Q2 2026 Qualys Inc Earnings Call

August 4, 2026

Operator: Ladies and gentlemen, thank you for standing by. Welcome to Qualys' Q2 2026 investor call. At this time, all participants are in a listen-only mode. After the speaker's presentation, there will be a question and answer session. To ask a question during the session, you would need to press star one one on your telephone. You will then hear an automated message advising your hand is raised. To withdraw your question, please press star one one again. Please be advised that today's conference is being recorded. I would like now to turn the conference over to Blair King, investor relations. Please go ahead.

Speaker #2: standing by. Welcome to QUALYS's second quarter 2026 investor call. At this time, all participants are in a listen-only mode. After the speaker's presentation, there will be a question-and-answer session.

Speaker #2: automated message advising your hand is raised, and to withdraw your question, please press star 11 again. Please be advised that today's conference is being recorded.

Speaker #2: I would like now to turn the conference over to Blair King, investor relations. Please go ahead.

Blair King: Thank you, Michelle. Good afternoon. Welcome to Qualys' Q2 2026 earnings call. Joining me today to discuss our results are Sumedh Thakar, our President and CEO, and Joo Kim, our CFO. Before we get started, I would like to remind you that our remarks today will include forward-looking statements that generally relate to product capabilities, future events, or future financial or operating performance. Actual results may differ materially from these statements. Factors that could cause results to differ materially are set forth in today's press release in our filings with the SEC, including our latest Form 10-Q and 10-K. Any forward-looking statements that we make on this call are based on assumptions as of today. We undertake no obligation to update these statements as a result of new information or future events. During this call, we will present both GAAP and non-GAAP financial measures.

Speaker #3: welcome to QUALYS's second quarter 2026 earnings call. Joining me today to discuss our results are Sumedh Thakar, our president and CEO, and Joo Kim, our CFO.

Speaker #3: Before we get started, I would like to remind you that our remarks today will include forward-looking statements that generally relate to product capabilities, future events, or a future financial or operating performance.

Speaker #3: The actual results may differ materially from these statements. Factors that could cause results to differ materially are set forth in today's press release and are filings with the SEC, including our latest Form 10-Q and 10-K.

Speaker #3: Any forward-looking statements that we make on this call are based on assumptions as of today, and we undertake no obligation to update these statements as a result of new information or future events.

Speaker #3: During this call, we will present both GAAP and non-GAAP financial measures. A reconciliation of GAAP to non-GAAP measures is included in today's press release. As a reminder, the press release, prepared remarks, and investor presentation are all available on the Investor Relations section of our website.

Blair King: A reconciliation of GAAP to non-GAAP measures is included in today's press release. As a reminder, the press release prepared remarks and investor presentation are all available on the investor relations section of our website. With that, I'd like to turn the call over to Sumedh.

Speaker #3: With that, I'd like to turn the call over to Sumedh.

Speaker #4: Thank you, Blair, and welcome to our second quarter earnings call. The adversaries playbook has been fundamentally rewritten by AI: collapsing exploit timelines and making one thing undeniably clear.

Sumedh Thakar: Thank you, Blair, and welcome to our Q2 earnings call. The adversary's playbook has been fundamentally rewritten by AI, collapsing exploit timelines and making one thing undeniably clear. Durable pre-breach risk management increasingly requires a vendor-neutral Agentic AI fabric that moves beyond theoretical exposure to autonomous quantification of actual exploitable risk and remediation. Demonstrating this conviction, we delivered another quarter of strong revenue growth and profitability. The urgency behind that conviction continues to intensify. Frontier and open-source AI models are capable of discovering and weaponizing vulnerabilities faster than any human team can triage them, compressing exploit timelines to hours, and in some cases, turning disclosure into compromise before a patch even exists. AI is simultaneously becoming the greatest force multiplier and the most formidable challenge cybersecurity has ever faced. Where we part ways with the continuous threat exposure management, CTEM Solutions, is how we respond to it.

Speaker #4: Durable pre-breach risk management, increasingly requires a vendor-neutral, agentic AI fabric that moves beyond theoretical exposure to autonomous quantification of actual exploitable risk and remediation.

Speaker #4: Demonstrating this conviction, we delivered another quarter of strong revenue growth and profitability. The urgency behind that conviction continues to intensify. Frontier and open-source AI models are capable of discovering and weaponizing vulnerabilities faster than any human team can triage them.

Speaker #4: Compressing exploit timelines to hours and, in some cases, turning disclosure into compromise before a patch even exists. AI is simultaneously becoming the greatest force multiplier and the most formidable challenge cybersecurity has ever faced.

Speaker #4: Where we part ways with continuous threat exposure management, CTEM solutions is how we respond to it. CTEM solutions today respond by generating more findings, more theoretical risk scores, and more dashboards, and then pass along these findings off to siloed solutions that collect data and do the patching while losing critical time at every handoff.

Sumedh Thakar: CTEM Solutions today respond by generating more findings, more theoretical risk scores, and more dashboards. Then pass along these findings off to siloed solutions that collect data and do the patching while losing critical time at every handoff. That approach was already failing before AI accelerated the threat landscape. It is fundamentally inadequate now. We believe the defenders who win in this new era of AI will not be the ones who simply detect more and more vulnerabilities and produce dashboard tourism. They will be the ones who can autonomously detect vulnerabilities at AI speed, validate actual exploitability in production, quantify that risk in dollar terms, remediate it, and then prove the exposure is closed in multi-vendor environments, all before an adversary gets there first.

Speaker #4: That approach was already failing before AI accelerated the threat landscape, and it is fundamentally inadequate now. We believe the defenders who win in this new era of AI will not be the ones who simply detect more and more vulnerabilities and produce dashboard tourism.

Speaker #4: They will be the ones who can autonomously detect vulnerabilities at AI speed, validate actual exploitability in production, quantify that risk in dollar terms, remediate it, and then prove the exposure is closed in multi-vendor environments.

Speaker #4: All before an adversary gets there first. That is the design outcome of the AI-native risk operations stack powered by our enterprise risk management ETM solution, and it is where nearly every customer conversation we are having is heading.

Sumedh Thakar: That is the design outcome of the AI native Risk Operations Center (ROC) powered by our Enterprise TruRisk Management (ETM) solution. It is where nearly every customer conversation we are having is heading. Against this backdrop, I'm pleased to announce major new capabilities on the platform we'll showcase at Black Hat later this week, spanning both AI for security and security for AI to address the post-MITRE threat landscape head-on. First, with respect to AI for security, we're pleased to introduce InstaScan, powered by Agent Insta, the newest addition to our Agentic AI marketplace and ETM solution for AI speed detection that is continuous, instantaneous, and scanless. Today, when a new vulnerability advisory is released, it takes 24 hours to a week for organizations to detect it through traditional scan cycles while adversaries weaponize the same vulnerability in minutes. Agent Insta is designed to collapse that timeline.

Speaker #4: Against this backdrop, I am pleased to announce major new capabilities on the platform will showcase at Black Hat later this week, spanning both AI for security and security for AI to address the post-Mythos threat landscape head-on.

Speaker #4: First, with respect to AI for security, we're pleased to introduce InstaScan, powered by Agent Insta, the newest addition to our agentic AI marketplace and ETM solution for AI speed detection that is continuous instantaneous and scanless.

Speaker #4: Today, when a new vulnerability advisory is released, it takes 24 hours to a week for organizations to detect it through traditional scan cycles while adversaries weaponize the same vulnerability in minutes.

Speaker #4: Agent Insta is designed to collapse that timeline by converting the asset inventory software paths and threat intelligence our customers already collect with QUALIS sensors into high-confidence exposure findings without a scan, new detections appear within minutes of disclosure, and no rescan required, and no agent disruption.

Sumedh Thakar: By converting the asset inventory software paths and threat intelligence our customers already collect with Qualys sensors into high-confidence exposure findings without a scan, new detections appear within minutes of disclosure, no rescan required, and no agent disruption. The finding is then handed to Agent Val for instant exploit validation. The risk impact is determined and quantified immediately. While competitors are still processing an advisory, writing signatures, and waiting for a scan to complete, our customers already know whether they are exposed and are taking action before a vendor patch exists. Because the finding flows straight into validation and remediation, detection is not a report. It is the first step of a continuous closed loop.

Speaker #4: The finding is then handed to Agent Val for instant exploit validation, and the risk impact is determined and quantified immediately. While competitors are still processing and advisory writing signatures and waiting for a scan to complete, our customers already know whether they are exposed and are taking action before a vendor patch exists.

Speaker #4: Because the finding flows straight into validation and remediation, detection is not a report—it is the first step of a continuous, closed loop. With last quarter's launch of TrueConfirm and Agent Val safely validating actual exploitability across chain attack paths, in live production environments, and hyper-prioritizing millions of findings to the fewer than 1% that require immediate action, the bottleneck is now shifting from identifying what to fix to actually fixing it before adversaries can act.

Sumedh Thakar: With last quarter's launch of TruConfirm and Agent Val safely validating actual exploitability across chain attack paths in live production environments and hyper prioritizing millions of findings to the fewer than 1% that require immediate action, the bottleneck is now shifting from identifying what to fix to actually fixing it before adversaries can act. This leads me to the next phase of our TruRisk Eliminate agenda, autonomous zero-day remediation at scale. Through AI-scored autonomous remediation waves, the AI-native ROC now determines the right action for every asset in multi-vendor environments, deploying a patch, staging a control rollout where caution is warranted, or applying a compensatory control where operational risk demands it. Every action is gated by our AI-driven patch reliability score and resiliency snapshots, delivering rollback rates below 1.5%, below half of 1%. The most critical assets remain human-in-the-loop oversight while the platform autonomously remediates the rest.

Speaker #4: This leads me to the next phase of our True Risk Eliminate agenda: autonomous zero-day remediation at scale. Through AI-scored, autonomous remediation waves, the AI-native rock now determines the right action for every asset in multi-vendor environments—deploying a patch, staging a control rolled out where caution is warranted, or applying a compensatory control where operational risk demands it.

Speaker #4: Every action is gated by our AI-driven patch reliability score and resiliency snapshots, delivering a rollback rate below 1.5%, below half of 1%. The most critical assets remain human-in-the-loop oversight while the platform autonomously remediates the rest.

Speaker #4: Orchestrating the cycle is Agent Sera, who prioritizes exploitable risk, quantifies it in dollar terms, sequence continuous waves, and revalidates closure with Agent Val all without proportional headcount.

Sumedh Thakar: Orchestrating the cycle is Agent Sara, who prioritizes exploitable risk, quantifies it in dollar terms, sequence continuous waves, and revalidates closure with Agent Val, all without proportional headcount. With the introduction of peer-to-peer patching, we are accelerating the delivery across distributed environments while removing the dependency on centralized infrastructure. Put simply, these newest innovations make autonomous zero-day remediation wave-driven, vendor-agnostic, safe, and provable. In live benchmarking, this collapsed the window of exposure from 21 days to minutes and auto-patched 60% of the vulnerabilities. This is not incremental. It turns a massive surge in exploitable vulnerability volume from an impossible backlog into a continuously clear queue at the speed of modern attacks. You cannot solve a minutes problem with a month-long solution.

Speaker #4: Furthermore, with the introduction of peer-to-peer patching, we are accelerating the delivery across distributed environments while removing the dependency on centralized infrastructure. Put simply, these newest innovations make autonomous zero-day remediation wave-driven vendor-agnostic, safe, and provable.

Speaker #4: In live benchmarking, this collapses the window of exposure from 21 days to minutes and auto-patch 60% of the vulnerabilities. This is not incremental. It turns a massive surge in exploitable vulnerability volume from an impossible backlog into a continuously clear queue at the speed of modern attacks.

Speaker #4: You cannot solve a minute's problem with a month-long solution. And that's the gap the AI-native rock was designed to solve with Agent Insta, providing AI speed detections, Agent Val hyper-prioritizing validated exposures, and Agent Sera performing autonomous remediation in a continuous closed loop.

