Good day, everyone, and welcome to Qualys' first quarter 2018 earnings conference call. This call is being recorded. At this time, all participants are in a listen-only mode. Later, we will conduct a question and answer session, and our instructions for asking a question will be given at that time. I would now like to turn the call over to Joo Mi Kim, Vice President, FP&A and Investor Relations. Please go ahead, ma'am.
Thanks, Brian. Good afternoon, and welcome to Qualys' first quarter 2018 earnings call. Joining me today to discuss our results are Philippe Courtot, our Chairman and CEO, and Melissa Fisher, our CFO. Before we get started, I would like to remind you that our remarks today will include forward-looking statements that generally relate to future events or our future financial or operating performance. Actual results may differ materially from these statements. Factors that could cause results to differ materially are set forth in today's press release and in our filings with the SEC, including our latest Form 10-Q and 10-K. Any forward-looking statements that we make on this call are based on assumptions as of today, and we undertake no obligation to update these statements as a result of new information or future events. During this call, we will present both GAAP and non-GAAP financial measures.
A reconciliation of GAAP to non-GAAP measures is included in today's earnings press release. As a reminder, the press release, prepared remarks, and an accompanying investor presentation with supplemental information are available on our website. With that, I'd like to turn the call over to Philippe.
Thank you, Joo Mi, and welcome everyone to our Q1 earnings call. As we previewed with many of you, we have shortened our prepared remarks to allow more time for questions and discussion. Melissa and I are pleased to report another great quarter that included both strong revenues and leading profitability. Melissa will go through those details in a moment. These results reflect our position as the leading security and compliance cloud-based platform that is centrally managed and self-updating, which provides for the five key tenets of security today: visibility, accuracy, scale, immediacy, and transparent orchestration. In Q1, our go-to-market capabilities expanded as follows. In partnership with the Cloud Security Alliance, we launched the inaugural CIO/CISO Interchange to enable security expert to share best practices on securing the digital transformation.
Expanded integration of the Qualys Cloud Platform, including Qualys Vulnerability Management, VM, and Policy Compliance, PC, cloud apps with the DXC Threat and Vulnerability Management MSS portfolio. We fully integrated the Qualys Cloud Platform with Ernst & Young Cybersecurity Innovation and Operation Centers at EY, opened in July 2017 to help joint clients stay ahead of emerging threats. We released two free groundbreaking services, CloudView and CertView, providing companies of all sizes the instant ability to track and monitor digital certificates and cloud resources. Most recently, we announced the following product achievements. The acquisition of 1Mobility, which enable us to uniquely provide enterprises discovery, inventory, security, compliance, and response on both enterprise-owned as well as employee-owned endpoints, expanding our footprint within our customer base.
Our ability to provide global asset IT inventory as well as cloud inventory in two seconds will be unmatched by competitive offerings. Integration with Illumio to deliver the industry's first vulnerability-based micro-segmentation. Integration also with the Cloud Security Command Center, Cloud SCC, for Google Cloud Platform, GCP. RSA Conference 2018 was clearly a turning point for our company as our platform, which uniquely provide full visibility across on-premise endpoints, cloud environments, and soon mobile, resonated extremely well with both customers and partner, including the release of new services and demonstration of new technology to come. We showcased CertView and CloudView, two new free groundbreaking services to help organization gain visibility of their digital certificates via CertView and track and monitor public cloud assets and resources via CloudView.
We released out-of-the-box Jenkins integration, Swagger support, a new Chrome browser recorder extension for our web application security app, enabling further automation and streamlining our REST APIs for the DevOps teams. We demonstrated live our forthcoming passive scanning technology that delivers near real-time network profiling and monitoring for continuous asset discovery of all devices that appears on the network, including mobile and IoT devices. The passive scanner monitors network traffic in a non-intrusive manner to discover and fingerprint devices to determine topology, services, and network threats. At the RSA Conference, we also saw a greater interest in our platform from our partners as cybersecurity services is becoming a more strategic offering for them. They recognize that the Qualys Cloud Platform helps customers regain visibility across their hybrid cloud environment, consolidate their security and compliance stack, and enable their digital transformation by helping them build security and not bolt it on.
Our Qualys Cloud Platform user used by over 10,300 customers serves also as a natural distribution channel, Making instantly available new solutions and improvements across the globe to customers, thus providing us and our partners with both operational and financial leverage. With that, I will turn the call over to Melissa to discuss our financial results.
