Qualys Q4 2025 Qualys Inc Earnings Call | AllMind AI Earnings | AllMind AI
Q4 2025 Qualys Inc Earnings Call
Operator: Welcome to Qualys' fourth quarter 2025 investor call. At this time, all participants are in a listen-only mode. After the speaker's presentation, there will be a question-and-answer session. To ask a question during the session, you would need to press star 11 on your telephone. You will then hear an automated message advising your hand is raised. To withdraw your question, please press star 11 again. Please be advised that today's conference is being recorded. I would now like to turn the conference over to Blair King, Investor Relations. Please go ahead.
Speaker #1: presentation, there will be a After the speakers' question-and-answer session. To ask a question during the session, you would need to press star 11 on your telephone; you will then hear an automated message advising your hand is raised.
Speaker #1: If you have a question, please press star 1-1 again. Please be advised that today's conference is being recorded. I would now like to turn the conference over to Investor Relations.
Speaker #1: Blair King, investor Please go ahead.
Blair King: Thank you, Michelle. Good afternoon and welcome to Qualys' fourth quarter 2025 earnings call. Joining me today to discuss our results are Sumedh Thakar, President and CEO, and Joo Kim, our CFO. Before we get started, I'd like to remind you that our remarks today will include forward-looking statements that generally relate to our future events or future financial or operating performance. Actual results may differ materially from these statements. Factors that could cause results to differ materially are set forth in today's press release and our filings with the SEC, including our latest Form 10-Q and 10-K. Any forward-looking statements that we make on this call are based on assumptions as of today, and we undertake no obligation to update these statements as a result of new information or future events. During this call, we will present both GAAP and non-GAAP financial measures.
Speaker #2: and welcome to QUALYS's fourth quarter 2025 earnings call. Thank you, Michelle. And good afternoon are Samedh Thakar, president and Joining me today to discuss our results CEO, and Joo Kim, our CFO.
Blair King: Before we get started, I'd like to remind you that our remarks today will include forward-looking statements that generally relate to our future events or future financial or operating performance. Actual results may differ materially from these statements. Factors that could cause results to differ materially are set forth in today's press release and our filings with the SEC, including our latest Form 10-Q and 10-K. Any forward-looking statements that we make on this call are based on assumptions as of today, and we undertake no obligation to update these statements as a result of new information or future events. During this call, we will present both GAAP and non-GAAP financial measures. A reconciliation of GAAP to non-GAAP measures is included in today's earnings press release. As a reminder, the press release, prepared remarks, and investor presentation are all available on the investor relations section of our website.
Speaker #2: remind you that our remarks today Before we get started, I'd like to will include forward-looking statements that generally relate to our future events or future financial or operating performance.
Speaker #2: Actual results may differ materially from these statements. Factors that could cause results to differ materially are set forth in today's press release, and our filings with the SEC, including our latest Form 10Q and 10K.
Speaker #2: Any forward-looking statements that we make on this today and we undertake no obligation to call are based on assumptions as of update these statements as a result of new events.
Speaker #2: both GAAP and non-GAAP financial During this call, we will present measures. A reconciliation of GAAP to non-GAAP measures is included in today's earnings press release, and as a reminder, the press release prepared remarks and investor presentation are all available on the investor relations section of our website.
Blair King: A reconciliation of GAAP to non-GAAP measures is included in today's earnings press release. As a reminder, the press release, prepared remarks, and investor presentation are all available on the investor relations section of our website. With that, I'd like to now turn the call over to Sumedh.
Blair King: With that, I'd like to now turn the call over to Sumedh. Thank you, Blair, and welcome to our Q4 earnings call. As threat actors continue to compress time to exploit, we believe the next phase of pre-breach risk management will be defined by an agentic AI-driven risk fabric with out-of-the-box business quantification and automated remediation to respond to the speed of these threats. Against that backdrop, we continue to execute well in Q4, demonstrated by another quarter of strong revenue growth and profitability. In my conversations with hundreds of CIOs and CISOs, as well as security leaders from many of the world's largest and most innovative organizations, one message has remained consistently clear: reducing cyber risk isn't about detecting more exposures. It's about operationalizing a cyber risk management program that aligns spend with risk tolerance.
Speaker #2: to now turn the call over to
Speaker #2: Samedh. So with that, I'd like
Sumedh Thakar: Thank you, Blair, and welcome to our Q4 earnings call. As threat actors continue to compress time to exploit, we believe the next phase of pre-breach risk management will be defined by an agentic AI-driven risk fabric with out-of-the-box business quantification and automated remediation to respond to the speed of these threats. Against that backdrop, we continue to execute well in Q4, demonstrated by another quarter of strong revenue growth and profitability. In my conversations with hundreds of CIOs and CISOs, as well as security leaders from many of the world's largest and most innovative organizations, one message has remained consistently clear: reducing cyber risk isn't about detecting more exposures. It's about operationalizing a cyber risk management program that aligns spend with risk tolerance.
Speaker #3: Thank you, Blair, and welcome to As third actors continue to compress time to our fourth quarter earnings call. exploit, we believe the next phase of pre-breach risk management will be defined by an agentic AI-driven risk fabric with remediation to respond to out-of-the-box business quantification automated the speed of these threats.
Speaker #3: Against that backdrop, we continue to execute well in Q4, demonstrated by another quarter of strong revenue growth and profitability. In my conversations with hundreds of CIOs and CISOs, as well as security leaders from many of the world's largest and most innovative organizations, one message has remained consistently clear: reducing cyber risk isn't about detecting more exposures.
Speaker #3: a cyber risk management program that It's about operationalizing aligns spend with risk tolerance. In doing so, CISOs are increasingly prioritizing the unification of fragmented security stack into a centralized risk fabric.
Blair King: In doing so, CISOs are increasingly prioritizing the unification of fragmented security stack into a centralized risk fabric, one that serves as a credible alternative to single vendor platforms by bringing diverse risk vectors into a prioritized, measurable view of risk that their teams can confidently communicate and remediate at machine speed. That message was further amplified at our recently concluded ROCON conference in Mumbai, with attendance up over 30% from last year's event as we again broadened the agenda to include a business track. And with the advent of AI, which is democratizing cybercrime and enabling adversaries to operate with unprecedented speed and sophistication, this need is only intensifying. As a result, we believe that the future of pre-breach risk management belongs to vendor-agnostic, agentic AI-powered solutions that continuously predict, assist, confirm, quantify, prioritize, and remediate risk across on-prem and multi-cloud environments.
Sumedh Thakar: In doing so, CISOs are increasingly prioritizing the unification of fragmented security stack into a centralized risk fabric, one that serves as a credible alternative to single vendor platforms by bringing diverse risk vectors into a prioritized, measurable view of risk that their teams can confidently communicate and remediate at machine speed. That message was further amplified at our recently concluded ROCON conference in Mumbai, with attendance up over 30% from last year's event as we again broadened the agenda to include a business track. And with the advent of AI, which is democratizing cybercrime and enabling adversaries to operate with unprecedented speed and sophistication, this need is only intensifying. As a result, we believe that the future of pre-breach risk management belongs to vendor-agnostic, agentic AI-powered solutions that continuously predict, assist, confirm, quantify, prioritize, and remediate risk across on-prem and multi-cloud environments.
Speaker #3: One single vendor platforms by that serves as a credible alternative to bringing diverse risk vectors into a prioritized measurable view of risk and remediate at machine that their teams can confidently communicate speed.
Speaker #3: That message was further amplified at our recently concluded RockOn conference in Mumbai, with attendance up over 30% from last year's event, as we again broadened the agenda to include a business track.
Speaker #3: And with the advent of AI, which is democratizing cybercrime and enabling adversaries to operate with unprecedented speed and sophistication, this need is only intensifying.
Speaker #3: As a result, we believe that the future of pre-breach risk management belongs to vendor agnostic agentic AI-powered solutions that continuously predict, assist, confirm, quantify, prioritize, and remediate risk across on-prem and multi-cloud environments.
Blair King: Over the past years, we continue to execute relentlessly towards this vision, delivering meaningful platform innovation to help customers reduce risk faster, operate more efficiently, and stay ahead of an increasingly dynamic threat landscape. Accordingly, in 2025, we broadly expanded the Qualys ETM platform to third-party data and launched a powerful new orchestration layer that unifies Qualys and non-Qualys findings, applies our industry-leading threat intelligence, and delivers a business-contextual, quantified view of risk with built-in prioritization and automated remediation. Building on this foundation, we introduced an agentic AI risk fabric that assesses and normalizes diverse internal and external data sources, applications, and machines. We extended these capabilities with the first-of-a-kind agentic AI risk management marketplace, enabling security and IT teams to quickly augment their existing workforce with highly specialized, autonomous experts that significantly reduce time to remediation, increase accuracy, and reduce costs.
Sumedh Thakar: Over the past years, we continue to execute relentlessly towards this vision, delivering meaningful platform innovation to help customers reduce risk faster, operate more efficiently, and stay ahead of an increasingly dynamic threat landscape. Accordingly, in 2025, we broadly expanded the Qualys ETM platform to third-party data and launched a powerful new orchestration layer that unifies Qualys and non-Qualys findings, applies our industry-leading threat intelligence, and delivers a business-contextual, quantified view of risk with built-in prioritization and automated remediation. Building on this foundation, we introduced an agentic AI risk fabric that assesses and normalizes diverse internal and external data sources, applications, and machines. We extended these capabilities with the first-of-a-kind agentic AI risk management marketplace, enabling security and IT teams to quickly augment their existing workforce with highly specialized, autonomous experts that significantly reduce time to remediation, increase accuracy, and reduce costs.
Speaker #3: past years, we continue to execute a Over the relentlessly towards this vision. Delivering meaningful platform innovation to help customers reduce risk faster, operate more efficiently, and stay ahead of an increasingly dynamic threat landscape.
Speaker #3: Accordingly, in 2025, we broadly expanded the QUALYS ETM platform to third-party data layer that unifies QUALYS and and launched a powerful new orchestration non-QUALYS findings, applies our industry-leading threat intelligence, and delivers a business contextual quantified view of risk with built-in prioritization and automated remediation.
Speaker #3: Building on this foundation, we introduced an agentic AI risk fabric that assesses and normalizes diverse internal and external data sources, applications, and machines. We expanded these capabilities with the first-of-a-kind agentic AI risk management marketplace, enabling security and IT teams to quickly augment their existing workforce with highly specialized autonomous experts that significantly reduce time to remediation, increase accuracy, and reduce costs.
Speaker #3: To further close security gaps, we again organically enhance ETM with a natively integrated identity security posture management solution at a time when identities have become part of the new AI perimeter.
Blair King: To further close security gaps, we again organically enhanced ETM with a natively integrated identity security posture management solution at a time when identities have become part of the new AI perimeter. And further flexing the power of our platform, we are now confirming exploits before customers are compromised. While traditional continuous threat exposure management solutions rely on a theoretical risk score and ignore mitigating security controls, ETM takes a fundamentally different approach. On a single platform, it uniquely detects vulnerabilities, validates exploitability, applies remediation, and revalidates exploits using Agent Val, agentic AI workflow. The net result is that Qualys is redefining how organizations manage pre-breach risk management. While competitors continue to focus on detecting vulnerabilities or mapping theoretical exposures, Qualys has moved decisively beyond that model.
Sumedh Thakar: To further close security gaps, we again organically enhanced ETM with a natively integrated identity security posture management solution at a time when identities have become part of the new AI perimeter. And further flexing the power of our platform, we are now confirming exploits before customers are compromised. While traditional continuous threat exposure management solutions rely on a theoretical risk score and ignore mitigating security controls, ETM takes a fundamentally different approach. On a single platform, it uniquely detects vulnerabilities, validates exploitability, applies remediation, and revalidates exploits using Agent Val, agentic AI workflow. The net result is that Qualys is redefining how organizations manage pre-breach risk management. While competitors continue to focus on detecting vulnerabilities or mapping theoretical exposures, Qualys has moved decisively beyond that model.
Speaker #3: And further flexing the power of our platform, we are now confirming exploits before customers are compromised, while traditional continuous threat exposure management solutions rely on a theoretical risk score and ignore mitigating security controls ETM takes a fundamentally different approach.
Speaker #3: single platform, it uniquely detects On a vulnerabilities, validates exploitability, applies remediation, and revalidates exploit using agent val, agentic AI workflow. The net result is that QUALYS is redefining how organizations manage pre-breach risk management.
Speaker #3: While competitors continue to focus on detecting vulnerabilities or mapping theoretical exposures, QUALYS has moved decisively beyond that model. We are pioneering the first agentic AI native risk operation center, ROC, a new category in cybersecurity designed to centralize an organization's response to threats spanning exploit confirmation to autonomous remediation.
Blair King: We are pioneering the first agentic AI-native risk operations center, ROC, a new category in cybersecurity designed to centralize an organization's response to threats, spanning exploit confirmation to autonomous remediation. Powered by our ETM solution, the ROC presents a fundamental divergence from traditional CTEM tools. Competitors can point to exposures. They can't quantify cyber risk in dollar terms that matters most to the business, and they cannot adequately fix that. ETM fills that gap. This is what sets Qualys apart. We don't stop at detection and non-quantifiable prioritization. We natively integrate CTEM, exploit confirmation, risk quantification, and remediation operations into a single AI-powered workflow, leveraging both Qualys and non-Qualys data sources. In doing so, our architecture orchestrates and implements a perception, reasoning, action loop, enabling autonomous agents to collect real-time telemetry, reason through risk signals, plan response workflows, and execute actions.
Sumedh Thakar: We are pioneering the first agentic AI-native risk operations center, ROC, a new category in cybersecurity designed to centralize an organization's response to threats, spanning exploit confirmation to autonomous remediation. Powered by our ETM solution, the ROC presents a fundamental divergence from traditional CTEM tools. Competitors can point to exposures. They can't quantify cyber risk in dollar terms that matters most to the business, and they cannot adequately fix that. ETM fills that gap. This is what sets Qualys apart. We don't stop at detection and non-quantifiable prioritization. We natively integrate CTEM, exploit confirmation, risk quantification, and remediation operations into a single AI-powered workflow, leveraging both Qualys and non-Qualys data sources. In doing so, our architecture orchestrates and implements a perception, reasoning, action loop, enabling autonomous agents to collect real-time telemetry, reason through risk signals, plan response workflows, and execute actions.
Speaker #3: Powered by our ETM solution, the ROC represents a fundamental divergence from traditional CTEM tools, competitors can point to exposures they can't quantify cyber risk in dollar terms that matters most to the business, and they cannot adequately fix that.
Speaker #3: ETM fills that gap. This is what sets QUALYS apart. We don't stop at detection and non-quantifiable prioritization. We natively integrate CTEM, exploit confirmation, risk quantification, and remediation operations into a single AI-powered workflow, leveraging both QUALYS and non-QUALYS data sources.
Speaker #3: In doing so, our architecture orchestrates and implements a perception reasoning action loop, enabling autonomous agents to collect real-time telemetry, reason through risk signals, plan response workflows, and execute actions.
Speaker #3: This enables organizations to holistically predict emerging risks, across infrastructure, cloud, application security, IoT, and identities, safely confirm probable exploits, prioritize threats based on business impact, remediate through patching, or other compensating controls, and verify the effectiveness of the remediated tactic.
Blair King: This enables organizations to holistically predict emerging risks across infrastructure, cloud, application security, IoT, and identities, safely confirm probable exploits, prioritize threats based on business impact, remediate through patching or other compensating controls, and verify the effectiveness of the remediated tactic. This end-to-end vendor-neutral approach is catalyzing a paradigm shift in pre-breach cyber risk management where customers aren't just seeing their risk holistically across the risk stack. They're validating it, quantifying it, and reducing it continuously and autonomously at scale. By aligning security and IT decisions directly with business priorities, we are providing organizations with measurable proactive risk reduction that brings customer value. Armed with this fresh new set of capabilities and early momentum already validating this model, we are now laser-focused on accelerating ETM adoption through our VMDR customer base and positioning Qualys for larger upsell opportunities over time.
Sumedh Thakar: This enables organizations to holistically predict emerging risks across infrastructure, cloud, application security, IoT, and identities, safely confirm probable exploits, prioritize threats based on business impact, remediate through patching or other compensating controls, and verify the effectiveness of the remediated tactic. This end-to-end vendor-neutral approach is catalyzing a paradigm shift in pre-breach cyber risk management where customers aren't just seeing their risk holistically across the risk stack. They're validating it, quantifying it, and reducing it continuously and autonomously at scale. By aligning security and IT decisions directly with business priorities, we are providing organizations with measurable proactive risk reduction that brings customer value. Armed with this fresh new set of capabilities and early momentum already validating this model, we are now laser-focused on accelerating ETM adoption through our VMDR customer base and positioning Qualys for larger upsell opportunities over time.
Speaker #3: This end-to-end vendor-neutral approach is catalyzing a paradigm shift in pre-breach cyber risk management, where customers aren't just seeing their risk holistically across their risk stack; they're validating it, quantifying it, and reducing it continuously and autonomously at scale.
Speaker #3: By aligning security and IT decisions directly with business priorities, we are providing organizations with measurable, proactive risk reduction that brings customer value. Armed with this fresh new set of capabilities and early momentum already validating this model, we are now laser-focused on accelerating ETM adoption through our VMDR customer base and positioning QUALYS for larger upsell opportunities over time.
