Good day, everyone, and welcome to Qualys' third quarter 2018 earnings conference call. This call is being recorded. At this time, all participants are in a listen-only mode. Later, we will conduct a question-and-answer session, and instructions for asking a question will be given at that time. I would now like to turn the call over to Natasha Asar, investor relations. Please go ahead, ma'am.
Good afternoon. Welcome to Qualys' third quarter 2018 earnings call. Joining me today to discuss our results are Philippe Courtot, our Chairman and CEO, and Melissa Fisher, our CFO. Before we get started, I would like to remind you that our remarks today will include forward-looking statements that generally relate to future events or our future financial or operating performance. Actual results may differ materially from these statements. Factors that could cause results to differ materially are set forth in today's press release and in our filings with the SEC, including our latest Form 10-Q and 10-K. Any forward-looking statements that we make on this call are based on assumptions as of today, and we undertake no obligation to update these statements as a result of new information or future events. During this call, we will present both GAAP and non-GAAP financial measures.
A reconciliation of GAAP to non-GAAP measures is included in today's earnings press release. As a reminder, the press release, prepared remarks, and an accompanying investor presentation with supplemental information are available on our website. With that, I'd like to turn the call over to Philippe.
Thank you, Natasha. Welcome everyone to our Q3 earnings call. Melissa and I are pleased to report both continued revenue growth and profitability. These results reflect our position as a leading cloud-based security and compliance platform, unifying IT, security, and compliance in a single pane of glass view with two seconds visibility across on-premises assets, endpoints, clouds, and soon mobile, OT, and IoT environments. Such capabilities is the keystone of security as there is no security without visibility. To that effect, I invite all of you to watch a short video at www.qualys.com/visibility so you could experience it for yourself. This unique competitive position was in fact reinforced when I met many of our European customers earlier in the month in Monaco at Les Assises de la cybersécurité, the leading security conference in France.
They shared with me their view that they see Qualys as a strategic partner as they move to consolidate their current security and compliance stacks and accelerate their digital transformation, in part because of GDPR, as well as by the need to remain competitive. As we continue delivering additional best-of-breed compliance and security solutions, application natively integrated within our cloud platform, and expanding our offerings on public cloud platform such as Amazon, AWS, Microsoft Azure, Google Cloud, and soon IBM Security Connect. We believe that we naturally increase our stickiness and drastically reduce both cost and complexity for our customers.
This is underscored by the fact that we continue to innovate and deliver on our product roadmap. In Q3 we showcase the passive scanning sensor, a new member of the Qualys sensor family that natively integrates network analysis functions, deep packet inspection, and data correlation into the Qualys cloud platform, delivering customers complete IT visibility at scale. In combination with our existing data-gathering sensors, specifically scanners and Cloud Agent, and our groundbreaking app for global IT asset inventory and CMDB synchronization, ITAM. These new capabilities enable us to offer our customers a single source of truth for all IT assets within hybrid environment, including on-premise assets, endpoint, cloud, and soon again, mobile, OT, and IoT environment, and you will see that on the video I just mentioned.
We now have more than 30 customers using our ITAM apps for known assets in beta and expect to go GA in November. Our passive network analysis for unknown assets will go into beta in November as well and is expected to go GA by year-end. We also announced a new out-of-band configuration assessment cloud app that allows customers to achieve complete visibility of all known IT infrastructure by pushing vulnerabilities and configuration data to the Qualys cloud platform from systems that are otherwise difficult or impossible to assess, such as highly locked-down devices and on air-gapped networks. Our expanded relationship with Microsoft and IBM are testament to the tremendous value our cloud platform offers to customers.
This quarter, we added an integration into Microsoft hybrid cloud Azure Stack, which allows us to provide a single-pane view of the security compliance posture of Microsoft Azure's infrastructure and user workloads across Microsoft Azure as well as the Azure Stack. We announced our release of monitoring and assessment for CIS, the Center for Internet Security Inc., Microsoft Azure Foundations Benchmark with our cloud security assessment. To enable our customers to build security into DevOps initiatives. We also announced an expanded partnership with IBM, whereby X-Force Red will deploy the Qualys Cloud Agent and Qualys Cloud apps into client environments across the globe, providing a programmatic vulnerability management approach that leverages the breadth of Qualys' continuous visibility and the depth of the X-Force Red team to identify, prioritize, and remediate clients' most critical vulnerability.
Finally, we were selected as a key partner for IBM's first open cloud platform, IBM Security Connect, to federate and analyze security data at scale. With IBM's open cloud platform, enterprises will be able to view their Qualys data across applications integrated with their network and other security solutions. Adding to our product capabilities, in October, we completed the acquisition of Layered Insight. Layered Insight, based in the Bay Area, is a pioneer and global leader in container-native application protection, providing accurate insight into container images, adaptive analysis of running containers, and automated enforcement of the container environment. By integrating Layered Insight's unique technology into the Qualys Container App, we'll add the ability to provide dynamic analysis of running containers and automated enforcement of the container environment. Layered Insight's unique technology brings transparent orchestration to container security.
