Good day, everyone. Welcome to Qualys' second quarter 2018 earnings conference call. This call is being recorded. At this time, all participants are in a listen-only mode. Later, we will conduct a question and answer session, and instructions for asking a question will be given at that time. I would now like to turn the call over to Melissa Fisher, Chief Financial Officer. Please go ahead, ma'am.
Good afternoon. Welcome to Qualys' second quarter 2018 earnings call. Joining me today to discuss our results is Philippe Courtot, our Chairman and CEO. Before we get started, I would like to remind you that our remarks today will include forward-looking statements that generally relate to future events or our future financial or operating performance. Actual results may differ materially from these statements. Factors that could cause results to differ materially are set forth in today's press release and in our filings with the SEC, including our latest Form 10-Q and 10-K. Any forward-looking statements that we make on this call are based on assumptions as of today, and we undertake no obligation to update these statements as a result of new information or future events. During this call, we will present both GAAP and non-GAAP financial measures.
A reconciliation of GAAP to non-GAAP measures is included in today's earnings press release. As a reminder, the press release, prepared remarks, and accompanying investor presentation with supplemental information are available on our website. With that, I'd like to turn the call over to Philippe.
Thank you, Melissa, and welcome everyone to our Q2 earnings call. Melissa and I are pleased to report a very good quarter that included both strong revenues and leading profitability. Melissa will go through those details in a moment. These results reflect our position as the leading cloud-based security compliance platform for securing the digital transformation and helping to build a safer world, one app at a time. We believe we are now uniquely positioned to enable customers to consolidate their security and compliance stack, drastically reduce their spend. In addition, our tool platform approach allows them to have a single pane of glass view across on-premise assets, endpoints, clouds, and early next year, mobile environments. As we continue delivering additional best-of-breed detection and response capabilities to our Qualys Cloud Platform, we believe that the savings our customers enjoy will compound.
Furthermore, we are now well on our way to providing CIOs a continuous and updated view of their global IT assets, and I will speak of that a bit later with two-way synchronization with our CMDBs. Such capabilities is in fact the cornerstone of security as there is no security without visibility. In Q2, we continued to innovate and deliver on our product roadmap. We released our container security app into GA. This new cloud app enables customers to build continuous security into their global container deployments and develop processes at any scale, and integrate the results into one unified view of their global hybrid IT security and compliance posture, breaking down silos and lowering ownership cost. We announced a new groundbreaking app for global IT asset inventory and CMDB synchronization I just spoke about.
The asset inventory cloud app uniquely provides a single source of truth for all IT assets within hybrid environments, including on-premise assets, endpoints, cloud, early next year, as mentioned earlier, mobile environments. We believe this solution is significant because it solves one of the most vexing issues for IT and is critical for security as you cannot secure what you do not know. This new service is now in beta, and we expect it will go GA before year-end. We added new out-of-the-box security assessment questionnaires capabilities to streamline GDPR compliance. We bought a minority stake in 42Crunch as our first venture investment and signed a distribution agreement with them. 42Crunch has developed an API security platform enabling organizations to quickly deliver applications built on secure APIs. Similar to Qualys, the solution enables customers to build security in.
We also held our first Qualys Security Conference customer event, as well as an online analyst and investor day event, which were great successes. We showcased how the Qualys Cloud Platform is uniquely able to collect and analyze data from millions of different sensors, enabling the five key tenets of security today: visibility, accuracy, scale, immediacy, and what we call transparent orchestration. We also provided in-depth technical sessions covering our latest solution, including container security, which is now in the GA, digital certificates management, and IT asset inventory and CMDB synchronization. We see strong demand for our solution from the federal market as we increased our go-to-market capabilities this quarter in the federal vertical as follows.
We announced an expanded partnership with Carahsoft to market, sell, and distribute the FedRAMP-authorized Qualys Gov platform to federal agencies as well as states and local governments. We appointed Anna Wheeler, formerly at Akamai, as VP of Public Sector Solutions. We're looking forward to our federal CIO/CISO interchange in the fall, as we believe we are uniquely positioned to meet the ever-growing security and compliance requirements of the federal government. With our expanded internal team, we have mutually agreed with Second Front Systems to maintain our business partnership rather than pursue an acquisition at this time. Additionally, we continue to leverage the Qualys Cloud Platform to broaden market awareness and generate demand as we have done successfully with the launch of CertView and CloudView.
