Qualys, Inc. Q1 FY2020 Earnings Call

Good day, everyone, and welcome to Qualys First Quarter 2020 Earnings Conference Call. This call is being recorded. I would now like to turn the call over to Vin Rao, VP, Corporate Development and Investor Relations. Please go ahead.

Good afternoon, and welcome to Qualys first quarter 2020 earnings call. Joining me today to discuss the results are Philippe Courtot, our Chairman and CEO; and Melissa Fisher, our CFO. Before we get started, I would like to remind you that our remarks today will include forward-looking statements that generally relate to future events or our future financial or operating performance. Actual results may differ materially from these statements. Factors that could cause results to differ materially are set forth in today's press release and in our filings with the SEC, including our latest Form 10-Q and 10-K. Any forward-looking statements that we make on this call are based on assumptions as of today, and we undertake no obligation to update these statements as a result of new information or future events. During this call, we will present both GAAP and non-GAAP financial measures. A reconciliation of GAAP to non-GAAP measures is included in today's earnings press release. As a reminder, the press release, prepared remarks, investor presentation, and supplemental historical financial spreadsheet are available on our website. With that, I'd like to turn the call over to Philippe.

Thank you, Vin, and welcome, everyone, to our Q1 earnings call. We hope that you and your families are healthy and safe, and that soon, America and the world will be open for business, again. It is now clear that after COVID-19, organizations and government agencies of all sizes are going to have to rethink the security and business continuity plans to include remote connectivity, accelerate their migration plans to the cloud, and streamline and secure, if not reinvent, their supply and delivery chains. This will have a profound impact on our industry, as it has also become clear that most of the current security solutions were not designed for remote and highly interconnected working. In fact, we experienced this ourselves. Unlike most other companies, we suddenly have most of our workforce working from home. Fortunately, because we had moved early with cloud-based enterprise applications, and spent many years laying the architectural foundational work for a robust, scalable cloud platform, we were able to not only secure our remote workers, but also continuously monitor and patch vulnerabilities under our systems in a very short period of time. As a result, we could continue our engineering and business development initiatives without much disruption. This was, in fact, the genesis for launching a cloud-based Remote Endpoint Protection free service in a matter of days. For our customers first, and now for the community at large by leveraging our powerful cloud platform and our strong base of engineering talent in Pune. As a result, today, we have close to 500 companies signed up for this free offering, which allows security teams to gain instant and continuous visibility of remote computers, easily see missing patches for critical vulnerabilities and apply them from the cloud. This represents a deployment of approximately 2.1 million cloud agents on the endpoints, 1.4 million from existing customers and 700,000 from new prospects. The patches are delivered securely and directly from vendors' websites and content delivery networks, ensuring there is little to no impact on external VPN bandwidth. We are now planning to add malware detection capabilities in a couple of weeks and will extend the free service for another 60 days for those who adopt the malware detection capabilities, which will also serve as a prelude to bringing the power of our Cloud Platform, our Cloud Agents, and passive technology to EDR, a new offering we plan to release this summer and to the Security and Event Management market later in the year. What makes Qualys unique is the significant investment we have made, as well as our determination over the years to build a highly scalable cloud-based platform that allows us to unify IT, security, and compliance across the new hybrid environment. Early on, we recognized the importance of capturing all the necessary telemetry via our sensors and building the backend with the scale and computing capabilities needed to handle such a large volume of data. Today, we handle more than 9 petabytes of data, indexing now more than 6 trillion data points on our ElasticSearch clusters, moving 5 billion messages a day on our Kafka bus, and pumping 1 million writes per second in our Cassandra log analysis engine. As a result, our cloud-based IT, security, and compliance solutions do not need to collect data from disparate sources, are easily deployable in environments with a dispersed and remote workforce, and this is what drove, in such difficult times, another good quarter in terms of revenue growth and profitability. This is underscored by the continued acceleration in our paid Cloud Agent subscriptions, which now total over 38 million, reflecting 114% growth from the prior year quarter. We continue to see good adoption of our free Global IT Asset Discovery and Inventory app, with almost 9,000 new companies signed up and over 700 new companies actively using the service. We now have over 600 existing customers using the solution as well. We saw solid growth this quarter from our paid IT Asset Discovery and Inventory and Cloud and Container solutions. A leading financial services company added our IT Discovery and Inventory paying modules this quarter to gain visibility of all the known and unknown assets across multiple environments, identify the end-of-life of their installed software and sync with our ServiceNow CMDB. Additionally, a large existing bank, which had acquired a competitor, utilized this opportunity to not only adopt VMDR but also add many of our newer solutions, like FIM, Container Security, and Cloud Security Assessment, as they could consolidate multiple existing security solutions in a single