Good day, everyone, welcome to the Qualys first quarter 2017 earnings conference call. This call is being recorded. At this time, all participants are in a listen-only mode. Later, we will conduct a question and answer session, and instructions for asking a question will be given at that time. I would now like to turn the call over to Joo Mi Kim , Vice President at FP&A and Investor Relations. Please go ahead, ma'am.
Thank you. Good afternoon, welcome to Qualys' first quarter 2017 earnings call. Joining me today to discuss our results are Philippe Courtot, our Chairman and CEO, and Melissa Fisher, our CFO. Before we get started, I would like to remind you that our remarks today will include forward-looking statements that generally relate to future events or future financial or operating performance. Actual results may differ materially from these statements. Factors that could cause results to differ materially are set forth in today's press release and in our filings with the SEC, including our latest Form 10-Q and 10-K. Any forward-looking statements that we make on this call are based on assumptions as of today, and we undertake no obligation to update these statements as a result of new information or future events. During this call, we will present both GAAP and non-GAAP financial measures.
A reconciliation of GAAP to non-GAAP measures is included in today's earnings press release. As a reminder, the press release and an accompanying investor presentation with supplemental information are available on our website. With that, I'd like to turn the call over to Philippe.
Thank you, Joo Mi, and welcome everyone to our Q1 earnings call. For those who don't recognize my voice, I've not lost my accent. I'm just out of a good flu. With that, Melissa and I are pleased to report another great quarter that included strong performance both on revenues and profits. This quarter, we saw year-over-year growth across renewals, upsells, and new customers. Qualys continued to replace McAfee Vulnerability Management solution with both small and large customers, and we continue to see evidence of the large under-penetrated opportunity within our customer base as our policy compliance, for example, solution was adopted by major banks who were only VM customers before. We also were pleased to see sustained growth performance from our newer solutions, Cloud Agent and ThreatPROTECT. Melissa will provide you with more color on this.
We have now partnerships with all of the major global MSSPs as we announced a partnership with IBM earlier this quarter that will add Qualys continuous cloud-based IT security and compliance solutions to its managed security services portfolio. IBM will integrate Qualys technology to enable its customers with enhanced visibility of IT assets, vulnerabilities, and threat data, accelerating how they prioritize remediation and simplify management of their IT security and compliance posture at scale. Concurrently, we launched a new Qualys app for IBM's QRadar security intelligence platform that allows joint customers to have an improved visibility and analytics tools to help them identify risk metrics and take actions against key threat.
As you may recall, at our state, we launched WAF 2.0 combined with WAS 5.0, which integrated together brings web application security to its next level by offering unprecedented scalabilities and remediation capabilities in the form of a one-click patching. We'll also showcase our File Integrity Monitoring, which is in beta now, and the detection of indication of compromised solutions, which will be in beta in the next few weeks. These new solutions, which leverage our Cloud Agent technology, enables our customers to have a deeper, continuous view into their security and compliance posture at a click of a mouse, their dynamic and customizable dashboard and alerts. These new solutions expand our potential share of our $4 billion addressable market and position us very well for continued growth.
As already mentioned in our last earning call, we plan to launch additional solutions in beta in Q4 of 2017, including Patch Management, digital certificate management, and passive scanning. During the quarter, we also continued to widen the technology gap between our cloud platform and the competition with our Qualys virtual scanner appliances now able to be directly deployed from the Google Cloud Launcher to the Google Cloud Platform. Our virtual cloud scanning capabilities now cover all major elastic environments. Furthermore, IDC confirmed that we have taken the number one market share position over IBM and HP in the $1.6 billion vulnerability assessment market.
Our strong positioning in the market is driven by our unique ability to provide enterprises with both a single pane of view that enables two-second visibility of their entire global IT assets, whether on-premise endpoints or elastic cloud environment, as well as the continuous view of the security and compliance posture, their customizable dynamic dashboards and alerts. As importantly, our cloud platform and solution help enterprises, large and small, to secure their digital transformation while reducing significantly the security and compliance spend, enabling them to consolidate multiple disparate on-premise security and compliance solution in a single platform that is centrally managed and self-updating. Our cloud platform and the global visibility it provides is the results of 10-plus years of continuous innovation, starting in the Silicon Valley and now also in Pune, India.
We believe it is the most comprehensive and technologically advanced in the markets in which we compete, yet we continue to innovate in order to deliver more value to our customers and remain ahead of the competition. In fact, we've now added new technology components to our platform to enable us to ingest, process, analyze, and store high volume of sensor data coming from our agents, scanners, and soon passive scanning analyzer, correlate that information at near light speed in a distributed manner for millions of devices. We now have, in fact, over 25 billion security data points indexed in our Elasticsearch clusters, providing almost instant query results. This gives our customers the two-second visibility without them having to index large amount of data.
