Qualys, Inc. Q2 FY2021 Earnings Call

Thank you for joining us for the Qualys Inc Second Quarter 2021 Investor Call. All participants are currently muted. We will have a question and answer session later, and we will provide instructions for that. I will now hand the call over to Mr. Blair King. Please proceed.

Thank you, Grace. Good afternoon, and welcome to Qualys' second quarter 2021 earnings call. Joining me today to discuss our results are Sumedh Thakar, our President and CEO; and Joo Mi Kim, our CFO. Before we get started, I would like to remind you that our remarks today will include forward-looking statements that generally relate to future events or future financial or operating performance. Actual results may differ materially from these statements. Factors that could cause results to differ materially are set forth in today's press release and in our filings with the SEC, including our latest Form 10-Q and 10-K. Any forward-looking statements that we make on this call are based on assumptions as of today, and we undertake no obligation to update these statements as a result of new information or future events. During this call, we will present both GAAP and non-GAAP financial measures. A reconciliation of GAAP to non-GAAP measures is included in today's earnings press release. And as a reminder, the press release, prepared remarks, and investor presentation are available on the Investor Relations section of our website. So with that, I'd like to turn the call now over to Sumedh.

Thank you, Blair, and welcome, everyone, to our second quarter earnings call. Q2 was another solid quarter with more customers upgrading to VMDR, increasing the deployment of our cloud agents on endpoints. We are delighted to share that we have continued to grow and operate effectively through the pandemic and management changes in the company. Faced with the latest increase in malware and ransomware cyber attacks paired with heightened government scrutiny, our customers are turning to us to fortify their security posture, respond faster, and integrate patching while reducing legacy IT costs. Our highly scalable cloud-based platform allows enterprises to deploy multiple applications using a single agent, which differentiates us in the industry. Furthermore, our scalable platform enables us to handle more than 20 petabytes of data, currently indexing over 9 trillion data points on our ElasticSearch clusters, moving more than 28 billion messages a day on our Kafka bus, and pumping over 1 million writes per second on our Cassandra clusters. As a result, our solutions do not need to rely on collecting data from disparate point products to detect, remediate, and respond to security threats. The single agent approach provides better security and user experiences and in turn, underpins the continued acceleration of our Cloud Agent subscriptions, which grew 51% year-over-year to $64 million. We continue to expand the ubiquity of our agent with our VMDR solution, which continues to gain traction in the market with 28% customer penetration as of Q2. Additionally, validating our solution consolidation approach, our top new customers in Q2 not only purchased VMDR but also started with a number of additional Qualys solutions out of the gate such as Asset Management, Patch Management, Multi-Vector EDR, File Integrity Monitoring, Policy Compliance with application scanning, and Container Security. We expect to further drive the VMDR adoption in the SMB segment with the new pricing and packaging we recently introduced. Given the desire of these smaller resource-strapped customers to have a single risk-based vulnerability management tool with built-in remediation, we recently announced the launch of a very strategic initiative, which is our cybersecurity asset management, CSAM application. Accurate and up-to-date asset management in the continuously changing hybrid environment remains a major challenge for large and small businesses. Despite this, being a fundamental building block and compliance requirement, organizations struggle with asset management that is focused on cybersecurity. We believe that Qualys Cloud Platform with our multiple sensors and scalable backend that collects, correlates, enriches, and categorizes large amounts of data provides the ideal and robust solution for this challenge. By combining agent-based and agentless data collection, active and passive scanning, and APIs, the Qualys Cloud platform now provides comprehensive asset discovery across the entire infrastructure, including on-prem, cloud, container OT, and IoT to add context for security-centric visibility with a reduction of security gaps, CMDB integration, alerting, and response capabilities. It was particularly encouraging to see a top-tier financial institution select our CSAM application just days after its introduction in pursuit of agent consolidation, simplified rational workflows, and a comprehensive view of the financial institution's IT asset infrastructure as it rebuilds the security architecture for the modern hybrid work environment. Exhibited virtually at Black Hat, we were pleased to see an overwhelming reception for this application by large enterprise customers worldwide. We continue to see customer interest in reducing agent sprawl with a single solution for risk management and response. For example, in Q2, a new Fortune 100 customer purchased VMDR, Policy Compliance, Patch Management, Cloud Security, Web Application Scanning, and Continuous Security together to standardize security hygiene on a single agent solution over multiple best-of-breed point solutions. In terms of our other newer paid solutions, we saw continued customer interest in our Container Security solution as well as our Patch Management application. In the quarter, several large new and existing enterprise customers selected our Patch Management application over competing solutions, given its ability to quickly patch remote endpoints easily and effectively without using the limited bandwidth available on VPN gateways. Finally, we are receiving positive customer feedback and support for our EDR solution. This application is a natural extension to our highly scalable cloud platform and strategically aligns with our vision of a single agent. Looking into the remainder of 2021, we plan to introduce XDR, which is our extended detection and response and next-generation security analytics and incident response solution, which natively integrates and correlates security telemetry across the security stack. Like EDR, this is another natural extension to our platform. This solution is currently in private beta with several design partner customers, and the feedback we are getting has been very encouraging. As the adoption of cloud applications continues to proliferate in the industry, we continue to focus on enhancing our cloud-native security solutions. We are rapidly expanding the power of our platform through organic innovation and targeted acquisitions in this area. The total cloud acquisition we announced today will soon be integrated into several of our cloud platform modules, including our CloudView application and the upcoming XDR solution to strengthen our cloud security posture management capability and enable users to easily create automated cloud workflows for rapid integration. In addition, as I outlined on our last earnings call, another key area of focus for me is on our go-to-market strategy and sales execution. Here, we continue to make appropriate investments in our business. I'm pleased to say Alan Peters, who recently joined Qualys as our new CRO, is off to a great start. It's great to have him as part of the team, and we are looking forward to continuing our growth momentum under his leadership. In summary, we believe Qualys has a superior competitive position that provides a runway for long-term revenue growth and profitability while supporting industry-leading performance of adoption for our customers and speed of innovation for our R&D efforts, paired with the investments we are making in our go-to-market and sales enablement activities. We view these advantages as a major contributor to an already favorable competitive environment that the company has benefited from in replacing legacy point product deployments. With that, I will turn the call over to Joo Mi to discuss our second quarter financial results and guidance for the third quarter and full year 2021.

