Thank you for standing by. Welcome to the Qualys First Quarter 2023 Investor Conference Call. At this time, all participants are in a listen-only mode. After the speakers' presentation, there will be a question-and-answer session. Please be advised that today's conference is being recorded. I would now like to hand the conference over to your speakers today, Mr. Blair King. Please go ahead.

Thank you, Norma, and good afternoon and welcome to Qualys’ first quarter 2023 earnings call. Joining me today to discuss our results are Sumedh Thakar, our President and CEO, and Joo Mi Kim, our CFO. Before we get started, I would like to remind you that our remarks today will include forward-looking statements that generally relate to future events or our future financial or operating performance. Actual results may differ materially from these statements. Factors that could cause results to differ materially are set forth in today's press release and our filings with the SEC, including our latest Form 10-Q and 10-K. Any forward-looking statements that we make on this call are based on assumptions as of today and we undertake no obligation to update these statements as a result of new information or future events. During this call, we will present both GAAP and non-GAAP financial measures. A reconciliation of GAAP to non-GAAP measures is included in today's earnings press release. As a reminder, the press release, prepared remarks, and investor presentation are available on the Investor Relations section of our website. With that, I’d like to turn the call over to Sumedh.

Thanks, Blair, and welcome to our first quarter earnings call. We’re pleased to announce that we delivered another quarter of healthy revenue growth and industry-leading profitability. A number of CISOs I’ve met with over the past several months continue to emphasize four key priorities; identifying all assets in their environments, prioritizing and quantifying cyber risk, finding fast and cost-effective solutions to address risk, and ensuring adequate protection against adversaries. The importance of these priorities was further reinforced by the findings in our 2023 TruRisk Report released by Qualys’ Threat Research Unit after analyzing 2.3 billion anonymized vulnerability detections in our platform. According to our research findings in the report, the average number of days to weaponize vulnerabilities in 2022 was 19, which is far less than the amount of time taken by IT teams to patch those vulnerabilities. Organizations are looking for platforms that can help them patch prioritized vulnerabilities before they get weaponized and exploited. The message is clear. Legacy technologies available in the market today that purely focus on generating more and more detections and alerts are not enough to help secure organizations. Against a backdrop of accelerating digital transformation and a cybersecurity skills gap, organizations require further assistance in prioritizing the most severe security findings present in their critical assets and resolving them prior to exploitation. As CISOs look to navigate the current macro and manage increased budget scrutiny, they are recognizing the need for a holistic, risk-based approach to quantify and align cyber risk to their business objectives and thereby, be in a position to communicate effectively with their Board and C-level executives. In terms of platform innovation, for years our mission at Qualys has been to drive continuous innovation to advance these initiatives. In doing so, we believe we’ve built a new security industry paradigm, which today leverages our powerful real-time data processing capabilities across more than 13 trillion data points on a natively integrated platform. Unlike traditional detection-only technologies, the Qualys Cloud Platform is proactively enhancing security programs worldwide by not only detecting vulnerabilities and misconfigurations, but also prioritizing, remediating, and preventing risk with over 45 million patches deployed by our Cloud Agents in 2022 alone. And, by leveraging the MITRE ATT&CK framework, we’re now further flexing the power of our platform to combine a continuous, real-time view of an organization’s security posture through the lens of an adversary with natively integrated, preemptive risk mitigation and prevention solutions. These capabilities, alongside our Cloud Threat Database featuring a unified threat intelligence platform of over 25 threat feeds, uniquely provide organizations with a comprehensive risk management solution to deliver quantifiable cybersecurity outcomes essential to protecting the digital infrastructure of today’s companies. Consequently, our strategic vision to consolidate the security stack has caused industry analysts to take notice. IDC recently pointed to a future of vulnerability management, which evolves into an integrated cybersecurity risk management platform. Our CyberSecurity Asset Management with External Attack Surface Management, along with VMDR TruRisk and Patch Management on a single platform, are key to addressing this market demand. Of additional importance, the seismic shift in software application development and digital transformation using open-source software is resulting in a surge of software supply chain attacks. In response, we’re taking our innovation to the next level by extending the power of VMDR to manage the risk of Software Composition Analysis in on-prem and cloud environments. With this extension of the Qualys Cloud Platform, security teams can automatically identify open-source software across the production environment of virtual images by leveraging the same Qualys agent for deep-scan detection and remediation spanning the entire application lifecycle with high efficacy and speed. This development advances our existing Software Composition Analysis and open-source software assessment capability for DevOps teams to secure container environments in continuous integration and deployment and at runtime. In addition to this enhancement, we’re also advancing our Custom Assessment and Remediation capabilities into our agent-based VMDR and Policy Compliance solutions. As organizations develop more and more custom software, the