Good day, everyone, and welcome to Qualys' fourth quarter 2018 earnings conference call. This call is being recorded. At this time, all participants are in a listen-only mode. Later, we will conduct a question and answer session, and instructions for asking a question will be given at that time. I would now like to turn the call over to Natasha Asar, investor relations. Please go ahead, ma'am.
Good afternoon, and welcome to Qualys' fourth quarter and full year 2018 earnings call. Joining me today to discuss our results are Philippe Courtot, our chairman and Chief Executive Officer, and Melissa Fisher, our Chief Financial Officer. Before we get started, I would like to remind you that our remarks today will include forward-looking statements that generally relate to future events or our future financial or operating performance. Actual results may differ materially from these statements. Factors that could cause results to differ materially are set forth in today's press release and in our filings with the SEC, including our latest Form 10-Q and 10-K.
Any forward-looking statements that we make on this call are based on assumptions as of today, and we undertake no obligation to update these statements as a result of new information or future events. During this call, we will present both GAAP and Non-GAAP financial measures. A reconciliation of GAAP to Non-GAAP measures is included in today's earnings press release. As a reminder, the press release, prepared remarks, and accompanying investor presentation with supplemental information are available on our website. With that, I'd like to turn the call over to Philippe.
Thanks, Natasha, and welcome everyone to our Q4 earnings call. Melissa and I are pleased to report another strong quarter and year in terms of revenue growth and profitability. These results underscore our position as a leading cloud-based security and compliance platform that unifies IT, security, and compliance in a single pane of glass view with two-second visibility across on-premise assets and cloud, and soon mobile and OT and IoT devices. With 19 cloud apps native in our platform, we believe we're well-positioned to expand our wallet share within our growing user base, as well as gain new customers. At our user conference in November, we observed that our customers increasingly view Qualys as a trusted strategic partner. As we all know, the digital transformation of businesses, fueled by an explosion of new technologies, is leaving gaping security holes in its wake.
Organizations who are continuing to layer on-point solution that do not communicate with each other are seeing diminishing returns. Qualys delivers a true platform offering greater visibility, accuracy, and scalability across hybrid and cloud environment, while ultimately allowing customers to reduce their overall spend. To achieve security and compliance in this new hyper-connected environment and respond to an ever-increasing set of regulations, we believe that organization, in addition to deploying traditional firewalls and intrusion detection, must know in real time what devices and application are connected on the network, always know the security and compliance posture for every devices, both known and unknown, and take immediate remediation action whenever necessary. This is precisely where traditional enterprise solutions are falling short, as they were not designed to operate at such a scale, and in reality, only solutions that adopt a cloud-based architecture can provide the necessary scale, visibility, correlation, and immediacy.
A few months ago, again, we demonstrated to our customers at our user conference the significant extension we have made to our cloud-based platform and cloud apps. In 2018, specifically, we launched several new solutions into general availability or beta, including container security, cloud inventory, cloud security assessment, certificate inventory, certificate assessment, as well as our new groundbreaking app for global IT asset inventory, which we call AI and CMDB synchronization. Our AI cloud app, formally launched yesterday, enable us to offer our customers a single source of truth for all IT assets within hybrid environments, covering on-premise assets, endpoint, cloud, and soon, again, mobile, OT, and IoT environments. We also demonstrated our passive network analysis solution, now in beta, that natively integrates network analysis function, deep packet inspection, device fingerprinting, and data correlation into the Qualys Cloud Platform, delivering customers complete IT visibility at scale.
This new capability will enhance our global IT asset management offering by adding the visibility of unknown asset to the existing capabilities. We acquired 1Mobility, completed in Q2, which will enable us to provide enterprise discovery, inventory, security, compliance, and response on both enterprise-owned as well as employee-owned mobile devices, further expanding our footprint within our customer base. We also completed the acquisition of Layered Insight, a pioneer and global leader in runtime container security, which will provide insight into container images, adaptive analysis of running containers, and automated enforcement of policy. We are currently integrating Layered Insight technology into the Qualys Container Security app, which will allow to uniquely bring transparent orchestration to container security.
We expect to complete this integration the second half of this year. In the fourth quarter, we continued to expand our partnerships, integrating with AWS Security Hub, introducing Qualys Vulnerability and Policy Compliance findings with AWS Security Hub. We launched the Qualys Container Security solution on the new AWS Marketplace for Containers. We also announced today an expanded relationship with IBM X-Force Red, who will deploy Qualys Patch Management and web application scanning into global client environments, along with its existing vulnerability management deployment. This expansion enables X-Force Red Vulnerability Management Services, VMS, to automate vulnerability prioritization and patching, enabling clients to simplify vulnerability remediation and fix their most critical vulnerability using less resources and time.
Earlier in 2018, we have been expanding our capabilities in the federal market with a deeper partnership with Carahsoft to market, sell, and distribute the FedRAMP-authorized Qualys GovCloud and are now working on attaining FedRAMP certification. We're broadening our relationship with key partners, including Microsoft and IBM, by adding integration into Microsoft Hybrid Cloud Azure Stack, releasing monitoring and assessment for the CIS Microsoft Azure Foundations Benchmark within our Qualys Cloud Security Assessment cloud app, adding an integration with X-Force Red, which deploys the Cloud Agent and the Cloud App into client environment across the globe, and adding integration with IBM Security Connect.
