Q3 2024 Qualys Inc Earnings Call
The King, Sumedh Thakar,
Ladies and gentlemen, thank you for standing by welcome to Koala's third quarter 2020 for Investor Call.
At this time, all participants are in a listen only mode.
After the speaker's presentation, there will be a question and answer session.
To ask a question during the session, you would need to press star 11 on your telephone. You will then hear an automated message advising your hand is raised. And to withdraw your question, please press star 11 again.
Speaker Change: Please be advised that today's conference is being recorded. I would like now to turn the conference over to Blair King, Investor Relations. Sir, please go ahead.
Speaker Change: Thank you for watching!
Blair King: Thank you, Michelle. Good afternoon and welcome to QALYS's third quarter 2024 earnings call.
Speaker Change: Joining me today to discuss our results are Sumedh Thakar, our President and CEO, and Joo Kim, our CFO. Before we get started, I would like to remind you that our remarks today will include forward-looking statements that generally relate to future events or a future financial or operating performance.
Speaker Change: Actual results may differ materially from these statements.
Speaker Change: Factors that could cause results that differ materially are set forth in today's press release and our filings with the SEC.
Speaker Change: including our latest Form 10-Q and 10-K. Many forward-looking statements that we make on this call are based on assumptions as of today, and we undertake no obligation to update these statements as a result of new information or future events.
Speaker Change: During this call, we will present both GAAP and non-GAAP financial measures. The reconciliation of GAAP to non-GAAP measures is included in today's earnings press release. And as a reminder, the press release, prepared remarks, and investor presentation are all available on the investor relations section of our website. So with that, I'd like to now turn the call over to Sumedh.
Sumedh Thakar: Alright, thank you Mr. King and welcome to our third quarter earnings call. Q3 was another quarter of rapid innovation for Qalis reflecting our ongoing commitment to technology leadership, cybersecurity transformation and successful outcome for our customers.
Speaker Change: As I have focused on product management and marketing in the last few months, I have personally spoken to many seed souls who are struggling with way too many security tools from shift left to run time, creating too many findings that are overwhelming the IT and dev teams.
Speaker Change: leading to multiple siloed top 10 dashboards and an inability to articulate the true risk to the business stakeholders. They are feeling the pressure to articulate the ROI of their security spend and rationalize the security spend in context of the risk to the organization, to their CFO, CEO, and board members.
Speaker Change: Risk can only be mitigated if it is remediated and performed in a timely manner. There is an immediate desire to stop playing the risk whack-a-mole and establish a properly operationalized risk management process by implementing a modern risk operation center.
Speaker Change: At our recent KYC event in San Diego, we ushered in the next era of cybersecurity innovation by announcing the GA of Enterprise Truest Management Solution, which is the world's first cloud-based ROC.
Speaker Change: ETM transforms siloed data into cohesive, real-time risk management solutions by consolidating qualis and non-qualis data from several technology design partners, including Wiz, AWS, Microsoft Defender, Oracle, Okta, and Forescout.
Speaker Change: The result is a single, comprehensive AI-powered platform that aggregates security findings, unifies threat intelligence,
Speaker Change: and provides organizations with actionable enterprise-wide insights to prioritize and remediate cyber risk with unique business context and financial impact via cyber risk quantification.
Speaker Change: Unlike some exposure management platforms in the market that only expose the exposure based on data their sensors collect and provide no remediation capabilities.
Speaker Change: Qualys ETM comprehensively provides a single risk view that goes beyond vulnerabilities.
Speaker Change: across core repositories on-prem.
Speaker Change: Cloud Container Remote Endpoint Identity, OT, and IoT findings from multiple existing security tools in the customer environment, along with patching and remediation capabilities.
Speaker Change: With ETM, Qualys has set a new gold standard in the industry for proactive cybersecurity risk management.
Speaker Change: Cyber risk orchestration is coordinated, quantification is comprehensive, remediation is transformed, and the enterprise-wide ROC at scale is now a reality.
Speaker Change: and being early to market. I encourage all of you to watch the video describing our ETM PowerDraw in more detail at Qualys.com.
Speaker Change: We also announced
Speaker Change: for lower tourist scores shared directly from ETM, allowing customers to transfer the residual risk to their business.
Speaker Change: with a ROC delivered by Qualys ETM, we are now empowering C-level executives and security teams with out-of-the-box
Speaker Change: and actionable insights into trending risk specific to their vertical and mapped to their own data to preemptively identify prevailing threats well in advance of a potential security incident.
Speaker Change: With this new app, which we call TrueLens, going GA soon, CISOs and their security teams can immediately be notified of potentially impacted IT and IoT assets within their environment.
Speaker Change: the materiality of these assets to their business, the associated impact to their overall risk score, and are equipped with the ability to make a remediation frictionless and immediate with a simple click of a button.
Speaker Change: Alongside several other existing announcements at QSC San Diego, we were pleased to commence GA of both our TrueRisk Eliminate and Qualys Total AI capabilities, marking another milestone in Qualys' 25-year history of cybersecurity innovation.
Speaker Change: We are pioneering these categories and both are key differentiators on our platform.
Speaker Change: These new approaches to cybersecurity risk management, along with several others on our roadmap in the coming quarters, arm our customers with the tools necessary to navigate an increasingly complex threat environment and regulatory environment, streamline security operations, and reduce cost.