need to expand vulnerability management from third-party software to first-party software is increasing. With this initiative, we are enabling customers to create their own detections for managing vulnerabilities in their custom software across their entire environment. And finally, we’ve continued to expand our coverage for public cloud providers by bringing real-time, cloud asset discovery and prioritized remediation solutions on a single agent to Alibaba’s cloud. Turning now to our go-to-market motion, Q1 remained a tough period. Despite improved upsell performance, new business was challenging as organizations continued to apply additional layers of scrutiny to spending and delay project start dates, which impacted bookings. While we expect these conditions to linger for at least the remainder of this year, consolidation remains a key theme with our customers. Given our thought leadership and continuous innovation, we are fortunate to be engaged in many such conversations. Those conversations are laying a firm foundation for future growth, and many customers are on a long-term transformation journey with us. Existing customers continuing to invest in consolidation with Qualys’ platform was evidenced in Q1 by the steady adoption of VMDR, which is now deployed by 50% of our customers worldwide. A few key seven-figure annualized bookings wins with VMDR in the quarter included two Global 200 financial institutions who chose Qualys for its ability to replace traditional siloed security tools and enhance security posture on a unified platform, and one of the world’s largest health care providers that is leveraging VMDR with TruRisk to manage a comprehensive risk management platform in both on-prem environments and cloud workloads. Beyond these wins, let’s take a look at some additional examples that demonstrate how the power of the Qualys Cloud Platform translated into strategic customer wins and provided immediate value to the customer. First, with Zero Trust transformations underway, we are helping customers standardize their operations across a broad spectrum of security subscriptions in a high six-figure annualized bookings in a large government agency aspiring to move beyond its detection-only solution, further expanding its use of VMDR and policy compliance by adding customer assessment and remediation, cybersecurity asset management, action management, and custom HDR context. This customer selected Qualys because we offer the only security and compliance stack available in the market today that utilizes both a FedRAMP authorized platform and a single lightweight agent to enable full asset visibility and context-aware mapping to proactively reduce technical debt, automate patching, and future-proof their security architecture with high-fidelity incident response capabilities across all environments. This is also a good example of how we are benefiting from the investments we are making in the channel to drive new business opportunities. Another marquee six-figure annualized bookings enterprise customer win in Q1 was with a leading business services company in the Fortune 500. This customer expanded their VMDR deployment with TruRisk while adopting asset management and patch management as part of the initiative to transform its IT security architecture while replacing point solutions from two vendors with a single platform. The ability of this customer to significantly enhance the security program with comprehensive internal and external asset criticality, holistic risk scoring, ticketing, and automated patching across multiple environments on a natively integrated platform were all key differentiators compared to alternative legacy technologies. With customers beginning to pursue Qualys as a leading risk management platform that consolidates multiple point solutions, we are growing increasingly confident in our ability to drive long-term growth and gain market share. This confidence was again bolstered in Q1 as customers spending $500,000 or more with us grew 27% from a year ago to 162. Growing our partner ecosystem continues to be a key pillar in our go-to-market agenda. In this quarter, we expanded our partnership with a leading MSSP in North America. With its platform already anchored in our VMDR solution, this partner is now launching a managed patching service, further validating our vision that organizations need timely remediation and not just more and more detections. This MSSP is standardizing on Qualys' automated patching solutions across Windows, Linux and Mac operating environments, mobile devices, and third-party applications without the need for a VPN. In addition, illustrating the fast progress we are making in our External Attack Surface Management (EASM) solution, we extended our relationship with a leading fabric insurance company that is now ingesting our EASM intelligence field to continuously assess risk for adaptive cyber insurance for their customers. Furthering our efforts to remove friction in the sales cycle by helping customers accelerate their cloud transformation and consolidate their security stack, we have introduced a new adaptive subscription model for organizations to extend the existing VMDR deployments into cloud and container environments for CSPM and CWPP through our total cloud solution. The early feedback we have received from customers for this model has been quite encouraging, and we are looking forward to early adopter customers in the current quarter. In summary, it's our view that during times like this, the best companies continue to innovate, focus on customer success, and emerge stronger than before. Looking beyond the short term, we believe the artful combination of our cloud-native platform and frictionless go-to-market motion positions us well for the fundamental holistic risk management platform of the future. Throughout the balance of this year, we will continue to focus on executing our strategic vision, driving customer success, and expanding our competitive advantage with a proven approach to balancing growth and profitability. With that, I will turn the call over to Joo Mi to further discuss our first quarter results and outlook for the second quarter and full year 2023.