We have seen great response to the release of CloudView and CertView, a successful lead generation effort which serves to distribute our Qualys Cloud Platform to more users from which we can sell many additional solutions. We have had over 6,500 activations, out of which over 700 are active users already. Additionally, our Qualys Community Edition, a free version of our cloud platform to provide organization, including SMBs, consultants, and MSPs with a unified view of IT security and compliance, was released for general availability today. We are excited about our roadmap and we continue to find innovative companies which we can acquire to accelerate our time to market.
In summary, we're enthused about our leadership position as our platform, which uniquely, again, provides full visibility across on-premise assets, endpoints, cloud, and soon mobile environments, enables company to consolidate their stack, considerably reduce their spend, and build security into their digital transformation initiatives. Before I turn the call over to Melissa to discuss our financial results, I would like to welcome Jason Ream to our board of directors. Jason is the CFO of Miratech Holdings. Prior to that position, he was the CFO of Relativity, and prior to that, the CFO of SolarWinds. As we continue to grow our SME/SMB business, we expect to leverage his experience at SolarWinds, which built a leadership position in the IT management software market by using a cost-efficient go-to-market model, leveraging powerful, easy-to-use products similar to those that Qualys provides in the security software market.
I would also like to thank both Don Dixon and Amer Deeba, who are departing Qualys after 17 years of services. Don joined the Qualys board as the lead independent director in 2001 because he shared our vision of a cloud-based platform for security. Around the same time, Amer joined Qualys and leveraged our platform strength to build the Qualys brand, most recently serving as Chief Commercial Officer.
Thanks, Philippe, and good afternoon. Before I start, I'd like to note that except for revenue, all financial figures are non-GAAP unless stated otherwise. As Philippe mentioned, we continue to see strong demand for our expanding set of applications, reflected in the following financial and operational highlights. Revenues for the second quarter of 2018 were $68.2 million, which represents 23% growth over the same quarter last year. The percentage of enterprise customers with three or more Qualys solutions rose to 37% this quarter, up from 28% a year ago. The percentage of enterprise customers with four or more Qualys solutions rose to 19% this quarter, up from 11% a year ago. Average sale size continued to increase in Q2, growing 16% year-over-year. 8.1 million Cloud Agents were purchased over the last 12 months. We saw good growth from both Cloud Agent and Threat Protection bookings.
New products released since 2015 contributed approximately 15% of total bookings in the quarter, up from 9% in Q2 2017. We have a strong current deferred revenue balance of $151.4 million as of June 30th, 2018, 21% greater than our balance as of June 30th, 2017. Our scalable model continues to drive industry-leading margins and significant cash flow, as reflected in our adjusted EBITDA for the second quarter of 2018 of $26.7 million, representing a 39% margin as compared to 37% for the same quarter last year. For comparability purposes, Q2 adjusted EBITDA margin would still be 39% adjusted for the impact of ASC 606, specifically the amortization of commissions. Operating cash flow for the second quarter of 2018 increased by 47% year-over-year to $24.2 million, and we now have over 1,000 employees, with over 500 of them based in India.
This quarter, we accelerated our investments in enhancing shareholder value by spending $7.3 million in capital expenditures, including principal payments under capital lease obligations, $5.9 million in aggregate on 1Mobility and 42Crunch, and $17.9 million on the repurchase of 235,539 shares. We have $80.6 million remaining in our share repurchase authorization. Driven by our great results, our momentum in the marketplace, and our scalable operational model, we are raising fiscal year 2018 revenue guidance to a range of $278 million-$279.2 million. We are also raising fiscal year 2018 non-GAAP EPS guidance to a range of $1.46-$1.50, and we expect capital expenditures in the second half of 2018 to be front-loaded.
For the third quarter, we expect capital expenditures to be in the range of $9.5 million-$10.5 million, and for the full year, we expect to be around the high end of our prior guidance of $28 million. We were delighted to share with you our vision, strategy, product roadmap, and financial outlook at our online analyst and investor event in June, and we're looking forward to hosting you at our user conference, November 14th and 15th. In conclusion, we believe that with the continuous platform enhancement, its increased adoption, and our scalable operational model, we can continue to grow our revenues and boost top-tier margins. With that, Philippe and I would be happy to answer any of your questions.
Thank you. Ladies and gentlemen, at this time, if you do have a question, please press the star and the number 1 key on your touchtone telephone. If your question has been answered or you wish to remove yourself from the queue, please press the pound key. Our first question comes from the line of Howard Smith of First Analysis. Your line is open.
Yes. Thank you. Congratulations on the quarter. Philippe, I want to clarify something in your prepared remarks where you talk about the 6,500 activations and 700 are active users already. Can you just explain activations versus active users and how it progresses? I may have a follow-up.
