Qualys, Inc. Q3 FY2023 Earnings Call

Good day and thank you for standing by. Welcome to the Qualys Third Quarter 2023 Investor Conference Call. At this time, all participants are in a listen-only mode. After the speaker's presentation, there will be a question-and-answer session. Please be advised that today’s conference is being recorded. And I would now like to hand the conference over to your speaker today, Mr. Blair King. Sir, please go ahead. Thank you, Chris. Good afternoon, and welcome, everyone, to our Qualys' Third Quarter 2023 Earnings Call. Joining me today to discuss our results are Sumedh Thakar, our President and CEO; and Joo Mi Kim, our CFO. Before we get started, I would like to remind you that our remarks today will include forward-looking statements that generally relate to future events or our future financial or operating performance. Actual results may differ materially from these statements. The factors that could cause results to differ materially are set forth in today’s press release and in our filings with the SEC, including our latest Form 10-Q and 10-K. Any forward-looking statements that we make on this call are based on assumptions as of today, and we undertake no obligation to update these statements as a result of new information or future events. During this call, we will present both GAAP and non-GAAP financial measures. A reconciliation of GAAP to non-GAAP measures is included in today’s earnings press release. And as a reminder, the press release, prepared remarks, and investor presentation are all available on the Investor Relations section of our website. So with that, I'd like to turn the call now over to Sumedh.