Thanks, Sumedh, and good afternoon. Before I start, I'd like to note that excess or revenue, all financial figures are non-GAAP, and growth rates are based on comparisons to the prior year period unless stated otherwise. We're pleased to report another quarter of consistent growth and profitability reflected in the following financial and operational highlights. Revenues for the second quarter of 2021 grew 12% to $99.7 million. As a reminder, last quarter, our calculated current billings were negatively impacted, and this was expected to reverse this quarter to have a positive impact on Q2 2021 calculated current billings. As of Q2, LTM calculated current billings growth was 15%. Paid Cloud Agent subscriptions increased to $54 million over the last 12 months, up from $61 million for the 12-month period ended in Q1 2021. And 47% of non-strategic alliance customers with our vulnerability management solution, up for renewal in the quarter, purchased VMDR, up from 34% last quarter. We're excited by the continued adoption of VMDR with a total customer penetration now at 28%. Our scalable platform model continues to drive superior margins and generate significant cash flow. Adjusted EBITDA for the second quarter of 2021 was $46.7 million, representing a 47% margin versus 48% last year. Non-GAAP EPS for the second quarter of 2021 was $0.79, up from $0.74 last year, and our free cash flow for the second quarter of 2021 was $47.7 million, representing a 48% margin versus 28% last year. Year-to-date free cash flow margin was 51%, which is 40% for the same period last year. In Q2, we continued to invest the cash we generated from operations back into Qualys, including $6.7 million in capital expenditures and $32.2 million to repurchase 316,000 of our outstanding shares. The weighted average shares outstanding in Q2 was $40.1 million, down from $40.9 million last year. We remain confident in our business model, and we believe that we are well positioned to drive growth given the traction we're seeing in newer solutions and the overall business momentum. We are delighted to be raising our full year 2021 guidance for both revenues and earnings. We are raising the bottom and top end of our revenue guidance for the full year to now be in the range of $406 million to $407.5 million, up from the prior range of $402.5 million to $404.5 million. We are raising our full year non-GAAP EPS guidance to now be in the range of $3.02 to $3.07 from the prior range of $2.67 to $2.72. For the third quarter, we expect revenue to be in the range of $103.8 million to $104.4 million, which represents a growth rate of 12%. We expect non-GAAP EPS to be in the range of $0.78 to $0.80. Q3 capital expenditures are expected to be in the range of $6 million to $7 million. With that, Sumedh and I are happy to answer any of your questions.

Your first question comes from the line of Hamza Fodderwala from Morgan Stanley.

This is Calvin on for Hamza. I think, first, I'd like to start out with, Alan Peters is now 3 months into the role. Have you seen or do you anticipate any further improvements in productivity? I know last quarter, you mentioned sales enablement and new businesses as a focus. Can you tell us how much progress you've made there?

