Good afternoon, and welcome to Qualys Third Quarter 2020 Earnings Call. Joining me today to discuss our results are: Philippe Courtot, our Chairman and CEO; and Joo Mi Kim, our CFO. Before we get started, I would like to remind you that our remarks today will include forward-looking statements that generally relate to future events or our future financial or operating performance. Actual results may differ materially from these statements. Factors that could cause results to differ materially are set forth in today's press release and in our filings with SEC, including our latest Form 10-Q and 10-K. Any forward-looking statements that we make on this call are based on assumptions as of today, and we undertake no obligation to update these statements as a result of new information or future events. During this call, we present both GAAP and non-GAAP financial measures. A reconciliation of GAAP to non-GAAP measures is included in today's earnings press release. As a reminder, the press release, prepared remarks and in this presentation are available on our website. With that, I'd like to turn the call over to Philippe.

Thank you, Vinayak, and welcome, everyone, to our Q3 earnings call. Let me begin by saying that we hope you and your families are healthy and safe. With the ongoing COVID-19 pandemic, our workforce continues to operate remotely, and our top priority remains providing support for our employees, partners, and customers. We are fortunate that the nature of our business allows us to successfully operate in this dynamic work environment. We have been able to adapt to the current challenges and deliver the results we had set out to accomplish last quarter. Joo Mi and I are pleased to report another good quarter in terms of revenue growth and profitability. We also had strong growth in our paid Cloud Agent subscription with 50 million now, representing nearly 80% growth from the prior year's quarter. This multifunction, lightweight Qualys Cloud Agent provides visibility across the entire hybrid environment and is the underlying technology for 7 of the security compliance and IT solutions that are natively integrated on our platform, that is: VMDR Vulnerability Management, Detection And Response; Multi-Vector EDR, Endpoint Detection and Response; Policy Compliance; File Integrity Monitoring; Patch Management; Global IT Asset Inventory; and the upcoming Certificate Management and more to come. Qualys VMDR has taken Certificate Management to the next level by providing the power to continuously detect vulnerabilities and misconfiguration across the entire global IT environment and respond in real time to remediate assets that are vulnerable or already compromised from a single platform with building orchestration. Currently, approximately 1,250 customers have adopted VMDR, which includes over 350 new customers. Qualys VMDR is not only being a huge success with customers but it's also driving further penetration of our Cloud Agents because of our Global IT Asset Inventory, which is bundled in it. Since VMDR helps proliferate our Cloud Agent, it in turn sets a foundation for further upsell or other paid applications. This quarter, we announced the general availability of our Multi-Vector EDR solution. This Multi-Vector solution unifies different context vectors like asset discovery, vulnerabilities and exploits, misconfiguration, in-depth endpoint telemetry and network reachability with our powerful backend for accurate assessment, detection, and response, all in a single cloud-based app. As an app built natively on the Qualys Cloud Platform, our Multi-Vector EDR leverages its power, scale, and accuracy to correlate billions of global events with threat intelligence, analytics, and machine learning to provide unprecedented context and real-time insight into the endpoint to carry out rapid threat hunting and response. Qualys, in fact, Multi-Vector EDR goes beyond traditional EDR solutions by providing comprehensive response capabilities such as killing processes and quarantining files or endpoints while also uniquely preventing future attacks by orchestrating responses such as patching vulnerabilities, removing exploits, fixing misconfigurations or uninstalling software before endpoints are compromised. Since our Multi-Vector EDR encompasses the entire attack life cycle, it makes it easier to automate the response and dramatically reduce the number of false positives. The combination of Qualys VMDR and Multi-Vector EDR allows us to provide a single end-to-end workflow that helps companies greatly reduce the time to respond and allows for the consolidation of the security stack. Also, we are now providing a comprehensive 2-way inventory synchronization with ServiceNow Service Graph CMDB as part of their new Service Graph Connector Program. This new integration helps customers to quickly, easily, and reliably load their complete and contextualized asset information into ServiceNow, enabling a consistent and consolidated data set across the hybrid IT environment. Thus, providing with an always up-to-date source of truth across their hybrid environment. In addition, we continue to see good adoption of our cloud-based Remote Endpoint Protection Solution, which leverages the Qualys Cloud Agent and its cloud-based architecture to deliver instant and continuous visibility of remote computers as well as their installed applications, obtain a real-time view of all critical vulnerabilities and misconfigurations and remotely deploy missing patches for critical vulnerabilities. We currently have approximately 700 companies, including 300 customer prospects, actively using this free service offering. In terms of our newer paid solution, we saw solid growth this quarter with our paid Global IT Asset Inventory – Asset Discovery and Inventory application. In fact, a large managed healthcare organization added our Global IT Asset Discovery and Inventory paid module this quarter in order to gain visibility of all their known and unknown assets across multiple environments, identifying the end-of-life of the installed software and synchronize with our ServiceNow CMDB. Patch Management continued to see strong customer adoption both in the mid-market as well as with large customers. In Q3, a leading financial services firm selected our Patch Management application over several competing solutions given its ability to easily and effectively patch remote endpoints without using the limited bandwidth available on VPN gateways. Finally, we also saw robust growth for our Container Security application with adoption from a respected regional financial institution that has already deployed VMDR and Policy Compliance. Now on the go-to-market front, we are expanding our relationship with the next-generation of managed security service providers, or MSSPs, given the increased breadth of our product suite with the addition of the VMDR and Multi-Vector EDR. This MSSP can leverage the Qualys Cloud