Good day, everyone, welcome to the Qualys third quarter 2016 earnings conference call. This call is being recorded. At this time, all participants are in a listen-only mode. Later, we will conduct a question and answer session, and instructions for asking a question will be given at that time. I would now like to turn the call over to Joo Mi Kim, Vice President of FP&A and Investor Relations. Please go ahead, ma'am.
Good afternoon, welcome to Qualys' third quarter earnings call. We would like to remind you that during this call, we expect to make forward-looking statements within the meaning of the Federal Securities laws. Forward-looking statements in this presentation include, but are not limited to, the following. Statements related to our business and financial performance and expectations for future periods, including the rate of growth of our business. Our expectations regarding capital expenditures, including investments in our cloud infrastructure and the intended uses and benefits of those expenditures. Trends related to the diversification of our revenue base. Our ability to sell additional solutions to our customer base and the strength of demand for those solutions. Our plans regarding the development of our technology and its expected timing. Our expectations regarding the capabilities of our platform and solutions.
The anticipated needs of our customers. Our strategy, the scalability of our strategy, our ability to execute our strategy and our expectations regarding our market position. The expansion of our platform and our delivery of new solutions. The expansion of our partnerships and the related benefits of those partnerships. Our ability to effectively manage our costs. Our expectations for currency exchange rates. Our plans to pursue arrangements with MSSP, which are multiyear contracts at fixed prices. Finally, our expectations for the number of weighted average diluted shares outstanding and effective GAAP and non-GAAP income tax rates for the fourth quarter and full year 2016.
These risks include those set forth in the press release that we issued earlier today, as well as those more fully described in our filings with the Securities and Exchange Commission, including our latest Form 10-Q and 10-K. The forward-looking statements in this presentation are based on information available to us as of today, we disclaim any obligation to update any forward-looking statements except as required by law. We also remind you that this call will include discussion of GAAP and non-GAAP financial measures. The non-GAAP financial measures are not intended to be considered in isolation or as a substitute for results prepared in accordance with GAAP. Discussion of why we present non-GAAP financial measures and a reconciliation of the non-GAAP financial measures discussed in this call to the most directly comparable GAAP financial measures are included in our earnings release issued earlier today.
Joining me today on the call are Philippe Courtot, the Chairman and CEO, and Melissa Fisher, our CFO. Philippe?
Thank you, Joo Mi, and welcome to everyone to our Q3 earnings call. We had a very good third quarter, where our top-line revenue was at the very high end of our guidance, and EPS was above, again, reinforcing the value of our cloud-based security platform in the marketplace and our balanced approach between profitability and growth. As you certainly recall, earlier in the year, we pointed out our ability to become a key player in the forthcoming consolidation of traditional enterprise security and compliance solutions. This quarter, we put more pieces in place central to this strategy with continued product innovation and expansion of our strategic partner ecosystem. I will further elaborate on this later. First, let me address what we're seeing from a macro industry level. A few weeks ago, we hosted our 16th annual Qualys Security Conference in Las Vegas.
The theme of the conference was centered around the visibility companies must achieve to effectively fend off cyberattacks and how our Qualys cloud platform approach can make this possible. At the conference, I had the opportunity to discuss with quite a few customers their long-term security needs and the state of the industry. They all expressed their need to consolidate the stack of the many security and compliance solutions they currently have, as they have become too costly to deploy and maintain. Integrating them is becoming complex and extremely expensive. In fact, our large customers are handling in excess of 30 disparate security and compliance solutions. They simply cannot take on more. Compounding the problem is the fact that they have a hard time finding qualified people to operate them.