Speaker Change: Moving to our business update, with many of our customers already embracing Qualys to help re-architect and consolidate their stack, Qualys VMDR has translated into an enviable customer base, broad adoption, and notable industry recognition. As recently announced, Qualys' VMDR with TrueRisk was recognized by GigaOM as a comprehensive risk-based approach to vulnerability management and a leader in the category for the fourth consecutive year.
Speaker Change: We believe Qualys's placement as a leading vulnerability management solution further validates our investments in the platform and continues to represent the high water mark for securing customer environments today and in the future.
Speaker Change: Given Qualys has demonstrated track record for delivering greater value to customers. Our VMDR solution with TrueRisk
Speaker Change: is not only fueling new logo lands but also helping to increase platform adoption especially
Speaker Change: in the area of Cyber Security Asset Management with EASM.
Speaker Change: patch management, and cloud security. Let me share a couple of recent wins, which illustrate why companies turned to Qualys to help consolidate their security tools and fortify their security operations.
Speaker Change: In Q3, one of my favorite wins was a large federal government agency becoming a Qualys customer. This new customer was previously using multiple legacy and next-gen solutions to manage a variety of risk management use cases across their security IT and DevOps teams.
Speaker Change: systems and elongated remediation efforts.
Speaker Change: Looking to migrate to a natively-integrated, cloud-based, ThreadRamp high-impact, level-ready solution that meets the CISA binding operational directives, we displaced five of their existing vendors in a seven-figure bookings deployment using multiple Qolus modules right out of the gate.
Speaker Change: These initial deployments included cybersecurity asset management with EASM, VMDR, and with TrueRisk, patch management, policy compliance, and EDR.
Speaker Change: Through this highly strategic and competitive win, the customer is now able to leverage unified dashboards that provide them with greater insights and automation than any of the competitive solutions that they had evaluated, while taking full advantage of a natively integrated platform.
Speaker Change: This win alongside a separate seven-figure upsell with an existing large government agency customer and a significant state win are a testament to our ongoing investments to expand our federal, state, and local government business in the United States.
Speaker Change: continuing our global expansion. I'm pleased to announce that
Speaker Change: IRAP in Australia has recently assessed QALYS at the protected level. This achievement opens the door.
Speaker Change: for Australian government agencies and commercial organizations looking to comply with the ACSC central aid strategy as well as their PSPF requirements to meet their country's most stringent security and compliance standards.
Speaker Change: Our successful assessment follows QALYS' approval as a cybersecurity service provider to the Victorian State Government for vulnerability management services. QALYS, as selected through a highly competitive
Speaker Change: extensive vetting process and is being bundled into a managed service delivered by ENY.
Speaker Change: Thank you for watching. I'll see you next time.
Speaker Change: Turning to the momentum we are seeing with our Total Cloud CNAP solution, in a mid-six-figure booking upsell with a financial services company in the Global 200, this existing VMDR and CSAM customer selected Total Cloud to scale their container deployments to over 70,000 hosts, monitoring millions of Kubernetes container images daily.
Speaker Change: Through its evaluation of competing cloud security providers, this customer determined that alternative point solutions added complexity to their operations, lacked integration, and missed detection, which hindered their ability to assess risk and consolidate their security tools.
Speaker Change: Closing compliance gaps and remediating risk with ITSM integration through a single dashboard from code to cluster.
Speaker Change: These capabilities provide the visibility, automation, and cloud hygiene necessary to defend against today's adversaries.
Speaker Change: and represent a significant long-term growth opportunity for Qualys. Our growing leadership in the cloud market was also recently recognized by Gartner in his July 2024 market guide for cloud-native application protection platforms.
Speaker Change: As a result, customer spending $500,000 or more with us in Q3 grew 15% from a year ago to $200,000.
Speaker Change: Consolidation isn't just happening with customers, it's also embraced and prioritized by our partners where we continue to see an increase in new customer deal registration and cost sales.
Speaker Change: We believe the expansion of our partner program continues to reflect our strengthening brand awareness.
Speaker Change: brings a highly differentiated value proposition to our customers as they get more security using fewer resources with the Qualys Enterprise Tourist Platform.
Speaker Change: with a unique opportunity in this environment to further strengthen our strategic position as the partner of choice for customers looking to re-architect and consolidate their security tools.
Speaker Change: To evolve, to solve modern security challenges, we believe we can continue to grow long-term, maintain best-in-class profitability, and invest in key initiatives aimed at further extending the gap between Qualys and the competition.
Speaker Change: With that, I will turn the call over to Jumi to further discuss our third quarter results and outlook for the fourth quarter and full year 2024.
Jumi: Thanks, Sumedh, and good afternoon. Before I start, I'd like to note that except for revenues, all financial figures are non-GAAP, and growth rates are based on comparisons to the prior year period, unless stated otherwise.
Speaker Change: Thank you for watching!
Speaker Change: Turning to third-quarter results, revenues grew 8% to $153.9 million with Channel continuing to increase its contribution making up 47% of total revenues compared to 43% a year ago.
Speaker Change: As a result of our continued commitment to leverage our partner ecosystems to drive growth, we were able to grow revenues from channel partners by 17%, outpacing Direct which grew 1%.