Platform to fully address the security needs of small and midsized customers that lack in-house resources to secure their hybrid environment as well as addressing the needs of large companies. We were pleased to announce that Infosys, a global leader in next-generation digital services and consulting, is integrating both VMDR and Multi-Vector EDR into its Cyber Next Platform, a Managed Security Service offering. Powered by the Qualys Cloud platform, Qualys VMDR and Multi-Vector EDR will collect vast amounts of telemetry from the Qualys Cloud Agent and multiple sensors to combine with network information for a broad view of the environment going beyond just the endpoint. This significantly reduces lateral movement of security breaches to spread across from the initial point of compromise. Infosys' customers can also extend their use of the Cloud Agent to Patch Management, File Integrity Monitoring, and other functionalities. In addition, Deloitte Canada is now offering Qualys VMDR via its Cyber Risk Services offering. Deloitte Canada clients now have access to the Qualys VMDR app as part of a holistic solution to meet their Vulnerability Threat Management requirement and provide visibility across their entire hybrid IT environment. Qualys Cloud Agents are embedded and fully integrated with the Deloitte Cyber Intelligence Center via APIs to deliver asset discovery and inventory, vulnerability assessment, including configuration control, threat prioritization, and patch detection to Deloitte's customers. Finally, last week we announced an expanded integration of Qualys Vulnerability Management with Microsoft Azure Arc, allowing customers to perform vulnerability scanning on servers outside of the Azure platform, including on-premise and multi-cloud servers. This capability is available to all customers of Azure Defender for servers at no additional cost. We continue to invest in expanding the capabilities of our cloud platform and aggressively developing additional solutions. Looking ahead, we are enthused about the additional solutions that we plan to introduce in the next few months. That is: Container Runtime Security, which provides runtime defenses and protection capabilities for containerized applications now in GA; Additional Detection and Response offerings that we call DRs, such as SaaS DR, Cloud DR and Mobile DR, which are also coming out of beta; Granular Access Control module and extension to our Global IT Asset Inventory; Multi-Vector EDR will also be available for Linux environments. In addition, an endpoint protection platform, EPP, extension to our Multi-Vector EDR solution will be available in Q1 2021; a major update to our passive scanning capabilities that will significantly expand our coverage of Industrial Control Systems, operational technology, as well as IoT devices; and finally, Data Lake/Analytics/SIEM, or what we now call XDR platform, which seamlessly will integrate all our current and forthcoming detection and response solutions or the DRs, has now entered beta with 10 design partners, and we're planning for it to go live by the end of Q1 2021. The development of these solutions has been possible because of the massive investment we made in our Cloud Platform and our strong engineering talent base in Pune with over now 900 employees located there. These new initiatives open significant incremental market opportunities for us and allow our customers to easily and cost-effectively consolidate their stack of traditional security and compliance solutions while providing them a single-pane-of-glass view on all assets across on-premise, endpoint, cloud, and mobile environments. Similar to our efforts on the cloud platform front, we are also building a marketing platform that, combined with increased investment in sales management and sales capacity, will drive future profitable growth. We will showcase this new solution at our upcoming QSC, or Qualys Security Conference. And I would like to personally invite you to attend this conference, which will be a 12-day virtual event from November 9 to 24. You could also listen to the presentation at your own leisure, and we currently have more than 5,000 people registered. You can access the agenda and register for the conference at www.qualys.com/QSC/2020/virtual. As mentioned earlier, replays of the session will be available on-demand at the end of the day when they are presented. At the conference, our President and Chief Product Officer, Sumedh Thakar, will discuss the evolution of our Cloud Platform as well as our recently launched Multi-Vector EDR solution and forthcoming Data Lake/Analytics/SIEM initiative or XDR platform extension. Our attendees will have the opportunity to listen to customers such as the Head of Product Security at Zoom; Manager of Information Security Operation at Jabil; and the senior security engineers at Informatica. We will also present our risk-based approach to vulnerability management, providing forthcoming updates to our Cloud and Container Security solution, share our view on risk management and compliance, and discuss our next-generation web application and API security solutions. Our focus continues to remain on balancing growth with profitability. The Qualys Cloud Platform serves as a distribution channel, enabling us to grow while maintaining industry-leading margins. Incremental future growth will be driven by our strong partnerships with MSSPs as well as further investments in sales and marketing, as mentioned earlier, with the addition of highly qualified technical individuals. On the hiring front, we are pleased to welcome back David French as EVP for the Americas Field Operation. David has extensive experience in sales and business development and will play an important role in driving continued growth for the company. Finally, M&A continues to be a part of our growth strategy as we seek to accelerate our product development and expand into adjacent markets. Acquisitions over the past couple of years have complemented our organic product innovation, expanding our cloud platform to provide more comprehensive security and compliance coverage as well as visibility across all global IT assets across, again, on-premise, endpoint, mobile, cloud, containers, and our OT and IoT environments. Our Cloud Platform has now reached the level of maturity where we can potentially explore acquisitions to expand our customer base in a disciplined manner as well as continue to acquire small companies with innovative technology. In conclusion, increasing the adoption of our Cloud Agent and the breadth of our solutions across environments enable us to offer customers greater visibility, accuracy, and scalability while ultimately enabling them to consolidate their security, IT, and compliance stack and drastically reduce their overall spend. With that, I will turn the call over to Joo Mi to discuss our financial results and guidance for the fourth quarter and full year fiscal 2020.

