Qualys, Inc.
Q2 2020 Earnings Call Transcript

Published: 11 Aug 2020

[Operator:]

Ladies and gentlemen, thank you for standing by, and welcome to Qualys Incorporated's Second Quarter 2020 Investor Call. At this time, all participants are in a listen-only mode. After the speaker's presentation, there will be a question-and-answer session. I will now hand the conference over to your speaker today, Vin Rao.

[Vinayak Rao:]

Good afternoon and welcome to Qualys' second quarter 2020 earnings call. Joining me today to discuss the results are Philippe Courtot, our Chairman and CEO; and Joo Mi Kim, our CFO. Before we get started, I would like to remind you that our remarks today will include forward-looking statements that generally relate to future events or our future financial or operating performance. Actual results may differ materially from these statements. Factors that could cause results to differ materially are set forth in today's press release and in our filings with the SEC, including our latest Form 10-Q and 10-K. Any forward-looking statement that we make on this call are based on assumptions as of today, and we undertake no obligation to update these statements as a result of new information or future events. During this call, we will present both GAAP and non-GAAP financial measures. A reconciliation of GAAP to non-GAAP measures is included in today's earnings press release. As a reminder, the press release, prepared remarks, investor presentation, and supplemental historical financial spreadsheet are available on our website. With that, I would like to turn the call over to Philippe.

[Philippe F. Courtot:]

Thank you, Vinayak, and welcome, everyone, to our Q2 earnings call. We hope that you and your families are healthy and safe. Our priority remains the health and well-being of our employees, while continuing to address and support the changing security needs of our customers. Since mid-March, we have seen at Qualys, a seamless transition to a remote workforce environment and have continued to effectively deliver on all aspects of our business, including product development, operation and support services. The unprecedented environment with the ongoing COVID-19 pandemic has created uncertainties for individuals and organizations across the globe. As companies are experiencing a never-before-seen explosion of remote endpoints connecting to critical assets of their organization, security of these endpoints is paramount. IT team are responding to the challenge of ensuring that employees are able to work productively and securely from remote location, and it is becoming eminently clear that traditional enterprise security solutions deployed inside organizations' networks are ineffective for protecting these remote endpoints. We believe that Qualys is one of the few companies well-positioned in this security market evolution due to our priority of investing in the expansibility and capabilities of our platform and our cloud-based architecture. Upon the onset of COVID-19, we addressed the needs of our existing customers by promptly releasing a remote endpoint protection service that will help them quickly address the challenge of securing these proliferating endpoints. This service, which we are providing at no cost for 60 days, leverages the Qualys Cloud Agent and its cloud-based architecture to deliver instant and continuous visibility of remote computers, as well as their installed applications, obtain real-time view of all critical vulnerabilities and misconfigurations, and remotely deploy missing patches for critical vulnerabilities. These patches are delivered securely and directly from vendor website and content delivery network, ensuring there is little to no impact on external VPN bandwidth. In Q2, we added malware detection capabilities to the solution, and customers that were already using the service could extend their free 60-day license for an additional 30 days. Malware detection uses file reputation and threat classification to detect known malicious files on endpoints, servers and cloud workloads. In addition, this service is now available to US federal agencies with a no-cost 60-day pilot. We currently have over 650 companies, including nearly 300 customer prospects actively using this free offering. The Remote Endpoint Protection service is based on the multifunction Qualys Cloud Agent, which instantly provide visibility to remote endpoints, detects vulnerabilities, manages their security hygiene proactively and patches them quickly at no cost. Our Cloud Agent is the technology platform for seven of our security compliance and IT solutions, Vulnerability Management, Policy Compliance, File Integrity Monitoring, Indication of Compromise, Patch Management, Asset Inventory and the upcoming, Certificate Management, and we have more to come. In Q2, we continued to see strong growth in our paid Cloud Agent subscription, with almost 43 million now, representing 81% growth from the prior-year quarter. We have continued to make strong progress on our goal of achieving ubiquity for our Cloud Agent. After organizations download our Cloud Agent once, it's frictionless for them to subscribe to our paid applications because no additional infrastructure is required to expand the solution with additional products. Furthermore, this multi-product adoption naturally increases the stickiness of our platform, and helps makes us impenetrable to our competitors. We do not offer the same – our competitors do not offer the same breadth of solution or ease of adoption. This is demonstrated by the fact that the growth (00