Speaker Change: U.S. and international revenue mix was 58% and 42% respectively.
Speaker Change: In Q3, we saw some stabilization in the selling environment, but believe ongoing budget scrutiny will persist for the foreseeable future.
Speaker Change: Reflecting the sentiment, our growth retention rate remained largely unchanged at approximately 90%, but with stronger upsell performance, our net dollar expansion rate came in higher at 103%, up from 102% last quarter.
Speaker Change: We continue to see a positive growth trend in new business, achieving a double-digit growth rate for the fifth consecutive quarter.
Speaker Change: In terms of product contribution to booking, cash management and cybersecurity asset management combined made up 15% of LTM bookings and 24% of LTM new bookings in Q3.
Speaker Change: Cloud Security Solution, Total Cost CNOT, made up 4% of LTM booking.
Speaker Change: The foundational theme underpinning these results is the power of our enterprise TrueRisk platform to help customers consolidate cybersecurity at scale.
Speaker Change: Turning to profitability, reflecting our scalable and sustainable business model, adjusted EBITDA for the third quarter of 2024 was $69.7 million, representing a 45% margin compared to a 48% margin a year ago.
Speaker Change: Operating expenses in Q3 increased by 12% to $61.8 million primarily driven by an 18% increase in sales and marketing investments aimed at capturing the market opportunities in front of us.
Speaker Change: As we continue to increase our investment intensity and focus on sales and marketing enablement, customer success, and productivity, we believe we will be able to drive wallet share and long-term return.
Speaker Change: Thank you.
Speaker Change: ATS for the third quarter of 2024 was 1.56 and our free cash flow was 57.6 million, representing a 37% margin compared to 64% in the prior year.
Speaker Change: In Q3, we continue to invest the cash we generated from operations back into Qualys including $3.4 million in capital expenditures and $44.9 million to repurchase 344,000 of our outstanding shares.
Speaker Change: As of the end of the quarter, we had $185.7 million remaining in our share repurchase program.
Speaker Change: Thank you for watching.
Speaker Change: With that, let us turn to guidance, starting with revenues.
Speaker Change: For the full year 2024, we are now expecting our revenues to be in the range of $602.9 to $605.9 million, which represents a growth rate of 9%.
Speaker Change: This compares to revenue guidance of $597.5 to $601.5 million last quarter.
Speaker Change: For the fourth quarter of 2024, we expect revenues to be in the range of $154.5 to $157.5 million, representing a growth rate of 7 to 9 percent.
Speaker Change: This guidance assumes lighter new business this quarter based on current pipeline and continued deal scrutiny from existing customers with no meaningful change in our net dollar expansion rate in Q4.
Speaker Change: Shifting to profitability guidance. Factoring in the better-than-expected profitability today, we expect full year 2024 EBITDA margin in the mid 40s and free cash flow margin in the mid to high 30s.
Speaker Change: We expect full year EPS to be in the range of 5.81 to 5.91 up from the prior range of 5.46 to 5.62.
Speaker Change: For the fourth quarter of 2024, we expect APS to be in the range of 1.28 to 1.38.
Speaker Change: Our planned capital expenditures in 2024 are expected to be in the range of $12 to $16 million, and for the fourth quarter of 2024, in the range of $5.5 to $9.5 million.
Speaker Change: Thank you for watching.
Speaker Change: Adding additional context, we are currently making certain investments in some of our data centers to achieve greater operational efficiencies and reduce medium to long-term marginal costs.
Speaker Change: These investments pressure Gross Morgan in Q3 by approximately 1%, and we anticipate a similar contraction in Q4.
Speaker Change: With respect to operating expenses, in Q4 we expect to continue to prioritize an increase in investment in sales and marketing, aimed at driving more pipelines, supporting sales, enhancing our partner program, and expanding our federal vertical with more modest increases in engineering and GNA.
Speaker Change: With that, Sumedh and I would be happy to answer any of your questions.
Speaker Change: Thank you. As a reminder to ask a question please press star 1 1 on your telephone and wait for your name to be announced and to withdraw your question please press star 1 1 again. And our first question comes from Jonathan Ho with William Blair. Your line is now open sir.
Speaker Change: www.mytrendyphone.co.uk
Jonathan Ho: Hi, good afternoon and congratulations on the strong results. Sumedh, can you talk a little bit about some of the changes that you've implemented on the product marketing side and maybe help us understand, you know, maybe what that impact could be just moving forward. It seems like your CNAP products did quite well this quarter.
Speaker Change: Yeah, thank you. Great question. So, I think where we see the opportunity really is aligning overall messaging around the different modules to the messaging around business risk and risk quantification that we have been talking about, which is really helping customers sort of
Speaker Change: You know, there's a lot of people talking about single pane of glass and platformization and different things and just bundling products for the sake of bundling. I think for us, as we launched The Rock, which is a big sort of
Speaker Change: that we made around QSC, which is really bringing all the things that we're doing in cybersecurity together from a risk operationalization perspective. At the end of the day, how much money you spend on cybersecurity is really directly proportional to how much risk you perceive to the business, and a lot of CISOs struggle to even articulate that.
Speaker Change: So if you don't necessarily have a good view of how much risk you have to the business, how do you decide on how much you should spend on the different areas of cybersecurity.