Thank you, Philippe, and good afternoon. Before I start, I'd like to note that except for revenue, all financial figures are non-GAAP, and growth rates are based on comparisons to the prior year period unless stated otherwise. We're delighted with our increasing Cloud Agent subscriptions and multi-product penetration as well as a strong adoption of the VMDR, which lays the foundation for future revenue growth and industry-leading profitability. Our Q3 financial and operational highlights include: revenues for the third quarter of 2020 grew 13% to $93.1 million. Please note our Q3 2020 calculated current billings was negatively impacted by the timing and amount of prepaid multi-year subscriptions as well as requests for shorter duration invoicing. Our average deal size increased 7%. Paid Cloud Agent subscriptions increased to 50 million over the last 12 months, up from 43 million for the 12 months ended in Q2 2020. 3 million Cloud Agents were purchased this quarter by a single customer. And 34% of VM customers, up for renewal in the quarter, renewed into a VMDR subscription, up from 19% in Q2 and 4% in Q1. Our scalable platform model continues to drive superior margins and generate significant cash flow. Adjusted EBITDA for the third quarter of 2020 was $45.1 million, representing a 48% margin versus 47%. Q3 EPS grew 19%. And our free cash flow for the third quarter of 2020 was $48.4 million, representing a 52% margin and up 21%. In Q3, we continued to invest the cash we generated from operations back into Qualys, including: $11.2 million on capital expenditures for operations, including principal payments under capital lease obligations; and $37.7 million to repurchase 352,000 of our outstanding shares. We remain confident in our business model, driven by our foundation of nearly 100% recurring revenue and expanding suite of applications. We are delighted to be raising our full-year 2020 guidance for both revenues and earnings. We are raising the bottom and top end of our revenue guidance for the full year to now be in the range of $362.4 million to $363 million from the prior range of $359 million to $360.5 million. We are raising our full-year non-GAAP EPS guidance to now be in the range of $2.85 to $2.87 from the prior range of $2.60 to $2.65. We expect to maintain industry-leading margins in 2020 and continue to produce strong cash flow. Our Q4 guidance for revenue is $94.2 million to $94.8 million, and for non-GAAP EPS is $0.69 to $0.71. For the fourth quarter, we expect capital expenditures to be in the range of $7 million to $8 million, which includes approximately $1 million for the build-out of our Pune headquarters. As Philippe mentioned, we are very excited by the robust adoption of VMDR and the launch of our Multi-Vector EDR solution, and we remain optimistic about the company's future. We feel very well positioned during this period of uncertainty due to the value provided by our Cloud Platform and our 20 apps as well as our underlying highly scalable and profitable operational model. With that, Philippe and I are happy to answer any other questions.