Blair King: Moving to our business update, with customers spending $500,000 or more with us growing 4% from a year ago to 215, let me now share a couple of recent wins which illustrate why organizations are ready to centralize their response to cyber risk or turning to Qualys to help unify their security stack, quantify, and remediate risk in their environment, and fortify their security operations. First, an existing Global 50 customer was struggling under the weight of multiple unintegrated security tools, millions of vulnerabilities, and limited visibility into the overall risk profile. Traditional prioritization methods were unable to adequately filter critical findings, leaving security and IT teams without the necessary business context to act decisively. Consequently, this customer selected Qualys and launched a strategic initiative to unify their security stack by transforming siloed risk signals, spanning on-prem and multi-cloud environments, into a cohesive Agentic AI-native risk management solution.
Sumedh Thakar: Moving to our business update, with customers spending $500,000 or more with us growing 4% from a year ago to 215, let me now share a couple of recent wins which illustrate why organizations are ready to centralize their response to cyber risk or turning to Qualys to help unify their security stack, quantify, and remediate risk in their environment, and fortify their security operations. First, an existing Global 50 customer was struggling under the weight of multiple unintegrated security tools, millions of vulnerabilities, and limited visibility into the overall risk profile. Traditional prioritization methods were unable to adequately filter critical findings, leaving security and IT teams without the necessary business context to act decisively. Consequently, this customer selected Qualys and launched a strategic initiative to unify their security stack by transforming siloed risk signals, spanning on-prem and multi-cloud environments, into a cohesive Agentic AI-native risk management solution.
Speaker #3: update with customers spending Moving to our business $500,000 or more with us growing 4% from a year ago to $215, let me now share a couple of recent wins which illustrate why organizations are ready to centralize their response to cyber risk are turning to QUALYS to help unify their security stack, quantify and remediate risk in their environment, and fortify their security operations.
Speaker #3: First, an existing global 50 customer was struggling under the weight of multiple unintegrated security tools. Millions of vulnerabilities and limited visibility into the overall risk profile.
Speaker #3: Traditional prioritization methods were unable to adequately filter critical findings, leaving security and IT teams without the necessary business context to act decisively. Consequently, this customer selected QUALYS and launched a strategic initiative to unify their security stack by transforming siloed risk signals, spanning on-prem and multi-cloud environment, into a cohesive agentic AI native risk management solution.
Speaker #3: This included expanding the ETM deployment to further operationalize their ROC with ingested third-party data from several sources, resulting in a mid-six-figure annual bookings upsell.
Blair King: This included expanding the ETM deployment to further operationalize the ROC with ingested third-party data from several sources, resulting in a mid-six-figure annual bookings upsell. By consolidating these data sources into the Qualys platform, we are now delivering this customer a unified orchestration layer and full visibility of their attack surface, centralized risk assessment, quantification, prioritization, and remediation workflows, while unleashing the operational efficiency of the stack consolidation. This expansion of the ROC underscores the power of our platform and reinforces Qualys' ability to unify siloed risk signals, operate as an autonomous defense layer, strengthen customer outcomes aligned to the business risk tolerance, and advance our leadership in the industry. Leveraging our MROC partner ecosystem, we are also pulling new business into Qualys.
Sumedh Thakar: This included expanding the ETM deployment to further operationalize the ROC with ingested third-party data from several sources, resulting in a mid-six-figure annual bookings upsell. By consolidating these data sources into the Qualys platform, we are now delivering this customer a unified orchestration layer and full visibility of their attack surface, centralized risk assessment, quantification, prioritization, and remediation workflows, while unleashing the operational efficiency of the stack consolidation. This expansion of the ROC underscores the power of our platform and reinforces Qualys' ability to unify siloed risk signals, operate as an autonomous defense layer, strengthen customer outcomes aligned to the business risk tolerance, and advance our leadership in the industry. Leveraging our MROC partner ecosystem, we are also pulling new business into Qualys.
Speaker #3: By consolidating these data sources into the QUALYS platform, we are now delivering this customer a unified orchestration layer and full visibility centralized risk assessment, quantification, of their attack surface, prioritization, and remediation workflows while unleashing the operational efficiency of the stack consolidation.
Speaker #3: of the ROC underscores the power of This expansion our platform and reinforces QUALYS' ability to unify siloed risk signals, operate at an autonomous defense layer, strengthen customer outcomes aligned to the business risk tolerance, and advance our leadership in the industry.
Speaker #3: Leveraging our MROC partner ecosystem, we are also pulling new business into QUALYS. During the planning stages of launching a new ETM POC with a global 200 company in Latin America, we secured a seven-figure annual bookings upsell, which included our total cloud CNAP and policy audit solutions.
Blair King: During the planning stages of launching a new ETM POC with a Global 200 company in Latin America, we secured a $ seven-figure annual bookings upsell, which included our TotalCloud CNAPP and Policy Audit solutions. This win demonstrates the leverage of our partner-led motion and our ability to convert early engagements into meaningful multi-solution growth. Turning to our federal business, we achieved a $ mid-six-figure expansion with one of the federal government's most visible shared security services utilized by several large government agencies nationwide. Faced with an overwhelming volume of security issues and limited resources to continuously assess risk across fragmented tools and manual workflows, this customer chose Qualys for its cloud-native FedRAMP high-authorized platform to enable a centralized government program that quantitatively prioritizes risk with automated assessment, standard outputs, and low operational overhead.
Sumedh Thakar: During the planning stages of launching a new ETM POC with a Global 200 company in Latin America, we secured a $ seven-figure annual bookings upsell, which included our TotalCloud CNAPP and Policy Audit solutions. This win demonstrates the leverage of our partner-led motion and our ability to convert early engagements into meaningful multi-solution growth. Turning to our federal business, we achieved a $ mid-six-figure expansion with one of the federal government's most visible shared security services utilized by several large government agencies nationwide. Faced with an overwhelming volume of security issues and limited resources to continuously assess risk across fragmented tools and manual workflows, this customer chose Qualys for its cloud-native FedRAMP high-authorized platform to enable a centralized government program that quantitatively prioritizes risk with automated assessment, standard outputs, and low operational overhead.
Speaker #3: of our partner-led motion and This win demonstrates the leverage our ability to convert early engagements into meaningful multi-solution growth. Turning to our federal business, we achieved a mid-six-figure expansion with one of the federal government's most visible shared security services, utilized by several large government agencies nationwide.
Speaker #3: Faced with an overwhelming volume of security issues at limited resources to continuously assess risk across fragmented tools and manual workflows, this customer chose QUALYS for its cloud-native FedRAMP high-authorized platform to enable a centralized government program that quantitatively prioritizes risk with automated assessment, standard outputs, and low operational overhead.
Speaker #3: Given the success of this deployment, we are now working towards a multi-agency ETM rollout representing a significant upsell opportunity as this shared service team prepares to operationalize its risk operation center.
Blair King: Given the success of this deployment, we are now working towards a multi-agency ETM rollout, representing a significant upsell opportunity as this shared services team prepares to operationalize its risk operations center. These results, alongside another six-figure upsell with a separate large federal agency, reinforce our proven ability to align technical capabilities with operational outcomes that address modern security challenges and underscore the long-term growth opportunity in our federal business. Beyond these wins, we are also gaining more leverage from our partner ecosystem. As we continue to endorse a partner-first-sales motion, partner-led deal registration increased again in Q4, reflecting deeper alignment and execution across the channel. In addition, with well over a dozen certified MROC partners actively launching new services, momentum continues to build towards a global ROC alliance, fueling our capability, harnessing transformative solution sales, and bringing new business to Qualys.
Sumedh Thakar: Given the success of this deployment, we are now working towards a multi-agency ETM rollout, representing a significant upsell opportunity as this shared services team prepares to operationalize its risk operations center. These results, alongside another six-figure upsell with a separate large federal agency, reinforce our proven ability to align technical capabilities with operational outcomes that address modern security challenges and underscore the long-term growth opportunity in our federal business. Beyond these wins, we are also gaining more leverage from our partner ecosystem. As we continue to endorse a partner-first-sales motion, partner-led deal registration increased again in Q4, reflecting deeper alignment and execution across the channel. In addition, with well over a dozen certified MROC partners actively launching new services, momentum continues to build towards a global ROC alliance, fueling our capability, harnessing transformative solution sales, and bringing new business to Qualys.
Speaker #3: These results, alongside another six-figure upsell with a separate large federal agency, reinforce our proven ability to align technical capabilities with operational outcomes that address modern security challenges and underscore the long-term growth opportunity in our federal business.
Speaker #3: Beyond these wins, we are also gaining more leverage from our partner ecosystem. As we continue to endorse a partner-first sales motion, partner-led deal registration increased again in Q4.
Speaker #3: Reflecting deeper alignment and execution across the channel. In addition, with well over a dozen certified MROC partners actively launching new services, momentum continues to build towards a global ROC alliance, fueling our capability, harnessing transformative solution sales, and bringing new business to QUALYS.
Speaker #3: Further contributing to our growth profile, QFlex to help customers accelerate and maximize adoption of the QUALYS ETM platform. Given the strong customer response and early success of this model, we plan to continue to focus on proactively identifying opportunities to leverage QFlex to enable select customers and partners to accelerate their adoption of QUALYS solutions in 2026.
Blair King: Further contributing to our growth profile, in Q4, we continued beta testing QFlex to help customers accelerate and maximize adoption of the Qualys ETM platform. Given the strong customer response and early success of this model, we plan to continue to focus on proactively identifying opportunities to leverage QFlex to enable select customers and partners to accelerate their adoption of Qualys solutions in 2026. In summary, we are fundamentally changing how organizations manage pre-breach cyber risk by unifying CTEM with exploit confirmation, risk quantification, and automated remediation powered by an agentic AI risk fabric. Our rapid pace of innovation and strategic investments are driving strong competitive differentiation, deeper ROC adoption, broader engagements across large federal agencies, growing partner-led execution, and initial QFlex success.
Sumedh Thakar: Further contributing to our growth profile, in Q4, we continued beta testing QFlex to help customers accelerate and maximize adoption of the Qualys ETM platform. Given the strong customer response and early success of this model, we plan to continue to focus on proactively identifying opportunities to leverage QFlex to enable select customers and partners to accelerate their adoption of Qualys solutions in 2026. In summary, we are fundamentally changing how organizations manage pre-breach cyber risk by unifying CTEM with exploit confirmation, risk quantification, and automated remediation powered by an agentic AI risk fabric. Our rapid pace of innovation and strategic investments are driving strong competitive differentiation, deeper ROC adoption, broader engagements across large federal agencies, growing partner-led execution, and initial QFlex success.
Speaker #3: In summary, we are fundamentally changing how organizations manage pre-breach cyber risk by unifying CTEP with expert-confirmation risk quantification and automated remediation powered by an agentic AI risk fabric.
Speaker #3: Our rapid pace of innovation and strategic investments are driving strong competitive differentiation, deeper ROC adoption, broader engagements across large federal agencies, growing partner-led execution, and initial QFlex success.
Blair King: Looking ahead to 2026, we'll continue our disruptive innovation, further advance our go-to-market investments, and execute our ROC vision with a balanced approach to long-term growth and profitability. With that, I will turn the call over to Joo Mi Kim to further discuss our Q4 results and outlook for the Q1 and full year 2026. Thanks, Maddie, and good afternoon. Before I start, I'd like to note that except for revenues, all financial figures are non-GAAP, and growth rates are based on comparison to the prior year period unless stated otherwise. We're pleased to report a healthy finish to the year, highlighting our continued execution, financial discipline, and scalable business model. For the full year, we grew revenues by 10% to $669.1 million and achieved adjusted EBITDA margin of 47%, even with continued 14% growth in investments and sales and marketing.
Sumedh Thakar: Looking ahead to 2026, we'll continue our disruptive innovation, further advance our go-to-market investments, and execute our ROC vision with a balanced approach to long-term growth and profitability. With that, I will turn the call over to Joo Mi Kim to further discuss our Q4 results and outlook for the Q1 and full year 2026.
Speaker #3: In 2026, we'll continue our disruptive innovation. Looking ahead, we plan to further advance our go-to-market investments and execute our ROC vision with a balanced approach to long-term growth and profitability.
Speaker #3: With that, I will turn the call over to Jumi to further discuss our fourth-quarter results and outlook for the first quarter and full year 2026.
Joo Mi Kim: Thanks, Maddie, and good afternoon. Before I start, I'd like to note that except for revenues, all financial figures are non-GAAP, and growth rates are based on comparison to the prior year period unless stated otherwise. We're pleased to report a healthy finish to the year, highlighting our continued execution, financial discipline, and scalable business model. For the full year, we grew revenues by 10% to $669.1 million and achieved adjusted EBITDA margin of 47%, even with continued 14% growth in investments and sales and marketing.
Speaker #2: Thanks, Ned and good afternoon. Before I start, I'd like to note that except for revenue, all financial figures are non-gas and growth rates are based on comparison to the prior year period unless stated otherwise.
Speaker #2: We're pleased to report a healthy finish to the year. Highlighting our continued execution, financial discipline, and scalable business model. For the full year, we grew revenues by 10% to $669.1 million, and achieved adjusted EBITDA margin of 47%.
Speaker #2: Even with continued 14% growth and investments in sales and marketing, net income and EPS grew 13% and 15% to $257.8 million and $7.07 per diluted share, respectively.
Blair King: Net income and EPS grew 13% and 15% to $257.8 million and 7.07 per diluted share, respectively. Free cash flow reached $304.4 million with 45% of revenues, all of which exceeded our expectations for the year. Turning to fourth quarter results, revenues grew 10% to $175.3 million. The channel continued to increase its contribution, making up 51% of total revenues compared to 48% a year ago. Revenues from channel partners grew 17%, outpacing direct, which grew 4%. As a result of our strategic emphasis on leveraging our partner ecosystem to drive growth, we expect this trend to continue. By geo, 15% growth outside the US was ahead of our domestic business, which grew 6%. US and international revenue mix was 56% and 44%, respectively.
Joo Mi Kim: Net income and EPS grew 13% and 15% to $257.8 million and 7.07 per diluted share, respectively. Free cash flow reached $304.4 million with 45% of revenues, all of which exceeded our expectations for the year. Turning to fourth quarter results, revenues grew 10% to $175.3 million. The channel continued to increase its contribution, making up 51% of total revenues compared to 48% a year ago. Revenues from channel partners grew 17%, outpacing direct, which grew 4%. As a result of our strategic emphasis on leveraging our partner ecosystem to drive growth, we expect this trend to continue. By geo, 15% growth outside the US was ahead of our domestic business, which grew 6%. US and international revenue mix was 56% and 44%, respectively.
Speaker #2: And free cash flow reached $304.4 million, or 45% of revenues, all of which exceeded our expectations for the year. Turning to fourth-quarter results, revenues grew 10% to $175.3 million.
Speaker #2: The channel continued to increase its contribution, making a 51% of total revenues compared to 48% a year ago. Revenues from channel partners grew 17%, outpacing direct, which grew 4%.
Speaker #2: As a result of our strategic emphasis on leveraging our partner ecosystem to drive growth, we expect this trend to continue. By GEO, 15% growth outside the US was ahead of our domestic business, which grew 6%.
Speaker #2: US and international revenue mix was 56% and 44%, respectively. With customers confirming their prioritization of security within IT budgets, we anticipate the selling environment in 2026 to remain similar to last year, with a low to mid-single-digit growth in security spend persisting for the foreseeable future.
Blair King: With customers confirming their prioritization of security within IT budgets, we anticipate the selling environment in 2026 to remain similar to last year, with a low to mid-single-digit growth in security spend persisting for the foreseeable future. Reflecting this sentiment, our Gross Dollar Retention rate remained comfortably above 90%. We saw a modest sequential decline in Q4, with our Net Dollar Expansion rate at 103%, down from 104% last quarter. In terms of product mix, our differentiated new products continue to drive growth, with all three of the following increasing contribution to bookings in 2025. First, CyberSecurity Asset Management, combined with ETM, made up 10% of total bookings and 13% of new bookings in 2025, up from last year's 8% and 9%, respectively. Next, Patch Management made up 8% of total bookings and 16% of new bookings in 2025, up from last year's 7% and 16%, respectively.
Joo Mi Kim: With customers confirming their prioritization of security within IT budgets, we anticipate the selling environment in 2026 to remain similar to last year, with a low to mid-single-digit growth in security spend persisting for the foreseeable future. Reflecting this sentiment, our Gross Dollar Retention rate remained comfortably above 90%. We saw a modest sequential decline in Q4, with our Net Dollar Expansion rate at 103%, down from 104% last quarter. In terms of product mix, our differentiated new products continue to drive growth, with all three of the following increasing contribution to bookings in 2025. First, CyberSecurity Asset Management, combined with ETM, made up 10% of total bookings and 13% of new bookings in 2025, up from last year's 8% and 9%, respectively. Next, Patch Management made up 8% of total bookings and 16% of new bookings in 2025, up from last year's 7% and 16%, respectively.
Speaker #2: Reflecting this sentiment, our gross dollar retention rate remained comfortably above 90%, but saw a modest sequential decline in Q4, with our net dollar expansion rate at 103%, down from 104% last quarter.
Speaker #2: In terms of product mix, our differentiated new products continue to drive growth, with all three of the following increase in contribution to bookings in 2025.
Speaker #2: First, cybersecurity asset management, combined with ETM, made up 10% of total bookings and 13% of new bookings in 2025, up from last year's respectively.
Speaker #2: Patch management made up 8% of next total bookings and 16% of new bookings in 2025, up from last year's 7% and 16%, respectively. Lastly, total cloud made up 5% of total bookings in 2025, up from 4% a year ago.
