Good day and thank you for standing by. Welcome to the Qualys Second Quarter 2023 Investor Call. Please be advised that today’s conference is being recorded. I would now like to hand the conference over to your speaker today, Blair King. Please go ahead. Thanks, Victor, and good afternoon, and welcome to Qualys’ Second Quarter 2023 Earnings Call. Joining me today to discuss our results are Sumedh Thakar, our President and CEO; and Joo Mi Kim, our CFO. Before we get started, I would like to remind you that our remarks today will include forward-looking statements that generally relate to future events or our future financial or operating performance. Actual results may differ materially from these statements. The factors that could cause results to differ materially are set forth in today’s press release and in our filings with the SEC, including our latest Form 10-Q and 10-K. Any forward-looking statements that we make on this call are based on assumptions as of today, and we undertake no obligation to update these statements as a result of new information or future events. During this call, we will present both GAAP and non-GAAP financial measures. A reconciliation of GAAP to non-GAAP measures is included in today’s earnings press release. And as a reminder, the press release, prepared remarks and investor presentation are all available on the Investor Relations section of our website. So with that, I’d like to turn the call over to Sumedh.

Thank you, Blair. And welcome to our second quarter earnings call. We’re pleased to announce that we delivered another quarter of healthy revenue growth and industry-leading profitability, demonstrating our increasing leadership in cybersecurity risk management and firm foundation to drive future growth. Q2 remained a tough period with customers continuing to scrutinize deals and delay project start dates. Nevertheless, the combination of today’s uneven macro and heightened threat environment is driving the need for security stack consolidation necessary for clear security outcomes, reducing vendor sprawl in customer environments and implementing a long-term security strategy based on cost and value. Our risk management platform positions us well to deliver these outcomes to our customers, and we feel fortunate that many of them are on a long-term transformation journey with us. This was evidenced in Q2 by the steady adoption of our VMDR solution, which is now deployed by 52% of our customers worldwide. Key competitive VMDR wins with TrueRisk include multiple customers, both down market and in the Fortune 1000. Qualys’ VMDR solution continues to garner significant industry recognition. As recently announced, Qualys VMDR with TrueRisk was voted the Best Risk Management Solution at the 2023 Awards Europe. This award evaluates vendors based on inputs from security practitioners and is held in high esteem. We believe Qualys’ placement as the number one vulnerability management solution further validates our investments in the platform and represents the gold standard for securing customer environments today and in the future. Leveraging our VMDR and single agent approach, we have built a blueprint for delivering greater value to our customers with multiple long-term drivers in our business. Let me highlight a couple of early platform successes we’re seeing broader adoption with our customers. In Q2, a Fortune 300 global manufacturing company chose Qualys because of our reputation to deploy across large complex environments quickly. Their existing Patch Management solution was unable to effectively patch OS, iOS, and third-party software, and they became victims of malicious activity. This customer needed to deploy a Patch Management solution quickly to over 40,000 assets to prevent a breach. The ability to deploy our solution the same day using the same agents they had already deployed for VMDR, and without the need for a VPN, saved the company from manufacturing line productivity losses. Through this brief but urgent engagement, Qualys built additional trust with the customer by demonstrating our expertise, professionalism, and technical efficacy. As a result, this customer is now evaluating our cybersecurity asset management solution with external surface visibility to further streamline their security stack. With the Qualys Cloud platform, they are eliminating legacy tools and have considerably improved their response times and security posture. In another example of continued adoption of cybersecurity asset management and external attack surface management, we also expanded our engagement with a Forbes 1000 food manufacturer in Q2. The customer expanded its deployment of VMDR with TrueRisk and selected Qualys’ cybersecurity asset management and Patch Management as additional solutions. The ability to enhance the security program with comprehensive internal and external asset contact risk scoring, CMDB integration, and fast remediation on a single console while consolidating agents on an integrated platform were all key differentiators in this win. Further broadening our platform capabilities, you may recall, in February of this year, we announced total cloud, a unified and extensible cloud-native CNAP solution, featuring agent and agent-less 0 touch assessment scanning options, along with CSPM, CWPP, and cloud detection and response capabilities to simplify workflows and help security teams migrate workloads to public and hybrid cloud environments. With over 30 million cloud agents already supporting workloads in the cloud, we are quite encouraged by the customer feedback and early adoption we are seeing for our total cloud solution. For example, in a recent mid-six figure with a total cloud win, a cybersecurity company seeking better security against advanced threats in multi-cloud and container environments