As you know, with all these kinds of new services when you bring them to market, you have a lot of people who join, some people forgot. Of course, we are putting all the methodology behind to try to remind people that activating is not enough. They need to use it. It takes some time. Today, through this 6,500, we have effectively connected with 700 of those customers, which are becoming heavy users and also starting to discuss with them about upsells. They are really qualified, if you prefer, leads at this time. If you look at the traditional metrics, this is already a pretty good success.
I'm sure as we continue connecting with the other ones which have not really used it for various reasons to try to get additional of these customers becoming more active, and as a result of that, enjoying the benefits of our very unique cloud platform.
Okay. It sounds like it's meeting your expectations as lead gen. Is that both for new customers that you can then sell the other products as well as upselling the existing customers to the full paid version, et cetera? Is it working both ways as expected?
Exactly. It's both. Absolutely. For our existing customers, it's a godsend because it validates for them, as you can see, the fact that they already have deployed the Qualys platform. There is more goodies coming to them. Then, of course, we can discuss with them about upselling these complementary services that go with them.
Great. Well, I thank you, and congratulations again.
Thank you very much.
Thank you. Our next question comes from the line of Alex Henderson of Needham. Your line is open.
Hi. Good afternoon. This is Dan Park on for Alex. Thanks for taking my question. I know during the analyst day, you highlighted you only had about 1% penetration into the federal market. With the successful launch of the Gov Platform and the recently announced expanded partnership with Carahsoft, how big do you think this opportunity could be?
This opportunity is significant. If you look today, roughly, we are only at 1%. Your typical security company typically has about 20% of their business in federal. Some go to up to 40%, which I think is a little bit too much because then you depend on very unique customers. I think today we are really shooting to go ahead and get 20% of our revenue. Now, the question is time. We have also established, so of course, now with Carahsoft in particular, which has formidable distribution channel capabilities in government, we are now also bidding big contracts. We have expanded our team. We will continue expanding our team. We have today very unique and very happy customers who have one of these agencies that you could not really name, which is now a fully disconnected version of our cloud platform.
We have another very big integrator, which has another private cloud platform as well. As you know, we are FedRAMP authorized, which is people have, and we are now also gunning to do FedRAMP High. The other thing which we are doing in federal, which is going to be also very significant, is that our cloud platform now is ready to be fully hosted in amazon.gov and all these other cloud providers for the government as well. That obviously will give us many opportunities to bid on contracts. Clearly federal is moving to cloud solution, of course, they are not your traditional cloud solution, need, of course, to follow their specific certification, but I think we are well on our way of being capable of doing that. FedRAMP High is going to be something quite significant for us as well in the near future.
Okay, perfect. Thank you very much.
Thank you. Our next question comes from the line of Robert Breza of Northland Capital. Your line is open.
Hi. Thanks for taking my question. Congratulations on the quarter. Melissa, maybe as you've spoken, or maybe you or Philippe spoke in the prepared remarks about the portion of people that are in India. Can you talk to us about how you see the margins trending maybe over the medium to longer term, and with that leverage base you have there and how you're capitalizing on it? Thanks.
Maybe before Melissa gives you some more specific details, let me remind what the team in India is. We did something very unique many years ago when we decided to re-architect our platform so we could essentially integrate more and more and develop our self best-of-breed solution. We made the big investment in India. Under our Chief Product Officer, Sumedh, we have put ops, DevOps, customer support, engineering, QA, customer support, and product management. We literally cloned that structure in India, where we have today 500 people, and that's essentially what we do. We have attracted significant talent. There's a huge pool of talent. In fact, we have plans to continuing significantly increasing our headcounts in India so we can continue developing and supporting products as we are developing more and more applications.
Of course, Melissa could speak about the economics, but the first priority was to find talent. The number 1 challenge today that every company has is to attract talent. Today, we have really found a formula. We're very happy with that. We have a fantastic team. Also, the second thing that India does for us, we have acquired successfully two companies, which were Nevis Networks that you see today, which is essentially the technology which is behind our global IT asset inventory, our quarantine. The integration, as you can see, is almost now done since we have went into GA. We're moving into beta, we're moving into GA now very soon. The other one is 1Mobility, where we expect to go beta in the early part of next year.
We're also now looking at these other companies, like the small companies, 20, 25 people who have significant technology that they have built are coming to us because they see a very good home where their technology can thrive. Currently are in discussions with two of them. It's premature to make any announcement at this stage, but we are still very active, and the economics are quite significant because instead of paying hundreds of millions for similar technology that if we would have to do that in the U.S., we are down to a few millions. With that, Melissa can give you a bit more colors on the statistics that you were asking for.