Thanks, Philippe, and good afternoon. Before I would start, I would like to note that except for revenue, all financial figures are non-GAAP unless stated otherwise. As Philippe mentioned, we continue to see strong demand driven by our strategic positioning as the leading cloud platform in our markets, reflected in the following financial and operational highlights. Revenues for the first quarter of 2018 were $64.9 million, which represents 22% growth over the same quarter last year. The percentage of enterprise customers with three or more Qualys solutions rose to 34% this quarter, up from 27% a year ago. The percentage of enterprise customers with four or more Qualys solutions rose to 16% this quarter, up from 9% a year ago. Average deal size continued to increase in Q1, growing 17% year-over-year.
7.3 million Cloud Agents were purchased over the last 12 months, a 23% increase over the last quarter. We saw good growth from both Cloud Agent and Threat Protection bookings. New products released since 2015 contributed approximately 15% of total bookings in the quarter, up from 8% in Q1 2017. Our scalable model continues to drive industry-leading margins and significant cash flow, as reflected in adjusted EBITDA for the first quarter of 2018 of $24.6 million, representing a 38% margin as compared to 32% for the same quarter last year. For comparability purposes, Q1 adjusted EBITDA margin would be 37%, adjusted for the impact of ASC 606, specifically the amortization of commissions. Operating cash flow for the first quarter 2018 increased by 33% year-over-year to $43 million. We continue to invest our cash in Qualys.
Capital expenditures, including principal payments under capital lease obligations, were $6.7 million in the first quarter of 2018. In Q1, we repurchased 21,288 shares. We have $98.5 million remaining in our share repurchase authorization. Driven by our great results, our momentum in the marketplace, and our scalable operational model, we are raising the low end of our fiscal year 2018 revenue guidance and therefore our midpoint. Our current fiscal year 2018 revenue guidance is now a range of $276.8 million-$278.5 million. We are raising our fiscal year 2018 non-GAAP EPS guidance from a range of $1.39-$1.44 to a range of $1.43-$1.48. We expect capital expenditures for the second quarter of 2018 to be in the range of $6 million-$7 million.
We have a strong current deferred revenue balance of $147.7 million as of March 31st, 2018, 23% greater than our balance as of March 31st, 2017. We look forward to sharing with you our vision, strategy, product roadmap, and financial outlook at our virtual QSC user and analyst and investor events June 13th to 14th. With that, Philippe and I would be happy to answer any of your questions.
Thank you. We will now begin the question-answer session. Our first question will come from the line of Alex Henderson with Needham. Your line is now open.
Great. Thank you very much. I was hoping you could talk a little bit about the decline in deferred, or excuse me, the slower growth in bookings. The growth, I think, has slowed down from almost 20% down to 10% in the quarter. Was there anything in that having to do with the change in the accounting that accounted for that? Is it just seasonal? Anything along that give us some sense of that would be helpful. Thank you.
Remember, we had a great quarter, and we have a very healthy outlook. As we discussed before, the 10% you're referring to is a total billings calculation. As we said, if you are going to look at a billings metric, the proper metric would be current billings because our non-current deferred revenue is driven by the number and amount of multi-year prepaid deals, which is customer driven. We don't incent our sales force on that, and so that fluctuates. That's why we focus on current deferred revenue growth, which is 23% year-over-year. Remember, as we discussed, that billings is not a perfect proxy for bookings on a quarterly basis. Over time, it comes close, but on a quarterly basis, it may differ, for example, by the impact of the timing of invoicing.
We may have a number of deals come in on March 31st that we end up invoicing on April 1st. We really emphasize that the of our annual revenue guidance is the best proxy for business momentum because certainly current bookings inform our guidance.
Great. That's perfect. Thank you very much.
Thank you. Our next question will come from the line of Sterling Auty with J.P. Morgan. Your line is now open.
Hey, guys. This is actually Ugam Kamat on for Sterling.
Hi, Ugam.
A quick question. Hello. Melissa, you mentioned that new products contributed 15% of total bookings in the quarter. Just to dig in a level deeper, if we just exclude the Cloud Agent, how does the other products fare in terms of their contribution to the total bookings?
Yeah. It's still primarily Cloud Agent bookings from a proportion perspective. As a group, both the Cloud Agent and Threat Protection, which is the other larger category, continue to do very well. In total, they grew over 100% year-over-year.
Okay. Just as a follow-up to that previous question, how much are you penetrated within your base with the Cloud Agent, just to think in terms of how much upsell opportunity is left?
Yeah, that's a great question. There's still a lot of opportunity. At this point, only about 12% of our customers have the Cloud Agent, so there's still a lot of upside for us.
Yeah, I would add one point. We're starting now to see more deployment on the endpoints. In fact, we did with one customer who has deployed 380,000 agent on the endpoint, so we can see our agent moving now from the traditional servers to make Vulnerability Management and Policy Compliance more real time, more effective, more precise, in fact. Now we see our agent really moving very well on one hand on the endpoints as well as in cloud environments.