Blair King: Lastly, TotalCloud made up 5% of total bookings in 2025, up from 4% a year ago. We believe that these differentiated products combined will continue to increase contribution to bookings in 2026, given our opportunity to increase market share and maximize share of wallet. Turning to profitability, Adjusted EBITDA for the fourth quarter of 2025 was $82.6 million, representing a 47% margin, same as last year's. Operating expenses in Q4 increased by 11% to $68.9 million, driven by investments in sales and marketing, which grew 18%. With this strong performance, EPS for the fourth quarter of 2025 was $1.87 per diluted share, and our Free Cash Flow was $74.9 million, representing a 43% margin compared to 26% in the prior year.
Joo Mi Kim: Lastly, TotalCloud made up 5% of total bookings in 2025, up from 4% a year ago. We believe that these differentiated products combined will continue to increase contribution to bookings in 2026, given our opportunity to increase market share and maximize share of wallet. Turning to profitability, Adjusted EBITDA for the fourth quarter of 2025 was $82.6 million, representing a 47% margin, same as last year's. Operating expenses in Q4 increased by 11% to $68.9 million, driven by investments in sales and marketing, which grew 18%. With this strong performance, EPS for the fourth quarter of 2025 was $1.87 per diluted share, and our Free Cash Flow was $74.9 million, representing a 43% margin compared to 26% in the prior year.
Speaker #2: We believe that these differentiated products combined will continue to increase contribution to bookings in 2026, given our opportunity to increase market share and maximize share of wallet.
Speaker #2: profitability, adjusted EBITDA for Turning to the fourth quarter of 2025 was $82.6 million, representing a 47% margin, same as last year's. Operating expenses in Q4 increased by 11% to $68.9 million, driven by investments in sales and marketing, which grew 18%.
Speaker #2: With a strong performance, EPS for the fourth quarter of 2025 was $1.87 per diluted share, and our free cash flow was $74.9 margin, compared to 26% in the million.
Speaker #2: Representing a 43% year. In Q4, we continued to invest a cash we generated from operations back into QUALYS, including $724,000 on capital expenditures, and $44.7 million to repurchase $328,000 of our outstanding shares.
Blair King: In Q4, we continue to invest the cash we generated from operations back into Qualys, including $724,000 on capital expenditures and $44.7 million to repurchase 328,000 of our outstanding shares. Since commencing our share repurchase program in February of 2018, we've repurchased 10.7 million shares and returned over $1.2 billion in cash to shareholders. As of the end of the quarter, we had $160.5 million remaining in our share repurchase program. We're pleased to announce that our board has authorized another increase of $200 million to the share repurchase program, bringing the total available amount for share repurchases to $360.5 million. With that, let us turn to guidance, starting with revenues. For the full year 2026, we expect revenues to be in the range of $717 to 725 million, which represents a growth rate of 7% to 8%.
Joo Mi Kim: In Q4, we continue to invest the cash we generated from operations back into Qualys, including $724,000 on capital expenditures and $44.7 million to repurchase 328,000 of our outstanding shares. Since commencing our share repurchase program in February of 2018, we've repurchased 10.7 million shares and returned over $1.2 billion in cash to shareholders. As of the end of the quarter, we had $160.5 million remaining in our share repurchase program. We're pleased to announce that our board has authorized another increase of $200 million to the share repurchase program, bringing the total available amount for share repurchases to $360.5 million. With that, let us turn to guidance, starting with revenues. For the full year 2026, we expect revenues to be in the range of $717 to 725 million, which represents a growth rate of 7% to 8%.
Speaker #2: Since commencing our share repurchase program in February of 2018, we've repurchased $10.7 million shares and returned over $1.2 billion in cash to shareholders. As of the end of the quarter, we had $160.5 million remaining in our share repurchase program.
Speaker #2: guidance, starting with revenues. For the full year 2026, we expect revenues to be in the range of $717 to $725 million, which represents a growth rate of 7 to 8%.
Speaker #2: For the first quarter of 2026, we expect revenues to be in the range of $172.5 to $174.5 million. Representing a growth rate of 8 to 9%.
Blair King: For Q1 2026, we expect revenues to be in the range of $172.5 to 174.5 million, representing a growth rate of 8% to 9%. This guidance assumes no material change in our Net Dollar Expansion rate, with moderate growth contribution from new business in 2026. Shifting to profitability guidance, for the full year 2026, we expect EBITDA margin to be in the mid-40s, implying mid-teens increase in operating expenses, and free cash flow margin in the low 40s. We expect full-year EPS to be in the range of 7.17 to 7.45. For Q1 2026, we expect EPS to be in the range of 1.76 to 1.83. Our planned capital expenditures in 2026 are expected to be in the range of $8 to 12 million, and for Q1 2026, in the range of $1.2 to 2.6 million.
Joo Mi Kim: For Q1 2026, we expect revenues to be in the range of $172.5 to 174.5 million, representing a growth rate of 8% to 9%. This guidance assumes no material change in our Net Dollar Expansion rate, with moderate growth contribution from new business in 2026. Shifting to profitability guidance, for the full year 2026, we expect EBITDA margin to be in the mid-40s, implying mid-teens increase in operating expenses, and free cash flow margin in the low 40s. We expect full-year EPS to be in the range of 7.17 to 7.45. For Q1 2026, we expect EPS to be in the range of 1.76 to 1.83. Our planned capital expenditures in 2026 are expected to be in the range of $8 to 12 million, and for Q1 2026, in the range of $1.2 to 2.6 million.
Speaker #2: This guidance assumes no material change in our net dollar expansion rate, with moderate growth contribution from new business in 2026. Shifting to profitability guidance, for the full year 2026, we expect EBITDA margin to be in the mid-40s, implying mid-teens increase in operating expenses, and free cash flow margin in the low-40s.
Speaker #2: We expect full-year EPS to be in the range of $7.17 to $7.45. For the first quarter of 2026, we expect EPS to be in the range of $1.76 to $1.83.
Speaker #2: Our planned capital expenditures in 2026 are expected to be in the range of $8 to $12 million. And for the first quarter of 2026, in the range of $1.2 to $2.6 million.
Speaker #2: In 2026, with respect to operating expenses, we plan to align our product and marketing investments to focus on specific initiatives aimed at driving more pipeline, accelerating our partner program, and expanding our federal vertical.
Blair King: In 2026, with respect to operating expenses, we plan to align our product and marketing investments to focus on specific initiatives aimed at driving more pipeline, accelerating our partner program, and expanding our federal vertical. As a percentage of revenues, we expect to prioritize an increase in investments in sales and marketing, with more modest increases in engineering and G&A. With that, Sumedh and I would be happy to answer any of your questions.
Joo Mi Kim: In 2026, with respect to operating expenses, we plan to align our product and marketing investments to focus on specific initiatives aimed at driving more pipeline, accelerating our partner program, and expanding our federal vertical. As a percentage of revenues, we expect to prioritize an increase in investments in sales and marketing, with more modest increases in engineering and G&A. With that, Sumedh and I would be happy to answer any of your questions.
Speaker #2: As a percentage of revenues, we expect to prioritize an increase in investments in sales and marketing, with more modest increases in engineering and G&A.
Speaker #2: With that, Sumed and I would be happy to answer any of your questions.
Speaker #1: Thank you. As a reminder to ask a question, please press star 11 on your telephone. And wait for your name to be announced. To withdraw your question, please press star 11 again.
Operator: Thank you. As a reminder to ask a question, please press star 11 on your telephone and wait for your name to be announced. To withdraw your question, please press star 11 again. The first question comes from Jonathan Ho with William Blair. Your line is open.
Operator: Thank you. As a reminder to ask a question, please press star 11 on your telephone and wait for your name to be announced. To withdraw your question, please press star 11 again. The first question comes from Jonathan Ho with William Blair. Your line is open.
Speaker #1: And the first question comes from Jonathan Ho with William Blair. You're lying is open.
Speaker #2: Hi, good afternoon, and congratulations on the strong quarter. Can you talk a little bit more about some of your QFLEX offerings and how it potentially helps remove friction and perhaps encourages broader adoption of your platform?
Jonathan Ho: Hi, good afternoon, and congratulations on the strong quarter. Can you talk a little bit more about some of your QFlex offerings and how it potentially helps remove friction and perhaps encourages broader adoption of your platform?
Jonathan Ho: Hi, good afternoon, and congratulations on the strong quarter. Can you talk a little bit more about some of your QFlex offerings and how it potentially helps remove friction and perhaps encourages broader adoption of your platform?
Speaker #3: Yeah, thank you very much. And that's a great question. We've talked about this last quarter as well. I think if you have to, if you take that in relation to what we are doing with the risk operations center and ETM, and how we're differentiating ourselves from the exposure management solutions, is that the ability to detect all your assets, find your vulnerabilities, ability to use agentic AI to actually not only prioritize those, which is what a lot of these exposure management solutions do, which is just giving you a score, we're leveraging the ability to use agentic AI to confirm those exploits within the environment, which is very differentiated from what everybody does.
Sumedh Thakar: Yeah, thank you very much. That's a great question. We've talked about this last quarter as well. I think if you take that in relation to what we are doing with the Risk Operations Center and ETM, and how we're differentiating ourselves from the exposure management solutions is that the ability to detect all your assets, find your vulnerabilities, ability to use Agentic AI to actually not only prioritize those, which is what a lot of these exposure management solutions do, which is just giving you a score. We're leveraging the ability to use Agentic AI to confirm those exploits within the environment, which is very differentiated from what everybody does. But then after that, actually, the ability to also remediate those.
Sumedh Thakar: Yeah, thank you very much. That's a great question. We've talked about this last quarter as well. I think if you take that in relation to what we are doing with the Risk Operations Center and ETM, and how we're differentiating ourselves from the exposure management solutions is that the ability to detect all your assets, find your vulnerabilities, ability to use Agentic AI to actually not only prioritize those, which is what a lot of these exposure management solutions do, which is just giving you a score. We're leveraging the ability to use Agentic AI to confirm those exploits within the environment, which is very differentiated from what everybody does. But then after that, actually, the ability to also remediate those.
Speaker #3: But then after that, actually, the ability to also remediate those—and so being able to get this end-to-end very quickly, very fast before attackers are leveraging AI to do the same for your environment—the QFLEX proposal allows the customer, at their pace, to then be able to platform with Qualys and do that over a period of time during their subscription with us. That allows them to maybe initially start with more of that prioritization and confirmation, but then as the year goes by, it allows them to leverage our eliminate capabilities more and more to be able to focus on getting the outcome of getting these things fixed.
Sumedh Thakar: And so being able to get this end-to-end very quickly, very fast, before attackers are leveraging AI to do the same for your environment, the QFlex proposal allows the customer at their pace to then be able to consolidate a lot of these capabilities on a single platform with Qualys and do that over a period of time during their subscription with us, which allows them to maybe initially start with more of that prioritization and confirmation. But then as the year goes by, it allows them then to leverage our eliminate capabilities more and more to be able to focus on getting the outcome of getting these things fixed. And so what we're excited about is our conversations initially with the customers that have adopted this have been very positive in the fact that the security environment is not a static environment at the beginning of the year.
Sumedh Thakar: And so being able to get this end-to-end very quickly, very fast, before attackers are leveraging AI to do the same for your environment, the QFlex proposal allows the customer at their pace to then be able to consolidate a lot of these capabilities on a single platform with Qualys and do that over a period of time during their subscription with us, which allows them to maybe initially start with more of that prioritization and confirmation. But then as the year goes by, it allows them then to leverage our eliminate capabilities more and more to be able to focus on getting the outcome of getting these things fixed. And so what we're excited about is our conversations initially with the customers that have adopted this have been very positive in the fact that the security environment is not a static environment at the beginning of the year.
Speaker #3: And so we're excited about is our conversations initially with the customers that have adopted this, have been very positive in the fact that the security environment is not a static environment at the beginning of the year.
Speaker #3: It is continuously changing throughout the year. And the flexibility that that pricing model offers them to actually be able to leverage different QUALYS capabilities throughout the year as the threats change, is a very big positive for them.
Sumedh Thakar: It is continuously changing throughout the year. The flexibility that that pricing model offers them to actually be able to leverage different Qualys capabilities throughout the year as the threats change is a very big positive for them. So really happy with the feedback we have gotten in the beta phase. And at this year, 2026, we look forward to doing more of that and moving more towards a GA model for that.
Sumedh Thakar: It is continuously changing throughout the year. The flexibility that that pricing model offers them to actually be able to leverage different Qualys capabilities throughout the year as the threats change is a very big positive for them. So really happy with the feedback we have gotten in the beta phase. And at this year, 2026, we look forward to doing more of that and moving more towards a GA model for that.
Speaker #3: So really happy with the feedback we have gotten in the beta phase. And at this year, 2026, we look forward to doing more of that and moving more towards the GA model for that.
Speaker #1: Got it. Got it. And then just in terms of some of your comments around AI, I mean, clearly you're seeing a lot of customer interest here.
Jonathan Ho: Got it. Got it. And then just in terms of some of your comments around AI, I mean, clearly you're seeing a lot of customer interest here. Can you maybe help us understand where the customer is in terms of their AI journey and also help us understand what that uplift opportunity looks like for Qualys? So if you start selling more of these agentic products, AI sort of native products, how do we think about how that can impact sort of net retention going forward? Thank you.
Jonathan Ho: Got it. Got it. And then just in terms of some of your comments around AI, I mean, clearly you're seeing a lot of customer interest here. Can you maybe help us understand where the customer is in terms of their AI journey and also help us understand what that uplift opportunity looks like for Qualys? So if you start selling more of these agentic products, AI sort of native products, how do we think about how that can impact sort of net retention going forward? Thank you.
Speaker #1: Can you maybe help us understand where the customer is in terms of their AI journey and also help us understand what that uplift opportunity looks like for QUALYS?
Speaker #1: So, if you start selling more of these agentic products, AI sort of native products, how do we think about how that can impact sort of net retention going forward?
Speaker #1: Thank you.
Speaker #3: Sure. I think a lot of people talk about AI is embedded in their platform. I think where we differentiate ourselves is the what we have done is introduce the concept of an AI agent marketplace within the platform, which allows the customers to actually augment their workforce, their security team, which we have talked about this for years, that there's never been enough talent in the security space.
Sumedh Thakar: Sure. I think a lot of people talk about AI is embedded in their platform. I think where we differentiate ourselves is what we have done is introduce the concept of an AI agent marketplace within the platform, which allows the customers to actually augment their workforce, their security team, which we have talked about this for years, that there's never been enough talent in the security space. So the ability to get Agent Sarah, who's an expert in patches data, the ability to get Agent Val, who's an expert agent with skill sets that can autonomously make calculations and decisions on exploitation, remediation.
Sumedh Thakar: Sure. I think a lot of people talk about AI is embedded in their platform. I think where we differentiate ourselves is what we have done is introduce the concept of an AI agent marketplace within the platform, which allows the customers to actually augment their workforce, their security team, which we have talked about this for years, that there's never been enough talent in the security space. So the ability to get Agent Sarah, who's an expert in patches data, the ability to get Agent Val, who's an expert agent with skill sets that can autonomously make calculations and decisions on exploitation, remediation.
Speaker #3: So, the ability to get agent Sarah, who's an expert in patches data, and the ability to get agent Val, who's an expert agent with skill sets that can autonomously make calculations and decisions on exploitation remediation.
Speaker #3: So the ability to say, "Look, I want to employ this particular agent on the platform to achieve a task which otherwise would take me weeks and months to hire a consultant to get that outcome." What we've done with our agentic AI capabilities is not only have those built-in throughout the platform, but with agentic AI, we can now actually have these agents that feel like they're really part of that team, and they can help you get those outcomes.
Sumedh Thakar: So the ability to say, "Look, I want to employ this particular agent on the platform to achieve a task, which otherwise would take me weeks and months to hire a consultant to get that outcome." What we've done with our Agentic AI capabilities is not only have those built-in throughout the platform, but with Agentic AI, we can now actually have these agents that feel like they're really part of that team, and they can help you get those outcomes. And the way we have really positioned this is that customers who are leveraging VMDR, they get a really high-quality list of findings. But then as they cross-sell into ETM, they get the ability to not only do the prioritization of these vulnerabilities, but they get the Agentic AI capabilities, which then allow them to achieve different tasks.
Sumedh Thakar: So the ability to say, "Look, I want to employ this particular agent on the platform to achieve a task, which otherwise would take me weeks and months to hire a consultant to get that outcome." What we've done with our Agentic AI capabilities is not only have those built-in throughout the platform, but with Agentic AI, we can now actually have these agents that feel like they're really part of that team, and they can help you get those outcomes. And the way we have really positioned this is that customers who are leveraging VMDR, they get a really high-quality list of findings. But then as they cross-sell into ETM, they get the ability to not only do the prioritization of these vulnerabilities, but they get the Agentic AI capabilities, which then allow them to achieve different tasks.
Speaker #3: And the way we have really positioned this is that customers who are leveraging VMDR, they get a really high-quality list of findings. But then, as they cross-sell into ETM, they get the ability to not only do the prioritization of these vulnerabilities, but they get the agentic AI capabilities, which then allow them to achieve different tasks.
Speaker #3: And as you look at how customers are thinking of headcount, etc., in the agentic AI world, these really help them get to those outcomes pretty quickly.
Sumedh Thakar: And as you look at how customers are thinking of headcount, etc., in the agentic AI world, these really help them get to those outcomes pretty quickly. And then, of course, in addition to that, with TotalAI offering, we're also helping customers detect, find, and address vulnerabilities and misconfigurations that are coming up in the AI workload that they have. And so with that, we look forward to customers bringing more data around their own agentic, around their own AI solutions into Qualys ETM. And we believe that the agentic AI capabilities are a differentiator for customers to upgrade from or to cross-sell from VMDR into ETM, as well as looking at some of the other exposure management solutions where they just give you a score. This will allow them to actually use an agentic AI to get patching done pretty fast and pretty quickly.