chose our solution over competing cloud security providers, given its flexible scanning options, rapid detection, and unparalleled remediation capabilities from development to runtime, all uniquely supported through our new adaptive subscription model, frictionless platform deployment, and unified dashboard. The wins I have shared here today, along with several others like them, underscore Qualys’ ability to help customers not only detect but also prioritize risk across all assets and environments while remediating vulnerabilities much faster than alternative siloed solutions. In today’s current macroeconomic environment, we believe our value proposition becomes even stronger as customers seek multiple security offerings from a single Qualys platform. With more and more customers beginning to pursue Qualys as a leading risk management platform that consolidates multiple security point solutions across all environments, we remain confident in our ability to drive long-term growth and gain market share. This confidence was again bolstered in Q2, as customers spending $500,000 or more with us grew 21% from a year ago to 168. Continuing our disruptive innovation, I am pleased to announce today our groundbreaking launch of our first-party software risk management solution. With nearly every organization today becoming a software development house, most of them lack proper tools to detect, prioritize, and remediate high-risk vulnerabilities and misconfigurations within their proprietary codebase. This new capability now allows organizations to leverage our existing Qualys VMDR platform deployment to not only detect CVEs and third-party software, but also manage it in their own first-party software using a single platform. Additionally, given the high prevalence of embedded open-source software like Log4Shell in these applications, this new capability allows customers to manage risk from these components and get a complete picture of their true risk. This new capability will be demonstrated at Black Hat next week. Encouraged by the early adoption of Total Cloud, we have further harnessed technology from our recent acquisition of Blue Hexagon to extend our cloud-scale deep learning AI-based CDR capabilities into container images by flexing the power of the Qualys Cloud platform to discover and identify relationships and patterns within our highly integrated data lake. We are now enabling organizations to rapidly predict, detect, prioritize, and remediate anomalous activity that is invisible and undetectable in traditional signature-based solutions in the cloud. This latest advancement empowers our customers to proactively respond to zero-day threats spanning cloud and container environments from development to runtime. This advanced AI-based capability is already in action with some of our customers helping transform their security operations center, magnifying our competitive differentiation in the market. Looking ahead, we are further integrating our deep learning AI and ML technologies into our TruRisk management and remediation solutions to provide predictive insights of unknown vulnerabilities, misconfigurations, and instances of exploitation. And with the algorithmic expertise already in-house, over the next few quarters, we expect to further extend these capabilities to transform the user experience on the Qualys Cloud platform, harvesting trillions of data points and rich investigation and remediation using generative AI. In terms of our go-to-market initiatives, investing in our partner ecosystem continues to be a key priority. In Q2, we expanded our relationship with several key cloud providers, including AWS, which is now making our new product bundles aimed at SME/SMB available in its marketplace. Additionally, we entered into a new relationship with a leading global MSSP who chose Qualys over a competing detection-only solution given our ease of orchestration, native integration, and single agent, to simplify its operations and significantly reduce remediation time for its customers. Finally, I’m pleased to highlight that Dino DiMarino has joined Qualys as our new CRO. Dino has an established track record in driving new business development and leading channel partnerships in high-growth SaaS cloud and cybersecurity companies, most recently with Snyk. He will be responsible for all aspects of revenue performance with a focus on delivering sustainable customer value and business outcomes, the leadership of the worldwide sales and partner organization, and accelerating Qualys’ growth with both new and existing customers. Dino has over 20 years of executive sales experience and demonstrated success in bringing out the most in the teams which successfully align sales with the product organization in support of the customer. He shares in our passion for product-led growth and we are looking forward to his contributions at Qualys. In summary, our leadership is a trusted risk management platform of record and strong financial performance stands as a testament to Qualys’ dedication to innovation, protecting customer environments and transforming the value proposition of traditional vulnerability management technologies with cyber risk posture assessment and response prioritization capabilities. With the unique opportunity in this environment, to further strengthen our strategic position as the partner of choice for customers looking to re-architect and consolidate security tools to solve modern security challenges, we believe we can continue to grow long term, maintain best-in-class profitability, and invest in key initiatives as we further extend the gap between Qualys and the competition. With that, I will turn the call over to Joo Mi to discuss in more detail our second quarter results and outlook for the third quarter and the full year 2023.