Congratulations on a strong quarter, Philippe and Joo Mi. This is a general question from last year's user group conference. Can you provide an update on the partnership announced last year with Microsoft Azure, particularly regarding the integration with the Azure Security Center? I remember that session had a particularly high turnout.

This partnership is doing very well. What we have done here is remarkable because this is the integration of our entire Cloud platform with Azure Cloud platform. And as I mentioned in my prepared remarks here is that we have now expanded that to move into Microsoft Azure Arc, which is, if you prefer, their private cloud initiative as well. And so this is, again, the partnership goes very well. Microsoft is a very big Qualys customer as well. So I think earning the respect of the engineering team and, as importantly, doing the work to fully integrate seamlessly to our solution is very unique. And we are, of course, working with other cloud providers to do the same.

Okay. Great. Philippe, you've expanded your portfolio beyond your core VM product. Are you noticing an increase in new customers who are engaging with your newer cloud-based products instead of the core VM product?

Yes, that's a great question. We are seeing that with our large customers, we are becoming increasingly strategic. They've started to recognize the value of our SIEM platform along with the DRs we've announced. We're uniquely combining detection and response into a single application, enabling real-time detection and response capabilities. Our XDR solution integrates various DRs we have, including VMDR and EDR, which competes with CrowdStrike. We also have SaaS DR for full visibility of applications like Office 365 and Salesforce, as well as Cloud DR to identify and correct misconfigurations in S3 buckets from a single interface. This automation streamlines workflows and significantly reduces costs. Our XDR platform is currently in beta with ten major customers, who are our design partners, and we aim to enter beta 2 early in Q1, planning for a general availability by the end of Q1. This platform is designed to meet the needs of both large and small companies, making it highly scalable. We're increasingly becoming strategic with our large customers, who are eager to adopt more Qualys solutions, particularly the upcoming XDR solution. At the lower end of the market, we simplify processes, offering a solution that spans the entire spectrum. With multiple applications available, we can attract new customers. The Global IT Asset Inventory is also gaining interest, and as we introduce new SaaS DR and Cloud DR offerings in the coming weeks, we expect to generate new customer growth. Once we implement our platform for a customer, that becomes our strategy, allowing us to sell more effectively, as everything is centrally managed and self-updating. We're also developing a marketing platform to extend our solutions to more companies globally. Does that make sense?