Sumedh Thakar: And as you look at how customers are thinking of headcount, etc., in the agentic AI world, these really help them get to those outcomes pretty quickly. And then, of course, in addition to that, with TotalAI offering, we're also helping customers detect, find, and address vulnerabilities and misconfigurations that are coming up in the AI workload that they have. And so with that, we look forward to customers bringing more data around their own agentic, around their own AI solutions into Qualys ETM. And we believe that the agentic AI capabilities are a differentiator for customers to upgrade from or to cross-sell from VMDR into ETM, as well as looking at some of the other exposure management solutions where they just give you a score. This will allow them to actually use an agentic AI to get patching done pretty fast and pretty quickly.
Speaker #3: our total AI offering, we're also helping And then, of course, in addition to that, with customers detect, find, and address vulnerabilities and misconfigurations that are coming up in the AI workload that they have.
Speaker #3: And so with that, we look forward to customers bringing more data around their own agentic around their own AI solutions into QUALYS ETM and we believe that the agentic AI capabilities are differentiator for customers to upgrade from or to cross-sell from VMDR into ETM as well as looking at some of the other exposure management solutions where they just give you a score, this will allow them to actually use an agentic AI to get patching done pretty fast and pretty quickly.
Speaker #3: And so we see that that differentiation can be the catalyst for us, for customers to pick ETM over some of those other exposure management solutions that are out.
Sumedh Thakar: We see that that differentiation can be the catalyst for us, for customers, to pick ETM over some of those other exposure management solutions that are out there.
Sumedh Thakar: We see that that differentiation can be the catalyst for us, for customers, to pick ETM over some of those other exposure management solutions that are out there.
Speaker #3: there.
Speaker #1: Thank
Jonathan Ho: Thank you.
Jonathan Ho: Thank you.
Operator: Thank you. The next question will come from Kingsley Crane with Canaccord. Your line is open.
Operator: Thank you. The next question will come from Kingsley Crane with Canaccord. Your line is open.
Speaker #4: Thank you. you. And the next question will come from Kingsley Crane with Canaccord. Your line is open.
Speaker #5: Hi. Congrats on the quarter. You answered some of this in the prior response, but we'd just love to hear more about how Agent Val is elevating ETM from an efficacy perspective and just how Agent Val is reducing total man-hours at the customer level, and how that's resonating with customers.
Kingsley Crane: Hi. Congrats on the quarter. You answered some of this in the prior response, but we'd just love to hear more about how Agent Val is elevating ETM from an efficacy perspective and just how Agent Val is reducing total man-hours at the customer level and how that's resonating with customers. Thanks.
Kingsley Crane: Hi. Congrats on the quarter. You answered some of this in the prior response, but we'd just love to hear more about how Agent Val is elevating ETM from an efficacy perspective and just how Agent Val is reducing total man-hours at the customer level and how that's resonating with customers. Thanks.
Speaker #5: Thanks.
Speaker #3: Thanks, Kingsley. I wish—unfortunately the call is only an hour, but I could talk about this forever. But look, I think we've seen the history of this evolution, back when Canaccord worked with this—it's like everybody's giving you theoretical scores, right, based on the vulnerability findings, NVD, assessed information that is out there.
Sumedh Thakar: Thanks, Kingsley. I wish, unfortunately, the call is only an hour, but I could talk about this forever. But look, I think we have seen the history of this evolution back when Canada came out with this is everybody's giving you theoretical scores, right, based on the vulnerability findings and CVSS information that is out there. Unfortunately, a theoretical score does not actually mean that a high score does not mean that the customer may not have other controls in place that mitigate that actual exploit from working in their environment. They might have a firewall. They might have something else, memory protection that is enabled that a typical scanner or a typical exposure management solution will not pick up.
Sumedh Thakar: Thanks, Kingsley. I wish, unfortunately, the call is only an hour, but I could talk about this forever. But look, I think we have seen the history of this evolution back when Canada came out with this is everybody's giving you theoretical scores, right, based on the vulnerability findings and CVSS information that is out there. Unfortunately, a theoretical score does not actually mean that a high score does not mean that the customer may not have other controls in place that mitigate that actual exploit from working in their environment. They might have a firewall. They might have something else, memory protection that is enabled that a typical scanner or a typical exposure management solution will not pick up.
Speaker #3: Unfortunately, a theoretical score does not actually mean that a high score does not mean that the customer may not have other controls in place that mitigate that actual exploit from working in their environment.
Speaker #3: They might have a firewall, they might have something else, memory protection that is enabled that a typical scanner or a typical exposure management solution will not pick up.
Speaker #3: What agent Val does is leverages that decision-making autonomous decision-making process to basically look at the findings, look at the scoring, but then actually the ability to run a very safe exploit against the asset to confirm whether that vulnerability is actually exploitable in their environment on their machine or it is not, not just a theoretical score.
Speaker #3: What agent Val does is leverages that autonomous decision-making process to basically look at the findings, look at the scoring, but then actually gives you the ability to run a very safe exploit against the asset to confirm whether that vulnerability is actually exploitable in their environment, on their machine, or it is not—not just a theoretical score. Typically, what happens is when the security team gives these scores to the IT team, they spend a lot of time trying to chase down these findings only to feel like, 'Oh, this was a false positive because, look, we already have a control in place,' and a lot of time is wasted in arguing back and forth. What the customers really want to be able to do is not waste their IT team's time on fixing things that actually are not exploitable in their environment.
Sumedh Thakar: What Agent Val does is leverages that decision-making, autonomous decision-making process to basically look at the findings, look at the scoring, but then actually the ability to run a very safe exploit against the asset to confirm whether that vulnerability is actually exploitable in their environment on their machine or it is not, not just a theoretical score. And what typically happens is when the security team gives these scores to the IT team, they spend a lot of time trying to chase down these findings only to feel like, "Oh, this was a false positive because, look, we already have a control in place," and a lot of time is wasted in arguing back and forth. What the customers really want to be able to do is not waste their IT team's time on fixing things that actually are not exploitable in their environment.
Sumedh Thakar: What Agent Val does is leverages that decision-making, autonomous decision-making process to basically look at the findings, look at the scoring, but then actually the ability to run a very safe exploit against the asset to confirm whether that vulnerability is actually exploitable in their environment on their machine or it is not, not just a theoretical score. And what typically happens is when the security team gives these scores to the IT team, they spend a lot of time trying to chase down these findings only to feel like, "Oh, this was a false positive because, look, we already have a control in place," and a lot of time is wasted in arguing back and forth. What the customers really want to be able to do is not waste their IT team's time on fixing things that actually are not exploitable in their environment.
Speaker #3: And the ability to, for sure, confirm by running an actual exploit in a safe manner that this is or is not exploitable means that the IT teams will be saving a significant amount of time—not chasing down ghost scores—and will actually have an absolute confirmation that, yes, it is a very highly exploitable vulnerability. But I don't need to worry about it because I have other controls that are mitigating this, or if it is highly—if I don't have a protection in my environment.
Sumedh Thakar: The ability to for sure confirm by running an actual exploit in a safe manner that this is or is not exploitable means that the IT teams will be saving a significant amount of time not chasing down ghost scores and will actually have an absolute confirmation that, "Yes, it is a very highly exploitable vulnerability, but I don't need to worry about it because I have other controls that are mitigating this," or, "It is highly exploitable. Attackers are using it, and I don't have a protection in my environment. So instead of just chasing scores, I can actually go and focus on fixing these, and that's going to make me a lot safer." So it's a significant time saving for the customer because of this Agentic AI workflow. They can actually then significantly reduce the number of findings that they have.
Sumedh Thakar: The ability to for sure confirm by running an actual exploit in a safe manner that this is or is not exploitable means that the IT teams will be saving a significant amount of time not chasing down ghost scores and will actually have an absolute confirmation that, "Yes, it is a very highly exploitable vulnerability, but I don't need to worry about it because I have other controls that are mitigating this," or, "It is highly exploitable. Attackers are using it, and I don't have a protection in my environment. So instead of just chasing scores, I can actually go and focus on fixing these, and that's going to make me a lot safer." So it's a significant time saving for the customer because of this Agentic AI workflow. They can actually then significantly reduce the number of findings that they have.
Speaker #3: So instead of just chasing scores, I can actually go and focus on fixing these and that's going to make me a lot safer. So it's a significant time-saving for the customer because of this agentic AI workflow.
Speaker #3: They can actually then significantly reduce the number of findings that they have. And the other thing is that once the exploit is confirmed on your environment, you don't have the time to create Jira tickets and ServiceNow tickets to then have people go and manually make the remediation.
Sumedh Thakar: The other thing is that once the exploit is confirmed on your environment, you don't have the time to create Jira tickets and ServiceNow tickets to then have people go and manually make the remediation. As soon as you know that this is exploitable in your environment confirmed, you want to be able to use another agent to immediately kick off remediation and get it fixed. You feel a lot more comfortable because now you have confirmed that this is exploitable. It's not theoretical. People are going to want to also save time and not leave the exposure open for a long time by being able to run that exploit and then also automatically run that remediation. You cannot show up for the AI fight today with your Jira tickets and your ServiceNow tickets.
Sumedh Thakar: The other thing is that once the exploit is confirmed on your environment, you don't have the time to create Jira tickets and ServiceNow tickets to then have people go and manually make the remediation. As soon as you know that this is exploitable in your environment confirmed, you want to be able to use another agent to immediately kick off remediation and get it fixed. You feel a lot more comfortable because now you have confirmed that this is exploitable. It's not theoretical. People are going to want to also save time and not leave the exposure open for a long time by being able to run that exploit and then also automatically run that remediation. You cannot show up for the AI fight today with your Jira tickets and your ServiceNow tickets.
Speaker #3: As soon as you know that this is exploitable in your environment, confirm, you want to be able to use another agent to immediately kick off remediation and get it fixed.
Speaker #3: And you feel a lot more comfortable because now you have confirmed that this is exploitable. It's not theoretical. So people are going to want to also save time and not leave the exposure open for a long time by being able to run that exploit and then also automatically run that remediation.
Speaker #3: And you cannot show up for the AI fight today with your Jira tickets and your ServiceNow tickets. You got to be able to do automation and autonomous decision-making to get things fixed.
Sumedh Thakar: You got to be able to do automation and autonomous decision-making to get things fixed. That's the differentiator.
Sumedh Thakar: You got to be able to do automation and autonomous decision-making to get things fixed. That's the differentiator.
Speaker #3: And that's the
Speaker #3: differentiator. Yeah.
Kingsley Crane: Yeah. It's really exciting times, and it's good that you're leading the way here. For Joo Mi, it's been a remarkable year for Qualys. You guided to 7% at the midpoint, entering last year, and you put up 10%, and now you're guiding closer to 8% this year. How can we think about the levers for upside to growth this year? Thanks.
Kingsley Crane: Yeah. It's really exciting times, and it's good that you're leading the way here. For Joo Mi, it's been a remarkable year for Qualys. You guided to 7% at the midpoint, entering last year, and you put up 10%, and now you're guiding closer to 8% this year. How can we think about the levers for upside to growth this year? Thanks.
Speaker #5: It's really exciting times and it's good that you're leading the way here. For Jumi, it's been remarkable year for QUALYS. You guided a 7% at the midpoint, entering last year and you put up 10, and now you're guiding closer to 8 this year.
Speaker #5: How can we think about the levers for upside to growth this year? Thanks.
Speaker #6: Yeah, 2025 was a solid year from an execution standpoint. It was a very exciting year for us, with ETM having gone live at the end of 2024.
Joo Mi Kim: Yeah. 2025 was a solid year from an execution standpoint. It was a very exciting year for us with ETM having gone live at the end of 2024. We've had a significant number of discussions with our existing customers in terms of how we can increase value without them having to double their spend initially with us. And so, in doing that and working through our partners, what we were able to do is finalize our pricing and packaging for ETM and identify our key products that are going to be levers for growth in the short term and then long term going forward as well. So, 2025, solid year with closing the year with another 10% growth for revenue, which we're really pleased about. Now, when it comes to current billings, it came in line as expectations from last quarter with 2025 current billings growth of 8%.
Joo Mi Kim: Yeah. 2025 was a solid year from an execution standpoint. It was a very exciting year for us with ETM having gone live at the end of 2024. We've had a significant number of discussions with our existing customers in terms of how we can increase value without them having to double their spend initially with us. And so, in doing that and working through our partners, what we were able to do is finalize our pricing and packaging for ETM and identify our key products that are going to be levers for growth in the short term and then long term going forward as well. So, 2025, solid year with closing the year with another 10% growth for revenue, which we're really pleased about. Now, when it comes to current billings, it came in line as expectations from last quarter with 2025 current billings growth of 8%.
Speaker #6: We've had significant number of discussions with our existing customers in terms of how we can increase value without them having to double their spend initially with us.
Speaker #6: And so in doing that and working through our partners, we were able to do is finalize our pricing and packaging for ETM and identify our key products that are going to be levers for growth.
Speaker #6: In the short term, in the long term going forward as well. So 2025, solid year with closing the year with another 10% growth revenue, which we're really pleased about.
Speaker #6: Now, when it comes to current billings, it came in line with expectations from last quarter, with 2025 current billings growth of 8%. That's slightly lower than the 9% that we posted back in 2024 for current billings.
Joo Mi Kim: That's slightly lower than the 9% that we posted back in 2024 for current billings. So looking ahead to 2026, I think that's kind of more or less in line with what the baseline case is for us. Looking out, our guidance is really informed by what we see in the business today, the discussions that we're having, what we expect from the macro, and then the spending environment. With that said, we do anticipate significant upside. Given what Sumedh just covered, we have very exciting product discussions with existing customers as well as prospects. I think that we've gone ahead and really leveraged our innovation and our power to really deliver what the customers are looking for and what the market is looking for. So we're excited about the outlook. But with that said, the baseline still remains to be around 7% to 8%.
Joo Mi Kim: That's slightly lower than the 9% that we posted back in 2024 for current billings. So looking ahead to 2026, I think that's kind of more or less in line with what the baseline case is for us. Looking out, our guidance is really informed by what we see in the business today, the discussions that we're having, what we expect from the macro, and then the spending environment. With that said, we do anticipate significant upside. Given what Sumedh just covered, we have very exciting product discussions with existing customers as well as prospects. I think that we've gone ahead and really leveraged our innovation and our power to really deliver what the customers are looking for and what the market is looking for. So we're excited about the outlook. But with that said, the baseline still remains to be around 7% to 8%.
Speaker #6: So, looking ahead to 2026, I think that's kind of more or less in line with what the baseline cases are for us. Looking out, our guidance is really informed by what we see in the business today, the discussions that we're having, what we expect from the macro, and then the spending environment.
Speaker #6: With that said, we do anticipate significant upside given what Sumed just covered. We have very exciting product discussions with existing customers as well as prospects.
Speaker #6: I think that we've gone ahead and really leveraged our innovation and our power to really deliver what the customers are looking for and what the market is looking for.
Speaker #6: So we're excited about the outlook, but with that said, the baseline still remains to be around a 7 to 8
Speaker #7: Thank you. And our next question will come from Rahul Chopra with Berenberg. Your line is open.
Operator: Thank you. Our next question will come from Rahul Chopra with Berenberg. Your line is open.
Operator: Thank you. Our next question will come from Rahul Chopra with Berenberg. Your line is open.
Speaker #8: Yes, thank you. I have a couple of questions. I mean, I appreciate these are not your estimates, but if I look at 2023 market share data, which you gave, at that time, you had the total market at $64 billion.
Rahul Chopra: Yes. Thank you. I have a couple of questions. I mean, I appreciate these are not your estimates, but if I look at 2023 market share data, which you gave, at that time, you had total market as $64 billion. In the current deck, you are talking about $53 billion market for 2026. At the same time, I can see previously, you had 2028 market of, I think, something around $79 billion, $78 billion. Now, 2029 market is $75 billion. My question here is that basically, is the core market shrinking for VM and exposure management? I appreciate these are not your estimates, but I just want to understand what you're thinking about the core estimates in terms of the market itself, what is it doing? One. The second question is, I wanted to understand your thoughts about the competitive landscape in more general, especially given that ServiceNow is acquiring Armis.
Rahul Chopra: Yes. Thank you. I have a couple of questions. I mean, I appreciate these are not your estimates, but if I look at 2023 market share data, which you gave, at that time, you had total market as $64 billion. In the current deck, you are talking about $53 billion market for 2026. At the same time, I can see previously, you had 2028 market of, I think, something around $79 billion, $78 billion. Now, 2029 market is $75 billion. My question here is that basically, is the core market shrinking for VM and exposure management? I appreciate these are not your estimates, but I just want to understand what you're thinking about the core estimates in terms of the market itself, what is it doing? One.
Speaker #8: In the current deck, you are talking about 53 billion market for 2026. At the same time, I can see previously you had 28 market of, I think, something around 79, 78 billion.
Speaker #8: Now, 29 market is 75 billion. My question here is that basically is the core market shrinking for VM and exposure management? I appreciate these are not your estimates, but just want to understand what you're thinking about the core estimates in terms of the market itself, what is it doing?
Speaker #8: One. The second question is I wanted to understand your thoughts about the competitive landscape in more general, especially given the ServiceNow is acquiring ARMES.
Rahul Chopra: The second question is, I wanted to understand your thoughts about the competitive landscape in more general, especially given that ServiceNow is acquiring Armis. Obviously, that's going to probably change some dynamics. So I wanted to hear your thoughts on that, please. Thank you.
Speaker #8: Obviously, that's going to probably change some dynamics. So I wanted to hear your thoughts on that, please. Thank you. Sure. Yeah. I think I've been in this QUALYS for 20-something years and vulnerability management has definitely changed.