Rob, thanks. I'm going to answer it first in the near term and then answer the longer-term question. We had a great first half in terms of both revenues and profitability, and we're proud of our industry-leading margins. We do plan to continue to invest, though, given the growth opportunities we have ahead of us. Since our second half revenue comps are tougher, we do expect second half operating margins to be down from the first half, resulting in flat margins for the year. Over the longer term, what we presented at our Analyst and Investor Day was our 2021 outlook for low 20s to mid-20s revenue growth and an expectation of EBITDA margins between 40%-42%, and free capital margins between 35%-40%.
As Philippe mentioned, not only are we getting significant leverage from India from a cost perspective, it's a talent perspective which allows us to accelerate our ability to go to market with new solutions.
Great. Congratulations.
Great. Thank you.
Thank you very much.
Thank you. Our next question comes from the line of Melissa Franchi of Morgan Stanley. Your line is open.
Okay. Thanks for taking my question. Philippe, I'm wondering if you could just talk about what you're seeing in terms of pricing on the core VM product. If you could maybe just talk a little bit about what you see in terms of contract values when a customer adopts a Cloud Agent versus maybe just like a traditional VM customer.
I don't know if we have made this kind of calculation specifically, but Melissa can give you a little bit more color after specifically. As far as the price on the core VM, we don't see much really pressure. It's more sometimes the competition in order to try to displace us or try to win a deal, they are going, of course, to drop the price. As you know, our competition is not really profitable. The fact that we are now, as you have seen in the numbers that Melissa told, that we have more and more of our customers which are adopting three and four more solutions, it makes us significantly more sticky. In addition, these free services that we are also delivering, it make them also very sticky. Of course, I think from a price standpoint, we are protected.
We saw Rapid7 many quite a few years ago being very aggressive against us, they were not successful. I think we believe we can maintain our price fundamentally. We are very cost-effective because we eliminate significant costs. It's easy to deploy Qualys. You don't have all that overhead that other solutions have. I think we feel very solid regarding our pricing.
I'll add a few data points, Melissa, to help you think about it. In general, the Cloud Agent, if you were paying, let's say, $1 per VM, you would pay $1.20 for the Cloud Agent VM. Remember, as we've discussed with the way our customers buy, they often, when they're expanding into a new solution, they will start small and expand over time. As we've talked about anecdotally, our customers have not fully deployed Cloud Agent where they have deployed vulnerability management. The exception being, we talked about this last quarter, we're starting to see customers want to deploy on the endpoint. For that, they need the Cloud Agent, they would go straight to a large Cloud Agent VM deployment in that case.
I could add one more thing on that subject. I mentioned that the last earnings call that we have one large company who deployed 250,000 endpoints, agent for their endpoints, essentially to do VM and policy compliance. That company is now already looking very seriously at the IOCs. That's another, of course, remember our agent enables a multiple stream of additional services. I'm really happy to let you know that we have another similar, in fact, the company now deploying another about 200,000 agents again. Again, looking at VM first and policy compliance, and now starting to evaluate our IOC solutions. That we see again, it's maybe a slow progression, but it's a pretty solid, sustainable, and we see now our agent going to the endpoint.
Of course, it goes into the cloud, the fantastic integration we have done with Microsoft and now with Google and with all of the cloud providers, our agent are the right architecture for the cloud. There's no question about that as well.
Great. Well, thank you for the color.
Thank you.
Sure.
Thank you. Our next question comes from the line of Erik Suppiger of JMP. Your line is open.
Thanks for taking the question. I got a few here. One, I think you had said the new services were about 15% of revenue. It's been at that level for a little bit. Do you think that contribution from the new services could start to pick up or what are your expectations as you look out over the next year? Secondly, did you give the number of Cloud Agents that activated in the quarter? Then I have a follow-up for Melissa, but I'll take those two first.
Thanks, Erik. In reality, our newer solutions are doing very well. In fact, our bookings for that group grew over 100% year-over-year. The way to think about it is, as I mentioned previously on the discussion with Melissa, is that our customers tend to start small and expand over time, which is a source of profitable growth for us. You see that in the penetration metrics. Cloud Agent penetration went to 14% of our customer base this quarter from 12% last quarter. In the multi-product adoption metrics that I covered, such as enterprise customers with three or more solutions going to 37% this quarter from 34% last quarter. As Philippe mentioned, this makes us even more sticky with our customers.
It sounds like that will start to move up as we look forward, as those penetration rates continue to improve.