Thank you. Our next question will come from the line of Howard Smith, First Analysis. Your line is now open.
Yes, thank you. Congratulations on a solid start to the year. One for Philippe, one for Melissa. For Philippe, CloudView, CertView, the free offering, a nice way to acquire some customers. I know it's very early days, just coming out a couple of weeks ago, but I was wondering if you could give any color on reception, downloads, commentary from people you've discussed it with that you're hearing.
Yes, I can certainly give you some color. To be specific, CloudView was totally GA. We have today about on CloudView, we have about more than 1,000 free sign-ins. Remember, this is a full service, so this is for people to essentially have the complete view of their inventory across all of their clouds. That's very good news, obviously. The CertView, which is the free service component, is for any company in the world, small or large, to have the ability to track their digital certificates, internet-facing digital certificates, when, where are they, who signed them, and when they're going to expire. It's just now entering full GA. We are expecting to see on this one a significant uptake as well.
Great. Thank you. Melissa, your cash flow was very strong this quarter. If I remember correctly, last first quarter, there was some stock-based comp and do the accounting that comes in there. Did that repeat or was this just working capital items seasonally just coming in strong?
If you look at the year-over-year comparison, it's actually the increased profitability that drove it. Last year, we actually had an impact of a lot of multi-year prepaid deals being collected. We actually didn't have that. It was really actually more driven by the profitability.
That's great. Thank you.
Yeah.
Thank you. Our next question will come from the line of Melissa Franchi with Morgan Stanley. Your line is now open.
Thanks for taking my question. Just following up on an earlier question about the adoption of multiple solutions. One of the metrics that continues to inflect higher is the number of customers adopting four-plus solutions. You mentioned Cloud Agent and Threat PROTECT, but I'm just wondering, beyond those solutions, what are you seeing good traction in?
It's really across all of our solutions, but obviously it's also going to include the older ones which have been out longer. For example, customers who are VM customers who are adopting web application scanning or policy compliance would drive that as well. Vice versa, a customer that might have been policy compliance only adopting the vulnerability management.
Okay.
It's pretty evenly across all of our services. In fact, what really people appreciate more and more now, finally, is that we have essentially it's one single platform. The analogy that I could really give is that if you look at your phone today, you have multiple apps. These apps are disjointed in the sense that you go to Uber, and you're going to have your credit card there, and you're going to pay this, a different application. With Qualys, all these apps that you have, they speak between each other, which, by the way, they improve. They essentially add value to each others. They're absolutely on one single platform. That's really the customers are starting now to realize the benefits of that, especially with the amount of services that now we provide.
I think it's very clear that the strategy that all the work that went down to really create that significant back end, which integrates all of these application, is really paying off. Now, by the way, we're also working to really create a front end which even more smoothly integrates all of these applications.
That's great. Just one quick follow-up from Melissa. Just kind of parsing through the comments that you made earlier in terms of the deferred revenue. Is it fair to say that the contract duration was shorter this quarter than a year ago? It sounds like that's kind of the conclusion. Just wondering if you could maybe put some numbers around it in terms of what's the average like this quarter versus a year ago?
Yeah. It's been around 1.1 the last few quarters. I think it may have got increased to 1.2 a year ago. These are kind of small moves.
Yeah. Also it's because one thing is that when you look at the length of our contract, we have a lot of very small customers who typically are one year.
That's right.
If you look at the real trends, we see our enterprise customers moving more and more to 3-year contract when the SME/SMB, they still stay at about 1 year.
Right. Even separately from that, as I mentioned, our non-current deferred revenues is going to be impacted by the number of customers within that multi-year bucket that actually decide to prepay, which is obviously not all of them as well.
Okay. Thank you very much.
Yeah.
Thank you. Our next question will come from the line of Matthew Hedberg with RBC Capital Markets. Your line is now open.
Hey, guys. Thanks for taking my questions. Philippe, maybe starting with you, I'm wondering if you can give us a little bit more color on geographic performance. I'm curious if you guys have started to see any real benefit from GDPR yet.
That's two questions. Geographic performance has been good everywhere. Europe doing very well, not really because of GDPR. I think we were not seeing yet really the direct GDPR correlation or obviously there is one, but it's because we see our customers in Europe deploying more and also adapting more new solutions. We have a very good customer base in Europe, which in the past was essentially mono product, and now they are starting to finally move into adopting more solutions. Therefore the deals are getting a bit bigger, and therefore we have very good growth, and the upsells are bigger. Today, the three markets, the Americas, Europe, and Asia are doing very well.