Rahul Chopra: Obviously, that's going to probably change some dynamics. So I wanted to hear your thoughts on that, please. Thank you.
Sumedh Thakar: Sure. Yeah. I think I've been in this Qualys for 20-something years, and vulnerability management has definitely changed. And if you recall, we've been talking about that as the number of assets has increased, the number of CVEs and software has increased. We're seeing that customers in the traditional way that vulnerability scanning was done is just generating way too much noise, and vulnerability management has evolved, which we have called out many times. And that's the reason the last few years, we've been focusing on shifting and focusing on the solutions that customers actually are looking for. So as an example, when we innovated with patch management, we're the first vendor to do that. And even today, we're not seeing really much traction with others in patch management was, yes, not just vulnerability management doesn't mean you just scan and scan and scan if you cannot get it fixed.
Sumedh Thakar: Sure. Yeah. I think I've been in this Qualys for 20-something years, and vulnerability management has definitely changed. And if you recall, we've been talking about that as the number of assets has increased, the number of CVEs and software has increased. We're seeing that customers in the traditional way that vulnerability scanning was done is just generating way too much noise, and vulnerability management has evolved, which we have called out many times. And that's the reason the last few years, we've been focusing on shifting and focusing on the solutions that customers actually are looking for. So as an example, when we innovated with patch management, we're the first vendor to do that. And even today, we're not seeing really much traction with others in patch management was, yes, not just vulnerability management doesn't mean you just scan and scan and scan if you cannot get it fixed.
Speaker #8: And if you recall, we've been talking about that as the number of assets has increased, the number of CVEs and software has increased, we're seeing that customers in the traditional way that vulnerability scanning was done is just generating way too much noise, and vulnerability management has evolved, which we have called out many times.
Speaker #8: And that's the reason the last few years we've been focusing on shifting and focusing on the solutions that customers actually are looking for. So as an example, when we innovated with patch management, where the first vendor to do that, and even today, we're not seeing really much traction with others in patch management was, yes, not just vulnerability management doesn't mean you just scan and scan and scan.
Speaker #8: If you cannot get it fixed. And so as that evolved, we innovated, we came up with patch management as a capability. We came up with cybersecurity asset management.
Sumedh Thakar: So as that evolved, we innovated. We came up with Patch Management as a capability. We came up with CyberSecurity Asset Management that was needed for a successful VM program. Now, we have expanded that capability with Agentic AI with ETM because that's really what customers are looking for is how do you continue to triage that. And then adding a layer of validation is another game changer in our mind from a vulnerability management perspective. And then along the way, we've also focused on how do we bring TotalCloud, which is a CNAPP solution that we have, which we're very happy with the traction that we're seeing with that. We're coming up with Agentic AI.
Sumedh Thakar: So as that evolved, we innovated. We came up with Patch Management as a capability. We came up with CyberSecurity Asset Management that was needed for a successful VM program. Now, we have expanded that capability with Agentic AI with ETM because that's really what customers are looking for is how do you continue to triage that. And then adding a layer of validation is another game changer in our mind from a vulnerability management perspective. And then along the way, we've also focused on how do we bring TotalCloud, which is a CNAPP solution that we have, which we're very happy with the traction that we're seeing with that. We're coming up with Agentic AI.
Speaker #8: That was needed for a successful VM program. Now we have expanded that capability with agentic AI with ETM because that's really what customers are looking for is how do you continue to triage that.
Speaker #8: And then adding a layer of validation is another game changer in our mind from a vulnerability management perspective. And then along the way, we've also focused on how do we bring total cloud which is a CNAP solution that we have, which we're very happy with the traction that we're seeing with that.
Speaker #8: We're coming up with agentic AI, so for us, it is about how do we continue to track the areas that customers are focusing on, and then how do we maximize our share of that spend that they have. And that's what you're seeing—the progression in the innovation that we are going.
Sumedh Thakar: So for us, it is about how do we continue to track the areas that customers are focusing on, and then how do we maximize our share of that spend that they have. And that's what you're seeing, the progression and the innovation that we are going. And it's great to see that there is focus and attention on the CTEM exposure management marketplace, as you mentioned, with ServiceNow buying Armis, which has been around for a long time using passive capabilities to detect asset inventory, etc. But the reality, again, is that today, customers don't want just more vulnerability findings from these solutions that don't actually help you fix anything. And so what we are looking forward to is, again, autonomous workflows leveraging Agentic AI to get customers to fix things quickly.
Sumedh Thakar: So for us, it is about how do we continue to track the areas that customers are focusing on, and then how do we maximize our share of that spend that they have. And that's what you're seeing, the progression and the innovation that we are going. And it's great to see that there is focus and attention on the CTEM exposure management marketplace, as you mentioned, with ServiceNow buying Armis, which has been around for a long time using passive capabilities to detect asset inventory, etc. But the reality, again, is that today, customers don't want just more vulnerability findings from these solutions that don't actually help you fix anything. And so what we are looking forward to is, again, autonomous workflows leveraging Agentic AI to get customers to fix things quickly.
Speaker #8: And it's great to see that there is focus and attention on the CTEM exposure management marketplace, as you mentioned, with ServiceNow buying ARMES, which has been around for a long time, using passive capabilities to detect asset inventory, etc.
Speaker #8: But the reality again is that today customers don't want just more vulnerability findings from these solutions that don't actually help you fix anything. And so what we are looking forward to is, again, autonomous workflows, leveraging agentic AI to get customers to fix things quickly as you saw in the recent Mandiant report that the mean time to remediate over the last five years has gone from 63 days to negative one day.
Sumedh Thakar: As you saw in the recent Mandiant report, the mean time to remediate over the last five years has gone from 63 days to -1 day. So today, again, with solutions like that, ServiceNow, Armis, and other solutions, do you have the time to create ServiceNow tickets and chase people down while attackers are having a field day exploiting your vulnerabilities? So what we feel pretty excited about with our customer conversations is the differentiation that we have that is allowing them to very quickly and accurately get to the things that actually matter to their business, put dollar-value loss quantification numbers on it, get the validation, get the vulnerabilities fixed. And that is allowing us to differentiate. And that's where a lot of the conversations we're seeing are very positive in the focus of not just another exposure management solution but moving towards a risk operations center.
Sumedh Thakar: As you saw in the recent Mandiant report, the mean time to remediate over the last five years has gone from 63 days to -1 day. So today, again, with solutions like that, ServiceNow, Armis, and other solutions, do you have the time to create ServiceNow tickets and chase people down while attackers are having a field day exploiting your vulnerabilities? So what we feel pretty excited about with our customer conversations is the differentiation that we have that is allowing them to very quickly and accurately get to the things that actually matter to their business, put dollar-value loss quantification numbers on it, get the validation, get the vulnerabilities fixed. And that is allowing us to differentiate. And that's where a lot of the conversations we're seeing are very positive in the focus of not just another exposure management solution but moving towards a risk operations center.
Speaker #8: So today, again, with solutions like that, ServiceNow, ARMES, and other solutions, do you have the time to create ServiceNow tickets and chase people down while attackers are having a free time exploiting your vulnerabilities?
Speaker #8: So what we feel pretty excited about with our customer conversations is the differentiation that we have that is allowing them to very quickly and accurately get to the things that actually matter to their business, put dollar value loss quantification numbers on it, get the validation, get the vulnerabilities fixed, and that is allowing us to differentiate.
Speaker #8: And that's where a lot of the conversations we're seeing are very positive in the focus of not just another exposure management solution, but moving towards a risk operations center.
Speaker #8: And so our goal here is that, of course, the security market keeps changing, etc. We're bringing solutions that we are looking forward to maximizing the share of the customers' spend focused on the pre-breach side of security and not necessarily the post-breach side.
Sumedh Thakar: Our goal here is that, of course, security market keeps changing, etc. We're bringing solutions that we are looking forward to maximizing the share of the customer spend focused on the pre-breach side of the security and not necessarily the post-breach side.
Sumedh Thakar: Our goal here is that, of course, security market keeps changing, etc. We're bringing solutions that we are looking forward to maximizing the share of the customer spend focused on the pre-breach side of the security and not necessarily the post-breach side.
Speaker #9: Okay. Understood. Thank you very
Rahul Chopra: Okay. Understood. Thank you very much.
Rahul Chopra: Okay. Understood. Thank you very much.
Speaker #9: much. Thank you.
Operator: Thank you. The next question is going to come from Nehal Chokshi with Northland Capital. Your line's open.
Operator: Thank you. The next question is going to come from Nehal Chokshi with Northland Capital. Your line's open.
Speaker #7: And the next question is going to come from Nihal Chokshi, with Northling Capital. Your line's
Speaker #8: Yeah. Thank you. And nice color there on why the ARMES acquisition by ServiceNow won't be impactful. It sounds like a key portion here is that basically they're lacking patch management.
Nehal Chokshi: Yeah. Thank you. And nice color there on why the Armis acquisition by ServiceNow won't be impactful. It sounds like a key portion here is that basically, they're lacking patch management. So can you dive a little bit further here and explain why patch management has remained such a differentiator for Qualys here?
Nehal Chokshi: Yeah. Thank you. And nice color there on why the Armis acquisition by ServiceNow won't be impactful. It sounds like a key portion here is that basically, they're lacking patch management. So can you dive a little bit further here and explain why patch management has remained such a differentiator for Qualys here?
Speaker #8: So can you dive a little bit further here and explain why patch management has remained such a differentiator for QUALYS
Speaker #8: here? Yeah.
Sumedh Thakar: Yeah. Thank you. I think today, if you see, right, people are finding millions and millions of findings, and the IT team does not want to be spending all their time instead of innovating, going out, and fixing so many vulnerabilities without the proper context. And so what we're seeing is that, and we talked about this a couple of months ago. The Qualys agents have been able to deploy 140 million patches just in the last 12 months. And in one of the recent GigaOm reports, we were placed as the number one patch management vendor by the analyst. And so the reason why we're getting so much traction is that in the past, I mean, I remember when I joined Qualys, scanning once a quarter and taking 30 days to fix all your issues was considered okay.
Sumedh Thakar: Yeah. Thank you. I think today, if you see, right, people are finding millions and millions of findings, and the IT team does not want to be spending all their time instead of innovating, going out, and fixing so many vulnerabilities without the proper context. And so what we're seeing is that, and we talked about this a couple of months ago. The Qualys agents have been able to deploy 140 million patches just in the last 12 months. And in one of the recent GigaOm reports, we were placed as the number one patch management vendor by the analyst. And so the reason why we're getting so much traction is that in the past, I mean, I remember when I joined Qualys, scanning once a quarter and taking 30 days to fix all your issues was considered okay.
Speaker #4: Thank you. I think today, if you see, right, people are finding millions and millions of findings, and the IT team does not want to be spending all their time, instead of innovating, going out and fixing so many vulnerabilities without the proper context.
Speaker #4: And so what we're seeing is that, and we talked about this a couple of months ago, the Qualys agents have been able to deploy 140 million patches just in the last 12 months.
Speaker #4: And in one of the recent GigaOM reports, we replaced this with number one patch management vendor by the analyst. And so the reason why we're getting so much traction is that in the past, I mean, I remember when I joined QUALYS, scanning once a quarter and taking 30 days to fix all your issues was considered okay.
Speaker #4: Today, when the attackers are attacking you within three, four, five hours of the vulnerabilities being disclosed, you need that ability to quickly correlate a CVE, figure out that it doesn't matter to your business or that it's not exploitable in your environment, and actually get it fixed.
Sumedh Thakar: Today, when the attackers are attacking you within 3, 4, 5 hours of the vulnerabilities being disclosed, you need that ability to quickly correlate a CVE, figure out that it doesn't matter to your business or that it's not exploitable in your environment, and actually get it fixed. And so our success with patch management really has been a highly integrated solution with VM and not just a partnership where you're going out with some other separate solution and trying to bridge that gap. It's a highly integrated solution that is quickly able to not only detect the vulnerability, find whether it is actually exploitable in their environment, but then within a matter of minutes, it can actually fix and patch that particular issue. And so what we're excited about is to see the success of patch management the last couple of years.
Sumedh Thakar: Today, when the attackers are attacking you within 3, 4, 5 hours of the vulnerabilities being disclosed, you need that ability to quickly correlate a CVE, figure out that it doesn't matter to your business or that it's not exploitable in your environment, and actually get it fixed. And so our success with patch management really has been a highly integrated solution with VM and not just a partnership where you're going out with some other separate solution and trying to bridge that gap. It's a highly integrated solution that is quickly able to not only detect the vulnerability, find whether it is actually exploitable in their environment, but then within a matter of minutes, it can actually fix and patch that particular issue. And so what we're excited about is to see the success of patch management the last couple of years.
Speaker #4: And so our success with patch management really has been a highly integrated solution with VM, and not just a partnership where you're going out with some other separate solution and trying to bridge that gap. It is a highly integrated solution that is quickly able to not only detect the vulnerability or find whether it is actually exploitable in your environment, but then, within a matter of minutes, it can actually fix and patch that particular issue.
Speaker #4: And so what we're excited about is to see the success of patch management the last few years, but also what we did at the end of last year is move even further into providing customers more abilities to mitigate the risk of the vulnerability without patching.
Sumedh Thakar: But also, what we did end of last year is moved even further into providing customer more abilities to mitigate the risk of the vulnerability without patching. And I like to call it patchless patching, which is applying mitigating controls on the machine, which has given even more flexibility to our customers because sometimes you're worried about a patch breaking something. How do you balance the worry of patch breaking something with the worry of getting exploited? And many times, because of our super deep research in the threat research landscape with our research analysts, we actually are able to figure out the way exploits are working and then find ways to apply mitigations on the machine so that the actual exploit can be blocked.
Sumedh Thakar: But also, what we did end of last year is moved even further into providing customer more abilities to mitigate the risk of the vulnerability without patching. And I like to call it patchless patching, which is applying mitigating controls on the machine, which has given even more flexibility to our customers because sometimes you're worried about a patch breaking something. How do you balance the worry of patch breaking something with the worry of getting exploited? And many times, because of our super deep research in the threat research landscape with our research analysts, we actually are able to figure out the way exploits are working and then find ways to apply mitigations on the machine so that the actual exploit can be blocked.
Speaker #4: And I like to call it patchless patching which is applying mitigating controls on the machine, which has given even more flexibility to our customers because sometimes you're worried about a patch breaking something, how do you balance the worry of patch breaking something with the worry of getting exploited?
Speaker #4: And many times because of our super deep research in the threat research landscape with our research analysts, we actually are able to figure out the way exploits are working and then find ways to apply mitigations on the machines so that the actual exploit can be blocked.
Speaker #4: So at the end of the day, what is the point of all the spend you do in vulnerability scanning is to get the right things fixed before the attackers get there.
Sumedh Thakar: So at the end of the day, what is the point of all the spend you do in vulnerability scanning, is to get the right things fixed before the attackers get there. So the majority of the value that comes in that overall spend is really about the patching part. If you do not patch it, you can build all kinds of dashboards. There's dashboard tourism going on right now, but those dashboards don't mean anything if you don't actually get it fixed before the attackers get to it.
Sumedh Thakar: So at the end of the day, what is the point of all the spend you do in vulnerability scanning, is to get the right things fixed before the attackers get there. So the majority of the value that comes in that overall spend is really about the patching part. If you do not patch it, you can build all kinds of dashboards. There's dashboard tourism going on right now, but those dashboards don't mean anything if you don't actually get it fixed before the attackers get to it.
Speaker #4: So, the majority of the value that comes in that overall spend is really about the patching part. If you do not patch it, you can build all kinds of dashboards—and there's a dashboard tourism going on right now—but those dashboards don't mean anything if you don't actually get it fixed before the attackers get to it.
Speaker #4: it.
Nehal Chokshi: Okay. Thank you. And Joo Mi, are there any headwinds leading to expectation of no change in NDR in your calendar 2026 guidance, that's embedded in your calendar 2026 guidance?
Nehal Chokshi: Okay. Thank you. And Joo Mi, are there any headwinds leading to expectation of no change in NDR in your calendar 2026 guidance, that's embedded in your calendar 2026 guidance?
Speaker #8: you. And Jumi, are there any headwinds leading to expectation of no change in MDR in your calendar 26 guidance that's embedded in your calendar 26
Speaker #8: guidance? Yeah.
Joo Mi Kim: Yeah. Our guidance is assuming no material change in Net Dollar Expansion rate. You could see that it's always kind of gone up a quarter or down a quarter in the past couple of years. Right now, us starting out the year, ending 2025 at 103, we don't anticipate material change to that rate.
Joo Mi Kim: Yeah. Our guidance is assuming no material change in Net Dollar Expansion rate. You could see that it's always kind of gone up a quarter or down a quarter in the past couple of years. Right now, us starting out the year, ending 2025 at 103, we don't anticipate material change to that rate.
Speaker #3: Our guidance is assuming no material change in net dollar expansion rate. You could see that it's always kind of gone up a quarter or down a quarter in the past couple of years.
Speaker #3: And right now, us being starting out the year ending 2025 at 1:03, we don't anticipate material change to that rate.
Speaker #8: So why is that? Why are you expecting no—
Nehal Chokshi: So why is that? Why are you expecting no change?
Nehal Chokshi: So why is that? Why are you expecting no change?
Speaker #8: change? Our
Joo Mi Kim: Our guidance is informed by what we're seeing in the pipeline today and what we're expecting based on our existing customers. What they anticipate buying more over, how they're thinking about spending more with Qualys in 2026, our preliminary discussions and view into the outlook today implies that assuming kind of similar inline Gross Dollar Retention, the expectations from an upsell standpoint, and then, of course, a new business, what we expect to land from a new logo perspective, this is all informing our guidance and the way we look at things.