Thank you, Blair, and welcome to our third quarter earnings call. In Q3, we continued to deliver strong financial results, reflecting our ongoing commitment to rapid innovation and customer success. We experienced another quarter of steady VMDR adoption, which is now deployed by 54% of our customers worldwide. Key competitive VMDR wins in Q3 included a leading multinational conglomerate, several global financial services, technology and manufacturing companies, a large government agency, and multiple new and other existing customers, both down market and in the Global 2000. Adding to these wins, I will take a moment to share a couple of examples of how our customers and partners are expanding their use of Qualys capabilities to further consolidate the security side. On the customer front, a Fortune 100 biotech company was overwhelmed by the number of security tools it deployed and needed a solution to not only provide better security outcomes but also consume fewer point products, agents, and resources through a unified dashboard in a mid-six-figure booking upsell. This customer, who already deployed cybersecurity asset management with External Attack Surface management and VMDR, expanded its use of VMD TrueRisk to over 290,000 assets while adding our web application scanning, task management, and total cloud CNAP solutions. In doing so, this customer consolidated three competing vendors across on-prem, cloud, and multi-cloud environments through an organically integrated platform with our innovative technologies, unmatched platform effect, and focus on reducing risk and friction. This win underscores Qualys's ability to eclipse pilot solutions and advance our leadership in the industry. Specifically, highlighting the momentum we're seeing with our total cloud CNAP solutions in a highly strategic and competitive mid-six-figure booking cross-sell for its 200 existing VMDR and patch management customers selected for the cloud to scale their container deployments in over 50,000 assets monitoring millions of container images daily. Through its evaluation of competing cloud security products, this customer determined that alternative point solutions added complexity to their operations, lacked integration, and missed detections, which hindered the ability to assess risk and consolidate security tools. Today, through a highly scalable, natively integrated CNAP solution, the Qualys Cloud Platform provides complete visibility of this customer's attack surface with advanced AI/ML technologies to uniquely detect zero-day malware while prioritizing and remediating risk at scale in real time. Our early wins in cloud and container environments are a testament to the extensibility of the Qualys Cloud platform with a unified dashboard and our adaptive subscription model. Today, we have over 31 million agents already supporting workloads in the cloud. While this is well armed with the organically integrated total cloud CNAP solution that unifies cloud workload protection, Cloud Security Posture Management, CSPM, cloud detection and response, infrastructure score, and container security powered by AI Threat Detection and Insight. Total Cloud was recognized as a strong technology leader in cloud security ahead of several competing modern cloud point solutions and next-gen platforms. I'm quite pleased by the early momentum we are experiencing in the market with our total cloud and increasingly encouraging customer feedback. Additionally, new customers continue to adopt cybersecurity asset management with external attack surface management and patch management alongside the VMDR right out of the gate. We believe this further highlights Qualys's ability to help customers not only detect but also quantify, prioritize, and remediate risk across all environments much faster than alternate siloed solutions. On the partner front, in Q3, we continued to advance our evolving ecosystem with two leading global managed service providers, which also expanded their offerings beyond VMDR to include our cybersecurity asset management and patch management capabilities. These partners have indicated they chose Qualys over competing solutions due to the ease of orchestration, natively integrated platform, and single agent approach to simplify their operations and significantly reduce remediation times for their customers. In addition, we expanded our relationship with another leading cloud provider, which is now taking the Qualys Cloud platform available in its marketplace. With wins such as this one, I have shared today, customers spending 500,000 or more with us in Q3 grew 15% from a year ago to 174. With more and more customers beginning to perceive Qualys as a leading risk management platform that consolidates multiple security point solutions across all environments, we remain confident in our ability to drive long-term growth and gain market share, especially in light of the recent IDC study highlighting a 403% ROI for customers choosing to partner Qualys with a platform approach. As I have said before, a cornerstone of our strategy is engineering innovation and with the customer-first, product-led growth focus, we challenge ourselves every day to lead the industry. Executing against this agenda, we will unveil our new platform approach at our upcoming Qualys Security Conference in Orlando from November 6 to November 9. This new approach will seamlessly integrate any number of third-party security tools in the Qualys Cloud platform. Regardless of the variety of tools utilized within an organization's infrastructure, Qualys will soon harness automated insights into critical areas of risk spanning on-prem, cloud, and multi-cloud assets to uniquely enable comprehensive remediation and risk posture assessment with new groundbreaking remediation capability. At this conference, our product and engineering teams will further showcase additional innovations on the cloud platform, including our advancements in delivering ML and AI-based predictive insights, first-party vulnerability and discontinuation detection response, the integration of software supply chain security into continuous integration and delivery CI/CD pipelines and more. Additionally, you can hear our customers speak for the first time about how our continuous innovation on the platform enables organizations to simultaneously reduce complexity and risk in their environment as they standardize our trusted platform that delivers an immediate ROI and lower total cost of ownership relative to siloed traditional detection-only technologies. We have over 900 people registered to attend and look forward to seeing many of you there. In summary, we are delivering strong profitability and cash flow while building business momentum in both our core and cloud expansion market, as companies uniformly recognize security transformation is fundamental to combating today's heightened threat and regulatory environment. As a result, customers are increasingly looking to reduce their risk exposure through the adoption of an integrated risk management platform spanning all environments instead of deploying a collection of disparate point solutions for different environments and hiring more people to manage those. We believe that our organically integrated, cloud-native platform built to solve modern security challenges positions Qualys well for future growth and is well-established to drive long-term shareholder value with a balanced approach to growth and profitability. With that, I will turn the call over to Joo Mi to further discuss our third quarter results and outlook for the fourth quarter and full year 2023.