[Joo Mi Kim:]

Thanks, Philippe, and good afternoon. Before I start, I'd like to note that except for revenue, all financial figures are non-GAAP and growth rates are based on comparisons to the prior year period unless stated otherwise. We're delighted with our increasing Cloud Agent subscriptions and multi-product penetration as well as a strong adoption of VMDR, which lays the foundation for future revenue growth and industry-leading profitability. Our Q2 financial and operational highlights include, revenues for the second quarter of 2020 grew 13% to $88.8 million. Please note our Q2 2020 calculated current billings was negatively impacted by the timing and amount of prepaid multiyear subscriptions, as well as requests for shorter duration invoicing, which we expect to continue to next quarter given the current market conditions. Our average deal size increased 7%, and platform adoption continued to increase as a percentage of enterprise customers with three or more Qualys solution rose to 54% from 44% and the percentage of enterprise customers with four or more Qualys solution increased to 38% from 24%. Paid Cloud Agent subscriptions increased to 43 million over the last 12 months, up from 38 million for the 12 months ended in Q1 2020, a 19% of the end customer up for renewal in the quarter, renewed into a VMDR subscription, up from 4% in Q1. Our scalable platform model continues to drive superior margins and generate significant cash flow. Adjusted EBITDA for the second quarter of 2020 was $42.8 million, representing a 48% margin versus 42%. Q2 EPS grew 34% and our free cash flow for the second quarter of 2020 was $24.9 million, representing a 28% margin and down 20% primarily due to recent changes in billing and payment terms for selected customers, given the current macroeconomic environment. Year-to-date, our free cash flow margin is 40%, and is up 6%. In Q2, we continued to invest the cash we generated from operations back into Qualys, including $4.3 million on capital expenditures for operations, including principal payments under capital lease obligations, and $25.3 million to repurchase 242,500 of our outstanding shares. We remain confident in our business model, driven by our foundation of nearly 100% recurring revenues and expanding suite of applications. We are delighted to be raising our full year 2020 guidance for both revenues and earnings. We are raising the bottom and top end of our revenue guidance for the full year to now to be in the range of $359 million to $360.5 million from the prior range of $354 million to $359 million. We are raising our full year non-GAAP EPS guidance to now be in the range of $2.60 to $2.65 from the prior range of $2.46 to $2.51. We expect to maintain industry-leading margins in 2020 and continue to produce strong cash flow. And our Q3 guidance for revenue is $91.6 million to $92.2 million and for non-GAAP EPS is $0.65 to $0.67. For the third quarter, we expect capital expenditures to be in the range of $8 million to $9 million, which includes approximately $2 million for the build-out of our Pune headquarters. Because of COVID-19 related delays, the timing of spend on our Pune headquarters has been pushed out a few months and we now expect that $2 million of our original planned spend will occur in the second half of the year. As Philippe mentioned, we are very excited by the robust early adoption of VMDR and the launch of our Multi-Vector EDR application. We feel very well-positioned during this period of uncertainty due to the value provided by our Cloud Platform and our 20 apps, as well as our underlying highly scalable and profitable operational model. With that, Philippe and I are happy to answer any of your questions.

[Operator:]

Thank you. And our first question is from Erik Suppiger with JMP Securities. Please go ahead.

[Erik Suppiger:]

Hi. Thanks for taking the question. Can you talk a little bit about linearity? How did the pandemic play out through the quarter?

[Joo Mi Kim:]

Yeah. I'll take that question. So, linearity, we didn't see any material highlights to note under linearity. It was similar to last quarter.

[Erik Suppiger:]

Okay. And then on VMDR, can you talk a little bit about how much adoption you've seen with – of using the Patch Management component to that?

[Philippe F. Courtot:]

So we have a big demand...

[Joo Mi Kim:]

Yeah, I think go ahead, Philippe.

[Philippe F. Courtot:]

...I can – yeah. No. We have a big demand for Patch Management. There's no question that this is an application that is really coming up and VMDR makes it much easier because obviously the last mile is you patch and it's at your fingertips. So, yeah, it's very significant. And we see what we're (00

[Erik Suppiger:]

And who are you displacing or who do you see on that patching front? Is that BigFix?