Yes, of course it will. Let me make another point, Erik, is that the fact that our base is increasing. Even though you see the 15%, it's a 15% on an increasing base. Already there, you have a kind of a very nice pickup. Of course, as the customers deploy more, of course you will see some acceleration. Again, everything in Qualys you have to realize, we don't push our customers to do deals which are going to end up into, like in many other, end up into shelfware. You pay for what you use, our customers have the tendency to start smaller and then deploy over time. Not all of them, but the immense majority of them.
We're very happy because they like the service, and then it becomes very cost-effective because as you know, it's much easier to sell additional services to existing customers and much more cost-effective than to try to, of course, get additional customers.
Unlike other companies, we don't incent our sales force by product, so we let it come naturally, as Philippe was describing, so that our customers, we have natural high renewal rates as a result, as opposed to just shoving shelfware.
Absolutely. This is the core for our profitability is on one hand the platform, which allows us to develop quite efficiently services that you can mention, that we did essentially what Evident.io has with six engineers in India. Then once they are on the platform, the distribution is instant and very cost-effective. Then of course on the sales side and the support side, it's significantly more easier to support and to a solution that where everything is centrally managed and self-updating, and that where customer can try and then buy. It's a very efficient model that we have built over time very, very consciously. That's why we have this margin that nobody can believe that we have, essentially.
Okay.
On the Cloud Agent question, we provided that we sold 8.1 million over the last 12 months. That's the base from which we can upsell a number of our other solutions that rely on the Cloud Agent from a technology perspective. That's the subscription base that we sell.
Then, in your guidance, based on our calculations, it looks like OpEx goes up notably in the fourth quarter, margin comes down a little bit. Is there any reason why your December quarter OpEx would bump up? Is that something that would remain at those levels, or is there anything that would change after that?
Yeah. As I said earlier, we do expect second half operating margins to be down from the first half as we continue to invest in the business. It's a number of areas. It's more senior level hires in sales and marketing we're planning on adding. We're doing implementation of systems in G&A such as, we're putting in Workday this year as well as an FP&A tool. We also have in Q4 our user conference, which is a significant amount spent that's also in sales and marketing. There is a bit of seasonality to some of the spend in sales and marketing, for example, but it's also continued hires in R&D to get products into beta and from beta into GA.
Very good. Thank you very much.
You're welcome.
Thank you. Our next question comes from the line of Rob Owens of KeyBanc Capital Markets. Your line is open.
Thanks, good afternoon, guys.
Good afternoon.
As you talked about your longer-term model and acceleration in revenue, if I look at the first half of this year, your billings, whether we look at kind of the total billings or even the quarterly billings, has grown at a slower rate than revenue. A couple questions. Melissa, what's the 606 in there? Because I'm sure that held down that recognized or realized Q1 billings. Then number 2, does that come through acceleration to achieve that higher growth rate, or is there something that's more in period, like from MSSP or something that would help you get there? Thanks.
Yeah. On ASC 606, there's actually no impact to our top line. It's really just the amortization of commissions. I think with regards to the billings questions, look, we were delighted that our current billings exceeded consensus. Our current billings are $71.9 million this quarter. As we've consistently said, that billings growth is not a proxy for annualized bookings growth on a quarterly basis, because it's impacted by factors such as the timing of invoicing, the duration of the current deferred revenue, and effects. We've consistently said that we believe the trajectory of our annual revenue guidance is the best proxy for business momentum, because certainly current bookings inform that guidance.
Yeah. In addition, the total billings are absolutely not representing the total of our business because we do not incentivize. We do three-year deals, and we've got quite a few of those, but it's three-year deal with annual payment. Of course, we do some three-year deal with everything paid upfront. You do not encourage our sales force, first of all, we don't commission them to bring these deals. It's more the customers coming to us. This is very irregular. Why would we go and try to give additional discounts when we have so much cash at the end of the day? That's not a good business decision. That's why the total deferred revenues of the billings are not really representative of the total of our business. And maybe, Melissa, you want to add something on that?
Yeah. Well, two things. As Philippe was saying, total billings distorts your ability to compare companies based on an annualized bookings or annualized recurring revenue metric, since it's based on total deferred revenue, which includes your non-current portion, which is based on prepaid multi-year deals. Since often prepaid deals come with a discount to the cash, we have no need to do that.
I think with regards to the other part of your question, Rob, we do expect to see our ability to increase our revenue growth, the outlook we had given for 2021 at the analysts and investor day of mid to low to mid 20%, is based on our ability to continue to sell more into our existing customers, which we can more easily do as we have additional solutions come out, but also to bring on new customers as, again, we have many different solutions to attract them to our platform with.
Great. Then you mentioned how you have high renewal rates. What are those renewal rates at this point? I guess both from a gross and a net basis, and with the addition of all these new products, what are you seeing with that trend line of net renewal rates? Thanks.