Thanks, Sumedh, and good afternoon. Before I start, I'd like to note that except for revenue, all financial figures are non-GAAP and growth rates are based on comparisons to the prior year period unless stated otherwise. Turning to third quarter results. Revenues grew 13% to $142 million, with growth from channel partners outpacing direct at 17% versus 10% growth from direct. Channel revenue contribution remained the same as last quarter at 43%. By geo, growth in the U.S. of 14% was ahead of our international business, which grew 11%. U.S. and international revenue mix remained the same as last quarter at 60% and 40%, respectively. In Q3, we started to see some indication of stabilization in the selling environment with customers confirming their prioritization of security within IT budgets, but we believe ongoing budget scrutiny will linger for the foreseeable future. Reflecting this sentiment, our gross retention rate has remained largely unchanged at approximately 90%, but our net dollar expansion rate came in lower at 106%, down from 108% last quarter. While there continues to be room for improvement from smaller customers, larger customers spending $25,000 or more with us grew 15%. In terms of new product contributions to bookings, cost management and cybersecurity asset management combined made up 11% of LTM bookings and 19% of LTM new bookings in Q3. In addition, we're pleased to share that we're seeing an increase in interest in our cloud security solution, TotalCloud CNAPP. Cloud Security Solutions made up 5% of LTM bookings in Q3, showing a return on the acquisition of TotalCloud and Blue Hexagon. Since 2021, we acquired TotalCloud, a cloud workflow management and no-code automation platform and Blue Hexagon, an AI ML innovator in cloud threat detection and response solutions to augment our cloud security solutions. It's exciting to see our continued innovation and investment in our platform is driving adoption and is starting to change the market perception of Qualys as a risk management platform that can help customers consolidate multiple security point solutions. We look forward to serving as a strategic partner to our customers as they evaluate their security vendor consolidation strategy. Now turning to profitability, reflecting our scalable and sustainable business model, adjusted EBITDA for the third quarter of 2023 was $58.8 million, representing a 48% margin compared to a 44% margin a year ago. We roughly maintained our operating expenses in Q3, only up by 2% to $55.1 million. Sales and marketing were up by 9%, the same growth as what we saw in Q2. While we believe some investments came in response to the business climate and the arrival of our new CRO in July, we achieved greater operational efficiency through focused efforts on optimizing investments. This led to EBITDA margin exceeding our expectations in Q3, further demonstrating our ability to maintain high operating leverage, remain capital efficient while continuing to innovate and invest in our long-term growth initiatives. With this strong performance, EPS for the third quarter of 2023 was $1.51, which came in higher than expected, partly due to the change in our tax estimates. In Q3, we recorded a 15% tax rate, but if the tax rate had remained unchanged at 24%, EPS would have been $1.37. Our tax rate guidance for both Q4 and the full year 2023 is 21%. Our free cash flow for the third quarter of 2023 was $98.6 million, representing a 64% margin in the quarter and 50% year-to-date. In Q3, we continued to invest the cash we generated from operations back into Qualys, including $1.8 million on capital expenditures and $38.9 million to repurchase $273,000 of our outstanding shares. As of the end of the quarter, we had $106.8 million remaining in our share repurchase program. With that, let's turn to guidance, starting with revenue. For the full year 2023, we expect revenues to be in the range of $554 million to $555 million, representing a growth rate of 13%. For the fourth quarter of 2023, we expect revenues to be in the range of $144.1 million to $145.1 million, representing a growth rate of 10% to 11%. With respect to margins, factoring in the better-than-expected profitability to date, we expect a full year 2023 EBITDA margin in the mid-40s and free cash flow margin in the mid-30s with full-year EPS in the range of $5.04 to $5.14, up from the prior range of $4.50 to $4.60. For the fourth quarter of 2023, we expect EPS in the range of $1.18 to $1.28. In Q4, we expect to spend $2 million to $3 million in capital expenditures, implying approximately $9 million to $10 million in total for the full year. We remain confident in our differentiated technology and ability to deliver on our growth opportunity long term while investing to maximize shareholder value. With that, Sumedh and I would be happy to answer any of your questions.

Great, thanks for taking my questions and congrats on the strong profits. I guess with 54% of your customers now adopting VMDR, can you just help us think about net dollar retention trends going forward? I know it's early, but maybe you can share how some of your customers are reacting to your new solutions such as context XDR and TotalCloud that could help drive net dollar in the future?