The ability to instrument images pushes automated deployment deep into the DevOps CI/CD pipeline, thus removing the resistance at deployment. This instrumentation provides real-time visibility into containers at runtime, completing our current capabilities of assessing container images in the build system for vulnerabilities and configuration issues. With this layered-in approach, there is no sidecar or privileged container needed by the solution, making it an ideal solution for intelligent edge and serverless container-as-a-service, CaaS, deployments like AWS Fargate, which are quickly becoming the future of containers like IaaS and PaaS, quickly becoming the future of containers. Through the layered-in presence in the application, the solution also provides protection, policy-based remediation, and response capabilities that further simplify end-to-end container security. We expect quick integration into our cloud platform with general availability in Q2 2019.
In line with our acquisitions made to date, key employees have joined Qualys, including Asif Awan as CTO of Container Security and John Kinsella as VP of Engineering, Container Security. In summary, our acquisitions complement our organic innovation, expanding our cloud platform to provide more comprehensive security and compliance coverage on the application side, customer-owned web applications, and providers' hosted SaaS web application. Also providing visibility across all global IT assets, including web applications, containers, APIs, OT, and IoT devices. We continue to make good progress in penetrating the federal market. We were delighted to win a large multi-product deployment with DHS, which was a competitive displacement. DHS has licensed Qualys' platform in support of the National Cybersecurity Assessment and Technical Services and CATS mission. Qualys will be used in the DHS initiatives for protecting critical infrastructure and election security.
Additionally, Cindy Stanton joined as VP of Product Marketing for both public sectors and cloud providers. Cindy previously worked at Alert Logic and Verizon Business and will leverage her experience to develop programs supporting federal agencies on their digital transformation and cloud security initiatives. Additionally, we continue to leverage the cloud platform as a distribution channel. We announced the new comprehensive offering for consultants, consulting organization, and managed service providers, the Qualys Consulting Edition, enabling them to perform multiple ongoing vulnerability assessment engagements and track these results from a single centralized and self-updating platform. We have seen a great response to the release of CloudView, Cert View, and the Qualys Community Edition, a successful lead generation effort which serves to distribute our Qualys cloud platform to more users from which we can sell many additional solutions.
We have over 12,000 activations now, out of which almost 6,000 are active users already, which is significant growth from the over 6,500 activation and 700 users we had at the end of Q2 2018. We are excited to host our customers and partners at our upcoming QSC user conference in Las Vegas on November 14 and 15. We expect this user conference to be significant for our company as we believe that it will be evident that we have moved well beyond vulnerability management and in fact, are bringing IT, security, and compliance together across the environment, drastically reducing the cost of deploying and maintaining traditional enterprise solutions, and this is due to our cloud architecture. At the conference, our Chief Product Officer, Sumedh Thakar, will showcase our new groundbreaking global IT asset inventory solution, which again, you can now preview at www.qualys.com/visibility.
This is a solution which is always up to date with two-way synchronization with CMDBs and enables the organization to regain full visibility across their on-premise, cloud, mobile, OT, and IoT environments. We will also showcase our new customizable dashboard that provides real-time analysis of your security and compliance posture in a single pane of view that identifies, in seconds, assets that are vulnerable to zero-day attacks or that have been compromised or are suspicious. Finally, among other innovative solutions, we will also unveil and discuss our forthcoming patch management and mitigation solutions, another approach to continuous security, which I have mentioned earlier, and how Qualys can embed security into your DevOps and digital transformation initiatives. At the conference, our attendees will also have the opportunity to discuss and listen to customers, which will share their experience and best practices.
You are, of course, welcome to attend that conference, which we combine with an investor day, and I will make some mention later on. We are hosting a dedicated track for this community on November 15, which will include a demonstration of our newest application in the platform by our Chief Product Officer, Sumedh Thakar, a financial update by our Chief Financial Officer, Melissa Fisher, customer speakers, and industry analysts. Before I turn the call over to Melissa to discuss our financial results, I would like to welcome Patricia Hader to our board. Patty brings unique experience as both a buyer and seller of security and IT solutions, given her prior roles as both the CIO and SVP of Operations at McAfee, as well as the SVP of Services.
In addition, she also served as GM of Security and Software IT and CIO for Intel Security and has also held a variety of leadership roles at Cisco and AT&T. As we continue to expand the breadth of application unifying IT security and compliance, we expect to leverage her expertise as we increasingly sell our integrated solution cloud platform to CIOs and CISOs.
Thanks, Philippe, and good afternoon. Before I start, I'd like to note that except for revenue, all financial figures are non-GAAP unless stated otherwise. As Philippe mentioned, our continued healthy financial results reflect our strong competitive position and continued platform adoption. I'd like to share the following Q3 financial and operational highlights. Revenues for the third quarter of 2018 were $71.7 million, which represents 20.5% growth over the same quarter last year. Platform adoption continues to increase as a percentage of enterprise customers with three or more Qualys solutions rose to 39% this quarter, up from 30% a year ago. The percentage of enterprise customers with four or more Qualys solutions rose to 20% this quarter, up from 14% a year ago. Cloud Agent adoption accelerated with 13.9 million Cloud Agents purchased over the last 12 months, up from 8.1 million for the 12 months ending in Q2.