Yes. I mean Alan has come on, we've been working together on figuring out what are the right investments that we need to make in working with Alan. We have continued to focus on sales enablement productivity in terms of process improvements, prospecting, and bringing on more solution architects. You can see some of the early indications of that in our guidance that we have provided. So I think these are the things that we are working on. As we continue to focus on the right investments, we will be making those through the rest of the year.

And then for my second question, can you kind of talk a little bit more about the recently announced partnership with Deep Watch and what that means for the company and potential go-to-market motion?

Yes. We've talked about this in the past that as more and more managed service providers are looking to modernize their platforms, they want to provide tools where they can offer their expertise on top of the platforms they have been building themselves. Those platforms have not been able to keep fully on top of the changing and evolving cybersecurity posture. That's what gives Qualys the advantage for these managed service providers as they look at focusing more on using a platform that already provides them a lot of the security context, whether it's asset information or vulnerability assessment from the risk mitigation perspective, providing the intelligence. MSSPs like Deep Watch, with whom we signed a partnership, we look forward to working with them. We are looking to leverage more Qualys capabilities so that they can consolidate their own stack and focus the resources on providing their customers with security expertise rather than spending the resources trying to build disparate point solutions into their own stack. From a go-to-market perspective, we'll work together as they will be taking us to their existing customers to use Qualys as their core solution for availability management as they continue to bring on more security automation-focused customers on that platform.

And your next question comes from the line of Brian Essex from Goldman Sachs. Your line is open, sir.

This is Hannah Velásquez on for Brian Essex. Just following up on that previous question, can you give us an idea of how much you plan to grow sales and marketing headcount this year? Perhaps maybe the quota-bearing reps in particular?

Yes. Last year, we ended the year with sales and marketing headcount approximately in the 300. We haven't disclosed the quota-carrying rep headcount. With Allan Peters on board, and we are planning to onboard a new CMO later this month. We will be reassessing the right profiles and team members to add to the team. Although we don't have a specific number target, we are planning to expand our sales and marketing professionals and grow that team.

And then I guess another follow-up there. So S&M grew about 17% in the quarter year-over-year. This quarter, do you plan to follow a similar trajectory after the past, I don't know, 3 or 4 quarters of declines in growth?

We are planning to increase our investment in sales and marketing. That said, in terms of the timing of when that investment will actually translate into our P&L and the impact on margins, it's a little bit difficult to say since Alan is still very much new. We do have other executives, including, not just the CMO, but also the CIO that we are looking for. With Sumedh as CEO, we plan to work very closely together as an executive team to figure out when the right timing is and what is the rate of investments this year and into next year. One of the things that we are very optimistic about is the current trend in the business momentum. As you can see, our revenue guidance is the best proxy for the business momentum. Our annual revenue guidance is now increasing to 12% year-over-year growth, and our current quarter is at 12% growth next quarter, and we're guiding to 12%. You can see that current billings are increasing at a faster rate than revenue. We're very optimistic about the potential reacceleration in bookings.

Our next question comes from the line of Yun Kim from Loop Capital Markets. Your line is open.

Congrats on a solid quarter, Sumedh and Joo Mi. Sorry, a strong VMDR upgrade rate for the quarter. Can you just talk about whether there was much of an uplift that you're seeing in terms of the overall multiproduct adoption when someone is upgraded to VMDR and any uplift that you're seeing in the overall deal size when a customer upgrades to VMDR?

I think VMDR enables many additional capabilities for the customer, and it does take some time for them to absorb those as part of their environment to operationalize those. What we see is that those who are looking at VMDR are also looking at asset management or cybersecurity asset management, patching, and other solutions. As I mentioned in the call, our new customers, as you're bringing on board, are looking at VMDR. They are also purchasing additional solutions as part of that. We see that interest and traction not just in looking at VM, but starting to look at our product portfolio even for customers who are coming straight off the bat when they sign on with us. That is encouraging for us to see. With existing customers, we continue to work with them as they deploy agents and operationalize them in their existing environment. That opens us up for opportunities to deploy patch management, EDR, and other solutions.

Sumedh, you mentioned MSSPs in your earnings press release. Can you just update us on your traction in the MSP market?

Yes. We see that. The reason they are looking at Qualys and leveraging us is that they see with a single platform, they can get multiple uses of security information needed to provide services to their customers. We work with them to onboard partnerships. There will be a time they will work to get us integrated as part of their platform, build services around that. Today, as we work with them, we see definite interest and potential, and we are working with some of these managed service providers that we recently signed up to integrate Qualys into their stack so they can provide additional services around that.

Thank you. Your next question comes from the line of Mike Cikos from Needham & Co.