[Philippe F. Courtot:]

Yeah. It's interesting is that it's not so much of the displacement, it's fact that it's become – it starts more like adding, for example, is much easier, of course to – with our solution to patch the endpoints. So we, in fact, believe in some cases, they could continue using, for example, SCTM for other solutions. But on the endpoints, it's much easier to do it with Qualys, so – and other Patch Management solution, but essentially it's adding to what they are doing. And we see more and more appetite (00

[Erik Suppiger:]

Very good. Thank you.

[Operator:]

Thank you. Our next question comes from Shebly Seyrafi with FBN Securities. Please go ahead.

[Shebly Seyrafi:]

Yes. Thank you very much. I want to drill down on the current billings. It looks like it grew by 13% year-to-year, down from 15% the prior two quarters. And I saw what you said in the script, so what would current billings growth have been versus 13% reported had duration not changed or declined?

[Joo Mi Kim:]

Yeah. So we have half year (00

[Shebly Seyrafi:]

I want to correct myself, current billings was up 7%. Like you said, 10% for the first half, but I'm trying to see because you expect these moving parts to linger, looks like, for the next few quarters. And I just want to know when you think things may normalize such that your current billings growth can go back to the historical something like 15% or so, do you think it's two quarters long or four quarters long?

[Joo Mi Kim:]

I think it's a little too early for us to talk, given the uncertainty of the environment. Basically at this time, we are leveraging our strong financial position to accommodate customers that are asking for shorter duration invoices as well as the late billings, which is another factor that we should take into account in addition to the renewals not being done at the time of end like renewal.

[Shebly Seyrafi:]

Okay. Last one for me is Spell Security. Do you have estimated incremental revenue and expenses for that company?

[Joo Mi Kim:]

Yeah. So for Spell Security, it's a small tuck-in acquisition, similar to what we've done before. We don't see a material impact to our top line or expenses from that acquisition.

[Shebly Seyrafi:]

Okay. Thank you.

[Operator:]

Thank you. Our next question comes from Alex Henderson with Needham. Please go ahead.

[Alex Henderson:]

Thank you very much. I was looking at the revenue associated with the customers that have bought the highest number of units, and it actually shows the revenue declining from $270 million to $257 million, even as you're adding more revenue per customer. And I was wondering if you were including in those statistics any of the free solutions that you're offering. How – why is it – why is the average revenue declining on your top customers?

[Joo Mi Kim:]

Yeah. Average revenue on the top customers, it could fluctuate depending on the category that as customers move into different categories. And another factor that we should consider is we're relooking all their metrics to make sure that they're all still relevant to customers. I think that one of the metrics that we've highlighted before is the multi-product adoption. With the launch of VMDR, VMDR is really counting as – we're counting it as floor (00

[Alex Henderson:]

So, are you including in that any of the free solutions or is that not included in the number of solutions?

[Joo Mi Kim:]

No. It only includes on the paid solutions and it's incremental solution that's (00

[Alex Henderson:]

Great. So, the second question with the – you've obviously got a lot of free stuff out on the market today. You talked about Patch Management and the free Asset Inventory, a number of programs. If you were to tally all of those free customer subscriptions up, what type of nut are we talking about? How big a chunk of business would that be? And to what extent – I'm assuming that that predominantly starts to roll off the free into some of the paid version of it. What type of conversion rate do you expect? And I think that's mostly in the fourth quarter is it not since most of that runs through September?

[Joo Mi Kim:]

Right. So, one thing that I'd like to highlight is because we're as a subscription business, our model is to really allow customers to buy at their own pace. Customers do trials and then often expand at the time of renewal for existing. And then for new, we do realize that with our several of the products that we've launched, it's great that we're seeing adoption and some traction in terms of the active usage both with respect to the Endpoint Remote Protection (sic) [Remote Endpoint Protection] (00

[Alex Henderson:]

...any of those products that would then force them to make a decision?

[Philippe F. Courtot:]

Yeah. So let me add on the (00

[Alex Henderson:]

Okay. Thank you.

[Operator:]

Thank you. Our next question comes from Yun Kim with Rosenblatt Securities.