Yes. Joo Mi, I have a quick question for you. Regarding the 7% increase in average selling price, is this increase more broadly based, or is it primarily due to large customers? Additionally, did the 34% of customers who upgraded to VMDR in the quarter significantly contribute to the ASP increase?

Yes. So 7% average deal size increase is more broad-based, not just concentrated on the larger customers. And in terms of VMDR adoption, we are very pleased with the increase in adoption with it increasing from 19% last quarter to 34%. With that said, as expected, the impact to revenue has been broadly neutral for year-to-date. And this is due to the same reasons I stated before, where you might see a VM-only customer spending a little bit more when they renew into VMDR versus offset by customers who used to subscribe to multiple Qualys solutions; they might be spending a little bit less. So overall, this year, we are seeing a broadly revenue-neutral impact. However, going forward, we really believe that this lays the foundation for continued upsell and really drives bookings growth with an increase in retention that we expect to come and witness next year.

Yes. I would like to highlight that VMDR is not just the next generation of vulnerability management, but also the application that gathers all telemetry and data which is crucial for vulnerability management and provides important context. When you deploy a VMDR, you already have all that data available. This is very significant for our XDR platform as it allows us to present the inventory and context, as well as the status of any devices connected to the network. This demonstrates our major strategy, where our vulnerability management solution also serves detection and response. Additionally, we have the Global IT Asset Inventory that deploys the agent and collects extensive telemetry, combined with our passive scanning for network analysis. To give you an idea of our operational scale, seven months ago we were indexing 3 trillion data points in ElasticSearch clusters, and now we index 9 trillion. This significant scale sets us apart from other solutions.

Simple question. You had a $4.3 million Q-o-Q increase in revenue. I think it's the largest over the past 6, 7 years. Is this simply VMDR adoption? Or is there something more going on here?

Yes. It's not attributable to the VMDR because the VMDR adoption is great. It's a long-term strategy, and we believe that it will drive the bookings growth and revenue growth overall turning next year. This year, it's been broadly neutral. So if you take a look at the revenue growth, we did outperform, beat our high-end of our revenue guidance because bookings came in better than what we had expected. We are seeing that momentum overall, not just specific to VMDR, with the bookings coming in and the deals closing on both the new and upsell as well as maintaining our strong retention rate.

So I guess what I'm driving at there is why did bookings come in stronger than expected? Can you point to some sort of broad theme that you would expect to continue? Or was it one-time in nature?

I wouldn't say it's one-time in nature. New deals came in better than what we had expected. So typically when we guide to revenue, what we do is we take a look at the pipeline in play, right, with respect to both new customers as well as upsell and expand potential with their existing customers and, of course, the renewals that are coming up. And so it just so happened that this quarter, we had better linearity. We had better new bookings than what we had anticipated. And so we are seeing that growth. And this is part of the reason. And what we've always said was if you take a look at our revenue, it might not necessarily be in line, and that current billings might not be indicative of the business momentum because if you take a look at current billings, we indicated that it was at 8% year-over-year. But revenue, we outperformed growing 13% year-over-year.

Yes, this is also providing more details about our solution. For instance, our Patch Management is performing very well, and our Container Security is also progressing nicely. Additionally, we are very optimistic about our upcoming Cloud Disaster Recovery and SaaS Disaster Recovery offerings. We have all these new solutions. What is particularly unique is that, unlike other companies that require multiple consoles to access different applications, whether they are cloud-based or not, we offer a single platform with one URI and one application. This gives users significant power at their fingertips, with all workflows integrated. Our approach combines multiple pathways that can be likened to rivers formed by those paths.

Congratulations on the strong results. You mentioned that bookings exceeded expectations. However, your current billings increased by 8%, which is a decline from the double-digit growth observed in previous quarters. Can you clarify if bookings grew by a double-digit percentage? Additionally, you noted in your statement that there were changes in the duration of multiyear contracts. Do you anticipate those metrics will recover soon?