You have Mike Cikos on the line here from Needham. Just had a question for you. If I'm thinking about the guidance and the results you guys just put up in Q2 here, it looks like most of this upside is coming from lower-than-expected OpEx. Should we anticipate a larger ramp as we look out to calendar '22? Are you behind in any of your expenditures, whether it's ramping sales force or hiring engineers for your R&D team? Can you help us think about those different expense buckets?

Happy to. Earlier this year, when we first set out our annual revenue guidance as well as EPS guidance, things were a little different. We went through some changes in management, including with Sumedh, who's been with us for a decade, now in the CEO role. Alan, our CRO, joined this year and we didn't have a CRO before him. Our new CMO will be joining later this month. With that said, the timing of investment has been pushed out a bit. We're not sure when that will translate into actual P&L impact and margin contraction. However, it is fair to say that some of the investments we planned to make this year have been pushed out to next year. We are seeing business momentum on bookings indicated by our current billings growth even without significant investments in expenses across sales and marketing, R&D, G&A, or cost of revenue. We don't see that changing. Next year will continue to be an investment year for us.

The first on your VMDR uptake, I think the adoption you guys cited was 47%, which I know is above the mid-30s that you guys were running in recent quarters. Can you help us understand what's driving the improved adoption rates there? And then the second item, I know it's still early days, you're in beta with a few customers on your XDR solution. But how do you anticipate differentiating your solution or competing there versus some of the other vendors?

Regarding VMDR, the penetration rate we've disclosed previously was the percentage of VM customers up for renewal in the specific quarter. Since we launched VMDR at the end of Q1 last year, this has been a metric we’ve tracked. The increased percentage was in line with our expectations. Currently, 28% of total customers have adopted VMDR, up from 24% last quarter, so it’s trending positively. Although factors like customer budgeting for renewals have played a role, we’re very positive about its growth.

I will add that the VMDR adoption is good this quarter, and we are quite happy with the way it's trending. As VMDR has been available for a year, customers coming up for renewal are seeing the value in quicker remediation as offered by VMDR. Additionally, the new packaging we are doing from an SMB perspective is enhancing interest in VMDR. We believe that our customers are experiencing and budgeting for the required upsells for VMDR and this trend should continue moving forward.

And your next question comes from the line of Jonathan Ruykhaver from Baird. Your line is open.

Yes. Sumedh, I'm wondering if you can talk about the demand trends around vulnerability management, particularly in light of the constant barrage of announcements regarding known vulnerabilities. Have you seen an uptick in volumes in the scope of scanning within enterprise customers? If so, does that lend itself to expansion opportunities at renewal?

Yes, I think there are multiple factors at play. That's a great question. Businesses are surprised by ransomware attacks. Organizations realize that while they've always owned their assets, they haven't had the visibility necessary to protect them. They're now realizing they need to prioritize vulnerabilities and take action. We have many conversations regarding how to improve visibility to stay ahead of threats. This situation leads to a more comprehensive conversation about Qualys’ capabilities with customers, including our VMDR, CSAM, and Patch Management solutions. Many are ready to expand their scope with Qualys and see the value in having a unified solution. We're assisting them in reevaluating their architectures to be more automated and responsive, leading to expansion opportunities.

You're seeing the opportunity to drive a higher ACV because of the value in the broader platform, it sounds. The other question is that if you look at the U.S. growth, it's lagged international since the beginning of 2020. Can you just talk about the reasons for that relative difference? Is there anything specific around competition or execution that you would highlight?

No, nothing in particular. It's really driven by our sales reps and their ability to penetrate and land new customers as well as expand with existing ones. There is a law of smaller numbers with EMEA and APAC still being smaller percentages of our total business versus Americas. But nothing notable to highlight there.

Yes, and we're also seeing that in the U.S., large customers have entrenched architecture over the years. As they work to adapt to modern architectures, there’s often a lag between their desire and ability to execute. Internationally, they tend to have less of a legacy architecture, allowing for faster execution on these changes.

Thank you. I am showing no further questions at this time. I would now like to turn the conference back to our CEO, Mr. Sumedh Thakar for any closing remarks. Sir?

Thank you for attending our earnings call and your questions. We believe our integrated platform is very well positioned to respond to customers' increasing need to detect and remediate issues at an increasingly rapid pace. Looking ahead, we're focused on executing our growth strategy encompassing continued innovation and advancing our go-to-market motion to reaccelerate growth while driving increased value for our customers and shareholders. Thank you again.

Thank you. Ladies and gentlemen, this concludes today's conference call. Thank you all for joining. You may all disconnect.