Sumedh Thakar: That's the gap the AI-native ROC was designed to solve with Agent Insta providing AI speed detections, Agent Val hyper prioritizing validated exposures, and Agent Sara performing autonomous remediation in a continuous closed loop. Turning to security for AI, as enterprises raise AI workloads into production, the AI infrastructure they are building is already the next attack surface. With the introduction of Local AI 2.0, organizations can now see their full AI estate from workforce to workload and from code to runtime. Through new sensors that see AI activity at both the employee and workload level, security teams can now discover shadow AI activity across the organization, from what employees are doing with AI to which models, endpoints, and services are running in production across hybrid multi-cloud environments.

Speaker #4: Turning to security for AI, as enterprises raise AI workloads into production, the AI infrastructure, they are building is already the next attack surface. With the introduction of local AI 2.0, organizations can now see their full AI estate from workforce to workload and from code to runtime.

Speaker #4: Through new sensors that see AI activity at both the employee and workload level, security teams can now discover shadow AI activity across the organization, from one employee's outdoing with AI to which models' endpoints and services are running in production across hybrid multi-cloud environments.

Speaker #4: We have also extended our posture management coverage to SaaS platforms, including Anthropic and OpenAI, to help organizations enforce security and compliance policies across the AI platforms their teams are already using.

Sumedh Thakar: We have also extended our posture management coverage to SaaS platforms, including Anthropic and OpenAI, to help organizations enforce security and compliance policies across the AI platforms their teams are already using. Additionally, they can now identify security gaps in code before deployment, remediate with guardrails at runtime, and test model context MCP tool exploits across over 50 adversarial scenarios. Of equal importance, every AI risk across the entire stack from GPU to infrastructure to supply chain to the newest prompting injection attacks is now scored and prioritized through the same TruRisk engine that powers the Risk Operations Center. For organizations seeking to secure the infrastructure powering their AI future, these new innovations become an increasingly strong differentiator for Qualys.

Speaker #4: Additionally, they can now identify security gaps in code before deployment, remediate with guardrails at runtime, and test model context MCP tool exploits across more than 50 adversarial scenarios.

Speaker #4: And of equal importance, every AI risk across the entire stack—from GPU to infrastructure to supply chain to the newest prompt injection attacks—is now scored and prioritized through the same True Risk engine that powers the Risk Operations Center.

Speaker #4: For organizations seeking to secure the infrastructure powering their AI future, these new innovations become an increasingly strong differentiator for QUALIS. As rock adoption accelerates and these capabilities continue to compound, we remain laser-focused on driving ETM adoption throughout our VMDR customer base and positioning QUALIS for larger upsell opportunities over time.

Sumedh Thakar: As ROC adoption accelerates and these capabilities continue to compound, we remain laser-focused on driving ETM adoption throughout our VMDR customer base and positioning Qualys for larger upsell opportunities over time. Moving to our business update with customer spending $500,000 or more with us growing 8% from a year ago to 229, let me share a couple of recent wins which illustrate why organizations are turning to Qualys to help unify their security stack and operationalize the ROC. The first is with an existing Global 300 customer managing a complex data-intensive environment spanning on-prem multi-cloud and rapidly growing LLMs in production. As the volume and velocity of vulnerabilities across the environment accelerated, their teams recognized that prioritization based on theoretical risk scores couldn't deliver the business context needed to act decisively.

Speaker #4: Moving to our business update, with customers spending $500,000 or more with us growing 8% from a year ago to 229, let me share a couple of recent wins which illustrate why organizations are turning to Qualys to help unify their security stack and operationalize their SOC.

Speaker #4: The first is with an existing global 300 customer, managing a complex data-intensive environment spanning on-prem multi-cloud and rapidly growing LLMs in production. As the volume and velocity of vulnerabilities across the environment accelerated, their teams recognized that prioritization based on theoretical risk scores couldn't deliver the business context needed to act decisively.

Speaker #4: With fragmented telemetry, disconnected tools, and little automation, their teams were spending more time documenting risk than reducing it, while unpatched assets and shadow IT were silently extending exposure windows by months.

Sumedh Thakar: With fragmented telemetry, disconnected tools, and little automation, their teams were spending more time documenting risk than reducing it, while unpatched assets and shadow IT were silently extending exposure windows by months. As a result, the customer chose Qualys to operationalize their ROC, adopting VMDR, ETM, TruRisk Eliminate, and TotalAI alongside several other modules in a low seven-figure QFlex annual upsell. By consolidating Qualys and third-party data into a unified risk fabric, this customer has aligned risk reporting to the board's tolerance level, shifted remediation from manual processes to autonomous workflows, and reduces exposure window from months to hours while flattening the hiring curve and delivering better security outcomes. This is also an outstanding example of how we are leveraging our channel partners to activate the ROC to win new business.

Speaker #4: As a result, the customer chose QUALIS to operationalize their rock. Adopting VMDR ETM True Risk Eliminate and Total AI alongside several other modules in a low seven-figure Q-Flex annual upsell.

Speaker #4: By consolidating QUALIS and third-party data into a unified risk fabric, this customer has aligned risk reporting to the board's tolerance level, shifted remediation from manual processes to autonomous workflows, and reduced its exposure window from months to hours while flattening the hiring curve and delivering better security outcomes.

Speaker #4: This is also an outstanding example of how we are leveraging our channel partners to activate the rock with new way to win new business.

Speaker #4: The second is with a European healthcare company that has been a small existing scan on behalf of QUALIS customer but was relying on a managed service provider to run their broader vulnerability program across more than 140 locations.

Sumedh Thakar: The second is with a European healthcare company that has been a small existing scan-on-behalf Qualys customer but was relying on a managed service provider to run their broader vulnerability program across more than 140 locations. That model delivered people and process but not autonomy. Scan operations, prioritization, and remediation guidance all flowed through the provider's team on the provider's timeline, leaving the customer dependent on external resources to understand and act on its own risk. As this environment grew more complex and vulnerability volume surged, the limitation of that dependency became unsustainable. The customer had limited visibility into the very data driving the decisions made on its behalf. This customer chose Qualys, consolidating its stack into the Qualys platform by adopting VMDR, ETM, and TruRisk Eliminate in a six-figure QFlex upsell.

Speaker #4: That model delivered people and processes, but not autonomy. Scan operations, prioritization, and remediation guidance all flowed through the provider's team on the provider's timeline, leaving the customer dependent on external resources to understand and act on its own risk.

Speaker #4: As this environment grew more complex and vulnerability volume surged, the limitation of that dependency became unsustainable. Costs were belowing remediation cycles were the customer had limited visibility into the very data driving the decisions made on its behalf.

Speaker #4: This customer chose QUALIS consolidating its stack into the QUALIS platform by adopting VMDR ETM and True Risk Eliminate. In a six-figure Q-Flex upsell. Rock automation was the entry point and remediation was the immediate proof of value.

Sumedh Thakar: ROC automation was the entry point, and remediation was the immediate proof of value. By unifying detection, prioritization, and autonomous remediation into a single AI-native workflow, this customer has replaced a manual people and process dependency with a platform that delivers significantly lower cost, less complexity, full control, and peace of mind for the CISO. These wins reflect the broader ETM momentum we are starting to see as more and more customers recognize the efficiencies and scale of AI-native ROC automation. Further supporting our growth trajectory, QFlex continues to gain traction as another strategic lever for accelerating ETM adoption. As we heard in the customer wins I described earlier, QFlex played a direct role in enabling significant upsells for Qualys by giving these customers the flexibility to commit broadly across the platform while preserving the ability to shift investments as their needs evolve.

Speaker #4: By unifying detection prioritization and autonomous remediation into a single AI-native workflow, this customer has replaced a manual people and process dependency with a platform that delivers significantly lower cost, less complexity, full control, and peace of mind for the CISO.

Speaker #4: These wins reflect the broader ETM momentum we are starting to see as more and more customers recognize the efficiencies and scale of AI-native rock automation.

Speaker #4: Further supporting our growth trajectory, Q-Flex continues to gain traction as another strategic lever for accelerating ETM adoption. As we heard in the customer wins I described earlier, Q-Flex played a direct role in enabling significant upsells for QUALIS by giving these customers the flexibility to commit broadly across the platform while preserving the ability to shift investments as their needs evolve.

Speaker #4: This precisely the value proposition of Q-Flex model was designed to deliver. Building on strong results from our initial rollout, we have now taken Q-Flex live for enterprise customers looking to expand with QUALIS and believe it can become an increasingly important driver of platform expansion over time.

Sumedh Thakar: This is precisely the value proposition of QFlex model was designed to deliver. Building on strong results from our initial rollout, we have now taken QFlex live for enterprise customers looking to expand with Qualys and believe it can become an increasingly important driver of platform expansion over time. Turning to our executive team, with the recent departure of our CISO and general manager of our ETM business, I want to address how we are positioning for continuity and acceleration. To lead product strategy and our ETM business going forward, I have appointed Shailesh Athalye as our Chief Product Solutions Officer, a nearly 14-year Qualys veteran who has served as our SVP of product for the last 5 years.

Speaker #4: Turning to our executive team, with the recent departure of our CISO and general manager of our ETM business, I want to address how we are positioning for continuity and acceleration.

Speaker #4: To lead product strategy and our ETM business going forward, I have appointed Shailesh Atle as our Chief Product Solutions Officer, a nearly 14-year Qualys veteran who has served as our SVP of Products for the last five years.

Speaker #4: Shailesh has an instrumental in shaping many of the platform innovations we discussed today and his deep institutional knowledge of our technology, our customers, and our roadmap makes him the natural leader to drive the next phase of ETM adoption and our customer-led growth strategy.

Sumedh Thakar: Shailesh has been instrumental in shaping many of the platform innovations we discussed today, and his deep institutional knowledge of our technology, our customers, and our roadmap makes him the natural leader to drive the next phase of ETM adoption and our customer-led growth strategy. Additionally, I'm pleased to welcome Nathan Smolenski as our new Chief Information Security Officer. Nathan is a seasoned cybersecurity executive with over 24 years of experience driving security transformations across financial services, insurance, and high-growth SaaS environments, most recently serving as the Global CISO at Cyera. We are excited to have both Shailesh and Nathan in these critical roles as we continue to scale our platform and accelerate ROC adoption.

Speaker #4: Additionally, I'm pleased to welcome Nathan Smolensky as our new chief information security officer. Nathan is a seasoned cybersecurity executive with over 24 years of experience driving security transformations across financial services, insurance, and high-powered high-growth SaaS environments most recently serving as the global CISO at Cyera.

Speaker #4: We are excited to have both Shailesh and Nathan in these critical roles as we continue to scale our platform and accelerate rock adoption. In summary, QUALIS has continued innovation spanning both AI for security and security for AI, growing AI-native rock adoption powered by our ETM solution, a growing federal pipeline for new business opportunities, strong partner-led execution, and promising early Q-Flex engagement, continue to reinforce the demand we're seeing for a unified risk management platform that autonomously moves beyond theoretical exposure to validated quantified and remediated risk at the speed of modern attacks in multi-vendor environments.

Sumedh Thakar: In summary, Qualys' continued innovation spanning both AI for security and security for AI, growing AI-native ROC adoption powered by our ETM solution, a growing federal pipeline for new business opportunities, strong partner-led execution, and promising early QFlex engagement continue to reinforce the demand we're seeing for a unified risk management platform that autonomously moves beyond theoretical exposure to validated, quantified, and remediated risk at the speed of modern attacks in multi-vendor environments. We believe these achievements not only advance our strong competitive differentiation, but also sharpen the market opportunity ahead of us and bolster our confidence in re-accelerating long-term growth in the business. With that, I will turn the call over to Junu to further discuss our Q2 results and outlook for the Q3 and full year 2026.