We released our Qualys Community Edition, a free version of our cloud platform to provide organizations, including SMB consultants and managed service providers, with a unified view of IT, security, and compliance, as well as two other free services, CloudView and CertView, providing companies of all size the instant ability to track and monitor digital certificates and cloud resources. We launch a new comprehensive offering as well, the Qualys Consulting Edition for consultant, consulting organization, and MSSP, enabling them to perform multiple ongoing vulnerability assessment engagements and track these results from a single centralized and self-updating platform. Now build upon a very successful 2018. We will continue to increase our competitive advantage by releasing new groundbreaking security and compliance application, leveraging both our talent base as well as acquired technology.
Our current plans in 2019 include the release of new solution such as passive network discovery, secure access control, certificate management, and cloud security management. The general availability of Qualys Patch Management announced today, enabling IT and SecOps team to quickly target critical common vulnerabilities and exposures, then deploy the patches across endpoints on-premise or cloud assets and verify remediation, all from one console. Continued acquisitions to enhance our product suite. In January, we completed the acquisition of Adya, a small, innovative Indian startup that build their solution on the AWS Lambda. Adya solutions enable security and compliance audits of SaaS application, which is becoming critical to enterprise as they increasingly relies on cloud-based software.
The Adya cloud-based solution provides company of all size with the ability to consolidate administration of their software-as-a-service application into one console, manage license costs across SaaS application, set and enforce security policies in one place, and report and audit on all activity with a single tool. Finally, we have invested significantly in our backend, continuing to build what we believe to be the most robust and scalable cloud platform in our market. We have now almost two trillion security data points indexed in our Elasticsearch clusters, providing almost instant query results and alert. This give our customers two-second visibility, and as we know, visibility, accuracy, and scale are the keystones of security. To support the significant number of additional solutions that we're bringing to market, we increased our sales organization in the second half of 2018 by over 20%, and we've continued to do so over next year.
We expect to continue to outperform market growth in 2019 while producing high level of profitability. We're optimistic about the opportunity to increase booking growth in the future because of newest solution, which solves meaningful problem for customers and are priced similar to or at a premium to Vulnerability Management and Policy Compliance. For example, our Cloud Agent and Threat Protection, which are priced at a fraction of Vulnerability Management and Policy Compliance. Qualys continue to clearly move well beyond Vulnerability Management and increase its competitive advantage through the acceleration of multi-product adoption. This naturally increase our stickiness, which is a key element of our profitable growth, driving value for our shareholders. With that, I will turn the call over to Melissa to discuss our financial results, guidance, and metrics. Thank you.
Thanks, Philippe, good afternoon. Before I start, I'd like to note that except for revenue, all financial figures are Non-GAAP, and growth rates are based on comparisons to the prior year period, unless stated otherwise. Our solid Q4 financial and operational results continue to reflect the healthy demand for our scalable and robust cloud platform. This is evidenced in the following financial and operational highlights. Revenues for the fourth quarter of 2018 grew 18% to $74.2 million. Platform adoption continued to increase as the percentage of enterprise customers with three or more Qualys solutions rose to 41% from 32%. The percentage of enterprise customers with four or more Qualys solutions increased to 21% from 15%. New products released since 2015 contributed approximately 26% of total bookings in the quarter, up from 15%.
Similar to Q3, we saw higher growth in the total number of orders from our SME and PCI customers. This positive result pulled our historical year-over-year average deal size increase down to 5%. However, the average deal size for our enterprise customers grew 11% year-over-year. Our scalable platform model continues to drive superior margins and generate significant cash flow. Adjusted EBITDA for the fourth quarter of 2018 was $29.1 million, representing a 39% margin versus 38%. For comparability purposes, Q4 adjusted EBITDA margin would have been 37%, normalized for the impact of 606 and software capitalization. Q4 EPS grew 62%, including the benefit of a tax true-up. Normalized for this, Q4 EPS would have grown a healthy 44%. We generated strong operating cash flow for the fourth quarter of 2018 of $29 million, an increase of 12%.
In Q4, we continued to invest the cash we generate from operations back into Qualys, including $6 million on capital expenditures, including principal payments under capital lease obligations, $10.3 million on the acquisition of Layered Insight, and $38.5 million to repurchase 521,257 of our shares. Looking back on the year, we had a successful 2018 at Qualys as we released several new products, features, and enhancements, completed two acquisitions, and made our first minority investment, saw an acceleration in the number of customers spending $500,000 or more, enjoyed continued Cloud Agent adoption with 16.2 million Cloud Agents purchased over the last 12 months, up from 6 million, over 150% growth, benefited from strong performance from new products released since 2015, which at 20% of 2018 bookings, almost double the prior year, contributed to growth of our subscription revenues by 20% when you normalize for the positive impact of FX.
We achieved record EBITDA margin to 39% and grew operating cash flow 21%, normalized for the ASC 606 benefit, software capitalization, and our investment in 42Crunch. All this despite our continued investment in the business, including 37% year-over-year growth in headcount in 2018. Looking to 2019, we expect full-year revenue in the range of $320 million-$323 million, which represents a growth rate of 15%-16%, and Q1 revenue in the range of $74.5 million-$75.2 million, which represents a growth rate of 15%-16%. We are excited about the opportunities to accelerate revenue growth with our new solutions. Many of our newer solutions, for example, FIM, IOC, AI, passive scanning, and patch management, are priced similar to or at a premium to Vulnerability Management and Policy Compliance, as Philippe mentioned. As you have seen, multi-product adoption has increased quarter after quarter.