Thanks for that question, and as we talked about earlier, I think we're pretty excited about some of the things that we are releasing, especially with cloud, etc. Of course, the environment continues to be challenging today. And so as our customers that we are working with, they look at a platform. Of course, they look at their current optimization of what they're buying from different vendors from Qualys. We continue to have great conversations. We continue to see opportunities. We continue to be happy with how CSAM patch management are becoming part of the bookings and entering new bookings. And the opportunities that we see in the future, especially as everybody's moving into the cloud, are opportunities for a truly natively built cloud platform to be an area where customers will continue to work with us to deploy our solutions to expand their VMDR offerings. So VMDR customers, as they move into the cloud with all the Cloud CNAPP capabilities, get not only VMDR but additional capabilities to really have one single pane of glass view for their entire cloud security. And this is the driving factor of many conversations that we are having now as they look forward to 2024 and look into cloud security. And some of the early events that we are seeing are encouraging. And so I think the customers adopting VMDR, and it is a pleasure to see that continue to pick up and get to 54%. And that, of course, gives us the ability to have our agents deployed in more environments. And those agents being deployed provides us the opportunity to do additional ops on CSAM, patch management, EDR, etc. But also now with 31 million agents running in the public cloud environments, the opportunity for us to work with them on TotalCloud is something that we're excited about.

Great. Thanks. Just a follow-up question. Maybe on OpEx, just with the new CRO. I know you paused as you revisited the go-to-market strategy. How should we think about, with your strong margins, maybe starting to invest in sales capacity as we exit this year or into next year? I guess another way that I'm trying to balance the macro-backup with the opportunity to maybe add sales capacity?

With Zeno on board, we are looking at all our investment opportunities for the remainder of this year as well as next year. We think that based on what we see today, our sales and marketing expense will be relatively in line in terms of the growth year-over-year in Q4 as in Q3. So you're looking at about 9%, 10% around that kind of range ending the year. And then for next year, we are going through the planning cycle right now to understand whether we think that we should double down on investment and accelerate versus perhaps put on hold. But with that said, given the under-investment that we had this year, based on the ROI that we estimated, we do expect an acceleration in sales and marketing investments next year.

Hi, this is Anushtha from Matt Hedberg. Thanks for taking my questions here. Maybe just to start with, can you talk about your high-level thoughts on 2024? And what you think would be the building blocks there? And then could revenue growth potentially accelerate in 2024, given easy comps and the investments you've been making over the past year?

I think it's a bit early for us to provide insights. We are currently in the planning phase. Looking at our current situation, Q4 is going to be a significant quarter for us. We are focused on understanding the prevailing dynamics and how they will affect our Q4 bookings. We aim to share more details in 2024 regarding our expected revenue growth. At this point, we observe that although the environment has stabilized, the market remains challenging. With our net dollar expansion rate at 106%, we believe there's potential for that to increase in the next few quarters, but it remains too soon to make definitive statements.

Got it. And then can you talk about the federal vertical a little bit? I realize it's a small vertical for you, but it looks like you've been seeing traction with it over the past few quarters. So just given the federal year-end, how did that vertical perform in the quarter?

Yes. Great question. We do have increasing focus on our federal side of the business. As you said, it's not a big part of our business today. But what we're seeing is the federal agencies are also looking for a refresh or really looking for a new approach to managing the risk there, having the same challenges that through any vulnerability findings coming their way. And so when they kind of look at the Qualys platform and our ability to showcase the inventory, one of the management, risk management, and then remediation capabilities, those are really resonating well with them. And so as we recently got on a federal leader, we're getting through the process of getting our program high ready certification completed, which makes us one of the only high-ready platforms for vulnerability and patch management. We do see, as we continue to invest in the federal market, good opportunities for us in the next couple of years to accelerate the growth for our federal business from where we are today.

Can you hear me? Okay. Sorry. Just in terms of your channel partner progress, can you talk a little bit about what you're seeing there? And maybe what some of the lower-hanging fruit can be just given the hiring of your new CRO?