stack, where all the data could be correlated more cost-effectively to provide a continuous and accurate view of the security and compliance posture across their entire environment. Finally, Patch Management continued to see strong customer adoption in the mid-market this quarter as well as strong interest from our large customers. We're also pleased to announce that the Qualys Container Security application is now available, and the Qualys Vulnerability Management solution within a month in Microsoft Azure Security Center to all customers that are on Azure Security Center Standard Edition. This jointly developed solution automatically analyzes virtual machines and container images in Azure, providing customers visibility into vulnerabilities and configuration issues, which are reported to the Microsoft Azure Security Center, including the ability to create playbooks for one-click remediation with no software to deploy or update. Our Security Conference during RSA in Q1, where we unveiled Vulnerability Management, Detection and Response, VMDR, which is now generally available, was a huge success. VMDR takes vulnerability management to the next level by continuously detecting vulnerabilities and misconfiguration across the entire global IT hybrid environment and responding in real-time to remediate assets that are vulnerable or already compromised from a single platform with built-in orchestration. We held a live virtual event on April 21, demonstrating how VMDR integrates Asset Discovery and Inventory with vulnerability assessment and patch detection in a single app. More than 3,000 people registered for our VMDR live event and over 600 organizations signed up for a VMDR trial after this event, 75% of whom were new customer prospects. For example, the Head of Security Research at Orange Cyber Defense, one of our MSSP partners, concluded that VMDR is going to shake up the vulnerability management space, given its focus on inventory, risk-based priorities, and workflows as well as its strong use of ElasticSearch capabilities. In fact, Armor saw the opportunity to integrate VMDR with the Armor Anywhere managed security offering, and Armor Anywhere customers will now have access to the newly announced Qualys VMDR application as part of a holistic solution to meet their Vulnerability Threat Management requirements and provide visibility across the entire hybrid environment. Qualys Cloud Agents are embedded and fully integrated with the Armor platform to deliver asset discovery and inventory, vulnerability assessment, including configuration control, threat prioritization, and patch detection to Armor customers. In addition, this quarter, Qualys was recognized as a Gartner Peer Insights Customers’ Choice for Vulnerability Assessment. VMDR is effortless to deploy on a global scale and priced as a fully branded solution, drastically saving deployment, administration, and software subscription costs with real-time, lightweight Cloud Agents and Virtual Scanners that are self-updating and easy to deploy. Our game-changing VMDR application was also highlighted during the quarter in a report by Ovum, the market-leading data research and consulting firm. In Q1, nearly 150 existing customers adopted VMDR, including approximately 60 new customers and seven of our top existing customers who were up for renewal in Q1 renewed into the VMDR subscription. In fact, 3.9 million out of our 38 million paid Cloud Agents subscriptions came from VMDR, of which 3 million were new agent subscriptions, laying the foundation for the ubiquity of our agent, which is the technology platform for seven security, compliance, and IT solutions, namely Vulnerability Management, Policy Compliance, File Integrity Monitoring, Indication of Compromise, Patch Management, Asset Inventory, and the upcoming Certificate Management with more to come. Earlier this month, we also announced general availability of the Qualys Cloud Agent on the Google Cloud Platform. GCP Customers can now easily activate multiple Qualys applications, including our game-changing VMDR application to build a streamlined workflow within GCP. At our user conference this past quarter, we participated in several impromptu videos, which you can access on our website. These videos underscore the fact that the security industry is on the verge of a major transformation as many of the current solutions offered by a plethora of vendors are becoming inadequate, as the architecture of our corporate network is drastically and rapidly changing. We noticed this trend quite a while ago. As mentioned earlier, we took the time to properly build our offering with this need in mind. These efforts serve as the foundation for our leadership position in our market, and we continue to innovate first, with VMDR, which went live in April, and with the next generation of SIEM and EDR, which we expect to deliver for beta at the end of the year, and EDR early this summer. Additionally, we will deliver significant extensions similar to our VMDR to our current offering, providing detection and response capabilities across cloud, mobile, SaaS, OT, and IoT environments by adding response capabilities to our Cloud Agent and additional detection capabilities to our network analysis efforts or passive scanning efforts. Looking forward, we believe the world after COVID-19 is going to be different. Companies are going to be more focused on reducing costs while increasing business flexibility, which is going to drive faster adoption of cloud-based solutions. In the current uncertain environment, we're fortunate to have a stable foundation of recurring revenues and a highly profitable model, which we believe can withstand short-term disruptions. Finally, because of the very nature of our business model, which is 100% recurring, and the fact that our solutions have become mission-critical to having greater visibility than many other security companies in our industry, even during difficult times, we are confident in our stellar profitability. With that, I will turn the call over to Melissa to discuss our financial results and guidance for the second and full-year fiscal 2020.