Speaker #4: We believe these achievements not only advance our strong competitive differentiation, but also sharpen the market opportunity ahead of us and bolster our confidence in re-accelerating long-term growth in the business.

Speaker #4: With that, I will turn the call over to Junie to further discuss our second quarter results and outlook for the third quarter and full year 2026.

Speaker #1: Thanks, Megan. Good afternoon. Before I start, I'd like to note that, except for revenues, all financial figures are non-GAAP, and growth rates are based on comparisons to the prior year period, unless stated otherwise.

Joo Mi Kim: Thanks, Sumedh, and good afternoon. Before I start, I'd like to note that except for revenue, all financial figures are non-GAAP and growth rates are based on comparisons to the prior year period unless stated otherwise. Turning to Q2 results, revenue grew 11% to $182.2 million. As a result of a strategic emphasis on leveraging our partner ecosystem to drive growth, the channels continued to increase its contribution, making up 54% of total revenues, compared to 49% a year ago. Revenue from channel partners grew 22%, with revenues from direct remaining largely unchanged from Q2 of last year. By geo, 15% growth outside the US was ahead of our domestic business, which grew 8%. The US and international revenue mix was 55% and 45% respectively.

Speaker #1: Turning to second quarter results, revenues grew 11% to 182.2 million. As a result, there was strategic emphasis on leveraging our partner ecosystem to drive growth.

Speaker #1: The channels continue to increase its contribution, making a 54% of total revenues compared to 49% a year ago. Revenues from channel partners grew 22%, with revenues from direct remaining largely unchanged from Q2 of last year.

Speaker #1: By GO, 15% grew outside the US with a head of our domestic business, which grew 8%. US and international revenue mix was 55% and 45% respectively.

Joo Mi Kim: In Q2, our overall upsell execution improved with our net dollar expansion rate at 105%, up from 104% last quarter. The net dollar expansion rate of customers with prior year purchase of ETM or CSAM subscriptions in Q2 was 107%, consistent to last quarter. Moving on to product mix, our differentiating new products continue to drive growth. First, ETM/CSAM combined made up 12% of total bookings and 14% of new bookings on an LTM basis in Q2, up from last year's 9% and 10% respectively. Next, patch management made up 9% of total bookings and 16% of new bookings on an LTM basis in Q2. This compares to 7% and 16% respectively in Q2 of last year. Lastly, total cloud made up 5% of total LTM bookings in Q2, unchanged from a year ago.

Speaker #1: In Q2, our overall upsell execution improved with our net dollar expansion rate at 105%, up from 104% last quarter. The net dollar expansion rate of customers with prior year purchase of ETM or CSAM subscriptions in Q2 was 107%, consistent to last quarter's.

Speaker #1: Moving on to product mix, our differentiated new products continue to drive growth. First, ETM and CSAM combined made up 12% of total bookings and 14% of new bookings on an LTM basis in Q2.

Speaker #1: Up from last year’s 9% and 10%, respectively. Next, patch management made up 9% of total bookings and 16% of new bookings on an LTM basis in Q2.

Speaker #1: This compares to 7% and 16% respectively in Q2 of last year. Lastly, total cloud made up 5% of total LTM bookings in Q2, unchanged from a year ago.

Speaker #1: We believe that these differentiated products combined will increase contribution to bookings in 2026, given our opportunity to increase market share and maximize share of wallet.

Joo Mi Kim: We believe that these differentiated products combined will increase contribution to bookings in 2026, given our opportunity to increase market share and maximize share of wallet. Reflecting our scalable and sustainable business model, adjusted EBITDA for Q2 of 2026 was $83.8 million, representing a 46% margin, compared to 45% last year. Operating expenses in Q2 increased by 8% to $73.2 million, driven by investment in sales and marketing, which grew 14%. With a strong performance, EPS for Q2 of 2026 was $1.98 per diluted share, and our free cash flow was $55.9 million, representing a 31% margin, compared to 20% in the prior year, due to fluctuations in working capital. Normalizing for this, H1 of 2026 margin was 42%, compared to 43% in the prior year.

Speaker #1: Reflecting our scalable and sustainable business model, adjusted EBITDA for the second quarter of 2026 was 83.8 million, representing a 46% margin compared to 45% last year.

Speaker #1: Operating expenses in Q2 increased by 8% to 73.2 million, driven by investments in sales and marketing, which grew 14%. With a strong performance, EPS for the second quarter of 2026 was 1.98 per diluted share and a free cash flow was 55.9 million, representing a 31% margin compared to 20% in the prior year due to fluctuations in working capital.

Speaker #1: Normalizing for this, first half of 2026 margin was 42% compared to 43% in the prior year. In Q2, we continued to invest the cash we generated from operations back into QUALIS, including 3.7 million in capital expenditures and 76.8 million to repurchase 797,000 of our outstanding shares.

Joo Mi Kim: In Q2, we continued to invest the cash we generated from operations back into Qualys, including $3.7 million in capital expenditures and $76.8 million to repurchase 797,000 of our outstanding shares. As of the end of the quarter, we had $229.8 million remaining in our share repurchase program. With that, let us turn to guidance, starting with revenue. For the full year 2026, we now expect revenues to be in the range of $732 to $738 million, which represents a growth rate of 9% to 10%. This compares to prior guidance of $721 to $727 million. For Q3 of 2026, we expect revenues to be in the range of $185.5 to $187.5 million, representing a growth rate of 9% to 10%. This guidance assumes our net dollar expansion rate remains at current levels, with moderate growth contribution from new business in 2026. Shifting to profitability guidance.

Speaker #1: As of the end of the quarter, we had $229.8 million remaining in our share repurchase program. With that, let us turn to guidance, starting with revenues.

Speaker #1: For the full year 2026, we now expect revenues to be in the range of $732 to $738 million, which represents a growth rate of 9% to 10%.

Speaker #1: This compares to prior guidance of 721 to 727 million. For the third quarter of 2026, we expect revenues to be in the range of 185.5 to 187.5 million, representing a growth rate of 9 to 10%.

Speaker #1: This guidance assumes our net dollar expansion rate remains at current levels with moderate growth contribution from new business in 2026. Shifting to profitability guidance, for the full year 2026, we expect EBITDA margin to be in the mid-40s, with a low teens increase in operating expenses and free cash flow in the low 40s, we expect full year EPS to be in the range of 7.74 to 7.88, up from the prior range of 7.44 to 7.65.

Joo Mi Kim: For the full year 2026, we expect EBITDA margin to be in the mid-40s, with a low teens increase in operating expenses and free cash flow in the low 40s. We expect full year EPS to be in the range of $7.74 to $7.88, up from the prior range of $7.44 to $7.65. For Q3 of 2026, we expect EPS to be in the range of $1.91 to $1.98. Our planned capital expenditures in 2026 are expected to be in the range of $8 to $12 million. For Q3 of 2026, in the range of $1 to $2.5 million. With that, Sumedh and I would be happy to answer any of your questions.

Speaker #1: For the third quarter of 2026, we expect EPS to be in the range of 1.91 to 1.98. Our planned capital expenditures in 2026 are expected to be in the range of 8 to 12 million, and for the third quarter of 2026 in the range of 1 to 2.5 million.

Speaker #1: With that, Sumedh and I would be happy to answer any other questions.

Operator: Thank you. As a reminder, to ask a question, please press star one one on your telephone and wait for your name to be announced. To withdraw your question, please press star one one again. The first question comes from Kingsley Crane with Canaccord. Your line is now open.

Speaker #2: Thank you. As a reminder to ask a question, please press star 11 on your telephone and wait for your name to be announced. To withdraw your question, please press star 11 again.

Speaker #2: The first question comes from Kingsley Crane with Canaccord. Your line is now open.

Kingsley Crane: Great. Thanks for taking the question, and congrats on amazing results. Sumedh, look, the volume of AI-generated vulnerabilities, it's a clear reason why customers need InstaScan and the ROC. Then if CVE volumes were to double again, how could you capture that in your per-asset pricing model?

Speaker #3: Great. Thanks for taking the question and congrats on amazing results. Sumedh, look, the volume of AI-generated vulnerabilities, it's a clear reason why customers need InstaScan and The Rock.

Speaker #3: Can you just double-click again on how this is showing up in pipeline, how this is showing up in urgency, and then if CVE volumes were to double again, you know, how could that how could you capture that in your per-asset pricing model?

Speaker #4: Yeah, that's a great question, and I think even though the disclosure findings are increasing, I think the organization's ability to remediate is what is currently being looked at, right?

Sumedh Thakar: Yeah, that's a great question. I think, even though the disclosure of findings are increasing, I think the organization's ability to remediate is what is currently being looked at, right? That's really where our focus has been on helping these customers with autonomous remediation, because at a very high level, you cannot go and tell your management as a security leader that you're going to respond to autonomous AI exploits with more manual tools that are emailing each other on what needs to be fixed, et cetera. If you look at sort of the Risk Operations Center and what we are focused on is Agent Sara is already helping with the autonomous remediation piece. To do a great job with that and with high confidence, you need to significantly hyper prioritize your findings.

Speaker #4: And that's really where our focus has been—on helping these customers with autonomous remediation. Because at a very high level, you cannot go and tell your management, as a security leader, that you're going to respond to autonomous AI exploits with more manual tools, like emailing each other on what needs to be fixed, etc.

Speaker #4: And so if you look at sort of the risk operations center and what we are focused on is Agent Sera, is already helping with the autonomous remediation piece.

Speaker #4: But to do a great job with that and with high confidence, you need to significantly hyper-prioritize your findings, and that's where Agent Val on the risk operations center platform is helping run actual exploits to reduce the number of findings that need to be auto-remediated that actually matter to the business, and then now our latest announcement yesterday of Agent Insta, which is the ability to scan instantaneously whenever new advisory comes out, now shrinks the timeline from the advisory coming to the timeline when the advisory the vulnerabilities you want detected in the customer environment.

Sumedh Thakar: That's where Agent Val on the Risk Operations Center platform is helping, run actual exploits to reduce the number of findings that need to be auto remediated that actually matter to the business. Then now our latest announcement yesterday of Agent Insta, which is the ability to scan instantaneously whenever new advisory comes out, now shrinks the timeline from the advisory coming to the timeline when the vulnerability went detected in the customer environment. With all three of these on the ETM platform, you now actually have a real path to get something that is important and exploitable in your business remediated within the first 24 hours with minimal human intervention.

Speaker #4: And so with all three of these on the ATM platform, you now actually have a real path to get something that is important and exploitable in your business, remediated within the first 24 hours with minimal human intervention.

Speaker #4: And that is the conversation that everybody is having, is that they need to go have conversations internally to say, how are we going to move towards a roadmap that allows us a feasible autonomous remediation plan, and the ATM is enabling that.

Sumedh Thakar: That is the conversation that everybody's having, is that they need to go have conversations internally to say, "How are we going to move towards a roadmap that allows us a feasible autonomous remediation plan?" The ETM is enabling that. We of course have been ahead of this, as you know, for the last few years with creating autonomous remediation capabilities. We already had a few customers in the pipeline who were discussing with this, who saw this beforehand. The conversation with post-MITRE has helped us accelerate a couple of these opportunities. However, there's a large number of customers that are very, very curious now about what they can do and what is the art of the possible with this kind of autonomous remediation.

Speaker #4: And so we, of course, have been ahead of this. As you know, for the last few years with creating autonomous remediation capabilities, and so we already had a few customers in the pipeline who were discussing with this, who saw this beforehand, and so the conversation with Post Mythos is helping helped us accelerate a couple of these opportunities.

Speaker #4: However, there's a large number of customers that are very, very curious now about what they are what they can do and what is the art of the possible with this kind of autonomous remediation.

Sumedh Thakar: We're very excited to see that pipeline in terms of the conversations, in terms of POCs, is looking good, and we're happy with that. Of course, we have to now move forward, get the POCs done, look at the budget, see when they will close, et cetera. I would say with all the innovation and the investment that we have made, we're pretty excited to see the current conversations that we are happening.