Maybe one other one. On one of your newer product launches that's still in beta, I'm curious for your container security solution. Seems like an interesting product. I'm wondering if there's any, I know it's early and it's still private beta, but any feedback on that product? Who's sort of been interested in it, and what does the competitive landscape look like for that?
Again, this is the same, but it's a very good question. Container is very hot, including for ourselves. I mean, we're now containerizing the entire infrastructure of Qualys, so we are also using ourselves, our solutions there. There's a huge interest for containers. What, again, people like compared with the other solution, that this is again, totally integrated with the Qualys Platform. All of our existing customers are really, really bullish. That product is coming close to GA, and I think this is still an early market, but it's becoming a very strategic market as companies are really moving into containers and moving into the cloud as well. Both CloudView and the container security, again, all of that out of the same platform, which is the analogy I was giving earlier.
Think of having all of your apps in the phone, being centrally managed, self-updating with the same pay, everything the same.
Interoperable.
Interoperable. All the cost that you can eliminate. On the top of that, the ability for you also to create an app that also bring the data to you the way you like it through our customizable customers. That's what we have done, and I think it resonated, I would say, significantly, and our partners were absolutely floored. We showcased the passive scanning, which is also, again, totally integrated. Now we can detect mobile and IoT devices, any devices that connect on the network. We are on track to deliver our passive scanning capabilities fully integrated by late summer.
That's great. Thanks a lot, guys.
Thank you. Our next question will come from the line of Srini Nanduri with Summit Insight Group. Your line is now open.
All right. Thank you so much. Melissa, I have a question for you. You mentioned the average deal size grew 17% year-over-year. Can you provide some color why, what is driving this growth? Also, can you comment on the length of the sales cycles in general? Have you seen any compression over the last year or so? I will follow for Philippe.
Yeah. Hi, Srini. It's a couple of different factors that have been impacting the increase in deal size. We've really seen it continue quarter after quarter to increase. One is we're seeing larger deployments of existing solutions. Whether it's a new customer starting out bigger than traditionally we had seen, or it's a customer expanding with, let's say, their VM capabilities, that's part of it. It's also, they're adding on new solutions. It's really multiple drivers that are driving up the deal sizes.
On the sales cycle?
Yeah. On the sales cycle, I think on our traditional market, I think the sales cycle are about the same. There are no significant changes. What we can see, but this is again, this is early, is that on the cloud, for people who are looking at the cloud solutions, that we can see that the selling cycle should be shorter. Because, of course, this is greenfield, and people need the visibility. That's why an indication of that is clearly the 1,000-plus people who register for the free CloudView service.
Okay. Philippe, on your recent acquisition, 1Mobility, could you provide some color? What does it do? When is the acquisition expected to close, and who does it compete against in the market? Thank you.
1Mobility is a fantastic acquisition that we made. The acquisition has closed, this is a done deal. The team is already integrated in Pune, India, totally. Essentially what they have done is a very nice a mobile application with a very well-architectured agent that goes into every version of Android, of Apple iOS, as well as Windows Mobile, and if I recall correctly, I think also BlackBerry. That essentially it's a similar agent technology than the one that we have for the traditional devices. We're bringing that into Qualys, which means it's going to extend all the capabilities that we currently have with the Qualys to the mobile environment. That's something that every customer demands. Essentially, I've got these, and I'm sure this is your case as well, I use myself an Apple tablet.
Today, the only thing that you have is essentially mobile management devices, but in terms of the security of that devices, of being able to quarantine that device, if there's something which has been detected, which is not capable, there's really nothing out there. I think this is increased significantly the strategic value of Qualys. In terms of when are we going to have that to market? For the current plan is to have, in fact, their solution, which we are integrating into the platform. As you know, everything we do when we acquire these companies, we don't continue selling what they have, really because we put all of our effort to integrating that into the platform.
The reason is because once these solutions are integrated into the platform, not only it makes it much easier and much more cost-effective for our customers, but also we can distribute this application instantly across the globe to all of our customers. They're also centrally managed and self-updating. We're very coherent with our architecture. We are anticipating to have their solution totally integrated with Qualys in the first quarter of next year.
Thank you for the color.
Thank you. Our next question will come from the line of Erik Suppiger with JMP Securities. Your line is now open.
Actually with JMP, two questions. One, your new products, they have been growing, the percentage of revenues generated by new products have been growing pretty rapidly if you go back a few quarters. They've leveled off in the last three quarters. I think they were 14, 15, and 15. Can you give us a sense of what kind of expectation we might have for that going forward? Is there any reason why that wouldn't re-accelerate or what are your thoughts there? Secondly, can you give us the metrics for Cloud Agent? How many additional agents you deployed in the quarter?