Approximately five million Cloud Agents were purchased by a cloud platform customer. New products released since 2015 contributed approximately 23% of total bookings in the quarter, up from 14% in Q3 2017, driven by solid growth from both Cloud Agent and Threat Protection bookings. We saw higher growth in the total number of orders from our SMB, SME, and PCI customers. This positive result did pull our historical year-over-year average deal size increase down to 5%. However, the average deal size for our enterprise customers grew 12% year-over-year. Our scalable model continues to drive industry-leading margins and generate significant cash flow. We now expect full-year operating margins to increase approximately 250 basis points. Adjusted EBITDA for the third quarter of 2018 was $31.9 million, representing a 45% margin as compared to 40% for the same quarter last year.
For comparability purposes, Q3 adjusted EBITDA margin would still be 44%, normalized for the impact of 606, specifically the amortization of commissions. In addition to the efficiencies inherent in our highly profitable operational model, this quarter our R&D expense benefited from a catch-up in software capitalization. Adjusted for this effect, R&D expense would have sequentially grown as we continue to invest in research and development, and in fact, are delighted with our successful recruitment efforts in Pune. We generated strong operating cash flow for the third quarter of 2018 of $31.6 million, a slight decline of 4% year-over-year. However, year-to-date, our cash flow has increased 21% versus the same period last year. We continue to invest the cash we generate from operations back into Qualys.
In Q3, we spent $6.7 million on capital expenditures, including principal payments under capital lease obligations, and we used $27.2 million to repurchase 310,815 of our shares. We remain confident in our financial model due to our strong competitive position and leading cloud platform. As such, our board of directors has authorized an additional $100 million two-year open market share repurchase program, resulting in $153.5 million of current repurchase capacity. This program will continue to minimize dilution to our shareholders. We have a strong current deferred revenue balance of $155.1 million as of September 30th, 2018, 17% greater than a year ago. Current billings in Q3 were $75.4 million or 13% greater than a year ago. Our Q3 current billings growth rate was negatively impacted by a large scale that we expect to close in Q4.
Our business outlook remains healthy. We are maintaining the top end of our full year 2018 revenue guidance, now in a range of $278.4 million-$279.2 million. As we have consistently communicated, we do not manage to quarterly billings and are focused on the long-term growth of our business. We are also raising fiscal year 2018 non-GAAP EPS guidance to a range of $1.62-$1.64. For the fourth quarter, we expect capital expenditures to be in the range of seven and a half million to eight and a half million. We feel very well positioned given the unique nature of our integrated IT security and compliance cloud platform, as well as our new groundbreaking applications, which you will see at QSC. With that, Philippe and I would be happy to answer any of your questions.
Ladies and gentlemen, if you have a question or comment at this time, please press star then one on your telephone keypad. If your question has been answered or you wish to remove yourself from the queue, simply press the pound key. To prevent any background noise, we ask that you please mute your line after your question has been asked. Again, to ask a question, please press star then one on your telephone keypad. Our first question or comment comes from the line of Daniel Ives from Wedbush. Your line is open.
Thank you. My question is in regards to obviously, you guys look like you're in a position of strength going into year-end. How are you in terms of thinking about things from an M&A perspective over the next year versus organic, from a product perspective?
This is Philippe. We continue on the same strategy. If you recall our strategy in terms of M&A, has been that first of all, we wanted to really complete our cloud platform enough so we could more easily integrate additional technology. What has been guiding us is identifying technology which either will accelerate a current engineering developments that we have or will accelerate our entrance into new markets. As you have seen, this is exactly what essentially that recent acquisition, the two previous one as well as the acquisition now of Layered Insight, which allows us to move much, much faster into that very hot market, which is container security. This being said, to answer your question, we believe that in 2019, it will be absolutely the same. We see quite significant opportunities today.
We have been, as I was mentioning earlier, very prudent in how much money do we pay because we see there's been an inflation, fundamentally, far too much money being poured by the VCs into our space, we believe. I think the industry is entering into a consolidation phase. We see a lot of opportunities. We have the advantage of having a platform which will allows us to integrate more solutions pretty easily. Second, we have the cash as well. I think we're in a very good position. Again, we're prudent. This is very deliberate. I used to say we're kissing a lot of frogs. We see a good outlook for 2019 in terms of doing a few additional acquisitions.
Okay. Then maybe from Melissa, look, expense controls is just phenomenal. Especially relative to competitors, the way that they're spending. When you think about just putting the pedal on the metal to just sales and marketing and R&D, especially just some of the big opportunities out there over the coming year, maybe you could just, I know you're not giving guidance for 2019, but just anecdotally talk about that balance and how you're able to do that, especially with competitors spending money pretty significantly.
Yeah. Thanks, Dan. First of all, we're obviously proud of our industry-leading margins. We feel like we are actually putting in significant efforts behind both those areas. To clarify, or maybe repeat, as I mentioned, R&D this quarter was sort of artificially depressed by this catch-up in software capitalization. As I said, we continue to invest in R&D, and if we didn't have this catch-up this quarter, it actually would have sequentially grown. Sales and marketing is obviously, just from a comps perspective, impacted by 606. We continue to spend there. Q4 is a big quarter for us in terms of sales and marketing because we have our annual user conference, and we continue to anticipate that we would continue to invest in 2019 as well.