Thanks, Philippe, and good afternoon, everyone. I would like to reiterate Philippe's comments that we hope our investors, analysts, and everyone on the call are all safe and healthy. Before I start, I'd like to note that except for revenue, all financial figures are non-GAAP, and growth rates are based on comparisons to the prior year period unless stated otherwise. We're delighted with our increasing Cloud Agent subscriptions and multi-product penetration as well as the strong adoption of VMDR, which lays the foundation for future revenue growth and industry-leading profitability. Our Q1 financial and operational highlights include: revenue for the first quarter of 2020 grew 14.5% to $86.3 million. Please note our Q1 2020 calculated current billings was positively impacted by the timing and amounts of prepaid multi-year subscriptions, somewhat offset by a few large deals that were invoiced in Q4 2019 rather than at their anniversary in Q1 2020. Our average deal size increased by 3%. Platform adoption continued to increase, as the percentage of enterprise customers with three or more Qualys solutions rose to 50% from 42%, and the percentage of enterprise customers with four or more Qualys solutions increased to 32% from 22%. Paid Cloud Agent subscriptions accelerated to 38.4 million over the last 12 months, up from 30.7 million for the 12 months ended in Q4 2019. 3 million Cloud Agents were purchased this quarter by a single customer, and new products released since 2015 contributed approximately 44% of total annual bookings in the quarter, up from 23%. Since this metric includes VMDR, we expect it to become less relevant for investors as more VM customers renew into VMDR over the coming quarters. As a result, we do not plan on providing this metric going forward, but we plan to introduce new metrics relevant to VMDR adoption, such as the percent of customers up for renewal in the quarter who renewed into a VMDR subscription. In Q1, this was 4%. Because VMDR is an integration of multiple apps, VMDR adoption should increase our strong renewal rates. Our scalable platform model continues to drive superior margins and generate significant cash flow. Adjusted EBITDA for the first quarter of 2020 was $38.2 million, representing a 44% margin versus 41%. Q1 EPS grew 34%. Our free cash flow for the first quarter of 2020 was $45.1 million, up 28%. Excluding one-time CapEx related to the build-out of our Pune headquarters and M&A-related payments, our free cash flow grew 36%. In Q1, we continued to invest the cash we generated from operations back into Qualys, including $4.7 million on capital expenditures for operations, including principal payments under capital lease obligations as well as $2.6 million in capital expenditures for the build-out of our Pune headquarters, and $28.9 million to repurchase 346,250 of our outstanding shares. Our Board has authorized an additional two-year $100 million open market share repurchase program, resulting in approximately $200 million in current share repurchase capacity. This gives us ample capacity to take advantage of any potential stock market dislocations. Now I want to share our thoughts on the potential impact of COVID-19 on our business this year. As Philippe mentioned, we consider ourselves fortunate relative to other companies because we have a strong, sustainable, and profitable business model. The fundamentals of our company remain strong. We have a healthy balance sheet with $435 million of cash and marketable securities as of the end of the quarter, and we have no debt. Our exposure to the retail, travel, and hospitality sectors is minimal; less than 5% of our trailing 12-month annual bookings came from customers in these segments. To date, we are seeing consistent renewal rates across our business in all geographies, and solid expansion with existing customers. 18% of our enterprise customers had five or more Qualys solutions, and as we've discussed, our five-plus enterprise customers had a gross dollar renewal rate of 99% in 2019. We increased the number of customers with over $500,000 of revenues over the last 12 months by approximately 30% to 96 at the end of Q1. Additionally, because our business is nearly 100% subscription, we have good visibility into our financial performance. Our updated fiscal year 2020 guidance range for revenue is $354 million to $359 million. This guidance assumes that similar to other companies, our revenues may be impacted in the next few quarters by organizations that defer purchases of new solutions as they focus on business operations and small and medium-sized companies that may need to reduce spending. Our updated fiscal year 2020 guidance range for non-GAAP EPS is $2.46 to $2.51. Because of our highly profitable model, we intend to continue investing at a similar level to what we planned for at the beginning of the year, in order to maintain our strong competitive position and drive future revenue growth. We expect to maintain industry-leading margins in 2020 and continue to produce strong cash flow. Impacting our non-GAAP EPS guidance by $0.06 versus what we provided last quarter is the recent decline in interest rates, which we estimate will result in approximately $1 million lower interest income per quarter. Our Q2 guidance for revenue is $88 million to $88.6 million, and our Q2 guidance for non-GAAP EPS is $0.63 to $0.65. For the second quarter, we expect capital expenditures to be in the range of $5 million to $6 million, which includes approximately $1.5 million for the build-out of our Pune headquarters. Because India has also been operating under a shelter-in-place policy, the timing of spend on our Pune headquarters has been pushed out a few months, and we now expect that $1 million of our original planned spend will occur in the second half of the year. Following Philippe's comments, we feel very well positioned during this period of uncertainty due to the value provided by our cloud platform and our 19 apps as well as our underlying highly scalable operational model. We believe we will emerge stronger from this, as our model enables us to continue helping our global community and investing for future revenue growth and profitability. With that, Philippe and I are happy to answer any of your questions.