Thanks, Sumedh, and good afternoon. Before I start, I’d like to note that, except for revenues, all financial figures are non-GAAP and growth rates are based on comparisons to the prior year period, unless stated otherwise. Turning to first quarter results, revenues grew 15% to $130.7 million with channel continuing to increase its contribution, making up 43% of total revenues compared to 41% a year ago. Revenues from channel partners grew 18%, outpacing direct, which grew 13%. By geo, growth in the US of 16% was approximately in line with our international business, which grew 15%. Looking ahead to the balance of 2023, we expect our US and international revenue mix to remain at roughly 60% and 40%, respectively. In Q1, we saw continued strength in customer dollar retention and upsell in line with expectations with our net dollar expansion rate on a constant currency basis at 109%, flat from last quarter, but down slightly from 110% last year. While there remains room for improvement from smaller customers spending less than $25,000 with us, we are pleased with the strong revenue growth of 18% from larger customers. In terms of new product contribution to bookings, Patch Management and CyberSecurity Asset Management combined made up 10% of LTM bookings and 16% of LTM new bookings in Q1. We attribute this success to an increasingly complex threat environment that highlights the relevance of the Qualys Cloud Platform to holistically assess, manage and remediate risk. Reflecting our scalable and sustainable business model, adjusted EBITDA for the first quarter of 2023 was $58.7 million, representing a 45% margin, compared to a 48% margin a year ago. Operating expenses in Q1 increased by 20% to $54.1 million, primarily driven by the growth in sales and marketing investments, including higher headcount and related costs. During the remainder of 2023, we believe it's prudent to take an opportunistic approach in executing against our investment plan while not losing sight of the importance of optimizing our prior investments to drive long-term profitable growth. EPS for the first quarter of 2023 was $1.09, and our free cash flow for the first quarter of 2023 was $62.8 million, representing a 48% margin. In Q1, we continued to invest the cash we generated from operations back into Qualys, including $4 million on capital expenditures and $66.6 million to repurchase 584,000 of our outstanding shares. As of the end of the quarter, we had $187.9 million remaining in our share repurchase program. Now, let us turn to our guidance. Starting with revenues, for the full year 2023, we are reaffirming our revenue guidance range of $553 million to $557 million, which represents a growth rate of 13% to 14%. For the second quarter of 2023, we expect revenues to be in the range of $135.2 million to $136.2 million, representing a growth rate of 13% to 14%. This guidance assumes no material change in our net dollar expansion rate in 2023, but continued challenges in new customer growth. We believe our value proposition remains strong with solid demand from our existing customers but anticipate the current macro environment will moderate returns in 2023, despite having increased our sales and marketing headcount by over 20% in 2022. With that said, given the long-term growth opportunities ahead of us, and our industry-leading margins and planned further room for investment, we will continue to responsibly invest in operations, people, and systems by recognizing the importance of optimization. As a result, we continue to expect full-year 2023 EBITDA margin to be in the low 40s with full-year EPS in the range of $4.13 to $4.28, up from the prior range of $4.10 to $4.18. For the second quarter of 2023, we expect EPS in the range of $0.98 to $1.03. Our planned capital expenditures in 2023 look to be in the range of $15 million to $20 million. And for the second quarter of 2023 in the range of $3 million to $5 million. Consistent with prior guidance, for the remainder of 2023, we intend to align our product and marketing investments to focus on specific initiatives to drive more pipeline and support sales in response to the current macro conditions. In doing so, we plan to prioritize investments in sales and marketing as well as related support functions in systems over our investment in engineering. As we endeavor to sharpen our execution by focusing on sales and marketing enablement and productivity, we believe we will be able to drive wallet share and long-term returns while balancing growth and profitability. In conclusion, in Q1, we delivered healthy top-line growth and industry-leading profitability with our comprehensive risk management solution attracting industry attention and delivering immediate time to value for our customers. We are confident in our ability to deliver on our long-term growth opportunities while investing responsibly to maximize shareholder value. With that, Sumedh and I would be happy to answer any of your questions.