Yeah, let me add something. One thing which I think is very important here to understand. At the end of the day, it's the model, stupid, fundamentally. If you look at the way we're structured the company, we're totally cloud-based since the very beginning, and we understood that if you can have your customers renewing, you can live forever, and if you can sell them additional services, you can grow forever, in a way, and certainly more profitably. If you sell them enterprise software solutions. That's the core reason. Now we have expanded our capability, again, thanks to the platform, to continue having very low acquisition cost of customers through the free services that I just mentioned earlier. It doesn't cost us much to distribute a free service across the planet.
Of course, from there, the platform is already now in use, then we can upsell additional services to these customers that we essentially got through these free services. The combination of upsells and free services really help us to continue, essentially, maintain such a profitable model. It's all about the architecture of the model.
Awesome. Okay, congrats. It's just a great quarter. Thanks.
Thanks, Dan.
Thank you.
Thank you. Our next question or comment comes from the line of Alex Henderson from Needham. Your line is open.
Thanks. I was hoping you could give us a little bit of a sense of scale on the acquisition. What is the size of the nut that you're bringing in terms of cost? I assume that there's not much of any revenues attached to it. On the R&D catch-up, it looks like that's a pretty good nut. If I were to take the 2Q number on R&D and grow it at 2% or 3% sequentially, is that the right way to think about where you'd be in the fourth quarter if it wasn't for that? In other words, up a couple hundred to $300,000-$400,000 versus 2Q?
Let me take the last question first. On a non-GAAP basis, it's about $700,000. I'll just give you the number so you can do that for the modeling. Then obviously, as I mentioned, that was a catch-up for the first three quarters, so that amount wouldn't continue going forward. With regards to Layered Insight, I'll talk a little bit about the financials and then Philippe probably might want to add some color around the strategic nature, because we feel like this acquisition really puts us at the forefront of container security when combined with our existing solution. In terms of transaction details, from an expense perspective, it's really not going to be material relative to our overall expense structure. The expenses for Q4 is baked into our guidance.
The transaction price is $12 million, there's another $4 million paid tied to an earn-out, another $4 million paid tied to employment of key employees through 2019.
Yeah. I would add to what Melissa said, that they have a quite impressive, albeit small numbers of customers like GE, you may have seen on the press release a quote from GE and a few others, and they are very good prospect. In fact, I would say that the three-quarters of their customers are already Qualys customers, which all welcome the fact that now we combine the superior, if you prefer, assessment technology that Qualys has with their very unique architecture. To be specific, and that's what attracted this to us, a brilliant team of people, small, but absolutely brilliant. They know what they're doing. They build really the right architecture for container security or for containers.
Instead of having a container managing other containers, as you know, containers are ephemeral and they drift, they essentially have built a similar architecture that the one that we have, which is a kind of and sort of an agent that goes into the containers. That gives significant scalability plus an enforcement point. Now you can really start to speak about application protection and so forth and runtime. All that is real time. Our two solution combines, it's a very, very powerful solution. As I'm sure we all know now, containers are really taking the world by storm. This is a very strategic acquisition that we've made.
If I could, just one last quick question. The growth rate for the fourth quarter is kind of edged back under 20% after four quarters of pushing it over 20%. I was wondering if you could just give us a little bit of a granularity around why that might be decelerating sequentially or year-over-year in that fourth quarter.
Yeah. Alex, we have a very healthy business in [our lake], as we mentioned earlier. If you remember, from a comparable perspective, we have tougher comps in the second half than the first half, actually in Q4 even more than Q3. The year growth number was 20% in Q4 versus 17% in Q3. That's what's impacting the growth rate.
Okay. Thank you.
Thank you. Our next question or comment comes from the line of Sterling Auty from JPMorgan. Your line is open.
Great. Thank you. Good evening, guys. This is actually Jackson Ader on for Sterling tonight.
Okay, Jackson.
Our question really revolves around the federal space. You guys have made it clear in a number of initiatives that you're going to try and head into the federal space outside of Philippe, the large deal that you mentioned with DHS. How would you say that progress is tracking relative to your internal plans?
I think we're absolutely delighted. As you know, we've been patient, which is one of the trait of Qualys, before deciding to finally enter the market because we thought the marketplace, we knew the marketplace was not ready for cloud. Now it is. I think we're extremely well-positioned. I mentioned that having DHS as a customer now having selected us, and it was a competitive displacement, What they do appreciate here is the scale of Qualys, the quality, the fact that we deploy. When you look at the federal market, it's absolutely all about scale. Today, of course, scale and cost. We have now the scale, and I believe we're going to really become a significant player in the federal space. This being said, it always takes time in the federal market because of the procurement.
We established a very strong relationship with Carahsoft, which is the premier distributor. We're putting all the pieces together. We attracted Cindy Stanton, which now is essentially our VP of product marketing for federal. We are starting a lot of new initiatives. We're very happy in fact, with our presence in the federal market, what we have done, and there's more to come. It's going to take time, we don't anticipate significant revenues in 2019. As you know, our model, we take the revenue as we deliver the service. The orders in federal have more tendency to come-
Longer
at the end of their fiscal year or the beginning of the other one. In term of revenues, this would be more in 2020. However, we anticipate to have more enrolled in that marketplace, which we'll be very happy to report.
Sure. Okay. Understood, then a quick follow-up, Melissa, on the CapEx side. Anything to call out here in the fourth quarter, reason why CapEx is expected to pop up a little bit?