Speaker #4: And so we're very excited to see that pipeline in terms of the conversations, in terms of POCs is, you know, looking good, and we're happy with that.

Speaker #4: And of course, we have to now move forward, get the POCs done, look at the budget, see when they will close, etc., but I would say with all the innovation and the investment that we've made, we're pretty excited to see the current conversations that we are happening.

Kingsley Crane: Great. Just to follow up for either Sumedh or Joo Mi, building off of that, billings grew 16%. It was a really sizable raise. On top of a broad base beat, we're now talking about re-accelerating long-term growth. Is it that the conviction in the business hasn't changed and the market has come toward you this quarter? Or just could you help us understand how much more bullish you are on the business today than you were 3 months ago? Thanks.

Speaker #3: Great. And then just to follow up for either Sumedh or Joo Kim, building off of that, you know, Billings Group 16%, it was a really sizable raise.

Speaker #3: On top of a broad-based beat, we're now talking about re-accelerating long-term growth. Is it that the conviction in the business hasn't changed and the market has come toward you this quarter, or just could you help us understand, you know, how just how much more bullish you are on the business today than you were three months ago?

Speaker #3: Thanks.

Sumedh Thakar: Look, I think we always sort of were ahead of this with remediation, et cetera. The conviction that this is what the market is going to need, and the investments that we put in before that has always been there. I think right now, with the advent of AI, it's just accelerated what we have sort of been seeing was going to happen at some point. The conversations are driving us to feel like because of the investment we put in the platform, these are solutions that actually can help customers right now in what they are looking for, to set up as auto remediation capabilities for the future. I will say that a lot of that goes to us being able to see where the industry is going to go and putting the investment behind it.

Speaker #4: Look, I think we always sort of were ahead of this with remediation, etc., and so the conviction that this is what the market is going to need, and the investments that we put in before that, has always been there.

Speaker #4: I think right now, with the advent of AI, it has just accelerated what we saw was going to happen at some point.

Speaker #4: And so that's sort of driving the conversations and driving us to feel like, because of the investment we put in the platform, these are solutions that actually can help customers right now in what they are looking for, to set up as auto-remediation capabilities for the future.

Speaker #4: So, I mean, I will say that a lot of that goes to us being able to see where the industry is going to go and putting the investment behind it.

Sumedh Thakar: Now, positive conversations with the customers are kind of helping us get through to ensuring that we can actually work through to see how these opportunities can close.

Speaker #4: And now, positive conversations with the customers are kind of helping us get through to ensuring that we can actually work through to see how these opportunities can close.

Sumedh Thakar: Now, positive conversations with the customers are kind of helping us get through to ensuring that we can actually work through to see how these opportunities can close.

Speaker #3: Thanks so much. Congrats.

Kingsley Crane: Thanks so much. Congrats.

Operator: Thank you. Our next question is going to come from Jonathan Ho with William Blair. Your line is open.

Speaker #2: Thank you. And our next question is going to come from Jonathan with William Blair. Your line is open.

Jonathan Ho: Hi, good afternoon, congratulations on the strong quarter. I wanted to understand a little bit better, when you talk to your customers about sort of their change in the exposure risk management process, can you maybe help us understand how much of this is that they need to cover more assets versus the fundamental patch management process changing versus having sort of the ROC part of this on the managed side? Can you just maybe unpack that for us a little bit in terms of what they're buying and also what they intend to buy over time? Thank you.

Speaker #5: Hi, good afternoon, and congratulations on the strong quarter. I wanted to understand a little bit better. You know, when you talk to your customers about sort of their change in, you know, the exposure risk management process, can you maybe help us understand how much of this is that they need to cover more assets, you know, versus the fundamental patch management process changing?

Speaker #5: You know, versus having, you know, sort of the rock part of this on the managed side. You know, can you just maybe unpack that for us a little bit in terms of what they're buying and also what they intend to buy over time?

Speaker #5: Thank you.

Sumedh Thakar: Great question. I think at the end, what they are focusing on is, Can I remediate the thing that actually matters to my environment as fast as possible, right? That includes all assets in that environment. That doesn't necessarily mean that they don't have other products that might be helping them get some visibility through acquisitions, this, that. I think that's where if you look at our strategy around ETM and what we have done with the concept of a ROC is that the ROC is a multi-vendor solution. It gives us the ability for the customers who are leveraging Qualys to have capabilities like InstaScan, where we can instantaneously detect things. We could do the same on data collecting from other scan-only products that are just throwing a bunch of CVEs.

Speaker #4: Great question. I think at the end, what they are focusing on is, can I remediate the thing that actually matters to my environment as fast as possible, right?

Speaker #4: And that includes all assets in their environment, but that doesn't necessarily mean that, you know, they have they don't have other products that might be helping them get some visibility through acquisitions, this, that.

Speaker #4: And I think that's where if you look at our strategy around ETM and what we have done with the concept of a rock is that the rock is a multi-vendor solution.

Speaker #4: So it gives us the ability for customers who are leveraging Qualys to have capabilities like InstaScan, where we can instantaneously detect things. We could do the same on data collected from other scan-only products that are just throwing a bunch of CVEs.

Sumedh Thakar: We are seeing with ETM that it is allowing us to expand the licenses in the early POCs that we have with some of these customers, the early purchasers. They are also bringing data on other tools from outside of Qualys into the ETM solution so that they can get a holistic view across multiple tools and then prioritize the ones that really matter, run the exploits, and then get into the remediation piece.

Speaker #4: So we are seeing with ETM that it is allowing us to expand licenses, you know, in the early POCs that we have with some of these customers in the early purchases.

Speaker #4: They are also bringing data on other tools from outside of Qualys into the ETM solutions so that they can get a holistic view across multiple tools, and then prioritize the ones that really matter, run the exploits, and then get into the remediation piece.

Sumedh Thakar: I think it's the focus on adding on the patch management eliminate capabilities is one aspect, and then with ETM broadening the coverage of with how many assets that they should look at to make sure the remediation succeeds is helping us that even if they have some other scan-only CVE detection tool which is producing a lot of false positives, we can all still bring that license as part of the Qualys ETM solution.

Speaker #4: So I think it's the it's the focus on adding on the patch management, eliminate capabilities is one aspect, and then with ETM broadening the coverage of with how many assets that they should look at to make sure the remediation succeeds, is helping us that even if they have some other scan-only CVE detection tool, which is producing a lot of false positives, we can all still bring that license as part of the Qualys ETM solution.

Speaker #5: Excellent. And just given the relative proximity of Mythos, you know, when do you think the bulk of the spending will start to materialize? I'm guessing we haven't seen it yet.

Jonathan Ho: Excellent. Just given the relative proximity of Mythos, when do you think the bulk of the spending will start to materialize? I'm guessing we haven't seen it yet. I just wanted to get your sense for how you think this is developing with the pipeline. Thank you.

Speaker #5: I just wanted to get your sense for, you know, how you think this is developing with the pipeline. Thank you.

Speaker #4: Yeah, I think, you know, we it's the same that we had talked about with a lot of projects came out and SolarWinds and stuff.

Sumedh Thakar: Yeah, I think it's the same that we had talked about when Log4j came out and SolarWinds and stuff. Look, our customers typically tend to be enterprises, organizations that are more thinking of long-term changes in their security programs and less about the knee-jerk reaction of immediate spending. That's kind of what we're seeing right now as well. A lot of these conversations are CISOs looking at the ways to use this post-Mythos threat landscape to make the point to the teams, internal stakeholders on long-term sustainable changes that they can make to their security program, where it's not that you do this one thing for the one month. For companies to roll out a program that allows them to do autonomous remediation, that's where they need to think through work with different stakeholders and then look at the budget.

Speaker #4: Look, our customers typically tend to be enterprises—organizations that are more focused on long-term changes in their security programs, and less on the knee-jerk reaction of, you know, immediate spending.

Speaker #4: And that's kind of what we're seeing right now as well. A lot of these conversations are CISOs looking at the ways to use this post-Mythos threat landscape to make the point to their teams' internal stakeholders on, you know, long-term sustainable changes that they can make to their security program, where it's not that you do this one thing for the one month.

Speaker #4: For companies to roll out a program that allows them to do autonomous remediation, that's where they need to think through, work with different stakeholders, and then look at the budget.

Sumedh Thakar: Does it come from an existing solution that they can get rid of? Is it something that they need to add on, et cetera. I think we are early on, we feel like in these conversations, and we will see as the next few quarter goes, to see what meaningful signals come in terms of when these budgets might be leveraged otherwise. So far right now, it's a lot more of positive conversations and pipeline building that we're doing.

Speaker #4: Does it come from an existing solution that they can get rid of? Is it something that they need to add on, etc.? So I think we are early on.

Speaker #4: We feel like in these conversations and we will see at the next few quarters goes, to see what meaningful signals come in terms of when these budgets might be leveraged.

Speaker #4: Otherwise, so far right now, it's a lot more positive conversations and pipeline building that we're doing.

Speaker #5: Thank you.

Jonathan Ho: Thank you.

Speaker #2: Thank you. And our next question will come from Patrick Colville, Wisconsin Bank. Your line is open.

Operator: Thank you. Our next question will come from Patrick Colville with Scotiabank. Your line is open.

Speaker #4: Thank you so much for having me on. I guess let me just ask Sumedh a question first, and then Jimmy, I'd like to ask you one after, if possible.

Kingsley Crane: Thank you so much for having me on. I guess, let me just ask Sumedh a question first, and then Jimmy, I'd like to ask you one after, if possible. Great to see the guide, Sumedh, fiscal year guide being raised from 8% to 10%. Then in your prepared remarks, talking about re-accelerating growth in the long term. I guess, can I ask, one question is like I think that's new disclosure. I don't think you've said that before. Can you just clarify that that is new and then-

Patrick Colville: Thank you so much for having me on. I guess, let me just ask Sumedh a question first, and then Jimmy, I'd like to ask you one after, if possible. Great to see the guide, Sumedh, fiscal year guide being raised from 8% to 10%. Then in your prepared remarks, talking about re-accelerating growth in the long term. I guess, can I ask, one question is like I think that's new disclosure. I don't think you've said that before. Can you just clarify that that is new and then-What gives you confidence, if it is new, to say that now? Is it stuff you're seeing or just conversations or just kind of help provide some color around that?

Speaker #4: Great to see the guide, Sumedh, you know, fiscal year guide, being raised from 8% to 10%. And then in your prepared remarks, talking about re-exposing growth in the long term, I guess, can I ask, you know, one question is like, I think that's new disclosure.

Speaker #4: I don't think you've said that before. Can you just clarify that that is new? And then what gives you confidence, if it is new, to say that now?

Patrick Colville: What gives you confidence, if it is new, to say that now? Is it stuff you're seeing or just conversations or just kind of help provide some color around that?

Speaker #4: Is it stuff you're seeing, or just conversations, or can you help provide some color around that? Yeah, I wouldn't say it's new, Patrick.

Sumedh Thakar: Yeah. I wouldn't say it's new, Patrick. I think we always talked about investing and innovating in the platform and our belief that what we're doing in helping with the focus on remediation is something that we've been working on strategically, along with a focus on federal and along with focus on working with our partners to focus on that acceleration of growth in the long term. Getting into long-term double-digit growth has been a focus for us. I think that is not new, so to say.

Speaker #4: I think we always talked about investing and innovating in the platform and our belief that, you know, what we're doing in helping with the focus on remediation is something that we've been working on strategically, you know, along with a focus on federal and along with focus on working with our partners.

Speaker #4: To focus on that acceleration of growth in the long term, you know, getting into long-term double-digit growth has been a focus for us. So I think that is not new, so to say.

Speaker #4: I would say that, given the current conversations that are happening, you know, it just gives us an opportunity again to talk about what we've already built and the innovations that we have already done and see how this maps to the current focus that the market has in terms of look at the end of the day, the CISOs need to be able to go tell their board and management somehow that they are going to adopt some form of autonomous remediation.