Thank you. Our first question comes from Shrenik Kothari with Baird. Your line is now open. Mr. Kothari, your line is now open. We'll go to the next caller. One moment. The next question comes from Matt Saltzman with Morgan Stanley. Your line is now open.

Hi, team. Thanks for taking the questions. So I know that you guys typically guide to revenue growth and not billings, but I do see that billings slowed to single digits in Q1, so when you think about the longer-term growth algorithm, how do you guys anticipate getting back to mid- to high-teens growth 20% top-line growth over the longer term? Are there any areas of the product portfolio that you're looking to press on, would you potentially look at acquiring other capabilities? Just curious on kind of the growth outlook from here?

Thanks for the question. It’s a great question. As we mentioned earlier, we are excited about our developments in CyberSecurity Asset Management, Patch Management, and the addition of EASM, along with total cloud solutions. We believe there are intriguing opportunities for our customers to consolidate. Q1 was a challenging quarter, as we noted in the previous earnings call regarding the CRO transition. Implementing that change was our primary focus during this quarter, and while there was some disruption, I’m pleased to say that the transition is now complete. I am now directly involved with our sales teams and working closely with them. Currently, we are examining a growing and maturing pipeline for 2023, and we are improving our sales execution. Compared to last year, we have increased our sales and marketing workforce by about 20%. For Q2, we are encouraged by what we see. We remain cautious about the macroeconomic environment, but looking at our net retention rate and other metrics, we feel positive about the business overall, even while remaining mindful of external factors. We are confident that our new product initiatives will help us regain the growth rates we experienced last year.

And just to add a little bit more color to that. If you take a look at the year-over-year compare, Q1 was a tough quarter. Q2 starts becoming easier. So we do anticipate the bookings growth to tick up for the rest of the year. And like Sumedh mentioned, we have a significant investment in sales and marketing headcount and without the current macro conditions, we would have expected higher return. But with that said, we do anticipate that to kind of generate the type of returns and growth in the longer-term.

Got it. And just as a quick follow-up. I know this quarter, you still lapped some of the benefits of Log4j last year. Are you able to quantify at all what those benefits were from a percent standpoint as it pertains to growth in the first quarter of last year, just so we can kind of look at it on a like-for-like basis?

Yes, last quarter, we did highlight that it wasn't an immediate benefit on Log4j. We did have a strong Q1 last quarter, but not specific to Log4j in particular.

Got it. Thank you.

Thank you. One moment for our next question. And the next question comes from the line of Brian Essex with JPMorgan. Your line is now open.

Hi. Good afternoon and thank you for taking my question. I was wondering, Sumedh, could you give us a little bit of sense of what you saw from a macro perspective in the quarter maybe relative to 4Q particularly as we see some of your peers have exposure to financial services, it might have been a more challenging maybe mid-market was a little bit more challenging. Would love to get your view on competitively and from a macro perspective, what you're seeing? Thanks.