Joo Mi Kim: Our guidance is informed by what we're seeing in the pipeline today and what we're expecting based on our existing customers. What they anticipate buying more over, how they're thinking about spending more with Qualys in 2026, our preliminary discussions and view into the outlook today implies that assuming kind of similar inline Gross Dollar Retention, the expectations from an upsell standpoint, and then, of course, a new business, what we expect to land from a new logo perspective, this is all informing our guidance and the way we look at things.
Speaker #3: Guidance is informed by what we're seeing in the pipeline today and what we're expecting based on our existing customers, what they anticipate buying more of, or how they're thinking about spending more with Qualys in 2026.
Speaker #3: Our preliminary discussions and view into the outlook today implies that assuming kind of similar inline growth dollar retention, the expectations from an upsell standpoint, and then, of course, a new business, what we expect to land from a new local perspective, this is all informing our guidance and the way we look at
Speaker #3: things.
Speaker #8: And that's the base case and
Sumedh Thakar: And that's the base case. And our goal will be to continue to improve our execution on the ETM and ROC, get the customers getting to know that. And that, to me, remains the upside for the business, is with the federal now with our federal empire that we got and the federal space partners, etc. So I think that's kind of where we are with just assuming 103 as we see it right now. But do we continue to work on the upsides in the business that we can potentially have?
Sumedh Thakar: And that's the base case. And our goal will be to continue to improve our execution on the ETM and ROC, get the customers getting to know that. And that, to me, remains the upside for the business, is with the federal now with our federal empire that we got and the federal space partners, etc. So I think that's kind of where we are with just assuming 103 as we see it right now. But do we continue to work on the upsides in the business that we can potentially have?
Speaker #8: our goal will be to continue to improve our execution on the ETM and ROC to the customers getting to know that. And that, to me, remains the upside in for the business is with the federal now with our federal empire that we got and the federal space partners, etc.
Speaker #8: So I think that's kind of where we are with just assuming 1:03 as we see it right now. But we continue to work on the upsides in the business that we can potentially have.
Speaker #4: So does that imply that your expectations of baseline expectations of ETM incremental penetrations and install-base continues at this relatively slow pace, that we're not hitting an inflection point?
Nehal Chokshi: So does that imply that your baseline expectations that ETM incremental penetration to installed base continues at this relatively slow pace, that we're not hitting an inflection point yet?
Nehal Chokshi: So does that imply that your baseline expectations that ETM incremental penetration to installed base continues at this relatively slow pace, that we're not hitting an inflection point yet?
Speaker #4: Yet? I think it's very early.
Sumedh Thakar: I think it's very early. So like we said at the end of last year where we had started with POCs, we are super encouraged with what we are seeing with the POCs and the conversion that we're having. But again, it's very early, right? We're talking about customers that are early adopters. So it's encouraging, but we haven't had enough of those to really map out a confirmed trajectory of how that is going to go. So I think as we execute better in the first couple of quarters, that's where we will get to understand even better. Now, that's where, as Joo Mi has talked about in the past, we will start to provide guidance on how ETM is going to how ETM is growing for us starting the Q1 earnings call for 2026.
Sumedh Thakar: I think it's very early. So like we said at the end of last year where we had started with POCs, we are super encouraged with what we are seeing with the POCs and the conversion that we're having. But again, it's very early, right? We're talking about customers that are early adopters. So it's encouraging, but we haven't had enough of those to really map out a confirmed trajectory of how that is going to go. So I think as we execute better in the first couple of quarters, that's where we will get to understand even better. Now, that's where, as Joo Mi has talked about in the past, we will start to provide guidance on how ETM is going to how ETM is growing for us starting the Q1 earnings call for 2026.
Speaker #8: So like we said at the end of the last year where we had a started with POCs, we have super encouraged with what we are seeing with the POCs and the conversion that we're having.
Speaker #8: But again, it's very early, right? We're talking about customers that are early adopters. So it's encouraging, but we're not we haven't had enough of those to really map out a confirmed trajectory of how that is going to go.
Speaker #8: So I think as we execute better in the first couple of quarters, that's where we will get to understand even better. Now, that's where as Jumi has talked about in the past, we will start to provide guidance on how ETM is going to how ETM is growing for us, starting the Q1 earnings call for 2026.
Speaker #8: And so that will allow you to sort of track where we're starting and then how we're going to expand through the next couple of years on that big opportunity that we see right now.
Sumedh Thakar: And so that will allow you to sort of track where we're starting and then how we're going to expand through the next couple of years on that big opportunity that we see right now.
Sumedh Thakar: And so that will allow you to sort of track where we're starting and then how we're going to expand through the next couple of years on that big opportunity that we see right now.
Speaker #8: Okay. Thank you.
Nehal Chokshi: Okay. Thank you.
Nehal Chokshi: Okay. Thank you.
Speaker #1: Thank you, and our next question will come from Rudy Kessinger with DA Davidson. Your line's open.
Operator: Thank you. Our next question will come from Rudy Kessinger with DA Davidson. Your line's open.
Operator: Thank you. Our next question will come from Rudy Kessinger with DA Davidson. Your line's open.
Speaker #9: Hey, great. Thanks for taking my question. Jumi, I think you said in response to what Jonathan's baseline remains around 7% to 8%. I'm not sure if you were referring to the revenue guide for this year, or if that was also your expectation for roughly what we should expect for current calculated billings for the—
Rudy Kessinger: Hey. Great. Thanks for taking my question. Jumi, I think you said in response to one of Jonathan's questions earlier, I think you said baseline remains around 7% to 8%. I'm not sure if you were referring to the revenue guide for this year or if that was also your expectation for roughly what we should expect for current calculated billings for the year.
Rudy Kessinger: Hey. Great. Thanks for taking my question. Jumi, I think you said in response to one of Jonathan's questions earlier, I think you said baseline remains around 7% to 8%. I'm not sure if you were referring to the revenue guide for this year or if that was also your expectation for roughly what we should expect for current calculated billings for the year.
Speaker #9: year. I would
Joo Mi Kim: I would say that we don't give a specific guidance for current billings. Our expectation is that current billings growth rate will be more or less in line with a revenue growth rate. 7% to 8% for both for a full year 2026.
Joo Mi Kim: I would say that we don't give a specific guidance for current billings. Our expectation is that current billings growth rate will be more or less in line with a revenue growth rate. 7% to 8% for both for a full year 2026.
Speaker #3: We don't give a specific guidance for our current billings. But our expectation is that current billings growth rate will be more or less in line with the revenue growth rate.
Speaker #3: So, 7 to 8 percent for both for the full year.
Speaker #3: 2026. Yeah.
Rudy Kessinger: Yeah. Okay. Got it. And then just maybe kind of a follow-up to the past question. Certainly, it sounds like there's a lot of optimism about the early ETM interest and adoption and whatnot. But at the same time, it's still just being too early to maybe drive an improvement in the net expansion rate or the overall revenue growth rate. I guess just I don't know. We've been hearing that for a few quarters now. I mean, what needs to go right, whether it's with the channel or utilizing QFlex? Is there potential that this year we could see enough adoption that we do see expansion rate tick up or revenue accelerate, or is that unlikely just based on the current pipeline?
Rudy Kessinger: Yeah. Okay. Got it. And then just maybe kind of a follow-up to the past question. Certainly, it sounds like there's a lot of optimism about the early ETM interest and adoption and whatnot. But at the same time, it's still just being too early to maybe drive an improvement in the net expansion rate or the overall revenue growth rate. I guess just I don't know. We've been hearing that for a few quarters now. I mean, what needs to go right, whether it's with the channel or utilizing QFlex? Is there potential that this year we could see enough adoption that we do see expansion rate tick up or revenue accelerate, or is that unlikely just based on the current pipeline?
Speaker #9: Okay. Got it. And then just maybe kind of a follow-up to the past question. Certainly, it sounds like there's a lot of optimism about the early ETM interest and adoption and whatnot.
Speaker #9: But at the same time, it's still just being too early to maybe drive an improvement in the net expansion rate or the overall revenue growth rate.
Speaker #9: I guess just, I don't know, we've been hearing that for a few quarters now. I mean, what needs to go right, whether it's with the channel or utilizing QFlex?
Speaker #9: Is there potential that this year we could see enough adoption that we do see expansion rate tick up or revenue accelerate, or is that unlikely just based on the current pipeline?
Speaker #9: Is there potential that this year we could see enough adoption that we do see expansion rate tick up or revenue accelerate, or is that unlikely just based on the current pipeline?
Speaker #8: All right. Yeah. I mean, all of that needs to go right. I think what we're I think we've done a lot of innovation. The products are coming out now, which is great.
Sumedh Thakar: Yeah. I mean, all of that needs to go right. I think we've done a lot of innovation. The products are coming out now, which is great. The Agent Val is going to be very interesting for us. And the recent identity solution is also very interesting. I think a key part of our strategy definitely has been working with partners. And so, as an example, one of the key areas of focus right now where we are certifying more MROC partners as an example. And we are getting these partners up to speed, and we're getting the partners trained and helping them create their offerings around the Risk Operations Center.
Sumedh Thakar: Yeah. I mean, all of that needs to go right. I think we've done a lot of innovation. The products are coming out now, which is great. The Agent Val is going to be very interesting for us. And the recent identity solution is also very interesting. I think a key part of our strategy definitely has been working with partners. And so, as an example, one of the key areas of focus right now where we are certifying more MROC partners as an example. And we are getting these partners up to speed, and we're getting the partners trained and helping them create their offerings around the Risk Operations Center.
Speaker #8: The agent Val is going to be very interesting for us. And the recent identity solution is also very interesting. I think a key part of our strategy definitely has been working with partners.
Speaker #8: And so, as an example, one of the key areas of focus right now where we are certifying more MROC partners, as an example, and we are getting these partners up to speed, and we're getting the partners trained and helping them create their offerings around the Risk Operation Center.
Speaker #8: And the idea here really is that these partners then with those services actually can bring us net new business, can bring us upsell opportunities because they don't have to have a replacement conversation maybe with the existing vendor that they might have been selling for the last couple of years.
Sumedh Thakar: The idea here really is that these partners then with those services actually can bring us net new business, can bring us upsell opportunities because they don't have to have a replacement conversation maybe with the existing vendor that they might have been selling for the last couple of years. They can actually create a service for risk management with MROC on top of their existing VM solution, as an example, by pulling that data into Qualys and then ETM and then charging the customer for the management and the consolidation of their various risk factors, etc. So that's an area that we are looking forward to as that matures and as we are in the early days of getting those partners up to speed. Once those partners then start to take those offerings to their customers, that response will also help us see how that is gaining traction.
Sumedh Thakar: The idea here really is that these partners then with those services actually can bring us net new business, can bring us upsell opportunities because they don't have to have a replacement conversation maybe with the existing vendor that they might have been selling for the last couple of years. They can actually create a service for risk management with MROC on top of their existing VM solution, as an example, by pulling that data into Qualys and then ETM and then charging the customer for the management and the consolidation of their various risk factors, etc. So that's an area that we are looking forward to as that matures and as we are in the early days of getting those partners up to speed. Once those partners then start to take those offerings to their customers, that response will also help us see how that is gaining traction.
Speaker #8: They can actually create a service for risk management with MROC on top of their existing VM solution as an example by pulling that data into QUALYS and then ETM and then charging the customer for the management and the consolidation of their various risk factors, etc.
Speaker #8: So that's an area that we are looking forward to as that matures and as we are in the early days of getting those partners up to speed.
Speaker #8: Once those partners then start to take those offerings to their customers, that response will also help us see how that is gaining traction. Again, early conversations have been great.
Sumedh Thakar: Again, early conversations have been great. We got to see that in the way that these customers, these partners are bringing us some of their business. I think QFlex has been really a positive thing for when we are taking a customer who has VMDR and then converting over to ETM. That has actually been a really positive thing for customers so that they can kind of build in sort of a certain amount of growth, and they can look at the ability to take the journey of a Risk Operations Center at that pace. And then, of course, we just got our FedRAMP end of last year. So that's allowed us to have more conversations for the 2026 budget cycle for federal that obviously were not in line in time for 2025.
Sumedh Thakar: Again, early conversations have been great. We got to see that in the way that these customers, these partners are bringing us some of their business. I think QFlex has been really a positive thing for when we are taking a customer who has VMDR and then converting over to ETM. That has actually been a really positive thing for customers so that they can kind of build in sort of a certain amount of growth, and they can look at the ability to take the journey of a Risk Operations Center at that pace. And then, of course, we just got our FedRAMP end of last year. So that's allowed us to have more conversations for the 2026 budget cycle for federal that obviously were not in line in time for 2025.
Speaker #8: We got to see that in the way that these customers or these partners are bringing us some of their business. I think QFlex has been really a positive thing for when we are taking customer who has VMDR and then converting them over to ETM.
Speaker #8: That has actually been a really positive thing for customers, so that they can kind of build in a certain amount of growth, and they can look at the ability to take the journey of a risk operation center at their own pace.
Speaker #8: And then, of course, we just got our FedRAMP High end of last year. So that's allowed us to have more conversations for the 2026 budget cycle for federal that obviously were not in line in time for 2025.
Speaker #8: So those conversations, after FedRAMP High for '26, '27, are also going to be quite interesting for us as potential upside. And so, I think as Jumi has provided sort of the guidance that we see as of now, we're excited about some of these things that can potentially create the opportunity for us to do better than—
Sumedh Thakar: So those conversations after FedRAMP for 2026, 2027 are also going to be quite interesting for us as potential upside. And so I think as Joo Mi has provided sort of the guidance that we see as of now, we're excited about some of these things that can potentially create the opportunity for us to do better than that.
Sumedh Thakar: So those conversations after FedRAMP for 2026, 2027 are also going to be quite interesting for us as potential upside. And so I think as Joo Mi has provided sort of the guidance that we see as of now, we're excited about some of these things that can potentially create the opportunity for us to do better than that.
Speaker #8: that. Thank
Operator: Thank you. And our next question will come from Matthew Hedberg with RBC Capital. Your line's open.
Operator: Thank you. And our next question will come from Matthew Hedberg with RBC Capital. Your line's open.
Speaker #1: You. And our next question will come from Matthew Hedberg with RBC Capital. Your line's open.
Speaker #10: Hey guys, this is Mike Richards. I'm from Matt. Thanks for taking the question. Keeping it a little high level here. Anthropic's new model released today put an emphasis on cybersecurity, and specifically the model's performance for vulnerability discovery and patching.
Mike Richards: Hey, guys. This is Mike Richards. I'm from Matt. Thanks for taking the question. Keeping a little high level here, Anthropic's new model released today put an emphasis on cybersecurity and specifically the model's performance for vulnerability discovery and patching. So I was just wondering if you could talk about what you believe these developments mean for Qualys and maybe the cybersecurity industry more broadly as model providers look to potentially go deeper into cybersecurity. Thanks.
Michael Richards: Hey, guys. This is Mike Richards. I'm from Matt. Thanks for taking the question. Keeping a little high level here, Anthropic's new model released today put an emphasis on cybersecurity and specifically the model's performance for vulnerability discovery and patching. So I was just wondering if you could talk about what you believe these developments mean for Qualys and maybe the cybersecurity industry more broadly as model providers look to potentially go deeper into cybersecurity. Thanks.
Speaker #10: So, I was just wondering if you could talk about what you believe these developments mean for Qualys and maybe the cybersecurity industry more broadly, as model providers look to potentially go deeper into cybersecurity.
Speaker #10: Thanks.
Speaker #8: Yeah. Great question. I think today's announcement was great in terms of that understanding the fact that autonomous AI during the coding process or when you look at the code of a software and pointing agentic AI to that is definitely something that the attackers are looking to leverage, and they are leveraging as well to be able in the codebase.
Sumedh Thakar: Yeah. Great question. I think today's announcement was great in terms of understanding the fact that autonomous AI during the coding process or when you look at the code of a software and pointing agentic AI to that is definitely something that the attackers are looking to leverage, and they are leveraging as well to be able to discover vulnerabilities in the codebase. Now, having the ability to discover a vulnerability in an open-source code is one thing, which is what Anthropic is helping. But once you find that this particular code has a particular vulnerability that could be exploited, you need to go find all of the machines running that software all over the customer's environment internally, externally.
Sumedh Thakar: Yeah. Great question. I think today's announcement was great in terms of understanding the fact that autonomous AI during the coding process or when you look at the code of a software and pointing agentic AI to that is definitely something that the attackers are looking to leverage, and they are leveraging as well to be able to discover vulnerabilities in the codebase. Now, having the ability to discover a vulnerability in an open-source code is one thing, which is what Anthropic is helping. But once you find that this particular code has a particular vulnerability that could be exploited, you need to go find all of the machines running that software all over the customer's environment internally, externally.
Speaker #8: Now, having the ability to discover a vulnerability in open-source code is one thing, which is what Anthropic is helping with. But once you find that this particular code has a particular vulnerability that could be exploited, you need to go find all of the machines running that software all over the customer's environment—internally, externally—and then the ability to test that, after all the controls that the customer has put in place in their environment on that machine, is that actually exploitable in each individual customer's environment and on each individual customer's machine?
Sumedh Thakar: Then the ability to test that after all the controls that the customer has put in place in their environment on that machine, is that actually exploitable, each individual customer's environment in each individual customer's machine? And that's the part where I think the Anthropic development actually really helps, again, stress the reason why after a particular vulnerability is discovered and exploit is discovered, why it is important to use an ETM, agentic AI-type solution to very quickly validate that in your environment and then actually fix it and apply a fix autonomously. Because when you're using AI to find these particular vulnerabilities and attackers are using the same model, they are going to try to do their best to very quickly exploit those.