Sumedh Thakar: I would say that given the current conversations that are happening, it just gives us an opportunity again to talk about what we have already built and the innovations that we have already done and see how this maps to the current focus that the market has in terms of, look, at the end of the day, the CISOs need to be able to go tell their board and management somehow that they are going to adopt some form of autonomous remediation. They're going to have to figure out how they're going to do that. If you look in the market, with Qualys having 150 million patches deployed in the last 12 months, 40 million of those already being deployed autonomously, that gives us an interesting conversation point to build confidence for them when they're looking at these things.

Speaker #4: And so they’re going to have to figure out how they’re going to do that. And if you look in the market, you know, with Qualys having 150 million purchased deployed in the last 12 months, 40 million of those already being deployed autonomously, that gives us an interesting conversation point to build confidence for them when they’re looking at these things.

Sumedh Thakar: Right now, it's the same sort of what we've always talked about and focused on is working towards innovating and investing to create long-term growth and double-digit revenue growth is what we've always been looking at, and so this is just continuing on that momentum.

Speaker #4: And so right now, you know, it's the same sort of what we have always talked about and focused on is working towards innovating and investing to create long-term growth and double-digit revenue growth is what we have always been looking at.

Speaker #4: And so this is just continuing on that momentum. Okay, very helpful, Sumedh. And Jimmy, if I may, the disclosure about new bookings—so, 14% of new bookings were from ETM and CSAM, which, if my model is correct, is the same as last quarter.

Patrick Colville: Okay. Very helpful, Sumedh. Joo Mi, if I may, the disclosure about new bookings, 14% of new bookings were from ETM and CSAM, which, if my model's correct, that's the same as last quarter. Then 15% of new bookings from Patch in Q2, again, if my model's correct, that's the same as last quarter. I guess, totally understand all the kind of qualitative commentary around ETM and Patch. How come it's not showing up more clearly in that new booking number? Should we expect that proportion of new bookings to ETM and CSAM and Patch to increase as we look towards kind of Q3 and Q4?

Speaker #4: And then 15% of new bookings from PATCH in 2Q. Again, if my model is correct, that's the same as last quarter. So I guess totally understand all the kind of quality of the commentary around ETM and PATCH.

Speaker #4: Shouldn't like, how come it's not showing up more clearly in that new booking number? And should we expect that proportion of new bookings to ETM and CSAM and PATCH to increase as we look towards the kind of 3Q and 4Q?

Speaker #3: Yeah, in terms of the percentage contribution to bookings from new customers, we do anticipate fluctuations. We're not too surprised whether it goes up or down.

Joo Mi Kim: Yeah. In terms of the percentage contribution to bookings from new customers, we do anticipate fluctuations. We're not too surprised whether it goes up or down. If you take a look at the percentage that made up from Patch management last quarter was 15, this quarter it's 16. You're right on the ETM side. On ETM/CSAM it's 14, the same as last quarter. We're not too surprised by it because it really depends more on the customer. We're onboarding at that point in time what they end up starting off with. For example, if we have a new prospect that decide to purchase more of that or spend more of that budget on VMDR versus ETM versus Patch management, we want to make sure that the customer is set up to succeed and grow with us. This percentage, it's a healthy percentage.

Speaker #3: So if you take a look at the percentage that made up from PATCH management last quarter was 15, this quarter is 16. You're right on the ETM side.

Speaker #3: ETM CSAM is 14, the same as last quarter. We're not too surprised by it, because it really depends more on the customers who are onboarding at that point in time and what they end up starting off with.

Speaker #3: So, for example, if we have a new prospect that decides to purchase more of that, or spend more of that budget on VMDR versus EDR versus Patch Management, we want to make sure that the customer is set up to succeed and grow with us.

Speaker #3: And so, this percentage—it's a healthy percentage. What it lends itself to for us is it's really a validation that when we land new logos, go after the market.

Joo Mi Kim: What it lends itself to for us is, it's really a validation that when we land new logos, go after the market, and when we're able to win, it's partly due to the fact that we were able to innovate and lead the market in terms of our continuous enhancement and our product solution set with ETM/CSAM, as well as Patch management.

Speaker #3: And when we're able to win, it's partly due to the fact that we were able to innovate and lead the market in terms of our continuous enhancement and our product solution set with ETM, CSAM, as well as PATCH management.

Speaker #4: Thank you so much.

Patrick Colville: Thank you so much.

Operator: Thank you. The next question is going to come from Rudy Kessinger with D.A. Davidson. Your line's open.

Speaker #2: Thank you. And the next question is going to come from Rudy Kessinger with DA Davidson. Your line's open.

Speaker #5: Hey, guys. Thanks for taking my questions. Congrats on the strong results here. You know, I guess if I hear what you're saying, and that, you know, the mythos stuff is more so still in the pipeline and conversation stages and that wasn't really the driver of the quarter.

Rudy Kessinger: Hey, guys. Thanks for taking my questions and congrats on the strong results here. I guess if I hear what you're saying in that the MITRE stuff is more so still in the pipeline and conversation stages and that wasn't really the driver of the quarter. It sounds like more so just better ETM execution. Certainly seeing those demand trends, I guess, if your goal is to accelerate growth going forward, I guess, are you guys more willing to maybe utilize some of that margin and put that to work and maybe take margins down a bit further to help drive that accelerated growth? How should we think about the growth profitability trade-off into next year?

Speaker #5: It sounds like more so just better ETM execution but certainly seeing those demand trends I guess, and if your goal is to accelerate growth going forward, I guess, are you guys more willing to maybe utilize some of that margin and put that to work and maybe take margins down a bit further to help drive that accelerated growth?

Speaker #5: Or how should we think about the growth profitability trade-off, you know, into next year?

Speaker #4: Look, I think we always look at—we've talked about this—we always look at investing in innovation, investing in our sales and marketing, as we have been doing more recently.

Sumedh Thakar: Look, I think we always look at, we've talked about this, we always look at investing in the innovation, investing in our sales and marketing as we have been doing more recently. I think we always focus on ROI, we see the opportunity ahead of us, as the opportunities move through the pipeline, it is something that we continue to evaluate. At this point, we feel good about kind of the investments that we're making. I think as we see the opportunity, we will continue to evaluate that to make additional investments where needed.

Speaker #4: And I think we are, you know, we always focus on ROI, and we see the opportunity ahead of us. As the opportunities move through the pipeline, it is something that we continue to evaluate.

Speaker #4: But at this point, we feel good about kind of the investments that we're making. And I think as we see the opportunity, we will continue to evaluate that to make additional investments as needed.

Speaker #3: Right. And to double-click on that, part of the reason why we're able to accelerate the top-line growth currently without necessarily having to double dip on the investment is the fact that we are a partner-first, partner-led growth momentum right now with majority of our growth, especially when it comes to new logo acquisitions.

Joo Mi Kim: Right. To double-click on that, part of the reason why we're able to accelerate the top-line growth currently without necessarily having to double-dip on the investment is the fact that we are a partner first, partner-led growth momentum right now with majority of our growth, especially when it comes to new logo acquisitions, we're working very with our partners, and we believe that we are investing appropriately at the current levels, with the sales and marketing expense going up by 17% in Q1 and 14% in Q2. In H2, we're anticipating further acceleration in the investments into sales and marketing.

Speaker #3: We're working very closely with our partners, and we believe that we are investing appropriately at the current levels, with the sales and marketing expense going up.

Speaker #3: But 17% in Q1 and 14% in Q2. And the second half, we're anticipating further acceleration in the investments into sales and marketing.

Speaker #5: Got it. Then for my follow-up, current calculated billings is really strong in the quarter. Anything to call out there as far as, you know, maybe early renewals or anything like that that drove the better sequential and year-by-year on CCB in Q2?

Rudy Kessinger: Got it. For my follow-up, Current Calculated Billings was really strong in the quarter. Anything to call out there as far as maybe early renewals or anything like that drove the better sequential and year-over-year on CCB in Q2? For Q3 and the full year, just any directional commentary on CCB growth expectations?

Speaker #5: And then for Q3 and the full year, just any directional commentary on CCB growth expectations?

Speaker #3: Yeah. Q2, from a current billings perspective, there are always naturally quarterly fluctuations. So I would point to the LTM, which just smooths out some of the lumpiness in the current billings growth rate, which is still an acceleration as of last quarter.

Joo Mi Kim: Yeah. Q2, from a current billings perspective, there's always naturally quarterly fluctuation. I would point to the LTM, which has smoothed out some of the lumpiness in the current billings growth rate, which is still an acceleration. As of last quarter, it was 8.5% on the LTM growth, this quarter, it's at 10%. We're very pleased with the growth, because of that, we decided to increase, raise our revenue growth guidance. In terms of H2 current billings growth, we're still anticipating for the baseline 7% to 8%, which implies a full year current billings growth in line with a revenue growth rate of 9% to 10%.

Speaker #3: It was 8.5% on the LTM growth, and then this quarter, it's at 10%. We're very pleased with the growth, and because of that, we decided to increase the raised revenue growth guidance.

Speaker #3: In terms of the second half current billings growth, we're still anticipating for the baseline 7 to 8%, which implies the full year current billings growth in line with the revenue growth rate of 9 to 10%.

[Analyst] (Jefferies): Super helpful. Thanks, congrats again on the results.

Rudy Kessinger: Super helpful. Thanks, congrats again on the results.

Speaker #5: Super helpful. Thanks and congrats again on the results.

Operator: Thank you. The next question is going to come from Junaid Siddiqui with Truist. Your line's open.

Speaker #2: Thank you. And the next question is going to come from Joonath Siddiqui with TrueWist. Your line's open.

Junaid Siddiqui: Great. Thank you for taking my question. Sumedh, TruConfirm appears to be a powerful tool for ETM by helping customers validate which vulnerabilities are actually exploitable in their environment. Is that becoming the land motion for ETM? In other words, once customers see exploit validation reduce thousands of findings to a handful of truly exploitable risks, how often does that conversation expand into broader ETM remediation and risk quantification deployments?

Speaker #1: Great, thank you for taking my question. So, My True Confirm appears to be a powerful tool for ETM by helping customers validate which vulnerabilities are actually exploitable in their environment.

Speaker #1: Is that becoming like the land motion for ETM, you know, in other words, once customers see exploit validation, reduce thousands of findings to a handful of truly exploitable risks, how often does that conversation expand into broader ETM remediation and risk quantification deployments?

Sumedh Thakar: That's a great question. I think when you look at the entire vulnerability life cycle to be successful with that, there's a three bucket side, which is detection as fast as possible, and that's where our innovation with Agent Insta, which I like to call scanless scanning. The ability to post detection in less than one hour makes it possible for you to get that visibility of what might be exposed. However, just based on what is exposed from a vulnerability perspective, doesn't give you the confidence that this is actually exploitable and not exploitable in the environment because you have other tools that you might have put in place. We definitely see that with TruConfirm, it's a differentiator. There are a lot of "CTEM solutions" that are just aggregating findings and giving you a theoretical score.

Speaker #4: That's a great question. I think, you know, when you look at the entire vulnerability life cycle, to be successful with that, you know, there's a three buckets, right, which is detection as fast as possible.

Speaker #4: And that's where our innovation with Agent Insta, which I call I like to call it Scanless Scanning, the ability to post the detection in less than one hour, makes it possible for you to get that visibility of what might be exposed.

Speaker #4: However, just based on what is exposed from a vulnerability perspective, you know, doesn't give you the confidence that this is actually exploitable or not exploitable in the environment because you have other tools that you might have put in place.

Speaker #4: And so we definitely see that with TrueConfirm, it's a differentiator. There are a lot of quote-unquote CTAM solutions that are just aggregating findings and giving you a theoretical score.