Speaker Change: with Product Marketing and Product Management. Really, we have really focused in the last couple of months on realigning our messaging to the risk message instead of just individual modules and products. Of course, the journey that we have started on.
Speaker Change: We're saying if you have these tools that you like, you can keep those, but we can bring the data into the Qualys platform and give you that.
Speaker Change: Thank you for watching.
Speaker Change: have a very simplistic view of essentially what is the risk so you can articulate that risk to your management, to your board and that is resonating extremely well. So when people are saying I want to consolidate different tools or bring data together, it is really at the end for the purpose of understanding...
Speaker Change: What does it mean to have so many different risk factors affecting a particular business entity? What does that mean in terms of how much risk do I have to the business? And so this change in marketing, product marketing, the announcement of the ROC as well as the MROC, a lot of these things are very new in the way that we have announced them at our QSC event.
Speaker Change: Thank you. Thank you.
Speaker Change: Excellent and then just for Jumi, can you talk a little bit about the strength you saw this quarter in terms of the net retention and you know should we expect things to maybe trend towards this positive direction just given you know the release of the new products and the new sort of bundles that you put together. Thank you.
Speaker Change: You know we were really pleased with the outperformance and the upsell especially after a few consecutive quarters of a tick down and a dollar expansion rate. So we're pleased to report that it's increased back up to 103 percent. Now with that said what we're assuming for the guidance is no material improvements in Q4 based on the current deals in play, what we're seeing in the business today. We are optimistic in the longer term that we will see that continue to tick up but for the purposes of guidance we are assuming no material change right now.
Speaker Change: Thank you.
Speaker Change: And the next question comes from Roger Boyd with UBS. Your line is open.
Roger Boyd: Oh great, thanks for taking the question. I want to touch on the channel. You continue to sound pretty confident in the opportunities that are unlocking there, particularly with the new platform offerings with MROC.
Roger Boyd: It's clearly shown up in the revenue numbers, but I wonder if you could just expand on the momentum you're seeing there, and maybe to what extent was Channel a material contributor to the pretty strong 3Q Billings growth here. Thanks.
Speaker Change: Thank you for watching!
Speaker Change: Yeah I think at a high level we are happy with sort of the journey we started a year, year and a half ago around really focusing more with our partners, channel partners, to bring a business to us, you know, increasing deal rates. So we're seeing positive momentum there and I think as we're seeing that momentum what we are really looking forward to is embracing the strategy which is our partner for strategy, right, for both a new business and for upsells. We're looking to say how do we work with our partners and pivot more and more towards helping them not just bring, you know, a resale deal to us but with the launch of the MROC how can we enable these partners to now provide some meaningful services.
Speaker Change: to the customer. For a long time, you know, MDRs and managed SOCs have been something that they have been focusing on, but a lot of our partners now are excited that after the
Speaker Change: And expanding from just channel partner, just managed service providers to even cyber insurance companies that we're talking to, is that partnership that can essentially help to say if you invest a certain amount in building out a risk operation center.
Speaker Change: that can give you benefit with lower risk scores and getting out of this this like too many alert fatigue to actually focus on saying that this can actually give us
Speaker Change: And a meaningful discount on our cyber insurance premium because we have set up a rock with a true risk score. So we see that a lot of things that we're doing really is about how do we embrace this partner for strategy across the board and creating products and capabilities and service that actually our partners can offer services on top of what we do and not just, you know, taking and reselling the capabilities.
Speaker Change: And our next question comes from Patrick Colville with Scotiabank. Your line is open.
Patrick Colville: Thank you so much, Sumedh and Jumi. Congratulations on a very healthy print. I guess I want to focus specifically on the current billing's performance, which is highly impressive.
Patrick Colville: The question I'm getting is, you know, were there any deals, remind me, that was pushed from
Speaker Change: 2Q into 3Q, or were there any deals that were signed in 3Q that were maybe kind of pulled in for 4Q? I mean, I guess, were there any one-offs, maybe, is a kind of phrase more succinctly this quarter with the current billing's performance?
Speaker Change: Thank you for watching!
Speaker Change: There were, but not outside the normal course of the business. In any given quarter we do have some deals that get pushed out and then pulled forward. And so it was a typical quarter from that perspective. With that said, when you take a look at current billings, it does get impacted by the billing schedule and the contract terms for the customers. And I would say that, you know, the 14% that we just posted, it is higher than the booking performance just based on the billing schedule. And so one of the things that we do take guide to is, if you take a look at, and on an LTM basis or even year-to-date basis, that helps to kind of smooth out the lumpiness in current billing. And so I would say that's probably more indicative of the business momentum that we see today.
Speaker Change: Thank you.
Speaker Change: Very helpful and so I guess
Speaker Change: I mean you just touching this now but I guess I want to zoom in on exactly what you said so it is using kind of an LTM basis the best way to get a kind of normalized view of what things might be next year you know appreciate you're not providing an early guide
Speaker Change: but you know is is that kind of mid to high single digit level the right level on a forward-looking basis or should we expect more like a double digit performance like this quarter?
Speaker Change: Thank you for watching!
Speaker Change: Yeah, it's a little too early to be commenting on next year, but because of the focus on current balance, I would say that, look, like the best guide that we could give right now, the indication that we can give for Q4 is more or less in line with our revenue growth guidance. So we're guiding to 7 to 9% revenue growth rate for Q4, and I would say that current balance, we are expecting it to be more or less trend in that direction.
