AI Made Bug Hunting Free. Tenable Sells the Cleanup.

Somewhere near 66,400 software holes were logged by mid-September this year. At the same point in 2025, the count sat around 33,500. Roughly double, with a quarter of the year left.

That's the flood, and Tenable (NASDAQ: TENB) sells the list. It inventories everything a business has plugged in, scores which weaknesses actually matter, and increasingly fixes them before a human has to. Picture the world getting thousands of new holes punched into it, with one guy holding the clipboard and the truck.

Models made finding bugs nearly free, which is why this matters. Epoch AI counted 1,300 to 1,500 high or critical CVEs from just 21 organizations in June, more than three and a half times the prior monthly record. Discovery stopped being the bottleneck. When discovery costs nothing, the only thing left to sell is the fix.

FIRST, which publishes the annual CVE forecast, made a first-ever mid-year revision in June. It now expects about 66,000 CVEs for 2026, 46.3% above February's estimate, citing AI-assisted discovery. The counterweight: known actively-exploited flaws barely increased. Most of the new pile is noise, and the noise is the product.

Tenable is selling autonomy into that mess. In September it embedded Anthropic's Claude Mythos 5 in Tenable One to power an Adversary View, with first customers this month and more in the fourth quarter. Days earlier came an inspector for community-built AI components, built on OpenAI's cyber models.

Hexa AI, the agentic engine that shipped in the second quarter, shows the appetite. More than 80% of the people who open it submit a prompt, nearly half act on the answer, and over 90% of recommended fixes get accepted. It works like a recommendation row that also presses play.

The packaging is quietly doing the work. Tenable One is half of new business, an all-time high, and should approach 40% of total sales by year-end. The Advanced tier prices about 60% above the standalone tools, and eight in ten buyers choose it anyway.

Ninety-five percent of revenue is recurring, and the last twelve months cleared a billion dollars. Free cash flow is guided toward $290 million, close to a 7% yield against the company's market value. This is a subscription business, not a project shop.

Two numbers say demand finally firmed. At a Piper Sandler conference this month, a co-CEO said calculated billings are tracking $8 million to $10 million better than plan. Net dollar expansion rose to 106% from 105%, the first sequential increase since early 2022.

Those are leading indicators, not receipts. Revenue grew 8.6% last quarter and is guided to about 7.6% now, just under 8% for the year. The turnaround lives in the pipeline, not the income statement.

The driver that would re-rate the stock is revenue finally echoing those billings. The shares change hands at a mid-teens multiple of forward earnings, a fraction of what CrowdStrike and Palo Alto command. The average analyst target sits below the last close, and the consensus rating is Hold.

Our read is that the market is pricing a legacy scanner, and the billings line argues for a platform. We think the turnaround is underpriced, narrowly, and only if the next two quarters confirm it.

September's balance-sheet work helps the patient case. Tenable upsized a convertible to $800 million, a 0.25% coupon due 2031, and added a $170.5 million buyback. About $778.8 million of net proceeds retired the term loans.

Now the short case, and it's meaner. GAAP net income was $3.8 million on $268.5 million of revenue, break-even dressed up, and the flattering 24.7% operating margin depends on add-backs. Eleven of twenty analysts are on Hold, the name was recently downgraded, and the average target sits under the market price.

The structural worry cuts deeper. If frontier models make discovery free, the only layer worth charging for is remediation and orchestration, and CrowdStrike, Palo Alto, Microsoft, Qualys and Rapid7 all attack it. Bundling also squeezes standalone renewals.

What proves the bears right? A third-quarter print at or below the midpoint with no lift to 2027, and expansion back at 105%. That would say the AI flood was a headline, not a purchase order.

Even the bulls' own math is sobering. MarketsandMarkets sizes exposure management at $2.2 billion in 2024, reaching $7.6 billion by 2029. Tenable already books about a billion a year, so most of the headroom arrives late in the decade.

What we're watching: the third-quarter report, expected in late October. Look for revenue at the top of the $270 million to $273 million guide, expansion holding at 106% or better, and billings keeping that cushion. The line that matters most is any early read on 2027 growth.

Disclosure: The Signal holds no position in TENB. Positions may change. This is not financial advice.