Let me take the first question first. Our new products have actually been doing very well. As I mentioned, bookings actually grew over 100% year-over-year. Remember, the percent of total company bookings is relative to how the rest of the solutions are doing at any point in time. For example, in quarters where other solutions are growing very well, like this quarter, Vulnerability Management and web application scanning did very well. The overall mix isn't going to shift much. It's a little bit hard to predict. Remember that we focus on total company revenues because we're selling a platform, and we don't incent our sales force by product because we don't want them to push customers on product that they're not going to renew.
I think that's why we provided the additional color to let you know that the solutions are doing very well and the mix in any one quarter may change.
The one thing that I would add to what Melissa said is that, of course, as we deliver more and more services, obviously, you would naturally expect that, of course, the volume of new solutions, as compared to the existing ones, would grow.
Does that?
Right.
Quick question on that front. Does that suggest that over the longer term, we should expect that 15% to re-accelerate, or is it just difficult to know how the VM side is going to perform?
I would say probably. It's the most likely, yes. Absolutely. VM is doing very well because again, because VM now is becoming much more strategic. People realize they need to have the visibility on everything. Of course, we have expansion still in our existing customer base. Still, there's a lot of companies which are not really doing full EVM. We have that behind us, so that will continue. I think at some point in time, the mass of new services that we're bringing to market, which is quite impressive, of course, is going to overtake.
Yeah. I was going to add that's because we're going to get the leverage from the additional new solutions coming out. Today, it's primarily still Cloud Agent Threat Protection. For example, FAM, IOC, they're still very early. We'll not only have additional revenues from those, but as well as the new solutions that we're talking about GA-ing, the CloudView assessment, the management of digital certificates, as well as container security.
Yeah, Patch Management.
Right. Just by numbers, more of it. That should drive it. It's just hard to predict sort of the actual specific numbers over which period in time.
Okay. The Cloud Agent?
Yeah. I had mentioned that Cloud Agents, we had sold $7.3 million over the last 12 months. We reported last quarter, $6 million Cloud Agents, the difference is $1.3 million net.
Okay. That's that. Thank you.
Thank you. Our next question will come from the line of Jason Nolan with Baird. Your line is now open.
Okay, great. Thank you. Philippe, I wanted to ask on RSA, you called it a turning point. How did conversations with customers and potential customers a couple of weeks ago differ from conversations last year? Did it result in better or higher quality lead generation?
Oh, no. I think because of all the demonstration that we make and our customers seeing that we're really delivering everything that is really coming together in a very well integrated. It was a kind of a aha moment. Yeah, this is it. Qualys is there. We saw the same reaction from our partners. Our partners, which typically were looking at us much more like the VM solution that they have, and they are very happy with, but suddenly they realized all these additional services that they can leverage. I think it was a kind of a aha moment. At the time, which is interesting, when you contrast that with the cacophony of RSA, which you have so many solutions, so many vendors, everybody's lost, including ourselves.
Seeing Qualys bringing all these applications today in a very rational way, in a very well-integrated way, again, everything centrally managed, everything self-updating out of this one single platform, that was really music to the ears of both of our customers and our partners.
Just to follow up there, we had a large integrator at the show tell us, he was joking, saying everyone claims to be cloud now, and that's
Yeah, exactly
The market coming toward you. Does that change the competitive landscape or confuse the buyer at all?
I think our customers are becoming, of course, less and less confused in a way because, obviously they realize that they made the right investment in the past, so they are pretty happy. Now today, with all these new services and we start to really, I think it sharpens up the ability to essentially start to accelerate our penetration of the market, which is already pretty high. That's why we came out of that, I would say, very bullish. We did that one initiative with the Cloud Security Alliance, which is quite significant, which is essentially we're working with the Cloud Security Alliance, which, as you may recall, it's about 100 chapters in the world with 80,000 volunteers, which are all security professionals. Really, they've been focusing, like us, since 2009, on the metrics to secure the cloud.
Now today, they are embarking into what do we need to do to really secure, enable the digital transformation. We are going to embark into conferences and forums everywhere in the world to essentially bring our customers and, of course, other users with experts to discuss about enabling the digital transformation. That's a significant initiative. We had done something very similar many years ago. I did that with the late Howard Schmidt, at the time when vulnerability management was looked as a kind of a secondary application. We went with our customers, with our early adopters, and with Howard and myself and a few other experts, really evangelize why vulnerability management was important, because you've got to know your vulnerabilities simply before the hackers can find them. Finally, it took that long.