We have deployed new Cassandra node clusters as the back-end for FIM, File Integrity Monitoring, and IOC, detection of indication of compromise, data collection, providing us highly scalable data store compared to traditional RDBMS. This failure-resistant and highly available data store with linear performance stores millions of events per second and ingests data regardless of type, which will provide superior performances specifically for FIM and IOC, which depends on analyzing millions of events. We have deployed also new Kafka nodes to enable us to have a heavily distributed processing form that will allow us to process data points and events coming from our sensors in near real time at rates of millions per second, minimizing processing delays in analyzing events and changes happening in customers' network on a continuous basis.
We are also now deploying Redis, which is a high-speed in-memory cache that reduces expensive disk writes and speeds up all analytics operation. In summary, with our upcoming solution and strengthening back end, we believe we will be the only platform capable of providing global prevention, detection, and remediation in a scalable and cost-effective manner across on-premise, endpoint, and elastic cloud environments. Supporting this, just yesterday, Frost & Sullivan recognized Qualys with the 2017 Global Vulnerability Management Market Leadership Award, highlighting the company's area of excellence in growth, strategy, product quality, customer ownership experiences, and unique platform technology leverage. As we seek to ensure that the market recognizes the full breadth of Qualys' Cloud Platform and the value we provide not only to security teams but also CIOs, we have hired a new CISO. Many of you met Mark Butler at our last Analyst and Investor Day in New York.
He was formerly a customer of ours as a chief information security officer advisor. He joined Qualys because he saw the opportunity for Qualys to emerge as a leading platform amidst the stack consolidation occurring in the marketplace. In addition to Mark, we have also recently hired a new vice president and general manager for SMB and SMB market, as we see additional upside to increasing management of our very profitable smaller enterprise business. With that, I will turn the call over to Melissa to discuss our financial results in detail. Thank you.
Thanks, Philippe, and good afternoon. I'd like to begin by sharing some color on, as some would call, our durable top line. We are delighted with our first quarter performance. Total revenues in the first quarter were $53.1 million, which represents 18% normalized growth over the first quarter of 2016. There was a negative impact on our Q1 2017 revenue growth rate of approximately 200 basis points from the MSSP contract and 100 basis points from FX. As Philippe mentioned, we saw strong performance across renewals, up-sells, and new customer business during the quarter. We continue to see adoption of our platform increasing with the number of enterprise customers with 3 or more Qualys solutions rising to 27%, up from 21% a year ago, and their spend in the quarter increasing 27% year-over-year.
The number of customers with a quarterly average spend of over $100,000 continue to show strong growth, increasing 32% year-over-year in Q1, and the cumulative revenues for these customers grew 44% year-over-year. In fact, the average deal size for all new customers grew 44% year-over-year. On a reported growth rate basis, our other security and compliance solutions revenues increased 23% over the year-ago quarter, in part in Web Application Scanning in our SMB and SME customer base, and our Vulnerability Management solutions revenues grew by 12%. As we've discussed, we see the opportunity to accelerate our growth rates with our new solutions, but we are in the early stages of adoption.
Having said that, we continue to see very good performance from both the Cloud Agent platform and from ThreatPROTECT, with new products released since 2015 contributing approximately 8% of total bookings in the quarter. These bookings are mostly due to Cloud Agent, which includes the associated subscription to either Vulnerability Management or policy compliance and include renewals that convert to Cloud Agent. We had 2.6 million Cloud Agents purchased in the last 12 months, up from 2 million last quarter, and we saw the highest year-over-year growth rate of Cloud Agent bookings since launch. Let me now address our deferred revenue balance. Our current deferred revenue balance was $120 million as of March 31, 2017, 18% greater than our balance at March 31, 2016. Normalized for the impact from FX, our current deferred revenue balance would have grown approximately 20% year-over-year.
Before moving to our profitability and cash flow, I would like to remind everyone that unless otherwise specified, all of the expense and profitability metrics I will be discussing on this call are non-GAAP results. Our non-GAAP metrics exclude stock-based compensation and non-recurring items. A full reconciliation of all GAAP to non-GAAP measures is provided in the financial tables of the press release issued earlier today and is available on our investor section of our website. Also note that certain amounts in prior periods have been reclassified to conform to the current period's presentation. As we discussed on our last call, 2017 is another investment year for Qualys, and in Q1, we continued to grow both our headcount and infrastructure. Because our unique operational model is so profitable, investing today to accelerate our growth and gain greater scale enables higher margins for the future.