Thanks, Sumedh. And good afternoon. Before I start, I’d like to note that except for revenue, all financial figures are non-GAAP, and growth rates are based on comparisons to the prior year period unless stated otherwise. Turning to second quarter results, revenues grew 14% to $137.2 million. Revenues from channel partners grew 17%, continuing to outpace direct, which grew 12%. Channel revenue contribution remained the same as last quarter at 43%. By geography, growth in the U.S. of 16% was ahead of our international business, which grew 12%. U.S. and international revenue remained the same as last quarter at 60% and 40%, respectively. Although customer dollar retention was largely unchanged in Q2, the selling environment was challenging, with new business down and our net dollar expansion rate on a constant currency basis at 108%, down from 109% last quarter and 110% last year. While there continues to be room for improvement from smaller customers spending less than $25,000 with us, we remain pleased with the continued strong revenue growth of 17% from larger spend customers. In terms of new product contribution to bookings, patch management and cybersecurity asset management combined made up 10% of LTM bookings, 19% of LTM new bookings in Q2. We attribute this success to our customers’ needs for broader contextualized awareness of their attack surface, mainly integrated risk management, and remediation workflows across all environments on a single platform. Reflecting our scalable and sustainable business model, adjusted EBITDA for the second quarter of 2023 was $65.8 million, representing a 48% margin compared to a 45% margin a year ago. Operating expenses in Q2 increased by 6% to $53.4 million, primarily driven by investments in sales and marketing, including headcount. Although we remain focused on driving growth, with our disciplined approach to investing, we are being mindful of where to further increase investments while optimizing returns in others, which resulted in EBITDA margin exceeding our expectations in Q2. This demonstrates our ability to maintain high operating leverage and remain capital efficient while continuing to innovate and invest to support our long-term growth initiatives. With this strong performance, EPS for the second quarter of 2023 was $1.27, and our free cash flow for the second quarter of 2023 was $50.1 million, representing a 37% margin. In Q2, we continued to invest the cash we generated from operations back into Qualys, including $1.4 million on capital expenditures and $42.3 million to repurchase 346,000 of our outstanding shares. As of the end of the quarter, we had $145.7 million remaining in our share repurchase program. Before turning to guidance, I’d like to provide a few comments. We continue to foresee a challenging environment for new customer growth, although we have been successful in building our pipeline and sales force. With the impact of the macro economy still unfolding, we are closely monitoring the business environment and shifting our priorities accordingly. With that said, given our ratable SaaS subscription model, our guidance for revenue growth for the full year 2023 remains largely unchanged at 13% with a revised range of $553 million to $555 million, the high end of the range down from $557 million last quarter. For the third quarter of 2023, we expect revenues to be in the range of $140.5 million to $141.5 million, representing a growth rate of 12% to 13%. Considering the long-term growth opportunities ahead of us and our industry-leading margins implying further room for investment, we intend to continue to make responsible investments to align our product and marketing strategy. In doing so, we expect to prioritize these investments and specific initiatives that drive pipeline growth and support sales. However, with our new CRO having just joined us this quarter, we naturally expect to revisit planned initiatives, which may push out some investments by a few quarters. As a result, we expect the full year 2023 EBITDA margin to be in the mid-40s, with full-year EPS in the range of $4.50 to $4.65, up from the prior range of $4.13 to $4.28. For the third quarter of 2023, we expect EPS in the range of $1.10 to $1.15. Our planned capital expenditures in 2023 are in the range of $10 million to $15 million, and for the third quarter of 2023 in the range of $2 million to $4 million. In conclusion, in Q2, we delivered healthy top line growth and industry-leading profitability and remain confident in our ability to deliver on our growth opportunity long term while investing responsibly to maximize shareholder value. With that, Sumedh and I would be happy to answer any other questions.

Hi, good morning, good afternoon. Just wanted to maybe dig a little bit into your guidance. Can you maybe help us understand some of the assumptions that you’ve now baked in and maybe what’s changed relative to your macro expectations and particularly around sort of the new customer add side?