Your first question comes from the line of Daniel Ives from Wedbush Securities.

Yes. Thank you. So maybe you can talk, Philippe, about from a day-to-day, what you're doing in terms of customers and partners to navigate the COVID-19 backdrop. Maybe just talk about from a day-to-day perspective, what you're doing to handle customers? And could you comment on the month of April versus March?

Okay. So let me maybe – yes, I mean, this is pretty straightforward. We are very close to our customers. Today, what we see is that many of our customers are essentially asking for some payment terms, which, of course, for us it's relatively easy to do, assuming they have good balance sheets, because we're not going to extend payment terms to companies that we believe are going to go bankrupt. As Melissa mentioned, we are not significantly affected in our business by the travel industry and other industries. Fortunately, we find ourselves in a good position there. So what we also see coming gives us a very unique opportunity. Customers want to reduce spending. Because, of course, cash is king, and we all need to weather that economic shutdown. So this puts us in a very good position because instead of discussing discounts, we are discussing the consolidation of the stack. Customers who adopt multiple solutions can replace our solutions and also gain visibility, but they can significantly reduce costs because everything is centralized in Qualys, everything is self-updating, and you need much less manpower to operate these solutions. The advantage of having everything done from one platform is a significant benefit. We have these discussions almost every day with all of our customers, and they are very positive. As far as the difference between March and April, not much. Quite frankly, we see that our business is solid. We had early in the difficult time, Q1 was slightly impacted by the fact that some new business was pushed out, as were some upsell opportunities. But overall, it was not significant, and so we feel very good.

Okay. Great. Well, thanks again and good job.

Thank you.

Your next question comes from the line of Sterling Auty from JP Morgan.

Hi, guys, this is Matt on for Sterling. Thanks for taking the question. In terms of hiring, how has the current situation impacted your hiring plans, if at all?