Yes. So great question. So we don't guide to bookings, and we haven't shared bookings previously. But what we can point to is, typically, we've had some negative impact from multiyear deals. So that's one example that I'd like to give it. If you have a multiyear deal, on the second year, because there's no change in the current deferred current spending, the way it's reflected is not indicative of bookings. And so that's one reason. And that we expect to continue because as we close multiyear deals and our contracts at length increases, we do expect that impact to continue. With respect to shorter duration invoicing requests, we've seen the uptick in that in Q3. We are seeing less of it in Q4 this quarter, and we expect that to kind of diminish or decrease over time. And so there will be continued puts and takes. Another reason why current billings might not be trending or be indicative of the bookings or the business upfront is because you don't manage quarterly billing. And so because of that, we have renewals that are done not at the anniversary of the initial deal. So that might be another negative or potentially a positive impact. So this is part of the reason why it's hard to perfectly normalize growth rates to account for all these different scenarios.

And the short-term billings essentially is the COVID-related thing where people are asking for some payment terms and so forth. And what we do is that we very specifically mention that this is only for the COVID year. So this is not to be repeated at the renewal time.

Right. And one big factor is if you take a look at our customers, right, typically, what we've seen historically is for the multiyear deals, we've seen over 60% might have been prepaying upfront for all the years. Now we're seeing because of the COVID, one-time relief and COVID-related concession, we're seeing less than 1/3 of that. And so right now, we are seeing both impacts on current billings as well as the cash flow margin but we don't expect this to continue into next year.

Okay. And also, can you talk about the puts and takes on the gross margin line which declined sequentially and year-to-year?

Yes. So gross margin is impacted by multiple different factors. One is, basically, we're expanding our data centers and the timing in which the assets are put into service, that does impact D&A. So if you take a look at our depreciation line, it increased by 6% quarter-over-quarter. And it just had to do with the timing. We are expanding into new data centers like Dubai and Las Vegas. And we do expect some headwinds as we transition over to Las Vegas. But in the longer term, we will see the benefit, right, because it is cheaper or more cost-effective than the one that we have currently in California. And so that has to do with the gross margin contraction.

I wanted to just delve into the commentary that you said about you built out your platform and now you're building out your capacity to go into the market and aggressively sell. That's somewhat of a change in tone around the strategy of building sales capacity, as I hear it. Obviously, some of that has to do with the MSSPs and Infosys type stuff. But can you talk about what capacity additions you're doing with a little bit more granularity?

Yes. First, I want to clarify that there's no shift in our strategy. We prioritize solidifying the platform and integrating all solutions before driving sales. Currently, our platform has reached a level of maturity. With the upcoming release of XDR, we are achieving our initial goals for many solutions. There will be opportunities for further expansion into similar markets, and our platform is operating at impressive scale. In fact, we've surpassed 9 petabytes in our operations. It's essential to understand that the Cloud Platform serves as our distribution channel. We are witnessing a significant shift as more MSSPs choose Qualys because we offer a platform that is hard to replicate. Previously, our development required extensive distribution efforts, but now our platform itself is also a distribution channel that allows us to deliver more content and generate additional returns. I encourage you to register for our user conference to see how our platform provides cost-effective distribution. It's crucial to communicate about our solutions, and while timing is important, I believe that the moment to share our progress has arrived.

If I could follow-up. Could you talk a little bit about when you start moving into protecting Cloud Platform or cloud application workloads? Are you seeing that predominantly around what I would describe as the more traditional applications when they move to the cloud on digital transformation? Or are you seeing it coming in from more modern applications Kubernetes-driven, DevOps-driven, or is infrastructure driven?

Yes, this was announced this morning regarding our acquisition of Layered Insight. It took us longer than expected to fully integrate them into our containerization process. Today, containerization is crucial for distributing microservices. We've made significant changes to our entire platform's DevOps practices, which reflect the scale at which we operate. Currently, we're effectively implementing DevOps. When examining web applications, we must consider existing applications as well as the increasing importance of APIs and the ongoing containerization of our applications. This approach clearly sets us apart from other Container Security solutions because we can now provide protection. Our focus remains on detection and response. If detection is complex or costly, it defeats the purpose. However, if we can automate detection and response, it streamlines our operations and reduces protection costs. This aligns with my analogy between diagnostics and treatment.