Yeah. We provided, at our analysts and investors event, our updated dollar net expansion rates, that's what we focus on. It's been increasing nicely over the years. It was 109% in the last quarter over the LTM period, from about 106% the year before.
Yeah. Another point you may want is that we have today a business that we have segmented very well in the sense that we have the enterprise, the SME, and the SMB. Associated with these markets, we have also, if you prefer, done a product segmentation where we have Qualys Enterprise, Qualys Express, and Qualys Express Lite. Of course, the renewal rates in the SME, SMB, especially on the SMB, are certainly not as high, obviously, than in the enterprise. When you look at that number, this is an aggregate number, which means you could see our enterprise business is even healthier than that. We do not disclose, essentially, the mix at this stage.
At some point in time, I think we are now gearing up now that we have all these new services and these free go-to-market services, we are really going to focus on the, essentially, as well on the SME, SMB to try to accelerate our growth there because we see a unique opportunity.
Sounds good. Thanks for your answers.
Sure.
Thank you. Our next question comes from the line of Sterling Auty of J.P. Morgan. Your line is open.
Yeah, thanks. Hi, guys.
Hi.
On the Fed initiatives that you have going through partners, et cetera, is there incremental infrastructure spend that's going to be necessary to support, especially when we think about the DoD side of the government?
Not per se on the subscription, et cetera. What we typically have is that you need, essentially, of course, to do FedRAMP High, for example. It's a big effort, so you have initial cost. When you look in overall perspective, of course, when we provide, for example, a disconnected platform, we charge more for that platform than we charge for a platform where Qualys automatically, remotely manage everything. All in all, the answer to your question is not significant. Also, we leverage a lot of integrators as well. As you know, we don't have professional services. We don't do professional services. Everything that we do is subscription-based 100%. We don't have these additional cost, of course, to carry.
Got it. Then Melissa, I missed it if you said it in the prepared remarks, but what was the FX impact on the top line and on expenses in the quarter?
Yeah. It was a positive impact of about 100 basis points to our growth rate. It was less than a penny to EPS, a couple hundred thousand USD bottom line.
Got it. Thank you.
Thank you. Our next question comes from the line of Anne Meisner of Susquehanna Financial. Your line is open. Your line is open. You might be on mute.
Sorry, can you hear me now?
Yes.
Yeah, we can.
Oh, great. Hi. Thanks for taking the question. The question is for Philippe. I was hoping to get an update on the Patch Management solution, which I believe is targeted for the second half. As you prepare to launch that capability, how are you looking at the go-to-market strategy there with respect to the buyer and the organization that you're targeting? Are you going to be targeting the same security team that focuses on vulnerability management, basically for the set of patches they're allowed to push out themselves, or do you think that would be a product that's used by kind of the broader IT organization?
I think we need to distinguish here the SMB versus the enterprise. What we believe with the patch management, which effectively is going to go to market at the end of this year. As you may remember, we delayed it because we put priority on the passive scanning, et cetera, so we realigned a bit our engineering resources. We always have seen the patch management as a kind of a no-brainer for the SME, SMB, because for them, everything becomes integrated. The networks are small. We have always seen a great interest in that market. On the enterprise, it's a little bit more complicated because they all have their own patch management solutions. The problem that the enterprise has today is immediacy of patching. We're looking at our solution today, not necessarily as a replacement of their existing infrastructure, but being there for immediacy.
If you look, for example, at vulnerabilities like WannaCry, you suddenly had to patch across multiple environments, Unix and this and Microsoft. Today, the current patching solution on the enterprise are pretty tedious. We think that we're going to enter through that use case in the enterprise, through that immediacy, when you've got to patch quickly. Of course, we will integrate also with some of these services. We see the immediate take essentially on the SMB, because that's a no-brainer for them. It's all integrated. You push a button, and you're done. The cost, of course, is not that significant either, and you don't have that many systems to patch as well.
Okay, perfect. That's helpful. Thank you very much.
Thank you. Our next question comes from the line of Gur Talpaz of Stifel. Your line is open.
Great. Thanks. I'll follow up that question. Philippe, maybe give us an update here on the passive network discovery product you plan to launch this year, and I think maybe taking that one step further, how important do you think passive network discovery ultimately is for full IT asset inventory?