I've been evangelizing the cloud as well for so long, but now the time is there. We saw what we call transparent orchestration, the full integration with Azure that we did. A lot of people speak about orchestration, but that orchestration is still the old way, which is essentially you have workflows, when at the end of the day, everything could be totally transparently integrated. That's what we showcase also at the cloud that we have with Microsoft Azure, which is absolutely remarkable. Again, in order to do that, you have to have the right architecture, which we go back to your question, which is there's a lot of people talking about how we've got a cloud platform, but how many really do have one? There's not that many, because that's not something that you do that easily.
Thanks for the color, Philippe.
Thank you. Our next question will come from the line of Rob Owens with KeyBanc Capital. Your line is now open.
Great. Thank you for taking my question. In your prepared remarks, you mentioned 12% of your customers have the Cloud Agent. Can you remind me how that's been trending? I guess if you can slice it one other way, with new customer acquisition in the quarter, what's the hit rate of those new customers taking Cloud Agents?
Yeah. That's right. It's 12% this quarter, Rob. It was 11% last quarter. It's been moving 1%-2% over the last few quarters. In terms of what new customers buy, it varies quarter by quarter. In general, I would say it's true of this quarter, they actually tend to disproportionately buy our newer solutions. Obviously, our newer solutions are bought by a mix of existing and new, but we see a higher uptake with new in general.
Can you put any color on it? Is it a quarter? Is it half or something of that nature?
Yeah. We haven't disclosed that historically. It's something we can look at providing going forward.
Second, as you look at the traditional VM market and some of the acceleration, can you speak to a little bit just relative to scanning in the cloud versus scanning on-prem? It seems like cloud has had a much higher attach rate. If you look within your install base, how much of VM do you think is coming from scanning within AWS or Azure at this point?
Let me make one first comment, is that scanning in the cloud and scanning a network are totally different. Scanning in the cloud, you want to have the Qualys agent, because putting a scanner in the cloud doesn't make really any sense. The architecture that we have for the cloud is really the right one. That's what we need to do with Microsoft. Any Qualys customer today, any Microsoft Azure customer can at a click of a mouse go to the Security Center and then at a click of a mouse, automatically a Qualys solution is provisioned, which gives them the view of the security and compliance posture on Azure. They can also automatically go to the remediation in the console of Azure. Of course, we can do the same thing in ours. You need that architecture.
We see today, of course, a very good uptake on our agents in the cloud. Again, this is more of a new compared to the huge install base that we have on the enterprise. The cloud is relatively newer.
Great, thanks.
Thank you. Our next question will come from the line of Michael Kidd with Imperial Capital. Your line is now open.
Hi, good afternoon, guys. With the expansion in your product suite over the last 12, 18 months, you have a pretty strong product roadmap for 18. Can you talk about more broadly how you may be changing your selling motion and how you capture more wallet share without potentially impacting deal velocity? Any thoughts on your go-to-market strategy? Thanks.
Yes. Our market strategy has not fundamentally changed, but of course, has evolved. On one hand, we see, as I was mentioning earlier, we have already built significant partnerships out there with all the Indian outsourcers being Qualys customers, all Indian outsourcers being Qualys partners. We have also very large customers and partners like Ernst & Young, PwC, et cetera. We have the Optiv of this word. What we see today now is that in the past, again, these channels were more looking at us as the vulnerability management solution. Now today they see the benefits of everything that we have done. We're becoming more strategic for them. What we are doing with them is, of course, training them more on our new solutions. That's one thing that we are doing.
We have also beefed up our strategy accounts group, we are now providing more and more training on the new services and so forth. Also, these three services are also available for our customers, that they can also market as well, so to create lead generation. On the enterprise, what we're doing, we're changing a little bit, again, adjusting our sales force. As you may recall, our sales force is divided into the hunters and the farmers. They both are technical. What we're doing here is essentially creating different categories of customers and as a result of that, of technical account managers. We are classifying our customers between the very extra large, which are large companies, like Microsoft, like Oracle, like Google, et cetera, very large deployments. Scale is of course the issue.
Here we have even a very highly technical sales force that we are now starting to build to support these customers, continuously be close to them. We have large customers, which now we are essentially making a higher category, if you prefer, of technical account managers. We have our regular customers. That's the changes that we're making here. That's it. We're continuously very consistent with our model. We're just tuning it to the fact that we're adding, sorry, a few more subject matter experts, again, to make sure that we have experts in these different modalities. Again, it's so easy to try and buy. If you're an existing Qualys customer, immediately all these new services are available for you, and you can even yourself automatically create a trial account.
We have these technical account managers which are there and eventually a subject matter expert to help you evaluate.