Sumedh Thakar: Then the ability to test that after all the controls that the customer has put in place in their environment on that machine, is that actually exploitable, each individual customer's environment in each individual customer's machine? And that's the part where I think the Anthropic development actually really helps, again, stress the reason why after a particular vulnerability is discovered and exploit is discovered, why it is important to use an ETM, agentic AI-type solution to very quickly validate that in your environment and then actually fix it and apply a fix autonomously. Because when you're using AI to find these particular vulnerabilities and attackers are using the same model, they are going to try to do their best to very quickly exploit those.
Speaker #8: And that's the part where I think the Anthropic development actually really helps, again, stress the reason why, after a particular vulnerability is discovered and an exploit is discovered, it is important to use an ETM, agentic AI-type solution to very quickly validate that in your environment, and then actually fix it and apply or fix autonomously.
Speaker #8: Because once you're using AI to find these particular vulnerabilities and attackers are going to are using the same model, they are going to try to do their best to very quickly exploit those.
Speaker #8: So what we feel is we are empowering our customers with ETM and with somebody like Agent Val to actually stay ahead of or the gap between discovery of a vulnerability to the exploitation that we can actually leverage ETM with agentic AI Val to then actually find this issue in their specific environment on their specific machine and then protect them very quickly by actually being able to patch that.
Sumedh Thakar: So what we feel is we are empowering our customers with ETM and with somebody like Agent Val to actually stay ahead of the gap between discovery of a vulnerability to the exploitation, that we can actually leverage ETM with agentic AI Val to then actually find this issue in their specific environment on their specific machine and then protect them very quickly by actually being able to patch that. And so that's really the main differentiator. So I think in a way, it's great to show the power of what AI is able to provide for the attackers to find issues in open source. And then it signifies even more the value of the ETM platform to actually find that during runtime and not just in the codebase as Anthropic is doing today.
Sumedh Thakar: So what we feel is we are empowering our customers with ETM and with somebody like Agent Val to actually stay ahead of the gap between discovery of a vulnerability to the exploitation, that we can actually leverage ETM with agentic AI Val to then actually find this issue in their specific environment on their specific machine and then protect them very quickly by actually being able to patch that. And so that's really the main differentiator. So I think in a way, it's great to show the power of what AI is able to provide for the attackers to find issues in open source. And then it signifies even more the value of the ETM platform to actually find that during runtime and not just in the codebase as Anthropic is doing today.
Speaker #8: And so that's really the main differentiator. So I think in a way, it's great to show the power of what AI is able to provide for the attackers to find issues in open source and then it signifies even more the value of the ETM platform to actually find that during runtime and not just in the codebase as Anthropic is doing
Speaker #8: today. Thank
Mike Richards: Thank you.
Michael Richards: Thank you.
Speaker #1: Thank you. And the you. next question, we'll come from Patrick Colville, Wisconsin Bank. Your line is open.
Operator: Thank you. The next question will come from Patrick Colville, Scotiabank. Your line is open.
Operator: Thank you. The next question will come from Patrick Colville, Scotiabank. Your line is open.
Speaker #11: Thanks. This is Joe Vanderkon for Patrick Colville. Can you help us understand? I know you kind of touched on this, but can you help us just better understand the strategy you're taking to get customers to adopt not just vulnerability management, but also prioritization and patch management?
Rudy Kessinger: Thanks. This is Joe Vandrick on for Patrick Colville. Sumedh, can you help us understand? I know you kind of touched on this, but can you help us just better understand the strategy you're taking to get customers to adopt not just vulnerability management, but also prioritization and patch management? And then I'm wondering, is there a way to think about what percentage of the customer base is just using that basic functionality of vulnerability management?
Joe Vandrick: Thanks. This is Joe Vandrick on for Patrick Colville. Sumedh, can you help us understand? I know you kind of touched on this, but can you help us just better understand the strategy you're taking to get customers to adopt not just vulnerability management, but also prioritization and patch management? And then I'm wondering, is there a way to think about what percentage of the customer base is just using that basic functionality of vulnerability management?
Speaker #11: And then I'm wondering is there a way to think about what percentage of the customer base is just using that basic functionality of vulnerability management?
Speaker #8: Yeah. Great question. I think if you kind of look at what we have been doing with patch management, by the way, and if you look at where we're happy to see the adoption of patch management, cybersecurity, asset management as the capabilities that sort of take that vanilla VMDR and add more execution around or execution for success around those lists of CVEs, we're pretty happy and excited to see that.
Sumedh Thakar: Yeah. Great question. I think if you kind of look at what we have been doing with Patch Management, by the way, and if you look at we're very happy to see the adoption of Patch Management, CyberSecurity Asset Management as the capabilities that sort of take that vanilla VMDR and add more execution around or execution for success around those list of CVEs. We're pretty happy and excited to see that. And so today, with the ability to provide customers with things like average exposure window, the ability to provide customers the way that that particular vulnerability actually impacts their particular environment.
Sumedh Thakar: Yeah. Great question. I think if you kind of look at what we have been doing with Patch Management, by the way, and if you look at we're very happy to see the adoption of Patch Management, CyberSecurity Asset Management as the capabilities that sort of take that vanilla VMDR and add more execution around or execution for success around those list of CVEs. We're pretty happy and excited to see that. And so today, with the ability to provide customers with things like average exposure window, the ability to provide customers the way that that particular vulnerability actually impacts their particular environment.
Speaker #8: And so today, with the ability to provide customers with things like average exposure window, the ability to provide customers the way that that particular vulnerability actually impacts their particular environment—for example, your typical threat exposure management solutions will give you a score, a risk score, and they will say that this particular issue has a risk, or this particular asset has a risk score of 900 on 1,000.
Sumedh Thakar: As an example, your typical threat exposure management solutions will give you a score, a risk score, and they will say that this particular issue has a risk or this particular asset has a risk score of 900 on 1,000, and another one has a 750 on 1,000. Which one will you fix first? If you just go by the risk score as an example, you're going to see that maybe that risk score of 900 on 1,000 is on a machine that makes you $2 million a year, but the 750 is on one that makes you $500 million a year. Immediately, your prioritization switches and is exactly the opposite of what your exposure management solution gave you because now you added a dollar value.
Sumedh Thakar: As an example, your typical threat exposure management solutions will give you a score, a risk score, and they will say that this particular issue has a risk or this particular asset has a risk score of 900 on 1,000, and another one has a 750 on 1,000. Which one will you fix first? If you just go by the risk score as an example, you're going to see that maybe that risk score of 900 on 1,000 is on a machine that makes you $2 million a year, but the 750 is on one that makes you $500 million a year. Immediately, your prioritization switches and is exactly the opposite of what your exposure management solution gave you because now you added a dollar value.
Speaker #8: And another one has a 750 on 1,000. Which one will you fix first? If you just go by the risk score as an example, you're going to see that maybe that risk score of 900 on 1,000 is on a machine that makes you 2 million a year, but the 750 is on one that makes you 500 million a year.
Speaker #8: Immediately, your prioritization switches and is exactly the opposite of what your exposure management solution gave you because now you added a dollar value. And once you have that and you know that your potentially going to have a loss of 500 million dollars because of the exploit of this vulnerability, the next thing that customers want to be able to do is how quickly can I protect myself from making sure that I don't lose that 500 million dollars?
Sumedh Thakar: And once you have that and you know that you're potentially going to have a loss of $500 million because of the exploit of this vulnerability, the next thing that customers want to be able to do is, "How quickly can I protect myself from making sure that I don't lose that $500 million?" And that's where integrated patching and integrated mitigation solution like Qualys is super impactful for them because now they don't waste time. Because once attackers are starting to exploit vulnerabilities, it is just a you're sitting duck with an open window. And the quicker you can close that window, the better it is going to be. And our customers are really seeing that. That's why their adoption of patch management has been increasing. 140 million patches in the last one year is quite a milestone for us.
Sumedh Thakar: And once you have that and you know that you're potentially going to have a loss of $500 million because of the exploit of this vulnerability, the next thing that customers want to be able to do is, "How quickly can I protect myself from making sure that I don't lose that $500 million?" And that's where integrated patching and integrated mitigation solution like Qualys is super impactful for them because now they don't waste time. Because once attackers are starting to exploit vulnerabilities, it is just a you're sitting duck with an open window. And the quicker you can close that window, the better it is going to be. And our customers are really seeing that. That's why their adoption of patch management has been increasing. 140 million patches in the last one year is quite a milestone for us.
Speaker #8: And that's where an integrated patching and integrated mitigation solution like Qualys is super impactful for them, because now they don't waste time. Once attackers are starting to exploit vulnerabilities, it is just—you're a sitting duck with an open window, and the quicker you can close that window, the better it is going to be.
Speaker #8: And our customers are really seeing that. That's increasing: 140 million patches in the last one year. It's quite a milestone for us. And the ability to sort of give them that visibility to say that you can with this platform, you're not just exposing your exposure, you're actually fixing it is a great story.
Sumedh Thakar: And the ability to sort of give them that visibility to say that you can, with this platform, you're not just exposing your exposure. You're actually fixing it is a great story. And our partners are also excited about the ability to not just provide service around more visibility. The ability to actually be the partner for the customer that gets them an outcome of actually the risk reduced is a differentiator. And that's kind of where we are looking forward to continuing our innovation around the exploit validation and the mitigation and patch management solution, as well as awareness building around the Risk Operations Center is an area for focus for us. And then along the way, risks come from cloud. They come from your standard virtual machines. They come from cloud. That's where we have TotalCloud. They come from identities. We have ISPM for that.
Sumedh Thakar: And the ability to sort of give them that visibility to say that you can, with this platform, you're not just exposing your exposure. You're actually fixing it is a great story. And our partners are also excited about the ability to not just provide service around more visibility. The ability to actually be the partner for the customer that gets them an outcome of actually the risk reduced is a differentiator. And that's kind of where we are looking forward to continuing our innovation around the exploit validation and the mitigation and patch management solution, as well as awareness building around the Risk Operations Center is an area for focus for us. And then along the way, risks come from cloud. They come from your standard virtual machines. They come from cloud. That's where we have TotalCloud. They come from identities. We have ISPM for that.
Speaker #8: And our partners are also excited about the ability to not just provide services around more visibility; the ability to actually be the partner for the customer that gets them an outcome of, actually, the risk reduced is a differentiator.
Speaker #8: And that's kind of where we are, looking forward to continuing our innovation around the exploit validation and the mitigation and patch management solution, as well as awareness building around the risk operations center, which is an area of focus for us.
Speaker #8: And then, along the way, risks come from cloud. They come from your standard virtual machines. They come from cloud. That's where we have Oracle Cloud.
Speaker #8: They come from identities. We have ISBM for that. They come from misconfigurations, and we have Policy Audit for that. They come from AI now, for which we have Total AI as an example.
Sumedh Thakar: They come from misconfigurations, and we have Policy Audit for that. They come from AI now, for which we have TotalAI as an example. So we continue to expand ways to bring more assets into ETM. At the same time, we continue to innovate on ways to absolutely get to the final outcome of actually reducing risk with automation and agentic AI as fast as we can. And that, honestly, is really, in my mind, the big differentiator.
Sumedh Thakar: They come from misconfigurations, and we have Policy Audit for that. They come from AI now, for which we have TotalAI as an example. So we continue to expand ways to bring more assets into ETM. At the same time, we continue to innovate on ways to absolutely get to the final outcome of actually reducing risk with automation and agentic AI as fast as we can. And that, honestly, is really, in my mind, the big differentiator.
Speaker #8: So, we continue to expand ways to bring more assets into ETM. At the same time, we continue to innovate on ways to absolutely get to the final outcome of actually reducing risk with automation and agentic AI as fast as we can.
Speaker #8: And that, honestly, is really, in my mind, a big differentiator.
Speaker #11: That makes sense. And if I could sneak in one more, I think you mentioned that you're still in beta testing for QFlex and that you're going to leverage it for select partners.
Rudy Kessinger: That makes sense. And if I could sneak in one more, I think you mentioned that you're still in beta testing for QFlex and that you're going to leverage it for select partners. Is that just timing, or are you not planning to go customer-wide with that pricing model?
Joe Vandrick: That makes sense. And if I could sneak in one more, I think you mentioned that you're still in beta testing for QFlex and that you're going to leverage it for select partners. Is that just timing, or are you not planning to go customer-wide with that pricing model?
Speaker #11: Is that just timing, or are you not planning to go customer-wide with that pricing model?
Speaker #2: Yeah. We went beta with QFlex last year, and so we understand that how we could be very additive to select on a case-by-case basis because we want to create a win-win scenario for us, right?
Joo Mi Kim: Yeah. We went beta with QFlex last year. So we understand how we could be very additive to solid cohort of customers. We're rolling it out on a case-by-case basis because we want to create a win-win scenario for us, right? For customers who we feel like they would really benefit and increase their spend with us by giving them this flexibility, we're more than happy to work with them, whether it's through a partner or directly with us. Broadly speaking, we don't want to be in a situation where unintentionally, it results in a downsell for us. Then also, they don't have the ability to try out other products because they're maximizing their budget and thinking through it from that perspective. So right now, it's in beta.
Joo Mi Kim: Yeah. We went beta with QFlex last year. So we understand how we could be very additive to solid cohort of customers. We're rolling it out on a case-by-case basis because we want to create a win-win scenario for us, right? For customers who we feel like they would really benefit and increase their spend with us by giving them this flexibility, we're more than happy to work with them, whether it's through a partner or directly with us. Broadly speaking, we don't want to be in a situation where unintentionally, it results in a downsell for us. Then also, they don't have the ability to try out other products because they're maximizing their budget and thinking through it from that perspective. So right now, it's in beta.
Speaker #2: If we're a customer who we feel like they would really cohort of customers. benefit and increase their spend with us by giving So we're rolling it out them this flexibility, we're more than happy to work with them.
Speaker #2: So whether it's through a partner or directly with us, broadly speaking, we don't want to be in a situation where unintentionally it results in a downsell for us, and then also they don't have the ability to try out other products because they're maximizing their budget and thinking through it from that perspective.
Speaker #2: So right now, it's in beta, but in the longer term, we do plan on going to GA with that and potentially with a slightly tweaked structure.
Joo Mi Kim: But in the longer term, we do plan on going to GA with that and potentially with a slightly tweaked structure.
Joo Mi Kim: But in the longer term, we do plan on going to GA with that and potentially with a slightly tweaked structure.
Speaker #11: Thank you.
Rudy Kessinger: Thank you.
Joe Vandrick: Thank you.
Speaker #1: Thank you. And our next question will come from Joo Kim with Loop Capital. Your line's open.
Operator: Thank you. Our next question will come from Yun Kim with Loop Capital. Your line's open.
Operator: Thank you. Our next question will come from Yun Kim with Loop Capital. Your line's open.
Speaker #4: All right. Thank you. Sumed, I think you already touched upon some of my questions already, but how engaged are partners involving core VM renewals or are they or a lot of them that you were partners that you attracted last year, are they more about selling new
Speaker #4: All right. Thank you. Sumed, I think you already touched upon some of my questions already, but how engaged are partners involving core VM renewals or are they or a lot of them that you were partners that you attracted last year, are they more about selling new products?
Yun Kim: All right. Thank you. Sumedh, I think you already touched upon some of my questions already. But how engaged are partners involved in core VM renewals? Or are they, or a lot of them, the newer partners that you attracted last year, are they more about selling new products?
Yun Kim: All right. Thank you. Sumedh, I think you already touched upon some of my questions already. But how engaged are partners involved in core VM renewals? Or are they, or a lot of them, the newer partners that you attracted last year, are they more about selling new products?
Speaker #8: Yeah. The MROC partners that we work with are pretty excited. We're starting to see these partners launch their own services for risk operations center, which obviously takes some time because they have to come up with the brochures for the services, staff them with the right experts for risk quantification, etc.
Sumedh Thakar: Yeah. The MROC partners that we work with are pretty excited. We're starting to see these partners launch their own services for Risk Operations Center, which obviously takes some time because they have to come up with the brochures for the services, staff them with the right experts for risk quantification, etc. But what they are excited about is that instead of just looking at, "Can I get another 5 cents, 10 cents of margin on a dollar?" the ability to say that with ROC, they can actually offer higher-value services. The service you can offer to a CISO is, "Hey, here, we're going to give you a business-oriented cyber risk visibility deck that you can take to your board every quarter. That's going to make you look very smart in front of the board," is a significant value.
Sumedh Thakar: Yeah. The MROC partners that we work with are pretty excited. We're starting to see these partners launch their own services for Risk Operations Center, which obviously takes some time because they have to come up with the brochures for the services, staff them with the right experts for risk quantification, etc. But what they are excited about is that instead of just looking at, "Can I get another 5 cents, 10 cents of margin on a dollar?" the ability to say that with ROC, they can actually offer higher-value services. The service you can offer to a CISO is, "Hey, here, we're going to give you a business-oriented cyber risk visibility deck that you can take to your board every quarter. That's going to make you look very smart in front of the board," is a significant value.
Speaker #8: they are excited about is that instead of But what just looking at, "Can I get another 5 cents, 10 cents of margin on a dollar?" the ability to say that with ROC, they can actually offer higher value services, the service you can offer to a CISO is, "Hey, here's we're going to give you a business-oriented cyber risk visibility deck that you can take to your board every quarter that's going to make you look very smart in front of the board." It's a significant value, and they can charge multiple dollars as an example for those services around ETM, which they cannot necessarily do around other areas.