However, these newer solutions are still early in their adoption and consistent with prior years, we are not assuming a material contribution from new solutions in our guidance. Furthermore, the large deal we referenced on our Q3 earnings call has not yet concluded. In terms of 2019 profitability, we expect to maintain our industry-leading margins while further investing to set the stage for future revenue growth. While we achieved record profitability in 2018, we invested in the business throughout the year, particularly in building our team, driving our record 2018 headcount growth of 325 employees. This spend was back-end loaded and combined with additional expenditures we plan to make in 2019 across our engineering, sales and marketing, operations and administrative functions, will result in our adjusted EBITDA margin in FY 2019 in the range of 37%-38% based on our current forecasts.
We expect capital expenditures from operations to be roughly flat with 2018 in a range of $22 million-$27 million. We're continuing to invest to support the growth of the business, but we will be benefiting from earlier investments in building out data center and U.S. office locations. Additionally, we expect to purchase less hardware for physical scanner subscriptions as customers increasingly subscribe to virtual scanners. As we have significantly increased our employee base in Pune, we do expect to spend an additional $4 million in the second half of 2019 for the beginning of our build-out of a new Qualys facility in Pune. For the first quarter of 2019, we expect capital expenditures to be in the range of $8.5 million-$9.5 million. Even with all these infrastructure investments, we expect our 2019 year-over-year free cash flow growth to exceed the earnings growth currently implied by our guidance.
We feel very well-positioned in our markets given the unique nature of our integrated IT security and compliance cloud platform. Our customer count growth accelerated in 2018, we added almost 1,100 active users to our free solutions. Our new solutions provide the opportunity for us to increase average revenue per user, accelerate revenue growth, and driven by our highly scalable model, expand margins in the future. Our focus continues to be growing our foundation of recurring revenues and maintaining strong profitability. With that, Philippe and I would be happy to answer any of your questions.
Thank you. Ladies and gentlemen, if you would like to ask a question at this time, please press star and one on your touch-tone telephone. If your question has been answered or you wish to remove yourself from the queue, please press the pound key. Your first question comes from Howard Smith with First Analysis. Your line is open.
Yes, can you hear me?
Yes, we can.
Okay, good. Thank you. Good afternoon, just wanted to start in thinking about the revenue guidance for 2019 in the context of some of your longer-term guidance. One, are you still comfortable with the 2021 projection of low 20s growth rate? If so, is the idea these product that are coming out and the investments you're making now and in 2019 in the headcount and sales starts to really kick in in earnest in the following years and cause that acceleration? Or maybe you can just put it in context for us.
I'll take this, Howard. Let me start with the 2019 and then come back to the 2021. We have a very healthy business. As I mentioned, multi-product adoption continues to increase, and new solutions contributed to 26% of our bookings. Having said that, consistent with prior years, we said that we are not assuming a material contribution from new solutions for the purposes of guidance because it's prudent given that the pace of adoption can be difficult to predict. The framework for the 2021 growth rate target was that the fact that all the additional solutions, when you add them up in totality, come to at least 10 times out of a dollar spent of VM, and that framework hasn't changed.
While we don't update the model on a quarterly basis, the framework hasn't changed, everything that we're doing now should put us in position to achieve that.
I will add to what Melissa said, is that we have a very strong pipeline in our business. We see a lot of very good adoptions. We are very eager to bring these new services to market. Again, it takes time, we've been relatively prudent. As Melissa indicated in her comments earlier today, because the Cloud Agent and the Threat Protection are only a fraction today of our Vulnerability Management solution and we have such a huge base, of course, it becomes a little bit harder for the services to fuel accelerated growth. That's why essentially that combination of these two factors, the reason why we have taken a prudent approach to our revenues.
Again, as we all know, being a 100% pure subscription-based company doesn't help in the terms of revenues because you need to, of course, you take the revenue as you deliver them. This is where we are. I think we're very bullish about the business, very happy with where we are. We made significant investment in our backend, you are going to see even more things in 2019, which we believe are going to add, if you prefer, to the very disruptive nature. Again, the passive scanning is not yet there, of course, we are essentially competing today on our traditional market against 2 companies, which is Tenable and Rapid7. Of course, we have a lot of more now to go and compete. We're doing very well with our FIM.
Of course, the passive scanning will bring us in competition with Forescout and others, but all of that out of a single platform. That's the really core philosophy of Qualys, and that's where we put a lot of effort. Scaling to scale today security at the scale that you need to is not a walk in the park.
Great. Well, I think that was a thorough response. I'll just leave it there, and I'll get back in queue if I need to. Thank you.
Thank you.
Thank you. Your next question comes from Eric Supiger with JMP Securities. Your line is open.
Hi, this is Michael Berg on for Eric Supiger. Quick question. I'm going to dive down a little bit deeper into the guide. Can you help us walk through why it's almost 3% lower than where the street had it? It seems like your new products are getting good initial traction. We had some checks that suggested the ITS inventory and passive scanning are really well-liked among the beta testers. Can you just describe to us why the lower guide?
Yeah. Let me remind you, we purposely do our full-year guidance at the end of Q4 because Q4 has a meaningful impact on the guide for the year. The early expectations were not our guidance. This is our first time setting formal guidance for the year. As I earlier mentioned, we have a very healthy business. As I said, the key metrics that we look at, like multi-product adoption and the contribution of new products into bookings have been doing very well. As Philippe mentioned, those earlier new products like Cloud Agent, Threat Protection, are only priced at a fraction of what I'll call the older products, Policy Compliance and Vulnerability Management. The newer solutions that are coming out are priced at a similar to or premium to Policy Compliance and Vulnerability Management. Thus, the opportunity to accelerate revenue growth in the future.
For the purpose of revenue guidance, we're not assuming a material contribution from these new solutions because it's difficult to predict what the uptake, what the pace of the adoption will be.