Yeah, it's really just a timing issue. We had expensed more in Q3 that didn't actually get paid, it doesn't show up as CapEx on the cash flow statement. It'll get paid in Q4, which then shows up on the cash flow statement then. We're still on track for what we had said was our full-year guidance CapEx of $28 million-$29 million.
Yep. All right. Thank you.
Thank you. Our next question or comment comes from the line of Gur Talpaz from Stifel. Your line is open.
Hi, this is Chris Spiro. I was actually on for Gur. I know they're still in beta, can you talk about the initial feedback that you've received from customers concerning both the passive scanning tool and the asset inventory product?
This is a huge positive response. In fact, this is absolutely a game changer. You understand, this is not something we have just been working recently. In fact, we saw the opportunity about 10 years ago. This is when we saw Goldman Sachs using the result of our scans to audit their CMDB, which was Tivoli. It took for us not only mastering the scan, then the agent technology, which give us the real time and absolutely the full inventory of everything that the device has. Now today, the missing piece was the passive scanning. Today, we have essentially more than 30 beta users of one part, which is the known asset, which is going to go GA in a couple of weeks. Now today, everywhere you can put our agent, you have the complete view of your asset inventory in real time, essentially.
You synchronize that two ways with the CMDBs. Now today, we're entering beta for the passive scanning, which essentially will give us the unknown. That's anything which connect to the network. You will see, I always encourage you to look at that video that we just published at, again, at www.qualys.com/visibility. You are going to see the passive scanning, discovering unknown devices, and then we fingerprint them. Essentially, that's another huge task that we have undertaken, which is to fingerprinting all the devices on the planet. Very similar to what Google did with their cars, for essentially mapping streets. Here, we're mapping all these devices, and of course, we use, to do that, machine learning. We have already a huge effort which has been undertaking. When you combine all that together, we provide now the source of proof.
What's very unique, again, with Qualys, it's not only on a few devices on your endpoint, it's on all of your on-premise servers, et cetera. It's on your endpoint, it's on your cloud environment, on your containers, on your web application security. Early next year with the mobile, with the launch of our mobile agent technology that we acquired from 1Mobility. During next year, it will be more and more OT and IT devices. All of that, we have the platform. We have index because, of course, you want to be able to analyze, correlate, and, of course, report almost instantly. We have now today indexed more than 620 billion data points on our Elasticsearch clusters. We anticipate that by year-end, we'll have essentially indexed close to a trillion.
This is really heavy lifting, and again, it took us 10 years to get there. We're very excited and so are our customers.
Great, thanks for the color there. Multi-product customer growth was impressive in the quarter. Are customers more willing to adopt multiple products at the initial point of sale, or is this growth being sourced primarily from add-on sales?
It's both, I would say that in general, we do see new customers taking on multiple products initially more than we had historically.
Yeah. We believe also that the other interesting part with that global IT asset inventory is that this is also going to be, as I'm sure you realize, a kind of a Trojan Horse strategy to have our agent being everywhere. Once we have our agent, of course, there's significantly additional services like file integrity monitoring, detection of indication of compromises, et cetera, that we can absolutely now deliver almost instantly. That's, again, the power of our platform. We see that ability to further penetrate with the agent in the cloud as part of inventory. We're really building the nervous system, if you prefer. The beauty of our solution is that we help our customers, that's something that very few company can do, I would make another very important point after that.
We can help them consolidate the stack of their current solution, which are becoming very costly and almost ineffective. That's one good thing for them, but also help them essentially build the security into their digital transformation. What we see today is that we're also moving into a new model of selling. Very few company, I believe, can do at the same time an architectural change. Moving from an enterprise software solution to a cloud-based solution, but also doing a business model change. We see today the Amazon, the Azure becoming extremely powerful platforms, essentially frictionless delivery of IT solutions. We are very easily embedding our solution into them. We are envisioning an environment where you essentially will not even need that much salespeople.
What you will need is people to essentially onboard to make sure that absolutely everything works, the customers understand what needs to be done. I don't see ourselves increasing our sales force significantly with what I call these are managed sales guys, which cost you a fortune and hunts elephants. It's all about frictionless. I think we have the right platform, the right architecture, the right business model, the right sales force. This is a question that people say, "You're not spending enough in sales." I say, "No, it's all about essentially building, if you prefer, that new delivery model." That's, by the way, exactly what Amazon has done when you look on the physical world, where they do essentially the procurement, the fulfillment, they deliver, they invoice you, et cetera. You put your goods on Amazon and so on, they distribute that very effectively.
That's the way IT is going, which of course is not good news for a lot of companies, but I think it's very good news for Qualys.
Great. Thanks for the color. Appreciate it.
Thank you. Our next question or comment comes from the line of Erik Suppiger from JMP Securities. Your line is open.
Yeah, thanks for taking the question. The Cloud Agent, I think you said that you had a service provider that took 5 million units. Is that right? Can you talk a little bit about that deal? Then if we exclude that deal, I think you added about 800,000, which I think is consistent with the prior quarter. Is that kind of the range that we could think of in terms of ongoing unit volumes on a quarterly basis?