Such discussions clearly reinforce our belief that Qualys is now very well-positioned to address these needs because of the breadth of the new solutions we are now bringing to market, solutions that are designed for scale, natively integrated, centrally managed, and self-updating, thus eliminating significant costs while providing best-of-breed functionalities. At our conference, in fact, we showcased our groundbreaking suite of new services, namely the File Integrity Monitoring solution, the detection of Indication of Compromise solution, and our Web Application Firewall 2.0. We are on target to deliver this additional solution by the first half of next year. Now, let me share some business highlights. Qualys has built a new distribution model that continues to set us apart from other competitors in the marketplace. We want meaningful engagements with additional global MSSPs who are now embedding the Qualys platform with their managed security services offerings.
This week, we're very pleased to announce a global strategic partner with HPE, who will be integrating the Qualys platform and suite of integrated solutions to deploy to their user base. Earlier this year, as you may recall, we also expanded our engagement with Wipro, who already saw value in our platform and is now including Qualys across all of their global offerings. We signed NTT, who is now rolling out Qualys as a critical part of their security offerings, again, on a global basis. The channel was not only the area that scaled in the quarter. I'm very pleased now to announce that we have received yesterday our Authority to Operate, or ATO, from the Department of Health and Human Services under our FedRAMP certification, which opens up the federal marketplace for us.
Our product development efforts continue to move forward with additional features and functionalities to our Cloud Agent platform. For example, we announced that the Cloud Agents are now available on the Microsoft Azure platform at a click of a mouse, allowing Azure users to have a continuous view of the security and compliance posture of their Azure environment. We continue to see strong adoption for the Cloud Agent from our customers, with now more than 1.3 million Cloud Agents being purchased in the last 12 months, as well as the pent-up demand for our new ThreatPROTECT solution that allows our customers to prioritize the remediation vulnerabilities in relation to the active threat landscapes. We continue to make significant progress with injecting new capabilities into our industry-leading platform, including implementation of the Cassandra open source engine, passive scanning, and container security.
It is now clear that in a perimeter-less, hyper-connected world, our solutions visible in a single pane of glass are critical tools that enable Qualys to become the actor of choice in this, or to be the actor of choice in this new era of enterprise security consolidation, while helping customers expand their security policies to the new cloud computing environment. We now provide our customers with a two-second visibility across all of their global IT assets, whether on-premise, on endpoints, or on elastic cloud environments. We allow them to continuously assess the security and compliance posture of those assets. Next year, we will help them identify those who have been already compromised. We eliminate significant costs out of the IT and IT security budget as we now consolidate more than 10 traditional on-premise enterprise security and compliance solutions.
We have never been more optimistic with regards to our future and believe that Qualys is very well-positioned for 2017 and beyond. With that, I will turn the call over to our CFO, Melissa, to discuss our financial results in more detail. Melissa?
Thanks, Philippe, and good afternoon, everyone. Our strong third quarter performance reflects the continued success our cloud-based security platform is finding in the marketplace. Total revenues in the third quarter were $51 million, which represents 20% growth over the third quarter of 2015. We also see adoption increasing with the number of enterprise customers who purchase three or more Qualys solutions rising to 23%, up from 18% a year ago and up from 21% last quarter. The percentage of total customers with two or more products, including PCI, the prior metric disclosed, was 63% in Q3, up from 61% a year ago and 63% last quarter. In addition, our average deal size increased 22% year-over-year in Q3. The negative impact of FX on our revenues mostly offset the positive impact from the MSSP contract this quarter.
Our revenue plus the change in current deferred revenue balance grew 20% year-over-year. As I highlighted last quarter, this calculation will not always mirror our current bookings due to the timing of the actual invoicing as well as the impact of FX. This quarter, our revenue plus the change in current deferred revenue balance continued to be negatively impacted by those factors as well as the impact from the MSSP contract. In accordance with our prior disclosures, our vulnerability management solutions remain strong, continuing to represent 79% of third quarter revenues, in line with results in the third quarter of 2015. Our last 12 months of bookings year-over-year growth rate for Policy Compliance and Web Application Scanning was 23%. Note that this figure does not include newer solutions like our Cloud Agent used for VM, our Private Cloud Platform, and ThreatPROTECT.