If I'm hearing you correctly, it sounds like accelerating revenue growth is still the plan for 2020 and 2021. It's just the 2019 numbers, you're gauging that based on what happened in the fourth quarter. Is that my understanding?
Let me clarify a couple of things. First of all, we've never given guidance for 2019 or 2020 before today. If you look back at both of our June presentation as well as the one we had at QSC, the long-term target that we provided was for a growth rate in 2021. It would have been, frankly, overly precise for us at that point in time to be able to give guidance for all the years up until then. As Philippe mentioned, we always act what we think is in the most prudent way. With regards to guidance for this year, Q4 obviously had an impact as well as other quarters, and we have this large base of customers and revenues.
In order to continue the growth rates at the levels, for example, that we achieved in 2018, we will need additional contribution from new solutions.
To answer your question directly here is that yes, we do anticipate, of course, that these new services, which carries a much bigger dollar value than the VM, which will be adopted by our customers, in fact, will contribute to accelerate growth in the future.
Okay. That helps answer my question. Thank you.
Thank you. Your next question comes from Daniel Ives with Wedbush Securities. Your line is open.
Yeah, thanks. First question in regards to large deals. Obviously, the one from Q3 hasn't closed yet, which you talked about, appreciate that. In terms of embedded into 2019 guidance, have you factored in any of larger deals of those sizes and specifically that Q3 deal to close in 2019?
Thanks, Dan. Yeah. We don't bake those type of outsized opportunities into our guidance because, again, we believe that we should be prudent with our guidance. Deals that would close of those sizes would be additive to what we've assumed.
Yeah, I could be a little bit specific about that one deal. In fact, that one deal, this is a customer which is essentially migrating a lot of his infrastructure at the time we're about to get the order into a cloud, into the totally cloud-based environment. For us to essentially complete that deal, we would have to port our solution to that specific cloud that they have selected, which is something in the making, but of course, that we don't have done yet. Until that happens, obviously it cannot materialize.
Okay, great. In terms of leverage, because obviously with the margin guidance next year, real strong. In terms of the model, I know you're not giving longer term guidance, is there just a lot more leverage even left in the model just as you just continue to execute on further strategy? Or maybe you could just talk about that, because obviously margin's strong for next year, I guess just some thoughts maybe going ahead. Thanks.
Yeah. No, thanks, Dan. We're proud of our industry leading margins, are delighted with what we achieved in the past year. We did, in conjunction with the 2020 outlook, we did provide an outlook on margins, the margins for 2021, we provided adjusted EBITDA margin range of 40%-42%. I think big picture, this is a very scalable model, as you saw in 2018, the more we drive the revenue growth to be higher, the more we actually expand margins.
Yeah, absolutely. Just to add to what Melissa said, effectively, we have a lot of leverage in our model, we really build a highly leveraged model. In fact, you can see that because we did increase our sales force significantly on the second half of last year by about 20%, as you mentioned. We're going to continue expanding our sales force because of all these new services that we have. In fact, with our market strategy, I would add this as two-pronged. One, you're going to see us launching a lot of what we call mini campaigns, which are campaigns whereby we invite people to try a specific solution. We have now 19 solution and more to come.
We're going to have a top-end build, we are preparing a top-down approach, which is essentially going to the CIO, et cetera, to explain to them the value of the Qualys platform. This is absolutely in the making. Despite all of that, in fact, you could see that the model still generates significant profitability. That's the leverage inherent to the model because we adopted absolutely a cloud. Our model has a lot of components on the leverage. Of course, our Indian operation is a huge leverage as well. We have today about 700 people now in Pune. I just visited Pune last year. There's a ton of talent in our operation there, that give us a significant leverage plus also the relationship with all the Indian outsourcers and additional partners. I think we're extremely well-positioned.
Thank you.
Okay.
Thank you. Your next question comes from Melissa Franchi with Morgan Stanley. Your line is open.
Great. Thank you for taking my question. I just want to circle back to sort of the same idea of previous questions and thinking about the acceleration or potential acceleration in the future. Multi-product adoption continues to proceed nicely and new products are contributing to bookings fairly well. Billings growth did slow this quarter. I am just wondering if you could maybe talk about what is happening in the core VM business. As you are thinking about the acceleration over the next few years, what do you need to assume about the health and pricing dynamics of core Vulnerability Management?
Hey, Melissa, it is Melissa. I am going to try and take this one at a time. First of all, let me handle your billings question. As I mentioned, we have a very healthy business. As we have previously discussed, though, we often, in collaboration with our customers, move deals from the end of a quarter to the beginning of the following quarter to lessen the procurement pain on both ends, as we did in Q4. The impact to us is a day or two of revenue, and this is baked into our annual revenue guidance. I think the bigger question, though, that you are trying to answer is, well, how do we think about the growth prospects?
The way I think about that, based on the conversations with investors, is, you would evaluate our revenue guidance, which we said doesn't assume a material contribution from new solutions, then assess what you think the uptake of these new solutions would be, as I said, which are not baked into our revenue guidance. With regard to the health of the core Vulnerability Management, I would say a couple of things. It still continues to remain healthy. As we've talked about previously, we don't incent our sales force by product, we don't manage the business on a product basis. Our sales force is incented on total dollars, and that way, they're working with the customers to be able to provide the customers exactly what they need, and they're not pushing specific products that they're not going to use, deploy, and then turn off.
We do assume that Vulnerability Management remains healthy, but I would say there's a number of different scenarios on a product basis that could accomplish the long-term target in 2021.