Yeah, it's very difficult to predict. What you see here is the fact that now our agent is starting to be really adapted more and more into the cloud. In fact, our agent is the ideal solution to give you the global-light asset inventory wherever you can put the agent, but also it goes into the cloud, and that's the beauty of our solution. It's a very small agent, you could see that adoption of our agent into this cloud environment, and that's what it is. We're anticipating, of course, that we'll see more of those. You have two dynamics here. One is the growth in the enterprise, if you prefer, moving more and more into the endpoint. Then you have that other dynamic, which is now the cloud.
It's hard for us to give you any kind of how to model at this stage because you have two different dynamics here.
Melissa, you had talked about billings being depressed in the third quarter because you had a deal that slipped into Q4. Can you give us a sense for what we might think of in terms of billings in Q4?
Well, it obviously was meaningful. That's why we called it out. I think I would point you back to our earlier remarks. We have a healthy business, that's reflected by the fact that our full-year revenue guidance is 21% for the year. To what we talked about earlier, we have strong Cloud Agent adoption as well as multi-product adoption.
I would add one thing also on that billings is that, again, aligned to what I mentioned earlier, that now the cloud is really moving. What we see also is that all these new cloud deals, if you prefer, that we are doing now are more moving into a consumption-based model, by the hour, by the node, monthly billings type. We see again, that doesn't change the revenues. Again, that's the beauty of being 100% subscription-based, it does affect our billings. We start to see looking forward that we're going to start to see this kind of a new consumption-based model. As you may know, Amazon is really pushing that very hard. All these cloud providers are going now into an hourly model, per node, per hour.
Of course, we are following that very naturally, that's the reason why I made the comment earlier that unlike other companies, for us, it doesn't change anything because it just affects the billings. It doesn't affect the revenues fundamentally that much. We're in a very good position to do that business model change as well.
Right. As Philippe said, that's why billings would become even less relevant for us and why we still were able to outperform on revenues despite the lower billings growth rate, because we're focused on managing revenues.
Okay. When providers move more towards a consumption-based model, does that change the size of the deal opportunities of those providers?
It will, because it's all about commoditization of the entire IT sector, if you prefer. Yes, it will affect. However, you're discussing here, again, significantly less cost. In fact, you just have to be a little bit more. We are building today an additional sales force as we speak, which essentially will not be customer-based. The analogy that I give here is when you look today, when you go and buy, and you go to an Apple store, you don't have a salesperson there, somebody's commission. You have a technical person, which will inform you, and that's, I think, the way our entire industry is going. Everything being what we call transparent orchestration. We have demonstrated that with Microsoft, where you click, click. You don't have to install anything. It's all already there. Then essentially, what do you need in terms of a sales force?
You need somebody to essentially onboard the customer, answer a technical question, and that's a sales force which is significantly less expensive. Then, by the way, this new platform, they do the invoicing. Everything is already pre-fulfilled, if you prefer. You have significant velocity acceleration. While the price will go down, you have absolutely significantly more volume that you generate. That's the way that technology has always gone. Remember the old good days of the PCs, which really make Microsoft extremely profitable and for a long time because, of course, the PCs had more volume at a lower price, but yet very profitable.
Very good. Thank you.
Thank you. Our next question or comment comes from the line of Howard Smith from First Analysis. Your line is open.
Yes. Thank you. Congratulations on continued solid results.
Thank you.
First question has to do with kind of the CloudView, CertView Community Edition. The numbers you put out, it's clearly having the impact of getting people's attention and getting them to sign up. Can you maybe qualitatively talk about the early signs of people actually becoming part of the ecosystem with other products through that lead gen effort?
We know it's a very good success everywhere. We're not publishing today much numbers about that. This is, of course, relatively new for us. What I can tell you is that we have been extremely surprised by the number of activations. Now it's also our challenge, and that's what we're building, that sales force has alluded to. Essentially onboard them, making sure that they use the service. At the appropriate time, because all these additional services are in the platform, you now start to upsell them. In that order, we are not here to entrap the customers and trying to immediately send them hordes of salespeople to upsell. We want them to be satisfied. They do what they need to do. Of course, at their own rhythm, they can adopt all the new services which are already in the platform.
We're putting a big effort today to essentially manage all of that and essentially building the new sales force I just talked about. In that case, of course, we believe we even will have additional, in fact, accelerated adoption. We're very happy. Again, the cost of delivering these three services is absolutely nothing. It's few engineers which have built a product. Of course, we can disseminate that across the globe. That's a very effective model.
Just following up on that effective and leverage on the sales and marketing. You talked about hiring some R&D folks and the impact of the software amortization. On sales and marketing, are you on pace with your staffing levels kind of to budget at this point in the year?
Yes. We are very well in Europe, I think very happy with the European operation in sort of both the post-sales and the pre-sales. In the U.S., we are very good on the post-sales. We are looking at expanding our new business, if you prefer, teams. In fact, I'm in the process of hiring an EVP for the Americas, to essentially start selling, and that's the purpose of that, expanding our new business, selling to the CIO. With, again, with that global IT asset inventory that now you can look for yourself. It takes you to a 13-minute video. You're going to be floored when you look at what we have done here. This is all real. This is not mock-ups. This is absolutely production-grade, the solution.