This is absolutely strategic. I think this is something that we're very proud of. We're so happy that it's coming. I've been patient, if you may, to get that done. I'm so happy that it's on beta. In fact, Sumedh gave to one of the large customers a demo, a real live demo, about a week ago. I was myself personally floored. I could not believe the degree of integration that we have done. Fundamentally, to answer your question more specifically, is that the passive scanning does a few things. First of all, on the discovery, on your network discovery, the scanning technology that we have mastered is really not good for the asset inventory. Just give you a kind of a discovery. You can see what's going on, but you don't have much visibility.
Conversely, the agent technology we have also mastered give you full visibility on the assets, what they have, what is on this asset, what has changed. The problem is that if, of course, if you want to do your global IT asset inventory and you have, like most company, no clue about what you have, you cannot put an agent. You have to know first. That's where the passive scanning comes in. The passive scanning listen now to the traffic, and we detect any devices that connects. We have done a huge effort at fingerprinting a large array of devices. We're adding also on the top of that, the ITAM capabilities. Now suddenly we can identify those assets that comes in with great precision, thanks to the passive scanning. Now the question becomes, do you want to have that device being managed, yes or no?
Should that device have an agent, or should we use authenticated scan or whatever other techniques? Then, of course, we continuously monitor that and now synchronize. In order to do that's a very important point that I'm making. You need a backend, which is absolutely significant, robust. Today, not only an Elasticsearch, which of course, allows you to essentially categorize, identify all these assets pretty quickly because you could not use an Oracle database to do that. It would take you forever. Today we have index on our Elasticsearch clusters, 250 billion data points. We could do twice as much. Also, you want to have all that information that we collect also coming from different sources, communicating very well. On our Kafka backend now, we have scaled that backend to 9 billion events a day. Significant.
We have the muscle, the engineering, everything behind. To finish the passive scanning also, we have a lot of other interesting use case, as with our IOCs, like suddenly we could identify not only just compromised device, but suspicious devices, and we'll eliminate that suspicion by listening to what's coming in and out of that device that were deemed suspicious because we have classified all the malware into families. Instead of just looking for precise hash or match, we can now look for what we call a family match. Other very significant usage of the passive scanning is on the IoT, because again, on the IoT devices, it's very difficult to put an agent, although Qualys is coming with an SDK, IoT vendors are going to be capable of building their own agent.
You also want to listen to the device because it's, et cetera. It's all about fingerprinting all these devices, which we are doing. We have a big team in India now doing nothing but fingerprinting. We are fingerprinting all the devices as we speak of a large manufacturer, car company in Europe. If you prefer that passive scanning is also a foundation for our forthcoming IoT solution. We have the backend, we have the platform, we need, of course, the detection, and the passive scanning is very strategic for that. This is significant and at the scale at which we do, and no competitors of ours has that totally integrated in the platform. Some competitors have the passive scanning since quite a while, but it's another application. It's not at all integrated with our platform.
That integration is not a walk in the park, I can tell you, because of the scale at which you need to really apply that technology.
That's really helpful color. Thank you.
Melissa, can I ask you one question here?
Yeah.
If we look at the billings makeup here, actually the deferred makeup, there's a clear trend towards current in terms of relative makeup. Have you seen durations shorten here over the past few quarters trending towards one year?
I would say a couple things. First of all, because as we discussed earlier, we don't intend our sales force to go after prepaid multi-year deals, you have seen our non-current declining. As a result, from the growth perspective, you're seeing it in the current deferred revenue. Again, that's really how we manage our business. I know I'm going to sound like a broken record, but we really do think if you're going to compare companies, you need to look at annualized metrics. For us, an annualized metric is going to be based on our current deferred revenue, not total. I suspect that's true for many companies because they're all going to have their non-current portions of their longer-term multi-year deals and their non-current.
Let me give you another color here. For example, when we have a customer who has cash and wants to do a three-year prepaid, they come to us and they say, "We'd like to have a discount for that." We say, "Really?" We can say no. Some people say, "Okay," or, "You don't give me enough," is more of the typical scenario. In that case, they go back to the three-year, which is annual payment. It's all still up front, which is good for the cash, but we don't get, of course. They have the price protection for three years, which is good for them, and for us, I don't have to discount. That's the reason why we don't want to incentivize.
We see, by the way, today, because of all the solution that we have, we are starting to see some large companies saying, "We would like to acquire all of your apps and without counting." Again, we're very careful. We are not going to go and discount AVD to get a bigger deal. We have that patience, which I think comes from the model itself. Prepaid, we have now some demands for monthly billings, but we try also to avoid that because this is more invoices that we've got to manage. That comes more from our MSSP partners. We have the tendency then to do with them some kind of quarterly payments more so they could aggregate their, i nstead of having us sending a lot of invoices.
Yeah. Just to go a little bit deeper, Gur.