That's why, just to add on, that's why we describe the platform as a natural distribution channel, as Philippe mentioned earlier.
Got it. Do you see an opportunity to accelerate your hiring of technical account managers this year and forward investing in some of that sales capacity?
We are doing that. The challenge we have is to really find, it's very hard to find good people. I mean, in our model, there's plenty today of what I call the managed sales guys as our industry is consolidating, that are on the market. One, they are extremely expensive, and second, they are not technical at all. That's not the people we are looking for. We're still continuing having more the SE type people, which are more technical. Our customers at the end of the day, they prefer that because they're hounded by too many security vendors, which essentially go for their wallets. That was the theme at RSA. I don't know if you saw on LinkedIn the post of the CISO of Lyft, which essentially was essentially telling at RSA, "Why do we go there?
I see the vendors, they are coming to me all day long, so why should I go to San Francisco to essentially go and meet more vendors and in the cacophony of what they say? It's a waste of my time.
No, absolutely. Well, thank you very much. Appreciate it.
Thanks, Michael.
Thank you. Our next question will come from the line of Gur Talpaz with Stifel. Your line is now open.
Great. Thanks for taking my question. Philippe, with the four new products set to hit beta here in 2H 2018, which ones are you most excited about? I guess more importantly, how do you think about the competitive environment across each of those, and how do you think about that more broadly speaking as well? Thank you.
Yeah, that's a broad question. I don't know where to start because I'm excited by all of them. Let me be specific. Today, by far, the most important, new service are the Cloud Agent, because as we discussed, the Cloud Agents, in fact, are essentially enabling additional services. We start to be very happy with the fact that these agents are going to the endpoint. What are they doing in the endpoint now? Not only they are doing the VM, which they weren't doing in the past, but they are starting to do the IoC. We are starting to displace company like Tanium there and others. That's for the detection of Indicator of Compromise. Of course, we have additional services in the cloud.
This is totally, this is greenfield. I think we're extremely well-positioned there, we're very excited about that with CertView, CloudView, all these things. The technology we really, really love, as well, is the passive scanning technology because that's another. The way I look from a strategic standpoint, Qualys has mastered today the scanning technology. We can scan every IP on the planet, every website on the planet. We do more than three billion scans a year with Six Sigma accuracy. In fact, better than Six Sigma. That's a technology we have mastered. The second technology we have now mastered are the agent. The agent allows us to have real-time information, we bring all that information to our back end as well.
The passive scanning, which is the third technology that we will master, which is essentially being capable of analyzing everything that connects onto the network, whether it's an IoT device, whether it's a phone, whether it's, in fact, at RSA, we detected visitor coming in, we detected Apple Watch as well. Then, of course, if we got the time, we could even launch a scan on these devices. Combining all these three different technologies is really going to make us absolutely unique in the marketplace. Nobody has built that. With also the back end, with the scale where we can absolutely manage significant amount of information now including log information, et cetera.
Bringing all that data into one single place where everything is indexed under Elasticsearch, where we have more than 2.5 billion data points currently indexed on Elasticsearch, which allows us to, in two seconds, being able to have the visibility on any devices out there, with, of course, the most precision, where they're located, the users connected to them, how many RAM they are using, what are the application it's installed in them. Essentially, being capable, very close with once we combine these three technology together, being able to provide you your global IT asset inventory and synchronize that with your CMDBs. That's the key strategic direction of Qualys, and I think we'll be there before the end of the year.
Philippe, fair to say you're excited for the future.
Well, not me, all of us. We're very happy with the company that we have built, the way we communicate, the way everybody's focused on what needs to be done. Really, we're very happy. Not to mention the profitability, which we have been accused of.
Having too much of
of having too much of it.
Fair enough. Melissa, maybe a question for you here as well. I know you don't provide it, but directionally, given the growth in the number of customers with three-plus and four-plus solutions, how has the dollar renewal rate been trending? I guess, with the growth in Agent, I would assume it's trending up or at least flat, but I was hoping you could provide at least some directional commentary there. That'd be really helpful.
Yeah, absolutely. Sure. We focus on dollar net expansion rate, and we've provided it at our last investor day. It was somewhere around 105%. We'll provide an update at our virtual event in June. I can say, obviously, given what we've been seeing in our performance, it won't surprise you that's obviously been trending in a positive manner.
That's helpful. Thank you.
Thank you. Our next question will come from the line of Siti Panigrahi with Wells Fargo. Your line is now open.