[Yun Kim:]

Thank you. Actually, congrats on a pretty solid quarter and welcome, Joo Mi. Philippe, one metric that really stands out in the quarter is the acceleration in the adoption of the multiple products, growth in the percentage of the customers with 2+, 3+, 4+, 5+, all accelerated from prior trends, not just 4+, products. Can you specifically point out anything particular that drove that acceleration in the quarter, and what are you expecting in terms of the – that trend going forward?

[Philippe F. Courtot:]

So, the trend will continue. What you see with some of these – it's a combination of few things. With some of these products is the maturity that we are reaching with these products, we see that very clearly with File Integrity Monitoring. We are also seeing, of course, Patch Management, has been also a very good take, while waiting to get the Unix and the IOS patch capabilities, which are coming in a couple of months, if I recall correctly. But it's – imminently that will boost further the adoption. And so – and of course, now what we see more and more is the interest in the platform itself, where you've got all the solution for the integrated. So, VMDR is a really huge success. And it addresses not only essentially – all of our customers have no reason to look for other solutions today. This also helped us in penetrating and displacing current competitors. So, VMDR is a big success and we anticipate with the much effect on EDR, which is, of course, brand-new, will go GA at end of the month, early September, the latest (00

[Yun Kim:]

Okay. Great. Thanks for that. And obviously, now with the initial success with the VMDR and, obviously a lot of high-profile product launches we've had, I think it's pretty clear that you have a platform strategy that is beyond your core VM footprint. Can you update us on any major go-to-market initiatives you may have planned to support all the product launches and where you are in terms of that product positioning today? And then in that regard, any plans to increase sales and marketing to support this? Perhaps any new sales and marketing initiative to perhaps accelerate adoption in the marketplace and really more focus on maybe the initial land deals and whatnot?

[Philippe F. Courtot:]

Yes. This is a very good question. So, in fact, our strategy since day one was to really build that multi-platform. It was – it has been a huge, huge undertaking as well, which we've been able to do because of the significant engineering team that we have now in Pune, India. We're close to 900 people. That was not a walk in the park. It was very complex. We had to inject a lot of the newer technologies like ElasticSearch, et cetera. So, that's where our focus has been. At the same time, not only beefing up the computing power of the platform was to also acquire telemetry. The problem today that you see with security is that in order for you to have context, you need to build – you need to bring data from multiple different application and you have not very much idea of how good that data is. And that's the problem that SIEM (00

[Yun Kim:]

Great. Thanks for that detail. But one question I do have on that is that do you plan to maybe accelerate the sales head count addition for your (00

[Philippe F. Courtot:]

Yeah. The big advantage we have is that, it's a proportion, because now we're going to be able to do bigger deals. Of course, you get more – you can spend more as a result. It's not going to change really our profitability. We're not going to deploy (00

[Yun Kim:]

Okay. Great. Thank you so much.

[Operator:]

Thank you. Our next question comes from Hamza Fodderwala with Morgan Stanley.

[Hamza Fodderwala:]

Hi. Thank you for taking my question. Philippe, I was wondering if you can comment a little bit more on the competitive landscape in Vulnerability Management and the sales cycles for Q2. Because, clearly, I think as far as your solutions are concerned, as far as providing more visibility and efficiency and more distributed work environment, the prioritization of that is clearly increasing, but we're not fully seeing that reflected in results quite yet. So, I'm wondering if you could comment a little bit about those two aspects, sort of the sales cycles, as well the competitive environment.

[Philippe F. Courtot:]

Sure. So the sales cycle has not changed essentially. If you look on the enterprise market is much more a displacement market. While on the mid-market and the small enterprise, it's a much more rapid market, but the sales cycle has not fundamentally changed. What has changed today is, with the entrance of VMDR, we have totally differentiated our solution vis-à-vis competitors, and today, with the forthcoming entrants – if we look today, we have two main competitors now, or less (00

[Hamza Fodderwala:]

Got it. Thank you. That's helpful. And then just one quick follow-up for Joo Mi.

[Philippe F. Courtot:]

Sure.

[Hamza Fodderwala:]

Any way you could quantify perhaps the impact of the shift toward lower durations and some of the renewal timing that impacted current billings?

[Joo Mi Kim:]

Yeah, we're tracking that internally. I mean, in terms of the shorter duration (00

[Hamza Fodderwala:]

Got it. Thank you very much.