Sumedh Thakar: They can charge multiple dollars, as an example, for those services around ETM, which they cannot necessarily do around other areas. And with the agentic AI capabilities built in, the partners are excited that that actually can also reduce the spend that they have to do to staff their services teams with people if agentic AI capabilities in the platform can get them a patch Tuesday report within 24 hours versus taking 2 weeks for a consultant to manually go and create Excel sheets to do things like that. So very exciting early conversations. We're already starting to see some interesting wins, though it's early days, with new business and existing business with those partners that understand the risk story and positioning the broader risk management rather than just, "Okay, here's another list of vulnerabilities that I can provide you." Those conversations are very positive.
Sumedh Thakar: They can charge multiple dollars, as an example, for those services around ETM, which they cannot necessarily do around other areas. And with the agentic AI capabilities built in, the partners are excited that that actually can also reduce the spend that they have to do to staff their services teams with people if agentic AI capabilities in the platform can get them a patch Tuesday report within 24 hours versus taking 2 weeks for a consultant to manually go and create Excel sheets to do things like that. So very exciting early conversations. We're already starting to see some interesting wins, though it's early days, with new business and existing business with those partners that understand the risk story and positioning the broader risk management rather than just, "Okay, here's another list of vulnerabilities that I can provide you." Those conversations are very positive.
Speaker #8: And with the agentic AI capabilities built in, the partners are excited that that actually can also reduce the spend that they have to do to staff their services teams with people if agentic AI capabilities in the platform can get them a patch Tuesday report within 24 hours versus taking two weeks for a consultant to manually go and create Excel sheets to very exciting early conversations.
Speaker #8: We're already starting to see some interesting wins, though it's early days with new business and existing business with those partners that understand the risk story and positioning the broader risk management rather than just, "Okay, here's another list of vulnerabilities that I can provide you." Those conversations are very positive.
Speaker #8: And so, as I said, we're really focused right now on our GTM efforts—around training these partners, partnering with them, and introducing them to customers as they introduce us to prospects, etc.
Sumedh Thakar: And so, as I said, we're really focused right now on our GTM efforts around training these partners, around partnering with them, and introducing them to customers as they introduce us to prospects, etc. And as that progresses, I'm excited about the potential that partners can bring customers to us. Even if that customer might have another VM scanning solution, they can keep that solution, and they can actually bring that customer to us. And the partner can make multiple dollars on every dollar of ETM that they sell for us.
Sumedh Thakar: And so, as I said, we're really focused right now on our GTM efforts around training these partners, around partnering with them, and introducing them to customers as they introduce us to prospects, etc. And as that progresses, I'm excited about the potential that partners can bring customers to us. Even if that customer might have another VM scanning solution, they can keep that solution, and they can actually bring that customer to us. And the partner can make multiple dollars on every dollar of ETM that they sell for us.
Speaker #8: that progresses, I'm And as excited about the potential that partners can bring customers to us even if that customer might have another VM scanning solution.
Speaker #8: They can keep that solution, and they can actually bring that customer to us. And the partner can make multiple dollars on every dollar of ETM that they sell.
Speaker #8: for us. Great.
Speaker #4: Okay.
Yun Kim: Okay. Great. That's very helpful. Joo Mi Kim, if you can remind us how renewals are lined up for the year, either skewed towards second half the year consistent with the prior years or with the newer products coming in, do you see some early renewals or renewals mix kind of changing up this year?
Yun Kim: Okay. Great. That's very helpful. Joo Mi Kim, if you can remind us how renewals are lined up for the year, either skewed towards second half the year consistent with the prior years or with the newer products coming in, do you see some early renewals or renewals mix kind of changing up this year?
Speaker #4: That's very helpful. Jimmy, if you can remind us how renewals are lined up for the year, either skewed towards second-half of the year consistent with the prior years or with the newer products coming in, do you see some early renewals or renewals mix kind of changing up this year?
Speaker #4: That's very helpful. Jimmy, if you can remind us how renewals are lined up for the year, either skewed towards second-half of the year consistent with the prior years or with the newer products coming in, do you see some early renewals or renewals mix kind of changing up this year?
Speaker #2: Right now, our expectation is that the seasonality remains the same—so, the same thing as what you saw in 2025. It will be skewed towards the second half of the year.
Joo Mi Kim: Right now, our expectation is that the seasonality remains the same. So same thing as what you saw in 2025. It will be skewed towards the second half of 2026.
Joo Mi Kim: Right now, our expectation is that the seasonality remains the same. So same thing as what you saw in 2025. It will be skewed towards the second half of 2026.
Speaker #2: 2026. Okay.
Yun Kim: Okay. Great. Thank you so much. That's it.
Yun Kim: Okay. Great. Thank you so much. That's it.
Speaker #4: Great. Thank you so much. That's
Speaker #4: it. Thank
Operator: Thank you. The next question will come from Junaid Siddiqui with Truist. Your line is open.
Operator: Thank you. The next question will come from Junaid Siddiqui with Truist. Your line is open.
Speaker #1: you. And the next question will come from Junai Sadwigwi with Truist. Your line is open.
Speaker #3: Great. Thank you for taking my question. Sumedh, you've talked about the Risk Operations Center's focus on proactive risk management versus the SOX focus on detection after the breach being a major differentiator.
Junaid Siddiqui: Great. Thank you for taking my question. Sumedh, you've talked about the Risk Operations Center's focus on proactive risk management versus the SOC's focus on detection after the breach being a major differentiator. I just wanted to ask, are you starting to see budgets flow more towards proactive security versus reactive detection and response?
Junaid Siddiqui: Great. Thank you for taking my question. Sumedh, you've talked about the Risk Operations Center's focus on proactive risk management versus the SOC's focus on detection after the breach being a major differentiator. I just wanted to ask, are you starting to see budgets flow more towards proactive security versus reactive detection and response?
Speaker #3: Just wanted to ask, are you starting to see budgets flow more towards proactive security versus reactive detection and response?
Speaker #5: Yeah. Thanks, Jumed. For the question, we definitely see the conversations with our partners who have said like, "Look, I've invested a lot over the last few years in EDR, XDR, post-breach solutions around SOC, and the and of course, there is some focus now on agentic AI SOC solutions that they're looking at to improve that even further.
Sumedh Thakar: Yeah. Thanks, Junaid, for the question. We definitely see the conversations with our partners who have said, "Look, I've invested a lot over the last few years in EDR, XDR, post-breach solutions around SOC." And of course, there is some focus now on agentic AI SOC solutions that they're looking at to improve that even further. But what they feel is that on the pre-breach side, they have invested, but they have invested in a bunch of I call them XPM tools, which is I have DSPM, I have SSPM, I have CSPM, but all of them are just giving you multiple dashboards.
Sumedh Thakar: Yeah. Thanks, Junaid, for the question. We definitely see the conversations with our partners who have said, "Look, I've invested a lot over the last few years in EDR, XDR, post-breach solutions around SOC." And of course, there is some focus now on agentic AI SOC solutions that they're looking at to improve that even further. But what they feel is that on the pre-breach side, they have invested, but they have invested in a bunch of I call them XPM tools, which is I have DSPM, I have SSPM, I have CSPM, but all of them are just giving you multiple dashboards.
Speaker #5: But what they feel is that, on the pre-breach side, they have invested, but they have invested in a bunch of, I call them, XPM tools, which is DSPM.
Speaker #5: I have SSPM. I have CSPM. But all of them are just giving you multiple dashboards. And there is definitely a bit of fatigue with these customers, and they're saying these dashboards are not helping me prevent a breach.
Sumedh Thakar: And there is definitely a bit of a fatigue with these customers in saying, "These dashboards are not helping me prevent a breach." While I have put in place a protection on the post-breach side to try to find attackers, if I can do a better job and operationalize my workflow so that I can take all these findings from multiple tools. You have these code scanners, which are kind of like false positive of service sometimes because they give you so many findings. The conversations definitely are moving in that. There is positive conversation on leveraging budget that they have or asking for more budget over the next couple of years to move in that direction. And the early adoption of ETM that we are seeing is necessary. Essentially, we're going and getting budget that they are not always moving away from something that already budgeted for.
Sumedh Thakar: And there is definitely a bit of a fatigue with these customers in saying, "These dashboards are not helping me prevent a breach." While I have put in place a protection on the post-breach side to try to find attackers, if I can do a better job and operationalize my workflow so that I can take all these findings from multiple tools. You have these code scanners, which are kind of like false positive of service sometimes because they give you so many findings. The conversations definitely are moving in that. There is positive conversation on leveraging budget that they have or asking for more budget over the next couple of years to move in that direction. And the early adoption of ETM that we are seeing is necessary. Essentially, we're going and getting budget that they are not always moving away from something that already budgeted for.
Speaker #5: While I have put in place a protection on the post-breach side to try to find attackers, if I can do a better job and operationalize my workflow so that I can take all these findings from multiple tools—you have these code scanners, which are kind of like false-positive services sometimes because they give you so many findings.
Speaker #5: The conversations definitely are moving in that there is positive conversation on leveraging budget that they have, or asking for more budget over the next couple of years, to move in that direction.
Speaker #5: And the early adoption of ETM that we are seeing is necessary in, essentially, we're going and getting budget that they are not always moving away from something that already budgeted for.
Speaker #5: So some customers have started to put budget aside for exposure management, so to say, or RBVM. But when we show them ROC, which is much bigger than exposure management and much more than RBVM, they are actually able to work with us to shift on that budget.
Sumedh Thakar: So some customers had started to put budget aside for exposure management, so to say, or RBVM. But when we show them ROC, which is much bigger than exposure management and much more than RBVM, they are actually able to work with us to shift on that budget. So I definitely feel like there is more of a focus last year and into this year on, "Hey, we need to do a better job at proactive risk management. We've done a lot of work around the reactive side. Let's focus to get better on the proactive side.
Sumedh Thakar: So some customers had started to put budget aside for exposure management, so to say, or RBVM. But when we show them ROC, which is much bigger than exposure management and much more than RBVM, they are actually able to work with us to shift on that budget. So I definitely feel like there is more of a focus last year and into this year on, "Hey, we need to do a better job at proactive risk management. We've done a lot of work around the reactive side. Let's focus to get better on the proactive side.
Speaker #5: So I definitely feel like there is more of a focus last year and into this year on, 'Hey, we need to do a better job at proactive risk management.'
Speaker #5: We've done a lot of work around the reactive side. Let's focus to get better on the proactive side.
Speaker #4: Great. Thank you.
Junaid Siddiqui: Great. Thank you.
Junaid Siddiqui: Great. Thank you.
Speaker #1: Thank you. And the next question will come from Jason Zhang with Wolf Research.
Operator: Thank you. The next question will come from Jason Jang with Wolfe Research.
Operator: Thank you. The next question will come from Jason Jang with Wolfe Research.
Speaker #6: Hey, guys. It's Joshua Tilton from Wolf Research. Can you guys hear me?
Joshua Tilton: Hey, guys. It's Joshua Tilton from Wolfe Research. Can you guys hear me?
Joshua Tilton: Hey, guys. It's Joshua Tilton from Wolfe Research. Can you guys hear me?
Speaker #6: me? Yes, Awesome.
Sumedh Thakar: Yes, Josh.
Sumedh Thakar: Yes, Josh.
Speaker #5: Josh.
Joshua Tilton: Awesome. Sumedh, I want to follow up on your answer when you were asked about kind of Anthropic's blog post today on cybersecurity. And I want to reask the question, but I want to ask it in a much more simpler way. Is the way to think about it that a lot of the functionality that Anthropic was talking to was more around application security testing and kind of some of the vulnerability discovery that happens before you would use a traditional VM tool? And again, I just play a security expert on TV, so if I'm thinking about it the wrong way, please let me know. But is that kind of the right way to think about it?
Joshua Tilton: Awesome. Sumedh, I want to follow up on your answer when you were asked about kind of Anthropic's blog post today on cybersecurity. And I want to reask the question, but I want to ask it in a much more simpler way. Is the way to think about it that a lot of the functionality that Anthropic was talking to was more around application security testing and kind of some of the vulnerability discovery that happens before you would use a traditional VM tool? And again, I just play a security expert on TV, so if I'm thinking about it the wrong way, please let me know. But is that kind of the right way to think about it?
Speaker #6: Sumedh, I want to follow up on your answer when you were asked about the kind of Anthropic's blog post today on cybersecurity. And I just want to re-ask the question, but I want to ask it in a much simpler way.
Speaker #6: Is the way to think about it that a lot of the functionality that Anthropic was talking to was more around application security testing, and kind of some of the vulnerability discovery that happens before you would use a traditional VM tool?
Speaker #6: And again, I just play a security expert on TV, so if I'm thinking about it the wrong way, please let me know. But is that kind of the right way to think about it?
Speaker #5: Yeah. Right now, a lot of that focus is on looking at open-source code, and going through the code base to look at commit logs, etc.
Sumedh Thakar: Yeah. Right now, a lot of that focus is on looking at open-source code and going through the codebase to look at commit logs, etc., around that code to find the vulnerabilities in that particular codebase. Now, that codebase is then compiled into some piece of application software, which then is running all over the place across millions of machines in different customer environments behind different firewalls, etc. So generally, that's sort of where we see Qualys's focus is more around once those vulnerabilities are discovered or attackers starting to use those, how do we then quickly assess those in runtime rather than application code discovery time, which is where a lot of these AI agents are focusing on.
Sumedh Thakar: Yeah. Right now, a lot of that focus is on looking at open-source code and going through the codebase to look at commit logs, etc., around that code to find the vulnerabilities in that particular codebase. Now, that codebase is then compiled into some piece of application software, which then is running all over the place across millions of machines in different customer environments behind different firewalls, etc. So generally, that's sort of where we see Qualys's focus is more around once those vulnerabilities are discovered or attackers starting to use those, how do we then quickly assess those in runtime rather than application code discovery time, which is where a lot of these AI agents are focusing on.
Speaker #5: Around that code to find the vulnerabilities in that particular code base. Now, that code base is then compiled into some piece of application or software, which then is running all over the place across millions of machines in different customer environments, behind different firewalls, etc.
Speaker #5: So generally, that's sort of where we see all this focus—it's more around, once those vulnerabilities are discovered or attackers start to use those, how do we then quickly assess those in runtime, rather than at application code discovery time?
Speaker #5: Which is where a lot of these AI agents are focusing.
Speaker #5: on.
Speaker #6: Makes total sense. And then
Joshua Tilton: Makes total sense. Then maybe just a quick follow-up for Jimmy. I think in the past, there's been several leadership changes throughout the years where there was always a plan to kind of invest to reignite growth. And I'm just curious, when we think about the EPS guidance for the full year, how do you think about the level of investment for 2026 that's baked into that EPS guidance versus prior years when maybe you've had one of these kind of new CRO in place or other leadership roles being filled?
Joshua Tilton: Makes total sense. Then maybe just a quick follow-up for Jimmy. I think in the past, there's been several leadership changes throughout the years where there was always a plan to kind of invest to reignite growth. And I'm just curious, when we think about the EPS guidance for the full year, how do you think about the level of investment for 2026 that's baked into that EPS guidance versus prior years when maybe you've had one of these kind of new CRO in place or other leadership roles being filled?
Speaker #6: Maybe just a quick follow-up for Jumi. I think in the past, there have been several leadership changes throughout the years where there was always a plan to kind of invest to reignite growth.
Speaker #6: And I’m just curious, when we think about the EPS guidance for the full year, how do you think about the level of investment for ’26 that’s baked into that EPS guidance versus prior years, when maybe you’ve had one of these kind of new CROs in place or other leadership roles being filled?
Speaker #2: Yeah, we're really pleased to start off the year strong, with all key positions filled and a strong, tenured executive team. So, keeping that in mind, last year we had guided to low 40s EBITDA margin, coming off of 2024's 47%.
Joo Mi Kim: Yeah. We're really pleased to start off the year strong with all key positions filled, with a strong executive team who's tenured. So keeping that in mind, last year, we had guided to low 40s EBITDA margin coming off of 2024's 47%. So the implied gap or implied margin contraction was significantly higher than what you're seeing today. We closed off the year 2025 with 47% EBITDA margin. We're guiding to mid-40s for EBITDA. So slight contraction, but it's not as significant as what we had guided to at the beginning of 2025.
Joo Mi Kim: Yeah. We're really pleased to start off the year strong with all key positions filled, with a strong executive team who's tenured. So keeping that in mind, last year, we had guided to low 40s EBITDA margin coming off of 2024's 47%. So the implied gap or implied margin contraction was significantly higher than what you're seeing today. We closed off the year 2025 with 47% EBITDA margin. We're guiding to mid-40s for EBITDA. So slight contraction, but it's not as significant as what we had guided to at the beginning of 2025.
Speaker #2: So, that implied gap—or implied margin contraction—was significantly higher than what you're seeing today. We close out the year 2025 with a 47% EBITDA margin.
Speaker #2: We're guiding to mid-40s for EBITDA, so slight contraction, but it's not as significant as what we had guided to at the beginning of 2025.
Speaker #6: It makes a lot of sense. Thank you so much, guys.
Sumedh Thakar: makes a lot of sense. Thank you so much, guys.
Joshua Tilton: makes a lot of sense. Thank you so much, guys.
Speaker #1: Thank you. This does conclude today's question and answer session. And this also concludes today's conference call. Thank you so much for participating. And you may now disconnect.
Operator: Thank you. This does conclude today's question-and-answer session. This also concludes today's conference call. Thank you so much for participating. You may now disconnect.
Operator: Thank you. This does conclude today's question-and-answer session. This also concludes today's conference call. Thank you so much for participating. You may now disconnect.
