The Bending Spoons Screen, Applied: Tenable at 3.9× Revenue

Nine days ago Tenable borrowed $800 million at a quarter-point coupon, used part of it to retire a $358 million term loan, and spent $170 million of the rest buying back its own stock on the day of pricing. That is not the balance sheet of a distressed seller. Which is exactly why Tenable is the second name through the screen — Rapid7 was the first pass, and I flagged Tenable then as the control case: cheap against the group, nowhere near broken, the name that shows what the AI-acquirer playbook pays for and what it refuses to pay for.

The recent history frames it. In July 2024, Bloomberg reported that Tenable was working with advisers after receiving takeover interest; the equity was then worth around $5.2 billion and nothing transacted. Today, after a year and a half in which the company grew revenue 11%, turned GAAP-profitable, and watched its net dollar expansion rate tick up for the first time in four years, the equity is worth about $3.7 billion — roughly 40% below the level where buyers were reportedly circling. The market de-rated the story while the company improved it.

The screen, briefly

The Bending Spoons trade has five levers, described in full on the value-creation page: buy mature recurring revenue at a depressed multiple; replace most of the acquired cost base with a shared platform; reprice a captive installed base; convert labor-delivered revenue into software economics; and finance a permanent hold out of the cash flows. Rapid7 scored strongest where it was most broken. The question this pass asks is what the same five levers return when pointed at a company that is executing.

Lever 1 — entry price: a discount, not a dislocation

At roughly 3.9× trailing revenue and 3.8× this year's guide, Tenable trades below the fourteen-name public-cyber group median near 5× — and far below Qualys, the closest structural comparable, at roughly 8× forward revenue on a debt-free balance sheet. But the screen's first question is whether you are paying for growth you don't need, and at Tenable you are. Revenue is guided up 7.9%, non-GAAP operating margin is guided to 24.2%, and free cash flow of $265–271 million is real and growing. The consequence is an entry near 15× guided free cash flow, against 6.8× at Rapid7. Roughly 96% of revenue is recurring and retention is disclosed and improving, so the quality boxes all check. The entry test clears on the revenue multiple and stalls on the cash flow multiple: the market has already paid Tenable for being well run.

Lever 2 — the cost base: half-harvested before any acquirer arrives

Tenable generated $501,000 of revenue per employee in FY2025 — $999.4 million across 1,995 people. That is 1.5× Rapid7's $329,000, the best of the vulnerability-management trio, and still a 5.1× gap to the $2.57 million Bending Spoons disclosed in its IPO prospectus. GAAP operating expenses ran $789.6 million, 79% of revenue: sales and marketing at 42%, R&D at 22%, G&A at 15%, for a GAAP operating loss of $9.2 million. But $191.8 million of the cost base — 19% of revenue — is stock-based compensation, and on a non-GAAP basis opex runs about 57% of revenue with the operating margin up 540 basis points year over year in the June quarter. Management is already running the compression play on itself, without an activist and without a new owner.

Here is the modeled version, clearly labeled as modeled: hold revenue at the guide midpoint of $1.078 billion, hold non-GAAP gross margin at 81.5%, and set total opex at 45% of revenue — the same assumption I applied to Rapid7. Operating income becomes roughly $394 million against the guided ~$261 million, and the entry multiple on the modeled number is about 10.3×. The same surgery that took Rapid7 to 3.6× modeled operating income only takes Tenable to 10.3×, because the market already credits the discipline in the price. The lever is real. The payoff per dollar of entry is a third of Rapid7's.

Lever 3 — repricing: zero, with one already-spent exception

Enterprise vulnerability management is the worst imaginable base for the Evernote trade: professional procurement, two direct substitutes in Qualys and Rapid7 that make switching a bake-off rather than a rebuild, and bundlers — Microsoft's vulnerability management inside the E5 license, CrowdStrike and Wiz absorbing exposure adjacencies — happy to price the category at marginal cost. The one sliver of Tenable that resembles a captive consumer base is Nessus, the self-serve scanner franchise, and Tenable has been raising its price for years without anyone's help. Where the lever works, the incumbent has already pulled it; where it hasn't been pulled, it doesn't work. Score it zero.

Lever 4 — labor conversion: the Rapid7 lever, absent

Professional services and other revenue was $10.4 million of $268.5 million in the June quarter — under 4% of revenue. There is no MDR book, no shifts of analysts watching consoles, no 20%-margin services line waiting to be converted into platform economics. The single richest lever in the Rapid7 pass simply does not exist here. The labor adjacent to Tenable's product sits inside the customer — the remediation workflow that Tenable One and the Vulcan Cyber acquisition are built to automate — and that is a product opportunity, not an acquirer's cost-conversion trade: you cannot convert delivery labor you do not employ. Score it at or near zero, and note the asymmetry plainly, because this lever is where the screen's security-specific upside lives, and Tenable's cleaner model locks it out.

Lever 5 — structure: a balance sheet that just disarmed itself

The September refinancing removed every forcing event. $800 million of 0.25% converts now mature in September 2031, with a $44.84 conversion price and a capped call to $64.06; the term loan is repaid in full; the revolver was allowed to expire unrenewed in July; pro-forma cash is an estimated ~$485 million against $265–271 million of guided free cash flow. The company bought back $231.6 million of stock in the first half and another $170.5 million concurrent with the convert — over $400 million this year, at prices the board evidently considers cheap. There is no activist; BlackRock's 10.3% sits on a passive 13G. What there is: a dormant process from the July 2024 Bloomberg report, a co-CEO structure — permanent since April 2025, following Amit Yoran's death in January 2025 — of a kind that rarely survives an approach and would simplify one, and a seat as the natural consolidator, or consolidation target, of exposure management, having itself bought Vulcan Cyber for $147 million in February 2025 and Apex Security for $47.8 million in June. Catalysts latent, not loaded.

The verdict, and the queue

Scored honestly: entry price, half a card — a discount without a dislocation. Cost base, real but half-harvested by the incumbents themselves. Repricing, zero. Labor conversion, zero for structural reasons rather than execution ones. Structure, quiet. The bet here is not retention — Tenable discloses net dollar expansion, at 106% and rising, the mirror image of Rapid7's silence — it is growth durability: pay 15× free cash flow and you need the 8% growth to persist, and nothing in the AI-first acquirer's playbook makes an enterprise security company grow faster. At Rapid7 the screen found a free option on platform economics at 6.8× current cash flow. At Tenable the option costs the spread between 15× and the group, and most of the underlying is missing. The conventional paths — strategic consolidation of exposure management, or a plain LBO underwritten on margin expansion the company is already delivering — out-compete the platform math here. That is what a control case is for. The screen prices broken-ness, and Tenable isn't broken.

Two passes in, the framework is behaving the way it should: it scored the cheaper, shrinking, services-heavy asset as the richer fit and the better-run compounder as the worse one. Next through the screen: Trend Micro, near 2× revenue with a failed auction behind it, and N-able, near 2× with a leveraged balance sheet and sponsor control.