Sure. I don't feel there was a significant change in Q1 compared to Q4. Overall, there's a lot of caution, and project start dates are being pushed out. We are seeing the same weakness in new business as others, especially in the lower end of the market. People are taking a step back from pursuing new business opportunities and are instead focusing on existing trusted vendors that they feel they can collaborate more with. We're excited about this shift, as the conversations are turning to how they can consolidate with us rather than purchasing multiple solutions. This trend is encouraging. However, we do not see any material difference in the macro environment from Q4 to Q1, and our guidance reflects that we expect the macro situation to remain the same without any improvements. Additionally, we have not seen any significant impact from the financial banking issues we've encountered. Joo Mi, would you like to elaborate on that?

Yeah. About 20% of our business comes from financial institutions. And from our side, we haven't seen anything in our discussions or observed anything specifically in our bookings. We don't think it's going to be material for our business, but as things evolve and if conditions change in Q2, we will see.

Got it. That's very helpful. If I could ask a follow-up, Sumedh, you mentioned changes in the Chief Revenue Officer position and that you're taking charge. Can you provide an update on your hiring efforts? Are you actively searching for a new CRO? Additionally, how does that align with your plans for adding to the sales and marketing teams this year?

I have been with the company for 20 years, so I have a strong understanding of the business. We are still searching for a sales leader, but I am currently working closely with our second-level team, who have been excellent and with us for a long time. Overall, I am pleased with our sales hiring, having seen a 20% increase from last year to this year. We will continue to be careful about our investments in sales and marketing, and while the growth rate may not match last year's, we still expect growth throughout the year. Our goal for the third quarter is to achieve double-digit growth, and we are optimistic about the opportunities ahead. Therefore, we will keep investing in that area.

Got it. Very helpful. Thank you, Joo Mi, as well.

Thank you.

One moment for our next question. And our next question comes from the line of Alex Henderson with Needham & Company. Your line is now open.

Thank you. I have a couple of questions regarding the decline in North America revenue, which has dropped quarter-to-quarter for the first time. Additionally, the direct revenue has decreased significantly from 19% growth last quarter to 12% growth in Q1. I'm curious if there is a shift in the company's focus that might be causing this decline. Is the robust 20% growth in the channel possibly affecting some of the direct revenues? How are you managing and measuring that balance? Thank you.

Yes. Right now, we are investing globally. And what we're looking at is, given the investments that we're making, we do anticipate the revenue mix between U.S. and international to stay approximately the same at 60% U.S. and 40% International. In terms of the direct versus indirect, we have been focusing on developing our relationship with and building our relationship with our channel partners. So we do anticipate the mix to be shifting more towards the channel partners, and we have been seeing the ramp-up there, even though compared to the growth rate in Q4, it has declined going from 22%. Right now, 18% is still strong from the channel partners, but it is lower.

To clarify, with the significant increase in your sales capacity in 2022 and continuing into 2023, is the majority of that focused on supporting the channel, or is it evenly divided between channel investment and direct sales investments?

Our focus has been more on providing incentives and collaborating closely with our channel partners rather than simply hiring additional channel managers. Therefore, the financial investment we've made in the business has been more directed towards the direct sales team.

Hey, great. Thank you for taking my question, guys. Joo Mi, I want to clarify what you said earlier, I think you said for the remainder of the year, your compares get a little easier, and you do expect bookings growth to accelerate. But to be clear, in your current calculated billings, again, came down to 9% this quarter. Do you expect your billings to accelerate throughout the rest of the year, or do you expect it to stay in the high single digits?

We do expect it to accelerate. So when I said the easier compare, if you take a look at the current billings growth rate last year, in the first half, it grew by 20% and 18%, versus 13% and 12%. So it is an easier compare in the second half of this year. So we do anticipate the growth rate to accelerate throughout the year.

Thank you for your insights. I'm curious about the EBITDA margin. You've demonstrated impressive performance in that area, regardless of revenue fluctuations this quarter, whether small or large. We see you maintaining low 40s EBITDA margins, which seems conservative. Can you provide any additional information on how you consistently achieve strong EBITDA margins? Additionally, do you believe that mid-40s is a more appropriate target moving forward, or are you confident that staying in the low 40s is the best approach for the future?