Yes. I think Joo Mi can provide a little bit more color. But overall, I think we feel like based on what we see right now, the guide is appropriate, and we’re not assuming any improvement in the macro given kind of what we see in the way customers are working through, in some cases, pushing out deals, et cetera. So, we did see additional scrutiny on the upsells this quarter, which was something that we worked through with customers. And while our win rates are down, we are excited about the pipeline that has been generated with some of the investments that we made in making in the last couple of quarters. And now with Dino coming on board, of course, like with any executive coming on board, we’re looking forward to the contribution he’s going to make in the long term, and there probably will be some disruption in the short term there. And so taking all those factors into consideration, really, we feel at this point. We believe the guide is appropriate for what we see.

Yes, to add a little bit additional color to what Sumedh said, if you take a look at our annual revenue guidance, it hasn’t really changed all that much. We’ve been consistent in emphasizing that we believe that we’ll be able to achieve 13% revenue growth. And so underlying that is our belief that our net dollar expansion rate isn’t going to materially change. It has ticked down by a percentage this quarter, and it could continue to do so, but we don’t think that even with that, our current billings was able to reaccelerate back up to 11% from 9%, and we don’t see that to change in the second half of this year.

Great. And maybe just to dig into that last comment a little bit more around the net dollar expansion, is there a way you could make, so a little bit more color in terms of what's impacting the net dollar expansion? Is there anything on the churn side? Or is there anything on your ability to sort of upsell product that's impacting this? Thank you.

So our retention continues to be strong. So the 1% downtick is due to the headwind and up-sell that Sumedh commented earlier. We are seeing additional deals group extended sales cycles on with existing customers who are looking at revisiting potential cross-sell and up-sell opportunities, and that contributed to the percentage down quarter-over-quarter.

Hi. This is Anushtha for Matt Hedberg. Thanks for taking my question here. It's good to see current billings accelerate versus last quarter back to double-digit growth. Maybe how should we think about billings growth in the second half of the year? Should we expect billings growth to continue to accelerate? And if so, could it accelerate back to mid- to high teens growth given comps ease in the back of the year?

Yes. We typically don't guide to calculated billings because we don't actively manage to that number, and it could fluctuate due to the billing terms for the customer. But with that said, what we're seeing right now in the business is no, at 9% to 11%, we don't see that materially ticking up in the next quarter. I think it will be more or less the same, assuming that there are no significant changes in the billing terms of existing and new customers coming in. Q4 is a little too early to tell, but at the same time we don't see it going down to single digits right now.

Got it. And then you significantly outperforming profitability with 48% EBITDA margin, which is a significant step-up from last quarter. Can you talk about what's driving that outperformance and improved leverage?

It's primarily due to the fact that we've always taken a very disciplined approach to investing. And we've been very flexible because the way we look at investment opportunities, we take a look at initiatives that we have to set plan for the full year, and then we tend to prioritize based on the returns that we see from each of the investments that we've already made. And right now, we just didn't see that there was a reason for us to accelerate and increase investments in multiple different areas, especially because we knew that we were looking for a new CRO. We had planned on finding the right person this year, and we're very fortunate to have Dino on board. So with Dino on board with us right now, we'll be assessing all the initiatives to understand maybe it makes sense for us to increase investments in Q3 or in Q4. But based on what we see right now, we think that the most likely scenario is ending the full year at EBITDA margin in the 45% range.

Hi. Guys. Thanks for taking my question. Joo Mi, I just want to maybe clarify on the current calculated billings and maybe the revenue guide. I know last quarter you said you expected current calculated billings growth to accelerate throughout the rest of the year. Obviously, it topped two points here in Q2 over Q1. Just to be clear, you expect current calculated billings growth to remain roughly flat in Q3 and Q4. I just want to make sure that's what you're saying? And then on the guide, again for the full year, growth about the same at the midpoint, but I think exiting the year, the guide now implies growth closer to about 11% versus probably 13-ish percent previously. So it does appear to be a step down of the growth exiting the year. Just want to make sure that there's nothing I'm missing there?