Speaker #4: But that theoretical score doesn't necessarily tell you whether it is actually going to be exploitable or not. So when we are able to tell the customer, look, the ETM solution will help you theoretically reduce your findings to the 1% that matter.

Sumedh Thakar: That theoretical score doesn't necessarily tell you whether it is actually going to be exploitable or not. When we are able to tell the customer, "Look, the ETM solution will help you theoretically reduce your findings to the 1% that matter. Additionally, you can run these lightweight, safe exploits to further reduce the number of findings that actually will work in your environment," that becomes a very interesting conversation because why is that interesting? Because now that you have reduced the number of findings, it makes autonomous remediation, which is the next thing that we are selling to them, really plausible. If you tell somebody that you're going to fix a million vulnerabilities autonomously, that's a very hard conversation.

Speaker #4: And then additionally, you can run these lightweight safe exploits to further reduce the number of findings that actually will work in your environment. That becomes a very interesting conversation because why is that interesting?

Speaker #4: Because now that you have reduced the number of findings, it makes autonomous remediation, which is the next thing that we are selling to them, a really plausible.

Speaker #4: If you tell somebody that you're going to, you know, fix a million vulnerabilities autonomously, that's a very hard conversation. But if you can show them that a highly validated set of 70 vulnerabilities are the ones that we are going to fix with automation—because they are confirmed exploitable and we cannot wait for attackers to exploit them—that conversation becomes a lot better.

Sumedh Thakar: If you can show to them that highly validated 70 vulnerabilities are the ones that we are going to fix with automation because they are confirmed exploitable and we cannot wait for attackers to exploit them, that conversation becomes a lot better. TruConfirm is definitely a key part of the conversation, especially with our existing VMDR customers who are of course getting great scanning. Now, the ability to upgrade to ETM and then run the validation, which then encourages them to look for the Eliminate, which is the remediation, kind of all fits and makes all these pieces work together really well. It is an important piece of every conversation we are having with existing customers.

Speaker #4: And so, TrueConfirm is definitely a key part of the conversation, especially with our existing VMDR customers who have, of course, been getting great scanning. Now, the ability to upgrade to ETM and then run the validation, which then encourages them to look for the eliminate—which is the remediation—kind of all fits and makes all these pieces work together really well.

Speaker #4: And so, it is an important piece of every conversation we are having with existing customers.

Junaid Siddiqui: Great. Thank you. Just to follow up, could you just help us understand the behavior of those customers that have not yet adopted ETM, like those VMDR only customers? Are you still experiencing a high amount of churn there? Is that kind of like still the primary source of any pressure on your overall net dollar retention rate?

Speaker #1: Great. Thank you. And just to follow up, could you just help us understand the behavior of, you know, those customers that have not yet adopted ETM, like those VMDR-only customers?

Speaker #1: Are you still experiencing a high amount of churn there? And is that still the primary source of any pressure on your overall net dollar retention rate?

Speaker #4: Hi. I think nothing to call out. We're pleased with the overall momentum of the business. And it's we look at that as a great opportunity for us to talk to our existing VMDR customers because all of them are going to have to answer to their management and board what they are doing to find a way for autonomous remediation.

Sumedh Thakar: I think nothing to call out. We're pleased with the overall momentum of the business, we look at that as a great opportunity for us to talk to our existing VMDR customers because all of them are going to have to answer to their management and board what they are doing to find a way for autonomous remediation. The conversation of upgrading to ETM and the conversation of upgrading and adding on Eliminate, we look at that VMDR customer base as a big base that we have where we can actually create growth opportunities because almost everybody's going to need some sort of a prioritization and remediation solution moving forward after the post-MITRE era.

Speaker #4: And so the conversation of upgrading to ETM, and the conversation of upgrading and adding on EDR, we look at that VMDR customer base as, you know, a big base that we have where we can actually create growth opportunities. Because almost everybody is going to need some sort of prioritization and remediation solution moving forward after the post-Lithos era.

Sumedh Thakar: That's actually a pretty good way for us to look at it, as I think less and less customers will, I mean, more and more customers, I would say, would want to look at a solution that's not just scanning, but also giving them remediation, and that's what we're seeing in the conversations right now.

Speaker #4: So that's actually a pretty good way for us to look at it as, you know, I think less and less customers will I mean, more and more customers, I would say, would want to look at a solution that's not just scanning, but also giving them remediation.

Speaker #4: And that's what we're seeing in the conversations right now.

Junaid Siddiqui: Great. Thank you.

Speaker #1: Great. Thank you.

Operator: Thank you. The next question will come from Joseph Gallo with Jefferies. Your line's open.

Speaker #2: Thank you. And the next question will come from Joseph Gallow with Jeffries. Your line's open.

[Analyst] (Jefferies): Hi, this is Grant doing on for Joe Gallo. Thanks for taking the questions. I wanted to ask first, have you seen anything different competitively post-Methos release? It seems like we're hearing more chatter from a variety of players who are signaling more interest in the space. Your results certainly signal strength, but just curious if you're seeing or expecting any change in competitive dynamics, and also if there's any difference in the frequency of competitive displacements to call out.

Speaker #5: Hi. This is Grant Dorling on for Joe Gallow. Thanks for taking the questions. I wanted to ask first, have you seen anything different competitively post Methos release?

Speaker #5: It seems like we're hearing more chatter from a variety of players who are signaling more interest in the space. So your results certainly signal strength, but just curious if you're seeing or expecting any change in competitive dynamics and also if there's any difference in the frequency of competitive displacements to call out.

Speaker #4: Well, I think the problem the customers have is the chatter, right? There's too many solutions that are just throwing more and more CVEs and, you know, which is kind of something that they're focusing on.

Sumedh Thakar: Well, I think the problem the customers have is the chatter, right? There's too many solutions that are just throwing more and more CVEs, which is kind of something that they're focusing on, that creates a lot of chatter and noise for customers that they have to read through. Where we are seeing success is not just the traditional, "Hey, let's find a 1 million CVE findings." Where we are differentiating and why we are seeing that differentiator is things like TruConfirm, where we're basically able to not just tell you the CVE is there, but actually have the ability to find a way to give you confidence in its exploitability by actually exploiting it in some cases, giving you additional information in other cases.

Speaker #4: And that creates a lot of chatter and noise for customers that they have to weed through. And so where we are seeing success is not just the traditional, hey, you know, let's find a million CVE findings.

Speaker #4: Where we are differentiating and why we are seeing that differentiator is things like TrueConfirm, right, where we're basically able to not just tell you the CVEs there, but actually have the ability to find a way to give you a confidence in its exploitability by actually exploiting it in some cases, giving you additional information in other cases.

Speaker #4: Our autonomous remediation—while there's a lot of tools that are throwing out CVEs, and, you know, tools that are saying they can find something and then they will email the patching solution what they need to fix—we're actually natively patching that in a matter of hours.

Sumedh Thakar: Our autonomous remediation, while there's a lot of tools that are throwing out CVEs and tools that are saying that they can find something and then they will email the patching solution, what they need to fix, we're actually natively patching that in a matter of hours. The interest is more to say, Oh, wait, there is a solution that can actually allow me to fix an exploited, exposed vulnerability in four hours from the release. Versus I'm going to have a hodgepodge of these different solutions that is not actually going to work in the environment. I think that's really what's driving the conversations right now, and that's what we're excited about.

Speaker #4: And so the interest is more to say, oh, wait, there is a solution that can actually allow me to fix an exploited, exposed vulnerability in four hours from the release.

Speaker #4: Versus I'm going to have a hotspot of these different solutions that is not actually going to work in the environment. And so I think that's really kind of what's driving the conversations right now.

Speaker #4: And that's what we're excited about.

Speaker #5: Got it. And then maybe for my follow-up, you know, you've referenced the growing federal pipeline a few times. I guess just any way to quantify the size of that business today and then just any more detail that you could provide?

[Analyst] (Jefferies): Got it. Maybe for my follow-up, you've referenced the growing federal pipeline a few times. I guess just any way to quantify the size of that business today, and then just any more detail that you could provide regarding your thoughts about that opportunity and maybe your right to win there going forward.

Speaker #5: You know, regarding your thoughts about that opportunity and maybe your right to win there going forward.

Sumedh Thakar: It is right now not a big part of the business, but that is where the opportunity lies right now. I think if you look at the focus of the current administration, if you look at the new CISA BOD, very interesting that the new CISA BOD really talks about fast detection, exploit validation, and quick remediation. I've heard this somewhere for the last two years, right? We've focused on building this and being ready for this. The federal government is also very focused on ensuring that they are seeing outcomes, which are CISA's new requirement of remediating in 72 hours. Okay? How are you going to remediate something if your scan is taking two days? That's where InstaScan is going to help you find the issue in the first 60 minutes, giving you a realistic chance to meet the BOD requirement.

Speaker #4: Right now, it's not a big part of the business, but that is where the opportunity lies. I think if you look at the focus of the current administration, and if you look at the new CISA board, it's very interesting that the new CISA board really talks about fast detection, exploit validation, and quick remediation.

Speaker #4: I've heard this somewhere for the last two years, right? So we've focused on building this and being ready for this. And so the federal government is also very, very focused on ensuring that they are seeing outcomes, which are CISA's new requirement of remediating in 72 hours, okay?

Speaker #4: How are you going to remediate something if your scan is taking two days? That's where InstaScan is going to help you find the issue in the first 60 minutes, giving you a realistic chance to meet the board requirement.

Speaker #4: And so, that is creating very, very positive conversations with the federal customers that we are engaged with. A lot of them have very old-school, traditional on-prem solutions for scanning, and different solutions for patching.

Sumedh Thakar: That is creating very positive conversations with the federal customers that we are engaged with. A lot of them have very old school, traditional on-prem solutions for scanning, different solutions for patching. They've been trying to patch those together for a while. Now these BODs and the focus from the administration is giving them an opportunity to look at something that is more modern and something that is really helping them give an outcome that is measurable. Now with Qualys having a FedRAMP High platform, that actually is the only platform that can do both the detection and the patching as a FedRAMP High solution. Our modern approach with Agentic AI capabilities built in with these three different agents versus sort of having one generic agent that is just talking in the back end to Anthropic or something like that.

Speaker #4: They've been trying to patch those together for a while. And now these boards and the focus from the administration is giving them an opportunity to look at something that is more modern and something that is really helping them give an outcome that is measurable.

Speaker #4: And so now with Qualys having a FedRAMP high platform that actually is the only platform that can do both the detection and the patching as a FedRAMP high solution, and our modern approach with agentic AI capabilities built in with these three different agents versus sort of having one generic agent that is just talking to in the backend to Anthropic or something like that, it creates a big differentiation in our mind and I think that is gives us the opportunity to go out and the right to have these conversations and work towards winning some of these opportunities that are coming our way.

Sumedh Thakar: It creates a big differentiation in our mind, I think that gives us the opportunity to go out and the right to have these conversations and work towards winning some of these opportunities that are coming our way. For us, given that right now it's not a big material part of the business, is where we see the big opportunity moving forward. We're excited about the conversations and the investments that we're putting behind that.

Speaker #4: And so for us, given that right now it's not a big material part of the business, it's where we see the big opportunity moving forward, and we're excited about the conversations and the investments that we're putting behind that.

Speaker #5: Understood. Thank you.

[Analyst] (Jefferies): Understood. Thank you.

Operator: Thank you. The next question is going to come from Joshua Tilton with Wolfe Research. Your line is open.

Speaker #2: Thank you. And the next question is going to come from Joshua Tilton with Wolf Research. Your line is open.

Joshua Tilton: Hey, guys. Can you hear me?

Speaker #6: Hey guys, can you hear me?

Speaker #1: Yes.

Sumedh Thakar: Yes.