Are you seeing customers that prioritize cloud solutions, including both cloud-native businesses and more traditional ones? I'm not entirely clear on the response. It seems that legacy customers will eventually transition to more modern applications, but are you also attracting cloud-focused clients? Can you discuss the extent to which companies built in the cloud are adopting your systems and technologies, particularly those starting with a Kubernetes-centric approach? Is this a significant part of your overall adoption?

No, it's not a meaningful percentage.

Philippe, I'd like to ask you about the progress of the platform. It seems to be gaining traction with VMDR. With David now as the new EVP of Americas, are there any major changes needed in the sales organization to support the selling of multiple products or a broader platform? Or do you anticipate only minor adjustments as you work to expand the platform narrative?

This is a great question. It's not just about the sales force. We are focusing on strengthening the management of the sales team so that we can communicate more effectively. Previously, our sales efforts were more bottom-up. We still have our technical sales team intact, but now we are in a better position to engage with C-level executives because we have more comprehensive offerings compared to the past when we were mainly focused on vulnerability management. The C-level executives tend to be more concerned with larger issues, like digital transformation. With our various components now coming together, we've expanded the management of our sales force and plan to add a few more team members. Our hunter and farmer model remains in place. We are enhancing our approach by broadening our solutions and expanding our subject matter experts, who specialize in areas like EDR, to support both our partners and our sales team. We've also strengthened our engineering capabilities, as mentioned earlier, by bringing in people to head our product lines. For instance, we now have leaders for the VMDR, EDR, Global IT Assets Inventory, and Policy Compliance product lines. We're looking to add more in the future. These leaders oversee product managers and subject matter experts and are responsible for both engineering quality and go-to-market strategies. This structural change is significant for the company as we now have a comprehensive and innovative platform. We anticipate that this will become evident soon.

Got it. And then maybe just a follow-up for Joo Mi, if I may. Joo Mi, so I appreciate the commentary on billings versus bookings. So you mentioned that bookings in Q3 improved sequentially, and you're seeing a pretty healthy pipeline in Q4 so far. But just if you could, maybe from a qualitative standpoint, give us any color as to how we should think about the pace of revenue growth going forward, right. Because it seems like, obviously, some of the investments that were supposed to be made from a sales perspective are likely to be pushed out into next year. And that's going to continue to generate strong bookings from the VMDR and some of the newer products that you guys have had. But from a revenue growth perspective, how do you think about the pace of that going forward?

Our Q4 is like 11% to 12% for Q4 revenue growth.

Joo Mi, I think you're breaking up on my end. I can hear now.

It's challenging to determine when new product adoption will impact revenue. Generally, we prefer to be cautious with our guidance, which is why we haven't provided specific revenue expectations related to new product adoption. For Q4, we anticipate that revenue from VMDR will remain mostly neutral. However, we believe that next year will bring significant contributions to revenue and increased bookings driven by the new products we are launching this year and into early next year. This will be in addition to our ongoing business growth from existing customers and new opportunities.

Philippe, I wonder if maybe if you could give us a little bit more color around MSSP and the traction that you're seeing in that market. Any way you can quantify the percentage of revenue associated with that channel? And how might we anticipate customer adoption as you go through that channel, particularly as you may add more kind of smaller customers onto your platform versus the large enterprise customers that may be in your installed base?

Yes, that's a good and broad question. We have a hybrid model where we sell both directly and through channels. The approximate mix is about 60% direct and 40% through channels. We have disclosed that 40% comes from MSSPs. I can share that we are seeing an increase in interest from traditional channels, especially with recent partnerships like Deloitte. As a result, we expect to see more MSSPs approaching us, and there will be further announcements in the future. That's the main point.