Yes. So in terms of the calculated billings, we knew that even though we don't manage to that number, 9% in Q1 was an anomaly. It wasn't really representative of the business momentum that we were seeing. So that's why we had indicated that it would be higher for the remainder of the year. Looking at 11% in Q3, I don't think that will be materially different. I don't see it kind of ticking down from that 11% right now. Q3 and Q4, I think it will probably be more in line with that 11% achievement that we had in Q2 or potentially higher.

Okay. And then maybe just one last one, the models, gross margins stepped up, good amount Q2 versus Q1, and I think just probably the highest you've shown at least in several years. Is that kind of a new go-forward far for gross margins? Or was there anything that you benefited from one-time in the quarter?

Nothing to call out, I think the one change that we did make this year is Employee PDP on merit cycle was done a little bit later. So that will hit in Q3 versus Q2. But if you take a look at the gross margin of 82%, we expect to hover around that 81% to 82%. We are getting some cost savings just because we are getting a disciplined approach, making sure that we're getting the efficiency where we think that we can. So it's nothing material to call out there. We think that will hover around that range.

Hi, thanks. I wanted to ask maybe about the GovCloud introduction. How is the early feedback from the Fed and government customers? And are you seeing that maybe Fed customers might be more or less slowing towards consolidation in your enterprise base?

Yes, that's a great question. It's really been exciting for us to see the conversations that we are having with federal customers. I think these are one of the best conversations I've seen since I've taken over. And so I think that's very encouraging for us. We had a couple of good wins last quarter. We highlighted that as well from the federal side, and we have a good pipeline that's developing. And primarily because when you talk about FedRAMP high readiness and the fact that the platform can do patch management and vulnerability management, all of it in one, there's no other vendor right now that has FedRAMP patch management as an example. And so the engagement really becomes very comprehensive. It's not just about can you scan and give me a FedRAMP high scanner. So those conversations become more holistic in nature. And what's also interesting is that the FedRAMP high and the GovCloud conversation is also driving commercial customers that want to also provide FedRAMP high services to the government to have these conversations with us because they want their clouds to be – their solutions to be FedRAMP high. So it's not just the pipeline building from the federal government, but also the pipeline that we're encouraged to see the early signs from commercial customers who are saying, we need to go for FedRAMP high, and Qualys is one of the only platforms that is providing that kind of a risk management side of the house, which has the FedRAMP high status.

Great. That's good to hear and helpful. And just for my follow-up question, congratulations on adding Dino DiMarino to the team. Just to clarify on OpEx, is it area you've slowed in the near term as you wait for him to kind of formulate a plan and that's the higher profitability? Or is it just overall cautiousness given the macro backdrop? Thank you.

It's more of the former because we really believe that we are focused on balancing growth and profitability. We think that there's a huge upside and opportunity ahead of us. But then again, we want to make sure that we time it so that we maximize the return. So right now, we are just reassessing, regrouping to make sure we understand and we can justify some of the investments that we're going to double down on.

Okay. Great. Thank you. Just following up on that question; congrats on the hiring of the new CRO. Should we expect any change to the go-to-market motion in the second half of the year? And what are some of the investments around go-to-market that you were initially planning in the second half that you plan on delaying into next year?

I think one of the reasons why we were so excited to have Dino is that he really has that product-led growth mindset, which really melds well with the culture here at Qualys, given all the capabilities that we have on the platform and the many opportunities that we have. As you saw today, even with the first-party risk assessment capability. And so I think if you look at some of the investments that we have been driving even before Dino came on board, we're pretty excited to see that some of those investments that we have in marketing and partner are actually showing some good early signs with a strong pipeline build, good interaction with our partners, etc. And then there are other areas where sales involvement, etc., where we're continuing to invest. Some of those are going to continue because I think we have strong conviction in the go-to-market notion around building the pipeline. And then as Dino comes on board and he is sort of looking at how the sales team is structured and how we're going to address larger accounts that are spending $25,000 or more versus the smaller accounts that are $20,000 or less, there are certain areas where we are looking at where do we make the investments? Where we optimize the investments that we already made? So we have a good growth in investments last year relative to the year before, and some of those investments you need to optimize them to make sure we're getting the value out of those. And so Dino will be coming as he's on board now, he will look at some of those areas as well and then will formulate an overall thesis. But I'm involved on a day-to-day basis every day with the business. And so Tim and I are going to partner to make sure that we continue our focus on growth and profitability, even balancing those while looking at additional opportunities to improve our execution in sales as well as the rest of the go-to-market strategy and improvement in partner motion, etc., so that we can set ourselves up for the longer-term growth that we believe we can bring.