Joshua Tilton: Awesome. Apologize for the background noise. I am in Vegas for Black Hat. Maybe just two quick clarifications. First one, Joo Kim, I think you said you still expect 7% to 8% current billings growth for the year. Can you help us understand why that stands or is un-updated from, I guess, what you expected last quarter, given the strong billings growth in Q2? Is it a conservative thing? Is it a Q2 is a blitz type thing? Help us understand why that full year outlook is left unchanged. Maybe I'll ask my second question now. Any way you could help us understand what net dollar retention rate is baked into the full year guidance since I think it's the Q2 now that it's kind of picked up for us? Thanks.

Speaker #6: Awesome. Apologies for the background noise. I am in Vegas for Black Hat. Maybe just two quick clarifications. First one, Joo, I think you said you still expect seven to eight percent card billing through the year.

Speaker #6: Can you help us understand, you know, why that stands or remains unchanged from, I guess, what you expected last quarter, given the strong billing growth in Q2?

Speaker #6: Is it a conservative thing? Is it a Q2 is a blips type thing? Just help us understand why that full-year outlook is left unchanged.

Speaker #6: Maybe I'll just, I'll ask my second question now. Any way you could help us understand, you know, what MET dollar retention rate is baked into the full year guidance since I think it's the second quarter now that it's kind of ticked up for us?

Speaker #6: Thanks.

Speaker #3: Yeah, to clarify, the current billings guidance for the full year is now in line with a revenue guidance of 9% to 10%. So, the 7% to 8% is for the second half current billings.

Joo Mi Kim: Yeah. To clarify, the current billings guidance for the full year is now in line with a revenue guidance of 9% to 10%. The 7% to 8% is for the H2 current billings. What we're assuming is for the baseline, the H2 current billings will grow by 7% to 8% year over year. That's predicated on no meaningful change to our net dollar expansion rate, which is now at 105% versus 103% that we started off the year at.

Speaker #3: So what we're assuming is for the baseline, the second half current billings will grow by seven to eight percent year over year. And that's predicated on no meaningful change to our net dollar expansion rate, which is now at one oh five percent versus one oh three that we started off the year at.

Joshua Tilton: To be clear, the current billings of 7% to 8% is for the H2, you're saying?

Speaker #6: To be clear, the current billing is seven to eight is for the second half you're saying?

Speaker #3: That's right.

Joo Mi Kim: That's right.

Speaker #6: Okay. Super helpful. Thank you.

Joshua Tilton: Okay. Super helpful. Thank you.

Operator: Thank you. The next question will come from Mike Cikos with Needham. Your line is open.

Speaker #2: Thank you. And the next question will come from Mike Sickos with Needham. Your line's open.

Mike Cikos: Hey, thanks for taking the questions here, guys. If I could just pick up on where Josh was leaving off there. I think even earlier this year, we were talking about a soft guide for that 7% to 8% CCB in calendar 2026. Just given the year-to-date outperformance we've seen

Speaker #6: Hey, thanks for taking the questions here, guys. If I could just pick up on where Josh was leaving off there—I think even earlier this year, we were talking about a soft guide for that 7% to 8% CCB in calendar 2026.

Speaker #6: Just given the year-to-date outperformance we've seen, why not tweak that CCB even for the back half of this year, at 7 to 8 percent? Why not take that slightly higher?

Mike Cikos: Why not tweak that CCB even for back half of this year at 7% to 8%? Why not take that slightly higher? Again, we're coming off this mid-teens result you just posted in Q2. It doesn't seem like there was any real fluctuations from early renewals. Can you just help us think about what your assumptions are in deriving that 7% to 8% in the back half?

Speaker #6: Again, we're coming off this mid-teens result you just posted in Q2. It doesn't seem like there were any real fluctuations from earlier renewals. So, can you help us think about what your assumptions are in deriving that 7% to 8% in the back half?

Speaker #3: Yes. Quarterly current billings, because we don't actively manage to it, tend to be lumpy. And so, if you take a look on a net LTM basis, that's what we like to point to if you're trying to gauge the business momentum.

Joo Mi Kim: Yes. Quarterly current, because we don't actively manage to it tends to be lumpy. If you take a look at it on an LTM basis, that's what we like to point to if you're trying to gauge the business momentum. On an LTM current billings growth rate, last quarter, it was at 8.5%. This quarter, it's currently sitting at 10%. What we believe right now is, look, it's great that we see the acceleration and the LTM current billings growth rate, and I think that that 10% better reflects the current business momentum today. As Sumedh commented on before, we didn't know exactly when the acceleration or heightened kind of pressure from our existing customers who are already pretty far along the discussion of ETM adoption, were really going to execute on those deals. Q2 is a reflection of that.

Speaker #3: So, on an LTM current billings growth rate, last quarter it was at 8.5%. This quarter, it's currently sitting at 10%.

Speaker #3: And so, what we believe right now is, look, it's great that we see that acceleration in the LTM current billings growth rate. And I think that that ten percent better reflects the current business momentum today.

Speaker #3: And as Sumedh commented on before, we didn't know exactly when the acceleration or heightened kind of pressure from our existing customers, who were already pretty far along in the discussion of ETM adoption, would occur.

Speaker #3: We're really going to execute on those deals. And Q2 is a reflection of that. If you were to take a look at our customer base and take a look at them and split them into two different camps, there are already a smaller cohort of customers that were pretty far along in the discussion around the ROC adoption, upgrading to ETM that ended up translating into a better-than-expected results in Q2.

Joo Mi Kim: If you were to take a look at our customer base and take a look at them and split them into two different camps, there were already a smaller cohort of customers that were pretty far along in the discussion around the ROC adoption, upgrading to ETM, that ended up translating into a better than expected result in Q2. With that said, the second camp of customers that are not as far along in discussion, what we're anticipating right now is we're not seeing any significant increases or acceleration in the sales cycle for the cohort of customers that are up for renewal in the H2. Given that, it's a data point Q2 very strong quarter.

Speaker #3: With that said, the second camp of customers that are not as far along in discussion where we're anticipating right now is, we're not seeing any significant increases or acceleration in the sales cycle for the cohort of customers that are up for renewal in the second half.

Speaker #3: So, given that, it's a data point—Q2 was a very strong quarter. We're not anticipating any meaningful or material changes in the deal cycle in the second half.

Joo Mi Kim: We're not anticipating any meaningful material changes in the deal cycle in H2, therefore, we decided to keep the baseline at 7% to 8% for the current billings growth for the H2 of this year.

Speaker #3: And so, therefore, we decided to keep the baseline at 7% to 8% for the current billings growth for the second half of this year.

Mike Cikos: Understood. Thank you for spelling that out, Joo Min. Maybe another one here. Just wanted to get a better sense. It was great to see the last 12 months net dollar expansion improve by a point again this quarter to 105, especially since you have this improvement for total company. Meanwhile, the ETM and CSAM NDR was unchanged sequentially at 107. Can you, I guess, provide any further granularity, almost like a quarterly snapshot here, as far as what was driving the total company improvement? From products or cohort of customers adopting or increasing spend? I'd just love to get a little bit more on that.

Speaker #6: Understood. Thank you for spelling that out, Joo Kim. And maybe another one here—I just wanted to get a better sense. It was great to see the last 12 months' net dollar expansion improve by a point.

Speaker #6: Again, this quarter to 1.05, especially since you have this improvement for total company. Meanwhile, the ETM and CCM NDR was unchanged sequentially at 1.07.

Speaker #6: Can you I guess provide any further granularity, almost like a quarterly snapshot here as far as what was driving the total company improvement from products or cohort of customers adopting or increasing spend?

Speaker #6: I'd just love to get a little bit more on that.

Speaker #3: Yes. If you take a look at our product mix, that'll help you to kind of come with us in this journey of different product adoptions, and as customers come up for renewal, where they decide to spend more on.

Joo Mi Kim: Yes. If you take a look at our product mix, that'll help you to kind of come with us in this journey of different product adoptions and as customers come up for renewal, where they decide to spend more on. Right now, with our ETM and CSAM currently making up 12% of total bookings, up from 9% a year-ago period, that kind of tells you that that's really helping to drive the bookings growth momentum that we see in the business today. Patch management definitely contributed to that as well, currently at 8%. A year ago, it was at 7%. Offsetting that was the VM/DR contribution coming down to 49%, down from 54% a year ago.

Speaker #3: So right now, with our ETM and CCM currently making up 12% of total bookings, up from 9% a year ago period, that kind of tells you that that's really helping to drive the bookings growth momentum that we see in the business today.

Speaker #3: Patch management definitely contributed to that as well. Currently at 8%, a year ago it was at 7%. And then offsetting that was the VMDR contribution coming down to 49%, down from 54% a year ago.

Mike Cikos: Excellent. Thank you so much.

Speaker #6: Excellent. Thank you so much.

Operator: Thank you. The next question will come from Brian Essex with J.P. Morgan. Your line's open.

Speaker #2: Thank you. And the next question will come from Brian Essex with JP Morgan. Your line's open.

Speaker #7: Great. Good afternoon. Thank you for taking the question. I guess I have two. I think both for Junie. But I guess, Junie, I'd love to it's great to see the traction that you've got on the partner side of the business on the indirect side.

Brian Essex: Great. Good afternoon. Thank you for taking the question. I guess ASF too. I think both for Joo Mi. I guess Joo Mi, it's great to see the traction that you've got on the partner side of the business, on the indirect side. I would love to kind of understand where you're guiding spending, particularly on sales and marketing, but for OpEx overall. I think in the last quarter, you talked about mid-teens growth. It seems like you're pointed in the same direction, but you've come in well under that for H1 of the year. I'd love to understand where are you seeing traction? Where might you regulate greater spend?

Speaker #7: But I would love to kind of understand where you're guiding spending particularly in sales and marketing, but for opex overall. I think in the last quarter you talked about mid-teens growth.

Speaker #7: It seems like you're pointed in the same direction, but you've come in well under that for the first half of the year. I'd love to understand, you know, where are you seeing traction?

Speaker #7: Where might you regulate greater spend, and, you know, what might—outside of outperformance on the top line—in the back half of the year, you know, how are you regulating spend on opex and sales and marketing relative to that mid-teens level, when we've come in materially below that in the first half?

Brian Essex: What might, outside of outperformance on the top line in H2, how are you regulating spend on OpEx and sales and marketing relative to that mid-teen level when we've come in material below that in H1? I got a follow-up.

Speaker #7: And then I got a follow-up.

Speaker #3: Yeah. On the sales and marketing spend, the majority of that spend increase is driven by the headcount. So if you take a look at the seventeen percent over a year for Q1 and fourteen percent over a year for Q2, both quarters, the majority of it was basically investing back into our business, expanding our team, making sure that we have the right team members in the GTM team, whether it be sales or marketing or product.

Joo Mi Kim: Yeah. On the sales and marketing spend, majority of that spend increase is driven by the headcount. If you take a look at the 17% year-over-year for Q1 and 14% year-over-year for Q2, both quarters, majority of it was basically investing back into our business, expanding our team, making sure that we have the right team members in the GTM team, whether it be sales or marketing or product. All across the board, it's really focused on selling our product and better positioning ourselves and working very closely with our partners. With that said, we are leveraging AI back into our business as well, and that certainly helped to make sure that we're looking at the operating efficiency, making sure that it's appropriate level of investment that we're spending each quarter.

Speaker #3: Across the board, we're really focused on selling our product, better positioning ourselves, and working very closely with our partners. Now, with that said, we are leveraging AI back into our business as well.

Speaker #3: And that certainly helped to make sure that we're looking at the operating efficiency, making sure that it's the appropriate level of investment that we're spending each quarter.

Speaker #3: And so, with that in mind, we're very pleased with the momentum that we see today. We do anticipate increasing spend. Number one is always going to be headcount for us right now for 2026, but there are other investments as well—certainly demand, making sure that we're investing back in the business to generate sufficient pipeline that's quality, that we can execute on for the second half of this year.

Joo Mi Kim: With that in mind, we're very pleased with the momentum that we see today, and we do anticipate increase in spend, whether it be, number one, it's always going to be headcount for us right now for 2026. There are other certainly investments that we're making, which is demand, making sure that we're investing back into the business to generate sufficient pipeline that's quality that we can execute on for H2 of this year.