Look, we started down this sort of investment about a year, a little bit over a year ago, taking a different approach lead to how we're working with partners. So we're pleased with the early feedback we're getting. You see some of the mix of our business also changing a bit to the partner side. And I think we do see that there is a good amount of opportunity for us to invest and increase how we work with all partners. So right now, as we look at the low-hanging fruit in terms of better deal registration and better incumbency protection that we have provided is showing some of the early impact of partners building the trust with us and working with us on some of these deals that we are working on. But then as we have Dino come on board and through the rest of the year, we look through what are the more specific opportunities for the short term with certain partners to work on investing with them so that we can get that benefit not only in the short term but then also a continued focus on the partner strategy for the long term. This is definitely an area that Dino and I are very much in line with and looking forward to continuing our focus and investment on the partner side.

Got it. And just as a follow-up, I guess, I'm a little bit confused because in the prepared remarks, you talked a little bit about indications that more and more customers are taking on a platform view of Qualys and sort of buying into the broader vision, but then we're seeing sort of the net retention shrink a little bit. So is this sort of customers are buying in, but because of budget constraints, they're just sort of renewing what they have? Are they reducing assets? I'm just trying to understand sort of how those two data points align?

Great question, and I think it continues to be challenging for our customers as well in terms of managing their spend and security spend and optimizing that. And so today, we continue to be happy with our overall retention rate, which is healthy. Customers are excited to continue to work with Qualys, and there are definitely opportunities as we work with our customers in terms of maybe they want to optimize some of their spend in a certain area of the product and then bring on other Qualys products on a platform approach, while not maybe significantly increasing their spend this year, but creating opportunities for in the future when those budgets open up to buy additional licenses of additional new capabilities that we deploy with them in the current deployment that they have. In some cases, they are adding additional features and in others, they are leveraging creating new opportunities for the newer products to be deployed right now in small quantities instead of maybe some of the existing products that they have. But the conversations are definitely more on the positive side of working towards bringing more Qualys solutions and then creating opportunities for us in the future as their budgets open up a little bit so that they can expand on those additional licenses as well.

Hi. Thanks for taking my questions. Can you just talk about how the competitive environment and how win rates as well as pricing trended this quarter?

I don't think you saw much of a change from what we have seen in the last couple of quarters. I think we definitely continue to see the similar players that we've always seen in the VM space. I think we see tremendous opportunity in the cloud security space where we are looking at and we talked about a couple of examples, so we're displacing some cloud point solutions that are out there. We see opportunities there as well. Overall, win rates are roughly stable from the last quarter. We see opportunity as customer budgets open up and our execution also continues to improve with Dino coming on board to be able to do better on that side as well. And we continue to see similar discounting from competitors to try to gain business. And that's where the opportunity for us to go back and then drive the price down, bundled capabilities like cybersecurity asset management and patch management that our competitors don't have, is creating opportunities for us, which is reflected in a way in the LTM 11% of overall bookings that already have CSAM and Patch Management, but also the fact that the new business bookings coming from new business, LTM looking there, over 19% of that is coming from these additional capabilities. So we are able to take advantage of the broader platform play in competitive and discounting situations. We can compete effectively.

Yes. Billings can vary for several reasons, and they may not always directly match our bookings or business trajectory. However, on a last twelve months basis, we saw an increase from 11% growth last quarter to 12%. This number might not fully capture the current market dynamics we are experiencing. For the next quarter, we do not anticipate any significant changes from this growth rate.

Hey, guys. Thanks for taking my questions. Joo Mi, I just want to go back and clarify, I heard your prepared remarks. You said free cash flow for the full year in the mid-30% range. I just want to make sure that's accurate. That implies breakeven cash flow to negative $15 million cash flow in Q4. Did you mean mid-30s for Q4?

No, it's about mid- to high 30s. So I'm expecting about only a few million in free cash flow for Q4. So you're looking at about maybe $205 million range for the full year. And that's primarily due to deferral of the tax payments to Q4.