Speaker Change: Thank you for watching!
Speaker Change: Terrific. Thank you so much and well done for a really great print.
Speaker Change: Thank you.
Speaker Change: The next question comes from Kingsley Crane. Your line is open.
Kingsley Crane: Great, thanks. Really impressive results. I'm sure it's gratifying for the whole team. I just want to get a little bit more granular on what drove the strength from a product perspective. It seems like with TrueRisk and TotalAI that those are really going to be more meaningful over the next couple quarters and years. Thanks.
Speaker Change: Thank you for watching!
Speaker Change: Yeah, great question. Look, I think overall we're happy to see we're in a good quarter, we're happy about that, you know, glad to see the...
Speaker Change: take up in the NRR that we saw this quarter. We're happy with multiple quarters of new business growth that we have seen, though, as you mentioned, looking at sort of the Q4 pipeline, we expect some of the new business stuff to moderate a little bit. But having said that, our federal investments that we have been making, we saw some good momentum and good deals with upsells and new business from the federal side as well in Q3. And we're happy with how our total cloud solution has been evolving and also the kind of performance that we saw from a Q3 bookings perspective. As you saw, VMDR or vulnerability management is really shifting with people buying more patch management as part of VM solutions.
Speaker Change: for
Speaker Change: very positive early conversations with customers around Togliatti.
Speaker Change: because what is happening right now is a lot of IT teams are getting ready to deploy some form of AI into production next year. They're coming to the security team and saying, hey, can you guys certify this? And most security teams today don't have any idea what to test from an AI LLM security perspective. And so
Speaker Change: with Qualistodal AI providing almost like a point-and-shoot scanner.
Speaker Change: for AI that tests jailbreaks and some of the common AI vulnerabilities and giving a thumbs up or a thumbs down is really the perfect recipe for what they're looking for at this point of time. So we're seeing that momentum building up as well. And so as we get into next year, we were looking forward to continuing that momentum with patch management, cybersecurity asset management.
Speaker Change: bringing on more customers who are looking at cloud security solution consolidation as we are seeing wins against the established cloud only players that are the ones in the market we're seeing wins against them one of those we highlighted here as well and then also we are seeing that
Speaker Change: Thank you. Bye.
Speaker Change: The amount of interest in
Speaker Change: The ROC and the ETM is very very high. Our Strategic Advisory Board, CISOs, we are seeing a lot of them eagerly waiting to test this, try this, and really hitting a key point of
Speaker Change: contention that they are seeing with their management and their board and so we feel like as we get into the next couple of years
Speaker Change: with growth on cloud, federal, ETM, and AI are really building up some very, very nice potential growth opportunities for us over the next couple of years.
Speaker Change: Great that's that's really helpful and Sumedh I just want to take a step back and circling back to the departure of Inkesh the chief product officer in September which had been planned I mean what have you learned operationally over the past couple months do you feel like you have the appropriate bandwidth it seems like you do it seems like things are going well
Speaker Change: Thank you for watching!
Speaker Change: Yeah, I do. I think it's always good to get back in and see and, you know, like most places, you just get people to talk to each other. What a wonderful impact that can make. And so I think as I stepped in and brought the product management, product marketing teams together, and we were able to really just in a very quick period come up with this branding of Risk Operations Center, which is a wonderful way of describing instead of calling it Security Data Lakes and all kinds of different names.
Speaker Change: the people are struggling with.
Speaker Change: It resonated really well and this just came from the creativity of our product management and product marketing team sitting together and saying What are we eventually offering our customers instead of coming up with some very fancy terms and names like it's literally just a risk operation center that helps them operationalize that cyber risk
Speaker Change: And so we're, I'm able to really see that enthusiasm in the team coming together and you're seeing some of that with the messaging and the clarity and the crispness of the messaging that is coming out of Qualys now.
Speaker Change: As we've evolved ourselves from just being a vulnerability scanner into a really much bigger broader platform for risk management and not just scanning and finding vulnerabilities.
Speaker Change: Great to hear. Thanks again.
Speaker Change: Thank you for watching!
Speaker Change: And the next question comes from Joel Fishbein with Truist. Your line is open.
Joel Fishbein: Thank you for taking the questions. Sumedh, just to follow up on the product questions, I'm really interested in TrueRisk Eliminate. It seems like a very differentiated product. Love to hear what the early feedback is and when does it specifically go to market and when do you expect revenue to come from the management platform altogether? Thanks.
Joel Fishbein: Thank you for watching!
Sumedh Thakar: Thanks, Joel. You always ask the product question. I like that. So, it's really Tourist Calibrate is very interesting. So, I mean, if you recall into the history a few years ago when I introduced patch management, there was a lot of pushback at the time.
Joel Fishbein: Thank you. Bye-bye.
Joel Fishbein: In the next segments.
Sumedh Thakar: Right. So we are looking at some significant uptake in the patching cycles from our customers and the number of devices that they are.
Joel Fishbein: 一下ing, etc. However, patching is a little bit of a political battle in a Customer environment between the IT team and security team, and so we run into that sometimes it's also an operational dynamic.