Yes. I will add that to what Melissa said. If you look today at the Vulnerability Management, in our larger customers today, as we mentioned, if you look today at the gross retention rate of customers which have more than four solutions, we have attained a 99%, which is absolutely strong. Today, if you look at the VM specifically, we are competing much more, continuing competing at the mid-market rather than at the large enterprise. In fact, we have tendency to continue expanding significantly. For us, we believe that today all be to have two competitors in that marketplace. One obviously is Tenable, and the other one is Rapid7. What we see specifically, Rapid7 is essentially more providing with InsightIDR.
They are more attacking the marketplace at the low end of Splunk, and that's where they find their growth, and they have done a pretty good job at packaging their solution around InsightIDR. Still, they don't scale. That we see that every time they try to capture one of our large customers, which we can, if I look today at the enterprise customers that we lose, you can count them in one hand, and they typically are those company who have not deployed more than two solutions. As far as Tenable is concerned, Tenable is extremely aggressive in price today, they try to steal the business. Yet they are still much more into that mid-market where we compete.
What we believe in terms of, we don't compete really on price because what happens, because scalability wins at the end of the day, and when we lose on price, we typically recover these customers one or two years later. What we believe is as we deliver more and more solution, of course, we are outgunning, if you prefer, the competition, and it's going to become harder and harder and harder to compete with Qualys as we deliver all these new services. When suddenly you have the asset inventory that you can do, the Qualys Patch Management that you can do, the passive scanning also, all of that integrated into a single platform, we really believe that it's going to be harder and harder to compete with Qualys.
That's what makes us very confident, in addition to a very significant pipeline that we have today that will be. Again, all of that needs to be translated into revenues, which again, this is where we are a little bit at a disadvantage because we have $0 of perpetual license.
Got it. That's helpful. Talking about the sales force, you've made some acceleration in hiring for the sales force for the second half of the year, how do you feel about the capabilities of those individuals in terms of selling the broader suite? I know a number of products are not yet on the market, are they fully ramped in selling the broader portfolio, or is there still work to do in terms of selling the suite?
I will answer that. They are fully ramped to sell all these new services. First of all, the reason I would substantiate why. If you recall, we have, in fact, a structure of sales force between the hunters and the farmers. The hunters, they're all technical, we hire them from our customers. They already have the understanding of what it takes to deploy enterprise solution, et cetera. Of course, they can pick up pretty quickly new solutions. Of course, we train them, et cetera, but also backed by SMEs, subject matter experts. We have done one change today with our post-sales, if you prefer, our farmers, which reflects, by the way, the fact that Qualys is becoming extremely strategic for a lot of companies.
We have now divided them into what we call the MASA, which is the major account solution architects, and of course, the regular technical account managers. We did that so we could have now the best of our talents have now been promoted to essentially handle less number of accounts, but much bigger ones. They have about, typically about 10 accounts. That has been already implemented, which of course allows us to grow with some banks, which we can see we could triple, quadruple the revenues that we do. As an example, that's what we have done for the post-sales. That is pretty much done. Essentially globally, in countries where we have enough of these very large customers, which is not, of course, every country, but essentially Europe and the U.S., and not yet in Asia, but that will come.
On the new business side, we are expanding, in fact, now more. That's where we make the investment. Our new business sales force, which now we're hiring typically from a consulting organization. Again, technical people, which have now the knows how to sell to the C-suite, which is obviously what is going to be the new, if you prefer, impetus of Qualys, since now we have all these solutions together building to one single solution. That's essentially what we have done in the go-to market. Again, all that, if you prefer, supported by what I mentioned earlier, which is that flurry of, you're going to see these mini campaigns going after, okay, try our File Integrity Monitoring solution, et cetera. We have about 20 of those mini campaigns on the way, which are going to essentially allows us to go bottom up.
We're now preparing a big campaign starting at RSA with selling top-down. That's essentially what we have organized. All the investment has already been made, essentially.
Very helpful. Thank you very much.
Thank you. Your next question comes from Alex Henderson with Needham. Your line is open.
Yeah. Hi, I just want to hit a couple of quick ones. First off, could you give a geo split, any sense of what the growth rates are between geos? I don't think that was offered up. Second, along the same lines, the acquisition, any sense of the size of that in terms of either revenues or costs that we need to build into the model would be helpful. I've got a follow-up, please.
What was it? I'm not so sure that I understood the second question.
The size of Adya.
Oh, the size of Adya. This is a small company. What is interesting, this is a fascinating company, by the way. It's a very small company in India.
Really not looking for a description of the company. I just need the revenue and costs associated with it.
It's not material. It's really like an acqui-hire, Alex.
Yeah, correct.
Okay, perfect.
What is interesting with them is that they have done everything based on the AWS Lambda, which is serverless architecture. You realize it's extremely cost effective for them to develop that application because they only have to upload their code into the AWS platform. To answer your previous question today, if we look at the dynamic, as you know, U.S. has always been the bigger market, and then followed by Europe and then by Asia. We are starting to see India, by the way, as a very significant market for us as we're picking up a lot of steam there. Globally speaking, we see today the growth rate in Europe being now today a little bit higher than in the U.S.
The reason is because, of course, the U.S. has already deployed all these that much more than Europe, the Threat Protection and all of these services which are only carrying a fraction of the cost. However, as we develop these new services, we believe it's going to revert back, the U.S. being growing much faster than Europe because, again, we have so much that we can sell to our existing huge large base of large companies, and therefore we're going to see that change. That's the dynamic that we have. Is that clear?
Yeah, that really wasn't what I was asking. Just looking for the mechanical splits.