Okay. Got it. Okay. And then just trying to understand the puts and takes of your Q4 revenue guidance. I mean, with the Q3 guide prior full year guide, you had implied a Q4 revenue guide before. And you beat revenue by about $1 million in the quarter. You saw current calculated billings reaccelerating a few points to 14%. And then you effectively lowered the Q4 implied revenue guide by about $0.5 million. So did what drove the outperformance in Q3 and why isn't it reflected in a higher Q4 revenue guidance?

Yes. The outperformance in Q3 and small outperformance if you take a look at it from the bookings trajectory, because I think our bookings performance is more fairly reflected by the LTM current billings growth. So you're looking at 11% to 12%. That was better than what we had expected, and that definitely helps with our current billings in terms of the 14% that we posted in Q3. With respect to revenue, it's not that much of a decline. If you take a look at the difference in terms of what was implied in Q4 versus the outperformance in Q3. And then there's really nothing more to within that.

Hey guys. Can you hear me?

Yes.

Great. I apologize if somebody addressed this already have kind of bounced around in the few tonight. But I remember last quarter you kind of gave some soft guardrails around what you thought Q3 current billings growth could be based off of what 2Q was. So I'm wondering if you can kind of give us some soft guard rails on what you think 4Q current billings could be based off the strong performance you saw in Q3.

Yes. We take that could more or less in line with Q3, so what we tend to look at is, I mean, current billings, we understand is a proxy for bookings performance and it tends to be monthly. So where you're looking at it as of Q2 LTM current billings growth was 11%, Q3 trended up a little bit higher than what we had expected and landing at 12%, and we expect it to be approximately that range ending the year in Q4 for the current billings growth for the full year to be around that 12% range.

Sorry, just to confirm, you expect Q4 to land in a way that the LTM current billings growth is in the 12% range?

Right. So what that basically means is that Q4 around the same like maybe 13% to 14% current billings growth for Q4.

Okay. Got it. Thanks for taking the questions.

Hi. Thanks for taking the question. Sumedh, a quick one for you. It's a bit of a philosophical one. But when you think about the cloud security and CNAP opportunity, there's a fair amount of debate among security practitioners around what's the best way to tackle the cloud security issue, whether it's agent-based or whether it's agentless. I'm just curious if you can talk a little bit about the benefits you see from the agent-based approach that Qualys leads?

Well, that's the beauty that we are not taking one or the other. Actually, that's part of what we have released with our total cloud CNAP solution is this ability for us to do FlexScan, which allows customers to use either an agent-based or an agentless approach. And so we don't get into this debate about what's better because I think if you look at the history of Qualys, we know cloud better than anybody, as we've actually been in the cloud for 20 years. And so we understand that really well. We went from an agentless scanning solution for many years to adding agent-based capabilities and not replacing the agentless scanning. And so today, if you're really being honest about what is needed from a security perspective, it is a combination of agent-based wherever you want to get a lot more details and then agentless where it's an operational impact where you want to reduce the operational impact by doing an agentless assessment. With our TotalCloud CNAP Solution, we give our customers the ability to pick whichever works best for them. And first and foremost, the most important for our customers is to understand that nobody is a cloud-only company. Everybody has cloud. They have some on-prem, they have office environments, they have laptops. So focus for everybody is how big do I get a single unified view of cloud, non-cloud or everything together? And for that, today's cloud solutions really need to be truly cloud-native and truly organically developed. And so instead of going out and acquiring multiple different cloud solutions, I'm trying to switch them together and calling it cloud-native. What we are focused on is really expanding what we have done for all these years in the cloud platform. Our own cloud platform and then expand that into a truly organically natively integrated solution that does both agent-based, agentless, snapshot, everything in a single platform. So customers don't have to pick and choose and have to sort of suffer through configuration every time.

Thank you. And I'm seeing no further questions in the queue. That will conclude today's conference call. Thank you all for participating. You may now disconnect. And have a pleasant day.