Hi, guys. Thanks for taking my question. I was actually switching between calls. My apology if this question has been asked. Philippe, when I see the pipeline that the products that you're planning to launch this year, already you have six product GA in First Half and four already in the pipeline. I feel like some of these products probably easier to update. What are the products that you are more excited about seeing quicker adoption versus some of the products maybe have later adoption? Just wanted to understand, what are the products that you think some sort of meaningful revenue contribution in near future versus midterm and long-term?
I think revenue contribution is a little bit different, and they all help each other anyway. Today, we're very bullish about our free services that we have launched. We saw, as I mentioned earlier, maybe you were not on the call, on our CloudView free service, we have already more have waited few weeks. In two weeks, we have about 1,000-plus people who register for the free service. CertView, it's about to go GA, we're anticipating a very big adoption. The beauty of these services is that, one, they do something very useful that people need to do. You need to know where your certificates are, who signed them, when are they going to expire. Same thing in the cloud, you need to know your inventory, by its S3 buckets, how many of them are exposed, et cetera, to the internet.
That's absolutely, they are must-have application. Of course, we have significant upsell. It does two things. One, it creates awareness for Qualys. For those who didn't know us before, or maybe they were knowing us, but they were not using us. Now it creates also significant upsell opportunities because once we have a customer doing with CloudView the assessment of their inventory, now we can sell to them, upsell to them the security assessment. Same thing with the certificates. If you do your Internet-facing CertView, we can now upsell you on your endpoints, on your internal servers, and then we'll also have the management of your different certificates to upsell you. They have started very well. We're very excited with that, and this is all greenfield.
The other thing that we really are counting on, we see the IOC starting to take off. I think with the passive scanning, they are going to be even better because we are going to be able to identify those devices which are suspect, which is something which is very important because then we have the quarantine behind. These are essentially the key services. Of course, we're improving our VM, we're improving our policy compliance. All in all, I think we're very happy with what we're doing. Again, we have now 50% of the our engineering ops and product management headcount now, which is in India, where we're continuing really attracting very good people. As we did with 1Mobility, acquiring a few very good companies that we can integrate very well. We're continuing doing that, of course.
Great. Thanks for the color, Philippe.
Thank you. Our last question will come from the line of Patrick Colville with Arete Research. Your line is now open.
Hey, thanks for taking my question. To you guys deep in the quarter on revenue, what was the thinking behind not lifting the full year guidance at the top end?
Yeah. We had a great quarter, and we have a very healthy outlook, Patrick. Similar to last year, it's early in the year, we chose to raise the bottom end of the full year revenue guidance in there for the midpoint and keep the top end as it is. Keep in mind, we do have tougher comps in the second half, we factored that into how we wanted to maintain the guidance as well.
Got it. Just on the contract duration, you said earlier in the call that your sales guys aren't incentivized to sell longer contracts. Did I hear that right?
That's correct.
Okay. Did you give us any color around the slight tick down in the gross margin, why there was a reason for that?
Yeah. We continue to invest in the robustness of our platform as we're moving products into GA from beta and new products into beta. This drove higher headcount expense, corporate allocations, and depreciation. We don't guide to gross margin, but we've said is over the year, we don't expect it to be materially different than where it's been the last few years.
Okay. Just as I'm the last person, I can kind of keep going. On the share purchase, can you remind me, the objectives of that are to neutralize the dilution on income statements, right? Is that right?
Sorry, Patrick, can you repeat that?
The share purchase, can you just remind me what the objectives of that are? Is it to neutralize dilution from stock-based compensation?
Absolutely. When you take a step back, we are very cash generative. We're very proud of our highly profitable operational model. Strategically, we've been focusing on M&A as a use of cash in order to drive value for our shareholders. We think that it's likely that our acquisitions are going to continue to be tuck-ins, which don't use up a lot of our cash, and we continue to generate significant amounts of cash. We thought it made sense to offset the equity dilution that we have, either from grants to employees or sometimes in M&A situations, by repurchasing shares.
We could also add that in terms of SBC, we're pretty reasonable as compared to other companies.
That's correct.
Yeah. Okay. Thank you so much.
Sure.
Thank you. Our last question will come from the line of Sterling Auty with J.P. Morgan. Your line is now open.
Hey, it's Ugam Kamat again for Sterling. Just a follow-up. How much is FX having an impact on increase of EPS guidance for 2018? Like your expectations for FX still when you gave the guidance in February versus the expectations right now?
Yeah, that's a great question. It actually hasn't impacted it. The increase in EPS guidance is driven really by our outperformance.
All right. Okay. Thank you.
Thank you. This concludes our question and answer session for today. Ladies and gentlemen, thank you for your participation in today's conference. This does conclude our program, and we may all disconnect. Everybody, have a wonderful day.