What do you mean by that?
Do you have those numbers for us? What portion was in the U.S., what portion was in Europe?
It's about typically 70% in the U.S., 25% in Europe, and 5% in Asia PAC.
Right. Was it the same as normal, or was there any change?
Yeah, that has not significantly changed.
Then looking at the guide for the 2019 period, can you give us some sense of what you're thinking in terms of impacts from FX, economic activity, any of the sort of exogenous variables? Are you taking into account a slower condition as a result of recent geo slowdowns or any change in conditions that you're seeing as a result of those broader environmental issues?
Yeah. We believe today that the impact from FX is immaterial, but we know that things could change. It obviously depend on how rates move. We do believe that the market for our products is still very healthy.
Yeah, absolutely. On the geo side, we don't see much change today. The dynamics that we see, for example, today in Europe, thanks to our global IT Asset Inventory are becoming very strategic for large European companies, especially because they have GDPR. One of the things they've got to do is their global IT Asset Inventory. That's a product that we see is going to take traction. Again, the platform aspect that we have, we helping them save money. We don't see any geopolitical impact. With the exception, I think India, we're extremely well-positioned to see, of course, to really becoming an interesting market for us. Again, it's just at the beginning here.
One last question, then I'll cede the floor. What rate of hiring and sales do you expect in 2019 and built into your model? Thanks. Then I'll cede the floor.
We have increased by 20% last year our sales force. Of course, we don't need to increase as much. The reason is because, I don't have the exact number, but it's certainly not going to be 20%, I can tell you. The reason is because on our farmers, it's totally predictable. This is absolutely, of course, and that's part of the power of the model is that if I double the revenues on an existing customers, I don't need to double the size of our technical account managers. It's more on the new business side. I would say today that it's quite less than 20%. We make the effort at the second half, I think we're going to continue expanding more on the new business side and on the farmers, it depends on the growth of the new business, essentially.
Yeah. I would just add to that, as Philippe had mentioned that a lot of these ads have come in the second half. We're going to see from an expense perspective, it'll obviously hit the full year in 2019. From a modeling perspective, you're going to see the areas, I think, of highest investment for us on a year-over-year basis be R&D and sales and marketing.
Thank you. Your next question comes from Sterling Auty with JP Morgan. Your line is open.
Hi, guys. I'm bouncing between calls. I'm still a little confused about the guidance for 2019 revenue and the slowdown. I caught the not including the new products given, want to make sure you get confidence, and I think I caught the one or two days maybe difference in terms of revenue recognition. What else explains the, it's a pretty material slowdown from the rate that you have been seeing. Is it competitive? Is it something that you're seeing in the customers? I'm still not clear.
No, it's essentially the fact that we're prudent because today you have to realize that what was fueling our growth is essentially the Cloud Agent, which is doing very well, the Threat Protection, all these new services, and they are a fraction of the cost of the, for $1 of VM, we got-
$0.20.
let's say cents to the $0.20 of those products. Because we have such a huge base today, growing that base, of course, will require, if you prefer, bigger guns. Today, this is exactly what these new services that we have now today, which carry far more than, for a $1 VM, these new services are a multiple of $1 VM. They will grind. We see today, for example, one of the services which was, like the FIM specifically, is now starting to grind because we have the full product, the APIs and so forth. We are just at the beginning. We're being prudent, and we don't want to overextend ourselves. That's the fundamental reason here. We hope that we are going to do significantly better, quite frankly, but we didn't want to.
What is remarkable, I would add, is that we can maintain our profitability and while continuing investing. That's not the case of many. We try to balance that. I think we've been doing that, and that's today we say, I wish we could continue populating the world with agents and with Threat Protect, et cetera. Of course, we have such a large user base, specifically in the U.S., which have adopted that pretty well, which by the way, again, remember this agent generate additional services and all of that, the small rats build big rivers, but it takes some time, we're prudent.
Basically, you're saying the core VM growth has been constant or steady over the last couple of years. You had a, not a surge, but you had an uplift from adoption of Cloud Agent, but now that you've gotten to a certain level of penetration, that growth will now kind of more normalize, and now it's just the timing as you wait for the new products to kick in to reaccelerate the growth.
Yeah, that's exactly it. We could be surprised pleasantly because these new products are very good, by the way. We know that. I'm not questioning at all the adoption of this new product. It's more a question of timing here.
Yeah. Just, Sterling Auty, what may help you is give you the breakdown from a revenue perspective, our VM grew 20% the past year, and the so-called non-VM categories grew 23%. You see VM, it's been fairly good.
Yeah. Of course, fueled by the component of the Cloud Agent for VM and Threat Protection, that's exactly the point.
Thank you. Your next question comes from Rob Owens with KeyBanc Capital Markets. Your line is open.
Yeah. If you look at the slowings to follow on, I guess, is it the VM then that slows, relative to 2019? With the 20% hiring throughout the year or in the back half, how do you think about Salesforce productivity, and at what point do those guys get fully ramped?
What we have today, again, we need to distinguish between the farmers and the hunters. The farmers are extremely good productivity. Of course, we make an investment, but all that as we sell new services. I would say that we certainly will maintain, if not increase the productivity on our farmers. It's on the new business side that today, of course, it takes a bit longer. Also, we have tendency, naturally, instead of pushing deals to make them bigger and bigger and bigger, we prefer to land the customer, young, if you prefer, and then grow that customer. That has been our model since the very beginning because of course, it's significantly more profitable than trying to go and give big discounts at the end of the quarter and all these things that enterprise software is pretty good at.