Yes. We maintain the low 40s because if you take a look at the year-over-year change, it's been a couple of hundred basis points contraction. So as an example, in Q1, it's a 45% EBITDA margin. A year ago, it was 48%. And I know that we ended the year in 2022 with a 45% EBITDA margin. We expect that to kind of trend down because of that.

Okay. Got it. That's it for me. I'll get back in the queue. Thank you.

Thank you. One moment for our next question. Question comes from the line of Josh Tilton with Wolf Research. Your line is now open.

Hey, guys, thanks for taking my question. I just want to follow up on the last one. I'm just going to ask it very straightforward to us with imperfect information, card billings is kind of the best indication of what your future revenue growth is going to be and you just grew billings 9%. I understand the investments to kind of improve the future growth algorithm. But is there anything you can give us to help us understand the confidence you have in reiterating the revenue growth for this year in light of the current billings coming in at 9% growth in 1Q?

The assumption is that current billings will accelerate. We expect current billings to exceed 9% in the second and third quarters as well as the fourth. One reason for this is that the comparison to last year is easier, particularly because we faced a more challenging period in the latter half of last year, with current billings for that timeframe being 13% and 12%. We also made a significant assumption that, despite the macroeconomic environment, we increased our sales and marketing investments considerably last year. In 2022, we increased our headcount by over 20% compared to just 3% in 2021, with most hiring concentrated in the latter half of 2022. Therefore, even if sales productivity is lower in 2023, it still enhances our distribution capabilities and selling potential. Additionally, we have a growing pipeline that is maturing, which we believe will contribute to bookings growth, thus positively impacting billings despite a lengthened sales cycle.

Okay. And then, just a follow-up on that. Maybe my math is a little incorrect here, but it looks like your partner sales, they did grow nicely year-over-year in 1Q. But on a dollar basis, they actually ticked down slightly from 4Q. What kind of visibility do you have into that part of the business? How does that compare to the visibility you have into the direct sales? And how should we think about that partner sales growth trending for the rest of the year?

Yes. Last year, around the same time, we initiated a partner program that is quite new for us. We have been enhancing our collaboration with partners by introducing incentives and aligning channel managers who previously did not work with these partners. Consequently, many of these deals see our channel managers or technical account managers working closely with the partner. As we improve this process and strengthen our partnerships, we gain visibility since we are actively engaged with them on several deals, particularly in the enterprise sector and to some extent in the mid-market as well. We expect to continue investing in our partner strategy and believe the focus will shift more towards partners, although we are not aiming for any specific targets at this moment.

Hey, guys. Good afternoon. It’s Daniel on for Mike. Thanks for taking the question. So I guess with the release of the VMDR packages for the SMB, just curious if you could provide us with some color on how this is being received by some of your smaller customers. Obviously, there's some pressure in this segment of your business on management. Any details would be helpful.

Yes. I think we launched them a couple of months ago. So it's still early from tracking specific numbers, but the conversations with our sales team have been very positive. They feel like they have been able to really streamline the conversations, move these packages quicker than what they would have to do, the fact that the sales execution is improving in terms of not having to quote multiple line items, especially around patch management, selling it as a single package and being able to position it. We've got pretty positive feedback. And so, we're optimistic about how that's actually going to impact us over the next few quarters, but we're tracking that. And we are looking to see if we need to do any additional packages as well, given the response that we've had with different numbers. So I think, overall, I would say I’m pretty positive about what we're seeing. And then we'll continue to track how much of an impact and how that's actually having an impact in that segment as we move forward. But early indications definitely show closings are quicker because the value proposition is much clearer and it's a single line item.

Great. Thank you very much for the color.

Thank you. One moment for our next question. And our next question comes from Shrenik Kothari with Baird. Your line is now open. Mr. Kothari, are you there? At this point, I'm showing no further questions. Ladies and gentlemen, thank you for participating in today's conference. You may now disconnect. Everyone have a wonderful day.