Now we can go and speak with the CIO. Essentially, this is going to be the mission of our new sales force, of our new business sales force, and we're expanding it mainly in the U.S., because of course, the marketplace is bigger. In Europe, we're already essentially done. We did also another change in our post-sales, if you prefer, model, which also our customers are very happy. Now that we have very large customers, we have now created a kind of a slight change in our technical account managers, as we call them. We have created a new category, what we call major account solution architects, which now handle a few very large accounts. These are accounts which are becoming multi-million dollar accounts. We see also we're becoming very strategic for them.
We see also the demand from these large accounts to say, "We would like to take all of your application, let's do a three, five-year contract, and we'd like for a fixed price to be able to deploy essentially all of your solutions." Our answer to that demand has been, "Let's do the global IT asset inventory, because when we do the global IT asset inventory, you will know exactly what you have, and then we can talk about deployment, about this, and come up with a good business decision about, okay, you don't want to buy one product at a time. You are standardized on our platform, let's get a bigger deal.
That's great color. Just real quick from Melissa, is there any FX impact that you would call out that's materially affecting growth rates sequentially or year-over-year?
No, nothing material.
Okay, thanks.
No. We're also starting to look at hedging as well, because again, our model is the ideal model to age. This is something we have not been doing in the past, but now today, Melissa is really looking seriously at that, which will never eliminate completely, but at least would soften. That's something which we're going to be able to do very soon.
Great. Thank you.
Thank you. Our next question or comment comes from the line of Melissa Franchi from Morgan Stanley. Your line is open.
Okay, thanks for taking my question. I wanted to follow up on the commentary on the billing slowdown. I appreciate that it's becoming maybe less relevant as you're going to more pay-as-you-go. If we think about the impact from the deal slippage and then the move to pay-as-you-go, can you maybe parse out the magnitude of those two headwinds in the given quarter? If we look at 20% current billings growth in Q2 versus 13% this quarter, to what degree were those impacts driving that slowdown?
No, in fact, when we say that we do not manage the billings, essentially, we don't fall on the trap of enterprise software, which is at the end of the quarter, let's get the deal within the quarter and against concessions, pricing concession. We have always refused to do that. What happens then is that we could have sometimes some of these orders, instead of coming at the end of the quarter, okay, they come a little bit later because the procurement people are busy trying to take their pound of flesh on these enterprise software vendors. Of course, we don't have the priority. You're speaking only of a few days or maybe a few weeks, but not much. It doesn't have a significant impact on the revenue side.
Of course, we may lose a few days here and there, but it's not that significant in the grand scheme of things. That has been our strategy since day one, and we've been absolutely firm and solid. We do not incentivize our sales force to precisely do that. When, of course, other company do exactly the opposite, that's not the way we do it. In term of now the impact on the monthly billing, this is something which is new. Today is not really material at all. We see it coming. The good news is that we believe, again, because we become a consolidator of the enterprise, we see our traditional enterprise business becoming stronger and stronger and stronger in the next, if you prefer, few years as we are now migrating into that new model.
I don't think overall, we're going to see much significant impact again on the revenues, and we'll start to see the billings being, again, not on a quarterly basis, if you prefer, not meaningful as much as, of course, as they could be with other models. Does that make sense?
Yeah, that's fair enough. Just one follow-up question on the channel contribution. The channel stays relatively stable at about 40% of the business. I'm just wondering if it's a priority to move this higher, or are you comfortable with your channel relationships and the contribution that you have today?
That's a very good question. No, we love, in fact, we're becoming significantly the relationship with the channel. They love us. In the past, the channel, they didn't like us because they say, "Oh, you're just essentially competing against us because, of course, there's less professional services, less installation." Today is exactly the opposite. We have a very good relationship with them. The reason why our channel business in dollars is not growing as significantly is because of the huge upsells that we do with our direct business, and that compensates. If we look now in term of the new business coming into Qualys, we could say that we could see that more of the new business is now coming from the channels. Overall, when you look at the dollars, it's not that significant. At some point in time, we establish more and more relationship.
We have developed very strong relationship with IBM and others. We could see them starting to sell. Wonderful relationship with Secureworks, all the PwC, et cetera, the Accentures, all the Indian outsourcers who have absolutely fantastic channels. Again, we're very differentiated because we don't do professional services, zero. We don't compete against our channel, and it depends on the customers, if they want to really come direct to Qualys or they prefer to go through a partner. This is their decision. It's not ours. Historically speaking, I've been there before. I've realized that typically you've got about 25% of the enterprise market who absolutely wants to have the direct relationship. You could say ultimately the model will go to a 25% direct and 75% channel. Again, we let that happen. We don't push one solution versus the other one.
We just let live live, as I used to say.
Okay, sounds good. Thank you very much.
Thank you. Again, ladies and gentlemen, if you have a question or comment at this time, please press star then one on your telephone keypad. Our next question or comment comes from the line of Jonathan Ruykhaver from RW Baird. Your line is open.
Good afternoon, Philippe and Melissa. Philippe, over the last year, you've expressed confidence around the opportunity with the endpoint agent, yet it does sound like that adoption continues to be sluggish. Can you just talk about some of the issues you're seeing around that opportunity and why adoption hasn't been stronger?
First of all, I would not say sluggish at all.
Yeah.