Unlike our competitors, I will not name a few of them, but who absolutely dump their price. That never has been Qualys. We try to do, okay, let's start small, and then let's grow the customer. That has been our philosophy. As a result of that, the ramping of that new business sales force is much slower.
Okay, great. Thank you.
Thank you. Your next question comes from Matt Hedberg with RBC Capital Markets. Your line is open.
Thanks, guys. I guess following up on Sterling and Rob's question, the VM market seems to remain healthy. I think 20% growth is pretty good relative to historical trends. I know it's hard to generalize, Philippe, but I guess excluding Cloud Agent, do you have a sense for how penetrated your customer base is in terms of being scanned? In other words, how much dark space is there in networks within your customer base?
I would say today, there is not that much. If you look at the large companies, in fact, that's the reason why Qualys is so strong in that marketplace on the large enterprise. That's what our competition, despite their pricing tactic and everything they can say, they really don't take that market away from us is because of scale. I would say that today there's still some more growth, but for us, it's more at the endpoint. On the service side, I think the large companies are pretty now looking continuously. On the endpoint, of course, we have now more opportunities because of the asset inventory is going to put our agent on the endpoint. Of course, now suddenly you do more VM and on and on. So for us, the green space or the whatever-
Dark space.
That's on the endpoint, which is quite significant. That's where we see the future growth. Of course, IOC, all these new solutions that all requires an agent, the patch management is going to really propel. And once now you suddenly do patch management on the endpoint, what about doing Vulnerability Management? What about doing compliance? When in the past people were saying, "Okay, okay, I'm not going to do it," or, "I've got another agent, I've got so many agent." Now today they've got a compelling reason to go. That's what we see on the high end of the marketplace. On the mid-market, what mid-market is small market, the new space is the cloud, which we're extremely well-positioned. More and more, the SME and SMB are moving to the cloud. Therefore, it's now a kind of a different market.
That's where we compete really essentially with the Tenable and the Rapid7 is in that mid-market, which is also moving into the cloud. There we believe we have a unique advantage because of our agent can natively be, as they are today, integrated with Azure, where they are about to fully be integrated the same way with AWS, as well as with Google, and soon with IBM as well. At some point in time, also Alibaba. I think we're native in the cloud, and that will give us an advantage. Currently today, that's where we fight, if you prefer.
Great. Thanks a lot.
Thank you. Your next question comes from Gur Talpaz with Stifel. Your line is open.
Hi. This is actually Chris Prassas on for Gur. Thanks for squeezing us in here. For Philippe, can you speak to the demand that you saw in Q4 for the recently launched container security and asset inventory products, as well as the feedback you've received from customers in the passive scanning beta?
Oh, absolutely. Container security, this is definitely the new game in town. It's still early in the market. Customers are adapting container security. Are we, by the way. We have containerized now almost everything that Qualys does. This is really the future. It totally changed a lot of the IT dynamics and of course, It's still early. Today, everybody likes our vulnerability assessment solution that we have for containers. It's very straightforward. We have quite a very good use cases from customers.
Now we're integrating with that acquisition with Layered Insight, which will happen most likely because there's quite a complexity in the end of Q2 timeframe, second half, maybe Q3, which then we will have the full solution for container security, because not only you can do the assessment, but also you do the runtime, and then you can, of course, control and push your policies. That's the new big game. No question, I think we're extremely well-positioned, In term of revenues, this is still relatively early. As far as the passive scanning is concerned, I'm very impatient to get that being delivered. It's today, we have a fantastic solution. We are better, as you know. I would expect, because there is a lot of complexity technically that you need to absolutely to make it easily deployable, et cetera. I think we will be in Q2 GA.
That component has a lot of This is the Forescout competitor, except that it's going to be totally integrated with the Qualys platform. You have, at the same time, agent, agentless, all that into a single platform, the full view of your Qualys Global IT Asset Inventory. Now you can do network traffic. It's also, well, embarking into another major development, which we're going to speak a little bit later in the year. It also gives so much information. Now what is fascinating is when you combine agentless, which is the scanning, agent plus the passive scanning, you are dealing now with a volume of data that there is not a single company today who can do that. That's essentially what we're now working on our back end, is to bring all that data into a single place where you can analyze, correlate, et cetera.
That's the new game. Passive scanning is very strategic for us, and I think we are taking our time because you need to build that at scale, and that's where the big challenge is. I was mentioning, we already have indexed two trillion data points on our Elasticsearch clusters. Believe it or not, Elasticsearch is becoming too slow. That's the new frontier. We're really moving into that new frontier as well. Later this year, we will talk about that.
Awesome. Thanks, guys.
Thank you. Your next question comes from Joshua Tilton with Berenberg. Your line is open.
Hi, thanks for taking my question. Just one more on the guidance. If the new products being released grow at a similar rate of the older non-VM products, should we expect upside to the guidance as to their price higher? Then maybe just what level of contribution to revenues are you hoping from these new products that have yet to be released?
Yeah. As I mentioned, since the guidance doesn't assume any material contribution from these new solutions, should that happen, yes, that would be additional contribution to our revenue guidance. I'm not sure I understood the second part of your question.
Do you guys have an anticipated contribution to total revenues from the new products that are yet to be released?
We really don't manage our business on a product basis. We really, as Philippe mentioned, we have hunter and farmer sales force, our sales force is focused on our, what we call farmers, are focused on renewals and upsells, and those are all done on a dollar basis. That's because we don't want our sales force pushing product on a customer that they're not going to use and that they're going to just turn off. We've always kept our sales force, as I mentioned, with dollar-based quotas, and we don't manage the business on a product basis.