The other thing that will have an impact on your year-over-year growth is the duration of your current deferred revenue.
Over the last few quarters, relative to the year before, maybe slightly shorter, but that's why generally there's a number of factors that impact the year-over-year growth rates of billings that are not impacting our year-over-year growth rate bookings, so it's really not on a quarterly basis, a great proxy.
Just one last, yeah.
If you are going to use something current is better than total.
Just for your sales force, do you incent on ACV? Is that how you're doing things?
That's exactly right.
Yeah. The sales force is incentivized different, but it's 100% ACV. Essentially we have, of course, the new business team, which is essentially sold on the new business. Our renewal teams or farmers are incentivized in both the renewal as well as the upsell.
I think from your perspective, you're not going to value a company that sells 3-year contracts, has $3 in their total deferred. That's a 3-year contract versus one year for us. Over 3 years, it's going to represent the same amount for us. We're just going to get it collected each year, the $1, and they've gotten it upfront.
Yeah. Another thing also, which is interesting in that event, just to tell you how strict we are with our model. We have some companies who absolutely wants CapEx. Of course, they want CapEx because that's what they need. What we do is essentially we create a sort of a CapEx solution. However, we only take the revenues as we deliver the service. We don't mix any sort of CapEx perpetual license. Everything that we do is 100% subscription-based, and we take the revenue as we deliver the service.
That's very helpful. Thanks for the deep color there. I appreciate it.
Okay. Thanks, Gur.
Thank you. Our last question comes from the line of Alex Henderson of Needham. Your line is open.
Thank you very much. I was looking at the, for the first time in the 30 years I've been doing this, the value of the rupee versus the dollar, I see it's down 7.6% since the beginning of the year. Assuming rates are rising here and flat there, probably see some more improvement in the back half, although obviously don't want to forecast currency. Given almost a 10% benefit from the exchange rate versus the Indian currency, one, what are you doing in terms of hedging against that? Two, if we stay at that level through year-end, how do you expect to take that benefit? Will it be through additional investment in R&D resources, or will it be something that you use to roll through the margins? How will you approach it?
Yeah. Today, we have a very big plan to expand our accounts big time. We have the machine, I think all the benefits, it goes right back. If you look today, one of the ways is that if you look at the differential between in engineering, you have a factor of 10. Obviously, we can hire significantly more people. That give us a very unique muscle out there, we've really mastered that relationship between our Indian subsidiary and Qualys. We now hire some people which have been with Qualys, they come here. We have really done a fantastic, Sumedh, in fact, this is really the credit that's to be given to both Sumedh, our Chief Product Officer, and Rima, our head of human resources, Rima. They both spent quite some time in India.
Myself, by the way, I go a minimum of one time a year to India because I want to absolutely show to them how much we value them. It's a huge source of talent, which is absolutely incredible. Pune turned out to be the best place because they have absolutely very strong universities, technical universities. There's a huge pool of talent in Pune. Not speaking of the square footage. We are now further expanding our buildings, our campus that we say now in India. The difference is $1.5 a square foot versus $50 here in the Silicon Valley. It's a huge differentiator.
Yeah. Just to add on to what Philippe said, obviously the business plans for expansion there, it's for the business. It's not actually because of its benefit of what's happening with the exchange rate. Finance doesn't drive the business.
No.
It drives finance.
It's a good godsend. I mean,
Right.
Yeah. I guess the question was, to what extent will you reinvest it or would you prefer to push it through margins?
No. So far we're reinvest, yeah, big time. There is so huge opportunity. We're going to acquire a few companies at some point in time, and that's another 20, 25 people that comes in that we totally integrate with our solutions. We're even now looking at other location in India. India is becoming also a very big market for us. We're starting to do a lot of good job there as well. Remember, all the Indian outsourcers are Qualys customers and Qualys partners, so having a strong presence in India is very important. You see also a lot of large companies have their IT in India now, so we're extremely well-positioned.
Yeah. The one thing I'd just add on is, remember, Alex, the size of the cost differential, it's still not a meaningful portion of our expenses. The total dollars we spend there are meaningfully less than us.
Great. Thank you.
Yeah.
Thank you. At this time, there are no further questions. I'd like to turn the conference back over to Ms. Melissa Fisher for any closing remarks.
Thank you, Amanda, and thank you all for attending our second quarter 2018 earnings call. We look forward to seeing many of you in a few weeks at the KeyBanc Technology Leadership Forum in Vail and at Citi's 2018 Global Technology Conference in New York in September.
Okay, thank you.
Ladies and gentlemen, thank you for your participation in today's conference. This does conclude the program. You may now disconnect.