[Operator:]

Thank you. Our next question comes from Brian Essex with Goldman Sachs. Brian, your line is open.

[Brian Essex:]

Apologies. Yeah. Apologies. I have mute on. Good afternoon. Thank you for taking the question. Philippe, I was just wondering if you could maybe give us a sense of conversations that you're having with customers, particularly after what we've seen high demand for endpoint identity firewall spend, are you seeing any derivative spend now that these more disparate networks may need to focus on security posture now that they've addressed those kind of initial concerns in a more distributed environment?

[Philippe F. Courtot:]

I'm not so sure – could you repeat the question? I'm not so sure that I understand the question there.

[Brian Essex:]

Yeah. I guess – just trying to get a sense of the conversations that you're having with customers from a budgeting and spending perspective, particularly after we've seen high demand for the obvious kind of work-from-home solutions like...

[Philippe F. Courtot:]

Okay...

[Brian Essex:]

...endpoint identity firewall. Are you getting a derivative of that spend now that those issues may have been addressed?

[Philippe F. Courtot:]

Yeah. No. Okay, makes sense. So I think today what happened is that the – obviously, the COVID has highlighted for a lot of companies the fact that their enterprise security solutions, they just don't – they are not built for that world where essentially everything is connected with everything across the Internet. And so, of course, enterprise security solutions were not designed for that. So, as a – so that became very visible. The first visibility is how do you patch a system which is outside of your network? (00

[Brian Essex:]

Got it. That's super helpful. And I just want to follow-up with maybe one for Joo Mi. I think someone touched on a question earlier about – particularly for enterprise customers with over four solution stack, LTM revenue per customer coming down slightly, but it looks like if you look at all the categories, you're coming down. So, I guess I'm just wondering what are the other categories? How are those affected and what are the drivers of that? Maybe it's a customer growth issue or a mix issue, but just wanted to get a sense of the declines in the other categories as well.

[Joo Mi Kim:]

Yeah. So, in terms of some of the other categories, some of it is attributed to the fact that we've rolled out a lot of smaller solutions, now with the newer solutions that are coming out, that we're expecting to be priced similar to VM, we are expecting the ARPU to go up over time. So, for example, we talked about Patch Management, FIM and IOC, that will have a similar deal size, whereas some of the smaller solutions that we've launched, like, an example is like Continuous Monitoring, it's not as – priced as high.

[Brian Essex:]

Got it. But, I mean, if I look at this, can I infer that – I mean it looks like it implies that just overall revenue per customer has gone down. Is that not the case? Is it just mix issue or...

[Joo Mi Kim:]

Well, overall, the average deal size we mentioned in the prepared remarks, it is up 7% year-over-year.

[Brian Essex:]

Okay. All right. Thank you very much.

[Operator:]

Thank you. Our next question comes from Gur Talpaz with Stifel.

[Gur Yehudah Talpaz:]

Okay. Great. Thanks for taking my questions. Philippe, you noted that you've added malware detection this quarter alongside the launch of EDR. I want to understand more broadly what your confidence threshold here is in competing in more traditional endpoint markets. And I think beyond that, what are you seeing in terms of customer interest thus far?

[Philippe F. Courtot:]

Oh, no. There's a very big interest. Now, the Malware Detection that we added with our 60-day free Endpoint Protection is detection, not response, because we didn't have yet the capabilities of response in our agent – build into our agent, and that's what is coming up with Multi-Vector EDR, which give you the full solutions. And the differentiation between our solutions – our solution and other solution is that all endpoint solution today, they essentially have only information about the endpoint. Now, of course, because we have all the telemetry, we can look beyond the endpoint, and that is very important. So today I think we have a solution that, technically speaking, have significant more advantages eliminating possibilities, allowing you to do certain things much more easily; because you need that access to all that information, you don't have go fishing as I used to call it, and so I think we have a very good solution. Now, the big advantage we have here is that we have already a large, large usage of our Cloud Agent, and for us to upgrade to – for our customers to really look at the solution, it's very easy because it's instant update of the agent to give them that response capability that I just discussed about and that's essentially all that is needed and it's pretty straightforward. And now you can try our Multi-Vector EDR. And we call it Multi-Vector EDR because the attacks today are precisely multi-vectored. So it's not only just the endpoint, you need to know to what that device connects to, because the device could be attacked from another part of the network and that's why you need that full view, just not the view of endpoints.