I think the question was, unless I misunderstood, on these new services like the Patch Management and all that. We said that we have not really considered that as meaningful revenues to 2019 because it's hard to predict the adoption ramp. We are very confident that our customers will adopt it, but it takes some time because they need to find the budget. They do the proof of concept, et cetera. Sometimes it's a displacement, much more than. You got all that takes time. We are absolutely confident of the adoption of these new services.
That's help added color. I was trying to provide the framework of how we manage our business, which is based on contribution from new customers and then growth of existing.
Are you guys expecting similar uptake by customers relative to the older products that have been released since 2015?
As we said, the actual curve is going to depend on what the pace of adoption is. Without any data points, it's hard to plot what the curve's going to be. Some may be faster, some may be slower.
Right. However, if you look at the key metrics that we disclose, that the number of customers which have adopted two or more solution, which now is, I think, 70%. Those who have three, which I think today it's 40%.
41%.
41%. Those who have adopted four and more, which is-
21%.
21%. Now we show the 10%, which is about 10%, correct?
Five plus is 10%.
five plus is 10%. We can absolutely say that today we believe that of course, these new product all continue fueling that. At the end of the day, we believe that 70% of our customer base are going to adopt all our four solutions. Why? Is because why you would never want to do that when they are totally native in one single platform, a single administration, self-updating, all of these benefits, and it start to reduce significantly your cost as you, instead of laying on all these different solutions that you got to integrate, to manage, have different teams, all of that will eliminate a lot of cost. We're very confident that overall, what we cannot really predict is essentially the ramp in the early days.
Today, as we start to see, having a data point, today we can see the trajectory, by the way, of the three plus, which today at 40%, you could almost predict when are they going to be at 70%. Those which are, the more you go into, of course, the newer ones, the harder it is to predict because we have less data point. Does that make sense?
Yep. Thank you very much.
Thank you. Your next question comes from Patrick Colville with Arete Research. Your line is open.
Thank you for taking my question. Can I ask about the Patch Management tool? I know that in my work, speaking to CISOs, that is going to be a product that's going to be really in demand. I'd just like to better understand it, in terms of what is the tool, I guess, going to offer and when it's likely to be released. Yeah, that'd be great. Thank you.
We just announced today that the Patch Management is really going GA or within a few weeks. It's well ready to go. That Patch Management solution is relatively unique. It cuts across all the different environments, the Patch Management tools today that you have are very specific to Microsoft Windows, to Unix, to this, to that. It's a nightmare for companies when they have, for example, to put an urgent patch which cuts across, like WannaCry, for example, multiple environments. Today with Qualys, you are now able to essentially, first of all, Qualys will tell you exactly where all your vulnerabilities are, where do you need to patch, and then you just push a button and it will be all patched. You could, of course, not do that 100% automatically.
You may want to have some kind of steps in between, but that's become an operational issue for the companies. That multi-patching capability is very unique of Qualys. That's one big differentiator. After that, the question becomes also a question of automation. The problem today is that you have never tied very well vulnerability with Patch Management, with the superseding patches, and that's we resolve all of these problems. Look at us operationalizing it. For example, you have solutions on Patch Management, like some of the Microsoft solutions, like SUSE, are totally free. The problem is that you just do patching without that visibility. Qualys for a relatively very attractive price, everything automated, give you this capability. I cannot tell you again, the rate of adoption, it's too soon.
I can tell you that we are solving a real problem here, because immediacy of patching has become today very important, because the more time you take to eliminate your vulnerabilities, the more time you give for the bad guys to essentially damage you. As you know today, zero days used to be few a month before an exploit was in the wild, was published. Today it's almost minutes. It's absolutely pretty fast. You better be on the top of your vulnerabilities. You need to patch. Without remediation, identifying your vulnerabilities, what does it mean? You could shut down your network, close down your network, you don't do any business. That immediacy is becoming very important. We anticipate a very good success as well of that Patch Management solution.
Can I just follow up on that? It seems like a very obvious place for you to go into. I guess why now, given that this would be a product that-
Very good question.
Yeah.
A very good question. If you look today at the story of patch management, you had BigFix. BigFix was the first solution that really was providing an enterprise-wide patch management solution, multi-platform, if you prefer. IBM bought them. The problem with BigFix is that it's enterprise software, so it's pretty heavy. It costs a lot. We took a cloud approach to patch management. Again, everything's centrally managed, self-updating. We have been working at that now for about essentially four years. It doesn't happen in one day. We took a lot of the technology in partnership with Ivanti. Because there's a lot of complexity, and to deliver that as a cloud solution, like doing Vulnerability Management solution, which is very unique to what Qualys did from the cloud, very few companies have done that.
In fact, we're the only one who really does that well and at scale. We needed to have our scanners, you put your scanners inside, you need to remotely manage. It's a lot of complexity to make it that easy, and that same thing with patch management. It took us about four years to get that product out.
Great. Thank you so much.
Thank you. I am showing no further questions at this time. I'd like to turn the call back over to Natasha Asar for closing remarks.
Thanks, Heather, and thank you all for attending our fourth quarter and full year 2018 earnings call. We are holding an event for our analysts and investors during the RSA Conference on Wednesday, March 6th from 11:00 A.M.- 1:00 P.M. Registration will be on our site soon. We also look forward to seeing many of you later this month at the JMP Securities Technology Conference and the Morgan Stanley TMT Conference in San Francisco. Thank you.
Ladies and gentlemen, thank you for participating in today's conference. This does conclude the program, and you all may disconnect.