Speaker Change: would like to learn upwards this year. Thank you, Dr. Lyons. Thank you as well. Excellent.
Speaker Change: very specific mitigation because we study how attackers go about
Joel Fishbein: at the conference.
Speaker Change: and also it provides the capability of isolation.
Speaker Change: And so we're seeing some highly regulated environments where they're saying look if I cannot catch I cannot mitigate I'm going to actually take the machine off the network because it has way too much risk And I just cannot take that kind of a risk
Speaker Change: And so this packaging is something that just rolled out to production this quarter. And so as we start to get this messaging out, we talked to our strategic advisory board members. They were very optimistic about that because it helps them address the...
Speaker Change: in this press conference.
Speaker Change: We just go back to our existing customers who have patch and say, hey, here's an upgrade that you can buy that allows you to also bring mitigate. And those who are resistant to patch management can now actually purchase the mitigate capability as part of the eliminate, where they say, well, I'm not patching, but I can actually buy this additional capability. So lots of interesting opportunities. And as we start to roll this out more broadly and getting early adopter customers using it, we're optimistic for this to be something that we will see more momentum next year.
Speaker Change: Great, thank you so much.
Speaker Change: Thank you for watching!
Speaker Change: And the next question comes from Rudy Kessinger with DA Davidson. Your line is now open.
Rudy Kessinger: Hey guys, great, thanks for taking my questions and congrats.
Rudy Kessinger: on a strong quarter, particularly on revenue and billings. Similar to Patrick's question, I guess I'm curious on the revenue outperformance in the quarter. One of your largest...
Speaker Change: I think as a public company, if not your largest relative to your guy, it sounds like upsell being better than expected was the primary driver, but I'm curious if that was it or anything else to it in in a particular on the upsell just.
Speaker Change: You know, was it a handful of large upsell deals or was it broad-based better upsell than expectations?
Speaker Change: From an upsell perspective, it was more or less broad-based, and we were really pleased with the performance. Just because if you take a look at the recent quarters, because we've been underperforming not only in Q2, but it's been continuing to tick down from a net dollar expansion rate, we were conservative in how we were viewing the potential results of Q3. And so with our net dollar expansion rate finally going back up to 103%, it was really primarily driven by the upsell performance, our focused execution, and getting the deals in the quarter that we had to work with. And then in addition to that, you definitely helped as well, because you're seeing a continued momentum in the new business.
Speaker Change: bookings where we're able to take some market share, get the new logos in, it's another double digit growth. And so looking to Q4, we don't expect that to continue. We do expect a lighter new business quarter. And then on the upsell, we don't anticipate a similar rate of success on the upsell based on the deals that we see today.
Speaker Change: Thank you.
Speaker Change: Okay that's helpful and then I believe in an answer to a question earlier
Speaker Change: You said Q4...
Speaker Change: and I'm going to be talking about current calculated billings in the 7-9 range that you're guiding to on revenue. Just to be clear, was that for CCD for Q4 or for trailing 12-month CCD in Q4, 7-9%? It's for Q4 CCD.
Speaker Change: Okay, got it. Thank you.
Speaker Change: Thank you for watching!
Speaker Change: And our next question comes from Matt Hedberg with RBC. Your line is open.
Matt Hedberg: Great, thanks for taking my questions. Sumedh, you know, a lot of a lot of positivity from this quarter. The channel contributions released to me a new product momentum. I guess I'm curious, you know, based on what you've seen now and maybe, you know, through the first month of Q4,
Matt Hedberg: Can you comment on the durability of these trends? You know, they seem to have an idiosyncratic nature versus maybe more macro-driven, but I was kind of curious on if you could provide a bit more color on maybe the durability of some of these trends that you're seeing.
Speaker Change: You know, I think if you look at the conversations that we are having, our user conference that we had in Mumbai as well as in San Diego, the strategic advisory board, you know, we just did this one exercise where we gave mock money to these CISOs to put on different products and the momentum, like the interest that we saw with AI, et cetera. I think there's a real desire and a real focus on we need to move in this direction. And we can continue to just buy more tools and get more alerts and just randomly ask IT and dev teams to start to fix everything. So aligning with this sort of business outcome and figuring out how do you get that one view of the different risk factors while keeping your tools and not having to go into the conversation
Speaker Change: So, I think we're encouraged with the conversations, the momentum, the level of interest. I think all of that has been quite positive. Now, how did that translate quarter over quarter in the short term, I think is something that is...
Speaker Change: a combination of our execution, which you were happy with how we did in Q3, and then focusing on some of the pipeline build that we need to have, etc. I think what I look at is, given these different capabilities, quite differentiated...I mean, if you look at
Speaker Change: I am in
Speaker Change: As the focus on cybersecurity is going to be stable and people continue to come back to say what are the areas of focus I have, I look forward essentially for these things to make a bigger impact in the next two, three years rather than sort of trying to find just the next couple of quarters. So I think the interest in all of that is real. I think how the deals close, I think some of that is going to be lumpy as we have seen.
Speaker Change: in the last few quarters.
Speaker Change: Well, that's super helpful. And maybe this kind of partially answers my next question. But for Jimmy, just maybe a point of clarification. I know you said even just to the answer to the last question that your guidance assumes lighter new business trends for 4Q. I just wanted to put a finer point on that. Is that something, is that a trend that you're seeing?