[Gur Yehudah Talpaz:]

That's helpful. Thank you. And Joo Mi, maybe one for you, just kind of building on the last question, how should we think about products like EDR and SIEM serving as the lift, if you will, to the ASP or average deal size?

[Joo Mi Kim:]

Yeah, this is something that we're very optimistic about. We believe that with the launch of VMDR followed by EDR and Data Lake and SIEM coming not after (00

[Gur Yehudah Talpaz:]

That's helpful. Thank you.

[Operator:]

Thank you. And our next question is from Matt Hedberg with RBC Capital Markets. Please go ahead.

[Matthew Hedberg:]

Hey, guys. Thanks for taking my questions. Philippe – and maybe I missed it, but – or could you comment on sort of some of the geographic trends you did domestically here and then overseas in terms of when economies start to reopen?

[Philippe F. Courtot:]

I think today we see – yeah, I think the US, as you know, is (00

[Matthew Hedberg:]

Got it. And then I know you've historically taken a very active role in sales, effectively running sales for several years, but I believe you promoted Laurie to EVP Worldwide Field Operations last year. As far as I can tell, I don't think she's with the company anymore. I wonder if you can comment on that, just sort of like the overall sales initiative.

[Philippe F. Courtot:]

As you know, we have the – we have, of course, replaced Laurie, and in fact, as you know, not – we have very long-term employees at Qualys, but not everybody stays forever, obviously, and so, I think (00

[Matthew Hedberg:]

Got it. Thanks.

[Operator:]

And our next question is from Sterling Auty with JPMorgan.

[Sterling Auty:]

Yeah. Thanks. Hi, guys. I think you mentioned a couple of times on the call that bookings in the quarter were stronger than expected. Early in the call – in the Q&A, you mentioned linearity was the same as it was last quarter. If that's the case, then I guess – I wonder why wasn't revenue in the quarter actually stronger than the reported number?

[Joo Mi Kim:]

Revenue – when we guided to the revenue, it was $88 million to $88.6 million and we actually reported a revenue of $88.8 million. And so it did come in higher than what we had expected. Is that what you meant, Sterling?

[Sterling Auty:]

Yeah. But I guess I would call that more in line with the top end of the range – or maybe were the bookings maybe just slightly above what you expected in the quarter?

[Joo Mi Kim:]

Yes. And coupled with the fact that sometimes when we do bookings, it really depends on – some of our bookings actually are based on a consumption model as well, as you know. Given our established partnerships, we do have consumption-based (00

[Sterling Auty:]

Got it. And then one follow-up on the VMDR and EDR. Can you remind us – I think you have some different pricing models, especially with VMDR. How is the uptake under that pricing model, and what should we take about the revenue contribution looking like for this year?

[Philippe F. Courtot:]

So, the pricing model is different. As you know, we're now an asset-based model which makes it very simple – much simpler, as you know, for our customers to procure than going through the old system that we had, which was a la carte and then also IP/day (00

[Sterling Auty:]

On revenue for the year. So, given your new products, so not knowing how much contribution you expect the total revenue for this year, is it meaningful, is it de minimis, is it a slow ramp, a fast ramp? Those types...

[Philippe F. Courtot:]

No, no, VMDR is moving very well. I mean, we have a huge adoption of VMDR as we have mentioned in the numbers. And no, this is, everybody is working (00

[Sterling Auty:]

Thank you.

[Operator:]

Thank you. And I'm not showing any further questions in the queue. I would like to turn the call back to Philippe Courtot for his final remarks.

[Philippe F. Courtot:]

Okay. So thank you – thank you all, and again, this – as you know, we are very excited to see our new solution coming, VMDR, it's been a fantastic, as I mentioned earlier, solution. We're now bringing the Multi-Vector EDR. As you can see, we are now moving into detection and response, VMDR, EDR, we have more to come, and of course, we are looking forward to launching our new incident response solution. So with that, we'd like to thank you for your time, and again, thank you very much.

[Operator:]

And with that, ladies and gentlemen, we thank you for participating in today's program. You may now disconnect. Have a wonderful day.