We have some fantastic deployments, 250,000 agents, 200,000 agents at the endpoint. This being said, what makes that penetration essentially not as fast as I would like to, but we're also very confident that it will accelerate, is the fact that today, if you look at the poor companies, they have nine agents on their endpoints. It's absolutely crazy. You have, of course, IT are not very inclined of putting another agent. That's what we believe that the global IT asset inventory is going to be absolutely a game changer because that's who is the beneficiary of that, IT being the first one. Security, of course, is a very beneficiary of that because again, you cannot secure what you don't know. That's the big secret in our industry.
We're putting a lot of things to try to protect, but if you don't know what you protect, you don't have a very good effective defenses. I think that will really help us continuing that penetration. I will not say sluggish. I would say it's the penetration. Again, we don't really push. We let things happen. We're very happy with our progression onto the endpoint. I think what is going to be another game changer essentially is our mobile agent. Why? We see a lot of our customers, you look at all the banks, they all have these kind of tablets, et cetera, where they really, really need an agent. That also will make our agent technology, if you prefer, becoming more pervasive. That's essentially our strategy.
I've done in my life the five times ubiquity. That's what I believe today we are at the point that now today with that new class of agent, combined with the passive scanning, that global IT asset inventory, that now we have what we need to really reach ubiquity. That's really what I'm really pushing absolutely now. Again, I've done that four or five times. I don't even count anymore in my life.
I appreciate that color, Philippe. Impressive the uptick in terms of new product contribution to bookings. Can you talk about specific products driving that higher? Especially maybe some notable success if you're seeing it with products that may have been released more recently.
The number 1 still driver is the Agent. That's the big one. However, this being said, we start to see the file integrity monitoring picking up. ThreatPROTECT, it's a very natural addition as well. These are the one that we see. I'm absolutely convinced that we're going to see a significant adoption. We have already quite a big adoption of synchronization with ServiceNow, and it's coming as well, of course, with the ITAM inventory, with the inventory behind, this is going to really make a lot of sense. That, I believe, is going to be hot. Container security is absolutely crazy. The containers are changing the world, and I think we're uniquely positioned today. Already our container security solution is moving. I think with the addition of Layered Insight, we have another game changer here in container security.
This is going to be very hot. Our web application scanning is doing well. Still, we are not having much traction with our web application firewall, which we should have now containerized because one of the issue is the deployment of it. That's what limits, that's the resistance of the deployment. It's the fact that you've got to install it behind the load balancers. It's a bit complicated. I think once we containerize it, and that should come pretty soon, I think we'll have now the really good solution for web application security.
Great. Thank you very much.
Thank you. Our next question or comment comes from the line of Patrick Colville from Arete Research. Your line is open.
Hey there. Thanks for taking my question. Can you just give me a bit more color on this 5 million agents, which were purchased by a service provider? Just, yeah, any context you could provide would be very useful.
It's difficult to give you any context here. This is a major cloud provider and cloud platform, I should say. This is a PaaS, not a cloud provider. It's a PaaS. It's a platform as a service. They are deploying more of Qualys, and we expect they are going to deploy even more, and the other ones as well. As you know, they are not typically inclined to tell the world what they do. We cannot, unfortunately, speak too much about.
Yeah. We obviously see it as a testament, their investment with us and using our Cloud Agent as significant, which is why we wanted to call it out.
Yeah. Understood. Can I just ask about the competition, just how you see trends with Tenable and Rapid7? Yes, please.
Yeah. Those are basically Tenable, as you can see, they have very good growth. It's like we're in different universe fundamentally. We are now starting to go into their universe with our Community Edition, with the new packaging that we did for Consulting and starting to essentially compete against them there and in federal as well. It's almost like we were in different universe, not really competing against each other. Now we are looking at moving into their space. As far as Rapid7 is concerned, it's like they have moved away in a way. We always have competed with them in the mid-range. They have essentially today, they are more into the Splunk turf, trying to essentially provide more of the analytics and kind of a platform. We still see them in the mid-market, and we compete very effectively against them.
They have also a kind of a managed security service with them. They don't compete against us but against our partners. They are there. I think we believe that as we continue delivering, especially that Qualys IT Asset Management is a game changer, and at the user conference, and I hope you could come, we're going also to unveil another major initiative that we're undergoing that will speak essentially more to our customers than trying to make it that public, but essentially embark our customers, which is always what Qualys has done, into a new adventure. Now today, our big adventure is we took 10 years to get there with the Qualys IT Asset Management. We're now moving into another big adventure, continuing pushing the boundaries of our platform.
Got it. Thank you so much.
Thank you.
Thank you. I'm showing no additional audio questions in the queue at this time. I would like to turn the conference back over to management for any closing remarks.
Okay. Thank you very much, and thank you to you all for these very good questions. I would like again to encourage you to really listen to that video, which takes, I think it's about 13 minutes. You don't have to listen to the entire 13 minutes to get a gist of it. I think you will get that pretty quickly. Also, I really would like to invite you again to our user conference and Investor Day, where you can speak with our customers. You're going to see a lot of the thing and really will give you the sense that really we have built a true platform, and that platform is really shaping up extremely well. You could see that again for yourself. I hope to see you there. Again, thank you very much for your time and for your questions.
Ladies and gentlemen, thank you for participating in today's conference. This concludes the program. You may now disconnect. Everyone, have a wonderful day.