Speaker Change: Or is it just, you know, sort of layers of conservatism, you know, as you go into what typically is a pretty strong, you know, end of year quarter for you guys?
Speaker Change: Thank you for watching!
Speaker Change: Thank you for watching.
Speaker Change: It's definitely not a trend that we're seeing today. I think that we've seen the trend where the new business bookings have been performing very well year to date for us. What I'm commenting on is based on the deals that we're looking at and the outlook, kind of the pipeline per se. We are seeing a lighter pipe than we would like to see for Q4.
Speaker Change: So, because of that, I'm pointing to the fact that, look, we've had this consecutive quarter of double-digit new bookings closed, which was great. I don't necessarily see that continuing Q4, not to say that it won't continue out to 2025. I'm just giving a little bit of color for Q4. Yeah, just to add to that, as you know, right, I mean, the pipeline in Q4 is informed by efforts that were made.
Speaker Change: a couple of quarters ago and so
Speaker Change: The changes in marketing that we have made are, you know, are important for us to understand kind of where we came from and
Speaker Change: We look forward to, with the changes that we have made, to bringing that pipeline back home. I think the momentum over the last few quarters has been quite encouraging and has been a trend, essentially, right? I think Q4 is calling out sort of what we see just for Q4 at this point.
Speaker Change: Got it. Thank you both for the answers.
Speaker Change: And our next question comes from Trevor Walsh with Citizens. Your line is open.
Trevor Walsh: Great, hi team, thanks for taking the questions. Sumedh, I know you had a lot of questions already around risk, so I wanted to just maybe back out from a high, super high level view.
Speaker Change: You had a good slide in the deck around just all the different tools out there that are quantifying risk in some way.
Speaker Change: and totally understand or get kind of where you guys are coming from and being kind of the consolidator of all those different views. Can you just maybe tell us from, you know, from the customer view, from the conversations you've had, what's maybe the one or two things that you think customers are going to lean on or like look to Qualys to kind of be that consolidator around risk as you roll out enterprise curious management?
Speaker Change: Yeah, excellent question. I think there are some smaller companies that are doing some form of quantification, but if they're focusing on the quantification from a dollar value perspective, they're not necessarily doing the finding consolidation of pulling data from multiple tools, and then if there are some tools that are doing some of that.
Speaker Change: primarily they're pulling a lot of their data from Qualys and they're not doing a really good job of quantification and neither tool is doing a good job of any remediation at all. So at the end of the day you spend billions of dollars building all these nice dashboards and staring at them doesn't mean anything if you don't actually get remediation done. And so the level of interest from a lot of our customers is very high with the ETM and the ROC story because first of all those who are Qualys customers already that information or what asset inventory which is a foundational element of any ROC.
Speaker Change: bringing all of that in one workflow. And, you know, it's a lot easier from what the feedback that our CISOs gave us, is they say,
Speaker Change: rather than go and ask for money for the next big, you know,
Speaker Change: The next big trend that has come out and you know, whether it's zero trust or this or that
Speaker Change: I can't explain that if I'm going to go and do something around zero trust as an example, what is the outcome that the company or the business is going to get? But with this, I can report something that says my $500 million business unit has a possibility for $10 million loss per day and my score that is collected from multiple different vendors.
Speaker Change: In a single score is giving an indication that there is a high possibility that you're going to lose that ten million dollars a day
Speaker Change: And when I take that to my CFO to say, look, our score is high, the possibility of losing 10 million a day is much higher, then it's a much better conversation to have to say, like, can we spend $650,000 to put these four controls in place?
Speaker Change: which will then bring the risk down to 30 percent, which is an acceptable level, and you can prove that that risk actually came down. And that conversation is a lot easier for them rather than going and asking for more money to deploy the next big thing in security without actually being able to explain what they're going to get in return for that, other than just saying, oh, we're going to make things safer.
Speaker Change: And so that's where the initial enthusiasm is very high that the time to value is very fast because a lot of the data is already in QALYS. I think for the business side
Speaker Change: I'm excited because our sellers and our partners, when they go to prospects who maybe have
Speaker Change: transfer market as well. So we're quite, that's really what customers like. It's not just a one score here. It's really a comprehensive look at how they can provide this visibility to their board and management.
Speaker Change: Thanks so much for the perspective. One quick follow-up for you, Jimmy, if I can. I appreciate the color around some of the sales and marketing investments made in the quarter and kind of the effect on operating expenses there. I think that's been a theme for a few quarters now around just the overall investments, whether it's channel or otherwise.
Speaker Change: Can you just maybe give us a sense of how you're thinking about tracking the ROI from these investments, maybe like a few levels deeper than the metrics that we're seeing, whether it's revenue or billings, and just how you kind of are, you know, seeing whether or not these different choices that you're making are kind of paying off. Thanks.
Speaker Change: Thank you for watching!
Speaker Change: And the way that we measure ROI, I mean one of the kind of the standard metrics is obviously from a direct sales force perspective, the sales productivity, how much
Speaker Change: were able to generate for each ranch sales headcount. And the way that we've been tracking on that metric is...
Speaker Change: We haven't seen that significant of an increase overall, just because you have percentage.