Well, I'm really glad that you asked that question because we are in a very unique position. People are flocking to Qualys. We are, in fact, one of the few companies that is continuously hiring. We have always been very deliberate with our hiring; we focus on quality, not quantity. But now we have a unique opportunity because a lot of people are worried in their companies, and they see Qualys as a shining star. We have been interviewing a lot, in fact, via video conference, and we are continuing to hire. So there's no hiring freeze, but we are very deliberate.

Got you. And then just one quick follow-up. Which products would you say are – you feel are going to be more positively impacted by the current situation? Have you seen a shift in customer preference in terms of which applications they're using Qualys for? Thanks.

Yes, that's another great question. Obviously, everything which is remote is in high demand. That's why we launched our free Endpoint Protection Service in record time, with the ability to patch across the Internet, which is very unique; very few companies can do that. We have seen an absolutely fantastic response to this, as I mentioned during the earnings call. Additionally, we plan to add the capability to detect malware very soon, within a few weeks, and that sets us up for our next big application to come, which is the next-generation EDR, which we're planning to announce and deliver in the summer. This is obviously a very hot market because you need to know exactly what you have deployed. Today, we have agents not only for Windows and MAC systems but also for Android and iOS, as well as the growing fields of Cloud and Container Security. We are extremely well-positioned. We are very bullish due to the many years we dedicated to architecting our platform and the performance we have achieved. What we have built did not happen overnight, and for any company today, to build at the scale at which Qualys has built and bring all that information into one single platform is no small feat. Therefore, to eliminate problems such as false positives in existing EDR solutions will be vital. Knowing how to manage false positives remotely is very challenging. We aim to have minimum false positives, and we are introducing response capabilities, such as killing processes, within our agent very soon. Consequently, we are extremely well-positioned.

Yes. Just to add on to Philippe's comment, we also view and we talked about this in our prepared remarks that VMDR is very well positioned in this environment because it has a very attractive value proposition, integrating multiple applications into one. We do expect to see continued strong adoption. The benefit for us is, as we've talked about, customers with multiple solutions have increased stickiness, which drives proliferation of our Cloud Agents and lays the foundation for further upsells of additional paid solutions.

Yes. And I will add, also to what Melissa mentioned, thank you for that. The key is that many of our competitors are worried about VMDR because it is a true game-changer. Many of them are trying to paint VMDR negatively, claiming it's just a bundle of solutions. No, it's not a bundle of solutions; we have all the recorded data consolidated in one place. That enables us to provide all the necessary workflows and everything into a single app. This allows the detection of any device that connects to your network, instantly. You can then determine whether you want to manage that device, create your global IT asset inventory, and analyze vulnerabilities across various platforms. We have a new prioritization engine that's far ahead of our competitors, which greatly enhances our remediation process. You will also see similar capabilities in the new offering that we plan to deliver for identifying SaaS applications and cloud applications, as well as EDR across endpoints, mobile, and very soon, OT and IoT environments. The power of the platform is that we have built a strong data collection capability and can efficiently consolidate various telemetry into one place. No other company has built anything close to this. It took time, but we have achieved it.

Great. I appreciate all the color there, guys. Thanks.

Your next question comes from the line of Yun Kim from Rosenblatt Securities.

Thank you. Hi, Philippe and Melissa, hope you guys are doing well and safe. In regards to the overall Cloud Agent adoption, I think this was probably the strongest sequential growth quarter by a mile. Even if you exclude that one customer purchasing 3 million agents, which I am assuming was VMDR driven. But can you just talk about the strength in your cloud adoption in regards to where you are seeing the adoption of your Cloud Agents? Is it more end-point driven? Or is it broader? Are you seeing strength also in cloud environments as well?

Yes. Now, this is another very good question as well. The reality is, the adoption is occurring everywhere. You have to realize that to handle 38 million agents, in fact, we could handle hundreds of millions, if not billions of agents. You need to have the right architecture. It took us time, but now, we are branching out. We're branching out to the endpoints with our free service, generating now 2.1 million agents. Those are either installed or in the process of being installed, which allows us to provide upgrade capabilities. The cloud is another area where you need agents to ensure comprehensive visibility. Many of our competitors lack this capability. Therefore, we have worked hard to collect this data. It's not by accident that we handle nine petabytes of information because these agents continuously report changes to our platform. Therefore, we need significant computing power and analytics capabilities, which we are, of course, enhancing with machine learning capabilities. We can efficiently process data in real-time and have a response time on our ElasticSearch cluster of about 100 milliseconds.