Great. Thank you for that. Joo Mi, there's a huge sequential increase in the long-term deferred revenue. Is there like a concerted effort to sign longer-duration deals? Or was that just a couple of larger deals that just tend to have a bigger deal in the quarter?

It's the latter. We're happy to have multiyear prepays, but it's not something that we were actively seeking.

Okay. Great. So it's not something that changed this past quarter, the strategy around those deal contracts linked?

No.

Hey, this is Patrick on for Josh. Thanks for taking my question. First on the billings in the quarter, linearity seems strong. Did you all see any benefit from deals that may have slipped out of Q1 and into Q2? And then with the adjusted EBITDA commentary moving up to the 45% range for the full year, does that change the commentary around the low- to mid-30s free cash flow margin expectations for the full year? Thanks.

Yes. I will answer the EBITDA margin and the free cash flow margin guide. We're guiding to a midpoint of 40 for the EBITDA, and then free cash flow will be in the mid-30s now, not low 30s because of that.

Okay. Great. And then on the billings, did you all see any benefit from deals that may have slipped out of Q1?

Not particularly. We typically call out if there's a large deal that impacted current billings. We didn't really see anything in Q1 or Q2 to call out. But naturally, there's always slippage, right? Sometimes we have some benefits, and we have some ticks.

Great. Thank you. So I'm just curious about any potential contributions from the MOVEit Hack intra-quarter. I know you mentioned still a tough period with deal scrutiny and delayed starts. But I'm curious if you saw kind of any incremental demand related to the hack and if so, if you're just able to maybe quantify what the potential benefit was?

No, nothing meaningful changed from that perspective. And I think it's the same pattern that we saw even back with SolarWinds or whatever as our customers typically and prospects they engage to understand and come out with a more long-term strategy around addressing these things rather than a jerk reaction of having to find and deploy sort of immediately more licenses, etc. So we really didn't see any impact in Q2 from that. Of course, it continues to highlight the importance of vulnerability management and patching these vulnerabilities in time, because that was one of the biggest things was not just that the longevity was there. It was actually being exploited pretty rapidly. And the conversation from our customers that we had was more around, can you help us fix it and patch it, not just can you detect that with a scanner. So I think what we're seeing is just continued engagement. We are Vulnerability Management and Risk Management is a strong focus for customers, but nothing to call out from a contribution in this quarter.

Got it. Thanks. And just as a quick follow-up on the announcement around risk assessment for first-party apps. I'm curious if the plan is to directly monetize this and that it will have an incremental ASP uplift? Or is this more about just bolstering the overall VMDR platform and making it sticky or making it more attractive for customers to adopt multiple solutions? Thanks.

Yes, I think that's always what I dream of every night I go to sleep and wake up is continued adoption and how all of these things will contribute towards better retention of VMDR. However, look, the way we look at this is the third-party risk assessment with CVEs has been something that Qualys and others have been providing for a while. But today, what we have is software running on servers, etc., is homegrown software, and that does not have a good way to create signatures and find vulnerabilities that are very specific to each individual customer. And so for us, providing this additional capability will be an add-on to the VMDR platform that customers will have to purchase. But what we do see is that because it then brings their third-party and first-party vulnerabilities and misconfiguration into a single view and with the initial conversations that I've had with about seven CISOs in the last couple of days, we're quite excited about the initial feedback that we are getting where they really don't have good tools right now, whereas a lot of them are writing their own scripts by hand. And so if they can just leverage the deployment of Qualys that they already have on the same asset to also look for their own custom vulnerabilities, a lot of them really want to take a look at it and evaluate it, and it will be additional revenue that we will look for. However, it's too early at this point to call out for how that traction of embracing that will be from our customers under adoption, etc. But we'll continue to look at it and monitor it, and just like we've done for Patch Management and Cybersecurity Asset Management, we will continue to look at this in total cloud as the additional new areas that we're getting good feedback on and see how they will start to contribute towards the ASP.

Thank you. And with that, we'll end our Q&A Session. This concludes today's conference call. Thank you for participating. You may now disconnect. Everyone, have a great day.

Goodbye.