Speaker Change: and We're taking a look at the different campaigns to see which ones worked and then which ones we should continue into 2025 and how that will impact our profitability
Speaker Change: Thank you for watching!
Speaker Change: Great. Thank you both. Appreciate the answers.
Speaker Change: And our next question comes from Srinik Kothari with Baird. Your line is open.
Srinik Kothari: Thanks for taking my question. Congrats on the really great quarter, Sumedh. I'd asked about the federal last quarter and the first public sector summit at the time and sounded quite enthusiast about it. You highlighted some great wins in Q3. Just if we can help like quantify or any color in terms of the potential uplift relative to your expectations.
Speaker Change: Beyond just the 3Q budget, you can talk about specific products and go-to-market strategies there, specifically in relation to deepening federal relationships and federal agencies and how to expand into new departments there. And then I'll have a quick follow-up.
Speaker Change: in consolidating multiple different tools and that's the good news in the federal space.
Speaker Change: focused on complexity and cost is driving people to to drop four or five different solutions in favor of one single Qualys platform and you know, typically these are bigger names that we are replacing as well. So we see the momentum. I think as you know, federal business is two, three budgets and it's a little bit lumpy that way, but overall we're seeing positive
Speaker Change: momentum as we get into the next few years. I think it takes time to build out that federal practice where it's a significant amount and so we are looking forward to continuing that investment into next year on the federal side and then seeing the outcome of that. But we're pleased with what we're seeing right now.
Speaker Change: Very helpful, Sumedh. Just a quick follow-up for Jumi. You touched on and mentioned the billing schedule, if I heard it right. If we can kind of delve a bit more into...
Speaker Change: It all kind of changed in terms of scheduling compared to what you perhaps said last quarter in terms of billings growth expected to mirror revenue growth for like mid-single digits in the second half.
Speaker Change: Just trying to understand if there are any factors which might be missing contributing to the upsides in relative to the revenues.
Speaker Change: on a LTM basis is probably more accurate.
Speaker Change: Thank you for watching.
Speaker Change: Got it. Thanks for the question.
Speaker Change: And our next question comes from Young Kim with Loop Capital. Your line is open.
Young Kim: Thank you. First, congrats on a solid execution. Sumedh, good to see continued solid bookings around new products. If you can give us some insights into the go-to-market around these new products. For instance, is the sales process for these new products, is that primarily driven by renewal process? And also, what kind of traction are you seeing with new customers for these new products?
Sumedh Thakar: Yeah, I mean as Juby talked about it, right, if you look at batch management, cybersecurity asset management, 24% of LTMnet new bookings is basically coming from these products and so this is really
Sumedh Thakar: The ability for our sellers to go in and not have the conversation of, oh, our scanner is a little bit better than the other scanner. Really to talk about the comprehensive ROI of saying you cannot scan without an inventory, and there is no point of scanning if you don't patch things. And so Qoalys is the only platform that is really providing the ability to have all of these three together. And so in this market, that is what is helping customers make the decision to say, even if they may be satisfied with the current scanner that they have from a scanning perspective, and we look at it holistically at their vulnerability management workflow. And we had a session at our QSC where we said Qoalys is putting the M back in VM. The management of vulnerability management process is important.
Sumedh Thakar: As our sellers are now going in and positioning the comprehensive packaging and in new businesses giving us advantage because then when we provide that and the sellers, the customer goes back to a competing solution, they cannot offer patch management, they're not offering patch management. In fact, I talked to a CISO of a new logo that just came on board and he said he did talk to our competition and said, you know, one of them is doing patch management. They said, well, then in that case, you should go to Qualys. And so we're seeing that these new product capabilities are differentiating as we are evolving out of just a vulnerability management scanning tool, which is something that people are not focusing as much on to just say, OK, we want to scan stuff. So new products are getting momentum, as I said.
Speaker Change: at Total Cloud. We had a good quarter with Total Cloud, and we're happy with that right now, so we are seeing...
Sumedh Thakar: Even new business people coming to us look at this and say, well, I could buy a cloud scanning only solution but then it doesn't scan my desktops and my...
Sumedh Thakar: of focus for us this quarter and they've been really putting a lot of focus on getting our sellers to articulate the newer messaging rather than just sort of going and saying our scanner is better than your scanner.
Speaker Change: Okay, great. I just want to make sure though, is the selling around these new products driven by the renewal process or is it independent of that?
Speaker Change: Sorry, the what process? The renewal.
Speaker Change: Aurelio
Speaker Change: Yeah, are you selling these new products in conjunction with renewals or is it really really independent of the video? Oh, yeah. Yeah. No, no both. So so the yeah, I got the question So that the 24% that we talked about for a game was
Speaker Change: on new bookings that come to Qalis, which is new logos coming to Qalis. And then the 15% is overall that includes existing customers who are
Speaker Change: either buying additional cybersecurity asset management and patch management or in some cases might be adjusting some of their VM spend to spend more on patching and buying more patch management. So it's both, we're seeing that in both places. So we are attracting net new logos because we have cybersecurity asset management, match management and we are also creating opportunities to upsell to existing customers these new capabilities because we don't see that with the competition.
Speaker Change: Thank you for watching!
Speaker Change: We would like to thank everyone for your participation. This will conclude today's conference call.
Speaker Change: And you may now disconnect.
Speaker Change: Goodbye!