Just to add on, we indeed observed significant acceleration of Cloud Agent adoption, which is exciting for us. VMDR indeed played a big role in this. That single large customer that purchased 3 million agents was actually separate from VMDR. Therefore, we believe that we are in an excellent position due to VMware driving Cloud Agent adoption. And this is why we mentioned earlier how satisfied we were with VMDR even before it was formally unveiled because it has the potential to drive proliferation of Cloud Agents both internally and at the endpoint. We have also seen excellent adoption with the free remote Endpoint Protection Service, but that's not included in the paid subscription, which provides us with additional upside in the future.

Okay, great. I just have a question around just the core VM market, the overall dynamics there and pricing environment in the core VM market. Just saw the ASP was up 3% in your press release. That's probably at the lower end of your range typically. Can you just talk about the market dynamics in your core VM market?

No, the dynamics are very clear. Our customers love VMDR, and we're confident the adoption of VMDR will accelerate quickly, and we’re already seeing this happening. Customers are eagerly inquiring about VMDR, and its capabilities are impressive. Many of our competitors feel threatened by VMDR because they lack some of the innovations we possess, such as the ability to show vulnerabilities and manage devices effectively. They are resorting to questionable pricing tactics, and it puts us in a very strong position to fend off this type of pricing strategy. We feel very good about the prospects for VMDR and believe we are in a position to gain market share.

Okay. Great. Thank you so much.

Thank you.

Your next question comes from the line of Nick Yako from Cowen and Company.

Hey, guys. Thanks for taking my questions. The company now has a number of free offerings that all seem to be gaining good traction in the market especially in this environment. I was just hoping you could discuss the likelihood of converting these users into paid customers and when we could see this impact in the numbers?

That's a very good question, also. The free services we provide are a cost-effective way to generate leads. As I mentioned in the last quarter, we've built a team in Pune, India, called technical account representatives, who are there to onboard customers using the free offerings and trials. As buying patterns shift towards a more trial-and-buy model, we are creating strong relationships with these users and will focus on potential upsells. We do not entrap our customers; our free services provide value on their own. However, we do see gradual adoption of the additional paid solutions as customers become familiar with our offerings. It costs us very little to provide this free service because the platform is self-sufficient. We are also ramping up our marketing capabilities further.

And we believe that this model is very sticky, right? Because we're letting our customers buy at their own pace, which is essential in a subscription business model.

Okay. Great. And maybe one follow-up for you, Melissa. As it relates to the outlook for the year, in your prepared remarks you mentioned that you do expect some deals for new solutions to get deferred. I was wondering if you could just talk about some of the underlying macro assumptions embedded in your full-year guidance?

Yes. Thanks, Nick. Happy to go into that. Our guidance reflects a good quarter and the strong adoption of new solutions like VMDR. What I explained earlier was that this guidance accounts for the potential impact to new and upsell bookings, and the range reflects the degree of impact from COVID-19. While we're not seeing disruptions to date, at the lower end of the range, we assume a potential impact on retention rates, especially at the lower end of our customer spectrum. The lower end doesn't generate significant dollars for us, and we believe VMDR provides a strong value proposition to increase renewal rates. Therefore, we are being cautious regarding the uncertainty around COVID-19.

Makes sense. Thanks, guys.

Thank you.

Okay. And now for closing remarks, Philippe, the floor is yours.

Okay. Thank you very much for attending our earnings call and for your questions. These are challenging times, but we feel fortunate to be in a very strong position with our cloud platform and applications, including our game-changing VMDR application, while continuing to build our pool of top-notch talent, as I mentioned during the call. We are emerging stronger than ever to serve our global community, employees, and shareholders. I hope all of you remain safe and healthy, and that the country returns to business soon. Thanks again.

This does conclude today's conference call. You may now disconnect.