Joo Mi Kim: There are other certainly investments that we're making, which is demand, making sure that we're investing back into the business to generate sufficient pipeline that's quality that we can execute on for H2 of this year.

Speaker #7: Okay, great. That's helpful. And maybe just to clarify, how far penetrated are you into your installed base of Q-Flex? And how are you regulating the level of availability that customers might have for Q-Flex?

Brian Essex: Okay, great. That's helpful. Maybe just on Q-Flex, how far penetrated are you into your installed base with Q-Flex? How are you regulating the level of availability that customers might have for Q-Flex? Are you still measuring it and keeping it the high-end customers, or could we expect maybe a broader rollout as you develop more experience with Q-Flex across your customer install base?

Speaker #7: Are you still measuring it and keeping it kind of like for the high-end customers, or could we expect maybe a broader rollout as you develop more experience with Q-Flex across your customer install base?

Speaker #3: Yeah, we have rolled out Q-Flex. It's really more intended for our enterprise customers, and so now it's generally available to enterprise customers. We are having the appropriate level of discussions with the set of customers that are up for renewal, as well as new prospects, as we discuss with them what they're looking for and whether Q-Flex is something that's going to be advantageous to them.

Joo Mi Kim: Yeah. We have rolled out Q-Flex. It's really more intended for our enterprise customers. Now it's.

Joo Mi Kim: Yeah. We have rolled out Q-Flex. It's really more intended for our enterprise customers. Now it's. Generally available to enterprise customers, we are having appropriate level of discussions with the set of customers that are up for renewal as well as new prospects. As we discuss with them what they're looking for, is Q-Flex something that's going to be advantageous to them? Really, if you think about this product, it's a premium product, right? It helps the customers really adopt a number of our solutions in a seamless way. They're more than willing to pay the premium price for this. The way that we. Think about it right now is it going to be right for customers who are willing to grow for existing customers as we look to drive our net dollar expansion rate further up and continue to focus on that metric as customers grow with us? It will be right for our enterprise customers who are looking for a cost-effective way to gain more value, while at the same time increasing their spend with Qualys.

Joo Mi Kim: Generally available to enterprise customers, we are having appropriate level of discussions with the set of customers that are up for renewal as well as new prospects. As we discuss with them what they're looking for, is Q-Flex something that's going to be advantageous to them? Really, if you think about this product, it's a premium product, right? It helps the customers really adopt a number of our solutions in a seamless way. They're more than willing to pay the premium price for this. The way that we.

Speaker #3: And really, if you think about this product, it's a premium product, right? It helps the customers really adopt a number of our solutions in a seamless way.

Speaker #3: And so they're more than willing to pay the premium price for this. The way that we think about it right now is it's going to be right for customers who are willing to grow, for existing customers as we look to drive our net dollar expansion rate further up and continue to focus on that metric as customers grow with us.

Joo Mi Kim: Think about it right now is it going to be right for customers who are willing to grow for existing customers as we look to drive our net dollar expansion rate further up and continue to focus on that metric as customers grow with us? It will be right for our enterprise customers who are looking for a cost-effective way to gain more value, while at the same time increasing their spend with Qualys.

Speaker #3: It will be right for our enterprise customers who are looking for a cost-effective way to gain more value, while at the same time increasing their spend with quality.

Speaker #7: Okay. That's helpful. Thank you.

Brian Essex: Okay, that's helpful. Thank you.

Operator: Thank you. The next question comes from Shrenik Kothari with Baird. Your line is open.

Speaker #2: Thank you. And the next question comes from Srinik Kothari with Bayard. Your line is open.

Shrenik Kothari: Hey. Yeah. Thanks for taking my question. Again, congrats on the great quarter. My big picture, you did underscore that near term, there is a stronger patch management cycle, but you believe there's a broader category reset underway around the control plane for the pre-breach risk management as you described, exploit validation, risk quantification, and autonomous remediation. Around the AI urgency, I remember last quarter, you guys did say since it's broadening the opportunity, customers may extend sales cycles or pause renewals. Just can you add any finer point around these broader strategic deal conversion timing, sales cycles? How long are these evaluations taking? Are you seeing these conversion rates getting faster broadly, just directionally? I had a quick follow-up.

Speaker #8: Hey, yeah. Thanks for taking my question. Again, congrats on a great quarter. So, my big picture: you did underscore that near-term there is a stronger patch management cycle, but you believe there's a broader category reset underway around the control plane for the pre-breach risk management, as you described—exploit validation, risk quantification, and autonomous remediation.

Speaker #8: Around the AI urgency, I remember last quarter you guys did say, since it's broadening the opportunity, customers may extend sales cycles or pause renewals.

Speaker #8: Can you add any finer points around these broader strategic deal conversion timings, sales cycles, or how long these evaluations are taking? Are you seeing these conversion rates getting faster, broadly—just directionally?

Speaker #8: And then, I had a quick follow-up.

Speaker #9: Yeah, it's a good question. I think, as I mentioned earlier too, when we talk about the ROC—the Risk Operations Center—pre-bridge risk management is broader than just one, like liquidity management.

Sumedh Thakar: Yeah, that's a great question. I think, as I mentioned earlier, too, and when we talk about the ROC, right, the Risk Operations Center pre-breach risk management is broader than just vulnerability management. Obviously, that is the focus right now. We've talked about the use of misconfigurations as part of these attacks, use of identities, and the recent OpenAI hacking case was a great example of a vulnerability misconfiguration and identity being used. The Risk Operations Center has been broadly built around that. I think in terms of the way we are seeing the conversations is not about saying, "Can I just patch for the next one month, and I'm done?" I think the conversation with customers are really about, nobody is saying that they're just gonna patch now and then go back to not having a regular patching cycle and autonomous patching in the future.

Speaker #9: Obviously, that is the focus right now. We've talked about the use of misconfigurations as part of these attacks, the use of identities, and the recent OpenAI Hugging Face was a great example of a vulnerability—misconfiguration and identity being used.

Speaker #9: And so, the Risk Operations Center has been broadly built around that. I think in terms of the way we are seeing the conversations, it's not about saying, can I just patch for the next one month and I'm done.

Speaker #9: I think the conversation with customers is really about—nobody is saying that they're just going to patch now and then go back to not having a regular patching cycle and autonomous patching in the future.

Sumedh Thakar: The broad-based conversation is about how do they, moving forward, create a process throughout their organization that is long-lasting, where any threat that comes out, they're able to actually respond to that threat very quickly. We see this more as something that is broadly being talked about, and we see the opportunity for that to be something that we can focus on. I think right now, like with any corporation, large companies, they want to understand what the big-picture roadmap is that they can talk to their management about while focusing on phases that they can deploy. The ROC conversation allows us to have a much broader strategic conversation with ETM. The vulnerability management, patch management is something more that they're focusing on right now to be able to have that phased approach.

Speaker #9: So the broad-based conversation is about how do they, moving forward, create a process throughout their organization that is long-lasting, where they're able to, you know, any threat that comes out, they're able to actually respond to that threat very quickly.

Speaker #9: And so, we see this more as something that is broadly being talked about, and we see the opportunity for that to be something that we can focus on.

Speaker #9: And so I think right now, like with any corporation or large company, they want to understand what the big-picture roadmap is that they can talk to their management about, while focusing on phases that they can deploy.

Speaker #9: And so the ROC conversation allows us to have a much broader strategic conversation with ETM, and then the vulnerability management, patch management, is something more that they're focusing on right now to be able to have that phased approach.

Sumedh Thakar: Overall, I think our innovation around ROC that we have been focusing on is coming to the help quite a bit for these customers to have broader conversation while the focus right now is changing their patch management processes and programs. I do think that this is giving us an opportunity to have those broader conversations with the customer. As JooMi said, of course, there were a small cohort of customers that was already in this process before MITRE came out to adopt patch management. Just a reminder, 150 million patches already applied by Qualys, so some customers have been at the forefront of these. That helped us sort of say, "Look, we were right." The customers were like, "Look, we're already in the process.

Speaker #9: So overall, I think our innovation around ROQ that we have been focusing on is coming to help quite a bit for these customers to have broader conversations, while the focus right now is changing their patch management processes and programs.

Speaker #9: So I do think that the opportunity—or rather, this is giving us an opportunity—to have those broader conversations with the customer. And, you know, as Jumi said, of course, there was a small cohort of customers that was already in this process before Mythos came out to adopt patch management.

Speaker #9: Just a reminder, 150 million patches have already been applied by Qualys. Some customers have been at the forefront of these, so that helped us sort of say, look, we were right.

Speaker #9: The customers were like, look, we're already in the process. We were right to focus on patch management. So that helps in the short term, but then there is a long cohort of customers that are having these conversations now, and it's going to create the opportunity for us to have sustained conversations of additional things in the roadmap as we move forward and they get comfortable with the auto patching.

Sumedh Thakar: We were right to focus on patch management." That helps in the short term, there is a long cohort of customers that are having these conversations now and is going to create the opportunity for us to have sustained conversations of additional things in the ROC as we move forward, and they get comfortable with auto-patching.

Shrenik Kothari: Got it. Very helpful. JooMi, just a follow-up to Mike and Josh's question around the NDR improvement. Very encouraging to see that tick up. The ETM cohort though remained at 107, I think they highlighted. Is Q-Flex going live? You did highlight it's playing a direct role in several of these large platform expansion, also helping pull forward the commitment, helping bookings, more than near-term usage. Is that what is kind of explaining these budgets shifting towards more newly urgent capabilities reflected in your sort of NDR next 12 months versus something more strategic around ETM, CyberSecurity Asset Management usage will follow through? Just wanted to understand if Q-Flex is playing a role there.

Speaker #8: Got it. Very helpful. And Julie, just a follow-up to Mike and Josh's question around the NDR improvement. Very encouraging to see that kick up.

Speaker #8: The ETM cohort, though, remained at 107. I think they highlighted that. But is Q-Flex going live? And you did highlight it’s playing a direct role in several of these large platform expansions.

Speaker #8: Also, helping pull forward the commitments, helping bookings, more than near-term usage. So, is that what is kind of explaining these budgets shifting towards more newly urgent capabilities reflected in your sort of NDR next 12 months versus something more strategic around EDR, CSAM—usage will follow through?

Speaker #8: Just wanted to understand if Q-Flex is playing a role there.

Speaker #3: Yeah. Q-Flex is really meant to accommodate customers who are looking for that flexibility and who are willing to spend more with us. And so we wanted to make the selling motion seamless and easier for them, where it creates a win-win opportunity for both the customers as well as us.

Joo Mi Kim: Yeah. Q-Flex is really meant to accommodate customers who are looking for that flexibility and who are willing to spend more with us. We wanted to make the selling motion seamless, easier for them, where it creates a win-win opportunity for both the customers as well as us. We are very pleased with us going GA with it broadly. It still applies to a small percentage of customers today who sign up for Q-Flex, so it is not yet reflected in the numbers, but we believe that this will help drive the NDR up for us, broadly speaking.

Speaker #3: And so we're very pleased with us going GA with it broadly. It still applies to a small percentage of customers today who sign up for Q-Flex.

Speaker #3: So it's not yet reflected in the numbers, but we believe that this will help drive the NDR for us, broadly speaking.

Shrenik Kothari: Got it. Very helpful. Thanks.

Speaker #8: Got it. Very helpful. Thanks.

Operator: Thank you. This will conclude today's question and answer session and also concludes today's conference call. Thank you so very much for participating, and you may now disconnect.

Speaker #2: Thank you. This will conclude today's question-and-answer session, and also concludes today's conference call. Thank you so very much for participating, and you may now disconnect.

Brian Essex: Goodbye.

Q2 2026 Qualys Inc Earnings Call

Request DemoDemo

Qualys

Earnings