In Q1, our gross margin remained flat sequentially at 78%, which is very healthy when you consider our continued investments. Gross profit increased by 11% year-over-year to $41 million in the first quarter of 2017, but our margin was down from 80% in Q1 2016. The year-over-year decline in margin was driven by increased headcount as well as higher depreciation from software and hardware to support continued scaling of our operations. Operating expenses in Q1 increased by 18% year-over-year to $29 million. Research and development expense increased to $8.6 million or 26% year-over-year, primarily due to higher headcount. Sales and marketing expense increased to $14.9 million or 16% year-over-year, primarily due to higher headcount as well. G&A increased to $5.8 million, 15% year-over-year, largely due to payroll taxes from a larger amount of options exercised this quarter.
Adjusted EBITDA for the first quarter of 2017 was $16.8 million, representing a 32% margin as compared to 35% in the first quarter of 2016. Net cash from operations in the first quarter of 2017 increased by 89% to $32.4 million, compared to $17.1 million in the same period in 2016. Free cash flow generated in the first quarter of 2017 was $27.9 million, compared to $12.8 million in the comparable period of 2016. The year-over-year increase in operating cash flow was driven by the overall growth of our business, an increased number of prepaid multi-year deals, and the benefit of the new accounting standard, ASU 2016-09, which bumps operating cash flow compared to prior periods by including the excess tax benefits from stock-based compensation. Excluding the benefit of the new accounting standard, cash flow would have still grown very strongly at 60% year-over-year.
Capital expenditures were $4.5 million in the first quarter of 2017, compared to $4.2 million in the first quarter of 2016. Capital expenditures in Q1 came in below our previous expectations as timing on certain purchases shifted into Q2. We expect CapEx related to our operations in the second quarter of 2017 of between $6 million and $7 million. We also expect to begin work on our new headquarters in Q2, and we anticipate CapEx related to that to be another $3 million-$5 million for a total Q2 CapEx spend of between $9 million and $12 million. Now turning to guidance, starting with revenues. For the second quarter of 2017, we expect revenues to be in the range of $54.3 million-$55.1 million, representing an estimated normalized growth rate of 16%-17% based on our current FX forecasts, as well as the previously mentioned impact from the MSSP contract.
We expect GAAP EPS for the second quarter of 2017 to be in the range of $0.15-$0.17 per diluted share, while non-GAAP EPS is expected to be in the range of $0.19-$0.21 per diluted share. We expect our operating expenses to sequentially increase throughout the year as we continue to expand our platform and build out and move into our new headquarters. We are thrilled to have started 2017 with such a strong quarter and are excited about the expansion of our solutions, which uniquely position us to become the ubiquitous security and compliance platform. For the full year 2017, we are raising the bottom end of our guidance for revenues, bringing our current guidance to a range of $225 million-$228 million.
We believe the additional services will increase our stickiness with our customer base, accelerate growth, and set ourselves up for expanded margins in the future. With that, Philippe and I would be happy to answer any of your questions.
Thank you. Ladies and gentlemen, if you have a question at this time, please press the star then one key on your touchtone telephone. If your question has been answered or you wish to move yourself in the queue, please press the pound key. Once again, if you do have a question, please press star then one. The first question is from Melissa Gorham of Morgan Stanley. Your line is open.
Great. Thanks for taking my question and congrats on the quarter.
Thank you.
I just wanted to dig into the upsell metrics that you disclosed. You noted a pretty meaningful uptick in the number of customers adopting three or more products. I'm wondering if you could maybe give us more details on what solutions are driving that adoption beyond VM.
It's really a mix. We see our customers expanding their scope of VM. Philippe talked about some customers adding on policy compliance that were VM-only customers before, as well as taking up our newer products like Cloud Agent and ThreatPROTECT.
Yeah. The Web Application Scanning as well.
Okay. Melissa, you mentioned the cash flow benefit from an increase in prepaid multi-year deals. Can you provide a little bit more color on that? Specifically, I'm wondering if you can quantify the extent to which contract durations increase.
Yeah. Overall, we still haven't seen a meaningful change in our contract length. As our deal sizes get larger, that combined with an increased number of prepaid multi-year deals, create a situation where we were able to collect a significant amount of cash flow this quarter. We don't manage our business to necessarily drive multi-year prepaid deals. It's often, frankly, our customers who view us as a strategic partner who come to us to seek a longer-term agreement.
Okay. Thank you very much.
Thank you. The next question is from Bill Choi of Wunderlich. Your line is open.
Okay, thank you. Last quarter, you talked about an environment where deals kind of closed towards the end of the