Great. That's very helpful. And maybe, Joo Mi, just a follow-up. Just playing with the model, looking at triangulating to guidance range, it looks like similar to last quarter, to get to guidance, we need a pretty steep ramp-up in spending for OpEx. But I understand that, I guess, last quarter, it seemed as though that there was some element of return-to-normal operating environment baked into that guide. Is that similar for Q4? And if so, where might some of that flexibility for upside to margins or maybe lower-than-expected spending might come from? Is that mostly sales and marketing? Or is it kind of across the board?

Yes. For Q4, it's mostly on the sales and marketing side. So in Q3, some of the spend or investment opportunities that we thought that it would incur in Q3 was pushed out to Q4. In Q4, we have QSC, even though it's virtual, we had some additional one-time expenses that's going to be occurring in Q4 as well as the Pune expansion was pushed out to Q4. We had thought that we would be moving into the Pune office in Q3, but unfortunately that had to be pushed out. And there are some other one-off expenses related to employees and COVID-related reimbursement that we expect to happen in Q4. But overall, that implied margin, EBITDA margin for Q4 is in the mid-40s. And for the ending of the year, we expect to end the year with EBITDA margin above the mid-40s. And so we anticipate there's always an upside to margin, given our scalable business model. But with that said, we did hire some new leaders in sales, including David French. So we expect to continue to invest and if I write employees and onboard them so that we can effectively drive the sales force.

This is Matt on for Sterling. You talked about expanding the relationships with MSSPs. Wondering if you could give any more additional color on what geographies you're really focused on expanding for that relationship.

So that's yes, no, that's…

Hey, Philippe, I can't hear you.

We have two types of managed security service providers, global and regional. We see interest from both, and we operate as a global company. We currently have many telecommunications companies as clients worldwide, in addition to numerous local managed service providers. Although these providers have not generated significant revenue in the past, primarily focusing on VMDR, we now have established valuable relationships, such as with IBM. Today, with our platform, interest in Qualys has increased due to the cost-reduction benefits of consolidation, which allows them to generate more revenue and create more stable capital. Furthermore, by providing response capabilities, they can enhance their services and become more profitable over time. The challenge for these service providers has been that the business is not very lucrative due to high labor costs. Without the ability to respond remotely, deploying personnel for on-site intervention becomes difficult. We have always understood this, but assembling the necessary components at the scale required has been a significant challenge for us, ultimately creating a strong barrier to entry in our market.

Great. That's very helpful. And then one last question from our side. So you've talked about the dynamics between the billings and bookings growth. I was wondering, obviously, not really asking for committed guidance on 2021, but how should we think about some of the targets that you laid with regards to revenue growth? Do you think that the trends that you're seeing here would indicate that revenue could accelerate in 2021?

Yes. We're very optimistic given the new product launches and what we're seeing in terms of the momentum. We do think of next year as an investment year. We do expect some positive impact on bookings from the new product lines, including the VMDR because we really believe that it lays a foundation for increased retention as well as cross-sell and upsell opportunities and, of course, once a budget opens up post-COVID. With that said, we will be providing more color next quarter when we give the full-year guidance for 2021.

And I'm not showing any further questions at this time. I would now like to turn the call back over to Philippe Courtot for any further remarks.

Thank you all for joining our earnings call and for your questions. Despite the challenging environment, we feel fortunate to be well positioned with our Cloud Platform and fully integrated app. We're pleased with our progress this quarter and have a positive outlook for next year. Our suite of IT security and compliance applications, including VMDR and Multi-Vector EDR, as well as our upcoming XDR, positions us strongly. I encourage you to attend our user conference, where we've worked hard to offer valuable sessions. You'll have access to recordings, allowing you to choose what interests you. We're building a marketing platform to distribute training and content effectively for our customers. In today's market, our solutions aim for mutual benefit, similar to how I've implemented an automatic lock at home for package deliveries. This reflects what Qualys is doing for security. Thank you again, and I look forward to continuing our discussion.

Thank you. Ladies and gentlemen, this concludes today's conference call. Thank you for participating. You may now disconnect.