breach and continued ways to help the government assess the state of cybersecurity and some of the challenges in front of it. So I'd say it's sort of a two-pronged approach, first and foremost execution, but certainly also that more strategic dialogue with key government leaders and policymakers. Thanks for the insight. A nd our next question is from Gray Powell with BTIG. Mr. Powell, are you there? Hi. Can you guys hear me okay? Yes. You can now, Gray. Thanks. Sure can. Okay. Great. Great. It really helps when I turn the mute button off. But thanks for taking the question. I really appreciate it. Yeah. I just had another question on the SolarWinds breach. I know you've answered a bunch of it already, but just one more follow-up, if I could. So do you see customers I guess, how do you see it playing out over the next six to 12 months? Do you see customers looking to increase asset coverage? Does it speed up evaluations of things like Lumin? Or is it more of a lever to drive new customer wins? Yeah. Just any thoughts on that dynamic would be really helpful. Yeah. I'd say, first of all, I'm extremely proud of how our team responded during the crisis in terms of getting information out to customers on a near real-time basis and understanding of the breach and understanding how to use the technologies to assess where they may have potential exposures and chase those to ground, which are, again, all critical when the security program is trying to respond to corporate leadership that has a visibility into a breach like this. So I think that is foundational, and from there, the natural questions are, "Okay. Where do we have visibility? Where do we have coverage? Where don't we have coverage?", and making sure that organizations have, whether it's through increased asset coverage, coverage across the enterprise, coverage into unidentified assets, as well as doing some of the prioritization activities so that high-risk vulnerabilities, risks which are more likely to be vulnerabilities which are more likely to be exploited or being exploited out in the wild, that organizations can get on top of those and be a little bit more proactive with their security, so I think the short answer is this could be a catalyst for increased levels of cybersecurity risk management, and we think we're the primary platform to help enterprises do that, and so it could translate into increased business, but it's hard, we're still in the early period, so it's hard to look at that and then translate into, "This is what it's going to be. This is what the impact's going to look like as we enter the year." Understood. Okay. Thank you very much And this concludes today's question and answer session, ladies and gentlemen. I'd like to turn the call back over to management for closing remarks. Okay. I'd like to just thank everybody for joining the call and the insightful questions. Look forward to seeing you at the investor conferences that we noted earlier and thanks for your time. Thank you all. This concludes tonight's conference. You may disconnect your lines at this time. Thank you for your participation and have a great evening.