In fact, Q3 bookings from the Cloud Agent platform grew almost 50% sequentially, and from ThreatPROTECT grew 90% sequentially. Before moving to profit and loss items, I would like to point out that unless otherwise specified, all of the expense and profitability metrics I will be discussing on this call are non-GAAP results. Our non-GAAP metrics exclude stock-based compensation and non-recurring items. A full reconciliation of all GAAP to non-GAAP measures is provided in the financial tables of the press release issued earlier today and is available on the investor section of our website. As I discussed last quarter, our strong margins are a testament to the scalable operational model of Qualys and are higher than other comparable security and SaaS companies. Driven by the opportunity to increase our profitable growth, we have been increasing our investment in 2016.
While gross margin declined slightly to 79%, down from 80% in the third quarter last year, driven by an increase in software and hardware expenses, gross profit increased by 18% year-over-year to $40.2 million in the third quarter of 2016. Operating expenses increased by 19% year-over-year to $27 million. R&D expense increased to $7.8 million or 25% year-over-year, primarily due to higher headcount. Sales and marketing expense increased to $13.4 million or 19% year-over-year, primarily due to higher sales headcount, higher marketing expense, and costs related to our salesforce.com implementation. G&A increased to $5.9 million, 13% year-over-year, largely due to higher headcount. Operating expenses were sequentially flat despite a meaningful increase in headcount because over 80% of our net hires in Q3 were made in India.
The sequential increase in sales and marketing expense from customer and acquisition costs and branding expenses were offset by a sequential decrease in G&A from lower third-party spend. Due to our strong revenue growth, adjusted EBITDA for the third quarter of 2016 increased by 16% to $17.6 million, compared to $15.1 million in the third quarter of 2015. Excluding the positive impact to revenues from the MSSP contract, adjusted EBITDA would have still increased over the third quarter of 2015. Adjusted EBITDA margin in the third quarter of 2016 was 35%, as compared to 36% in the third quarter of 2015. Moving on now to earnings per share. For the third quarter of 2016, GAAP EPS was $0.13 per diluted share, up from $0.11 in the third quarter of 2015.
Non-GAAP EPS was $0.22 per diluted share in the third quarter of 2016, up from $0.19 in the third quarter of 2015. Net cash from operations in the third quarter of 2016 increased by 26% to $20.2 million, compared to $16.1 million in the same period in 2015. Free cash flow generated in the third quarter of 2016 was $10.4 million, compared to $11.7 million in the comparable period of 2015. The lower free cash flow was due to $4.8 million of capital expenditures incurred in Q2 that was paid out in Q3. As we discussed last quarter, we front-loaded CapEx that was scheduled to be paid later in the year. Of the $7.4 million front-loaded, $4.8 million was paid out in Q3, with the rest scheduled to be paid out in Q4.
Excluding the previously mentioned $4.8 million, capital expenditures were $5.1 million in the third quarter of 2016, compared to $4.5 million in the third quarter of 2015. In the fourth quarter of 2016, we expect capital expenditures to be in the range of $3.5 million-$4.5 million, excluding the $2.6 million remaining to be paid from the $7.4 million Q2 expenditure. As a reminder, $5.2 million of the $7.4 million was related to the early renewal of a license arrangement, as we were able to lock in an attractive rate on database software for the next several years. This was CapEx that otherwise would have been spent in 2017 and does not represent a change in our business model. Excluding the early license renewal, our expectation for capital expenditures remains roughly the same at approximately $20 million-$21 million for fiscal year 2016.
Turning to our guidance, starting with revenues. For the fourth quarter of 2016, we expect revenues to be in the range of $51.9 million-$52.9 million. In the fourth quarter, we expect a negative impact from FX to outweigh the positive impact on revenues from the MSSP contract. For the full year of 2016, we are raising the bottom end of our guidance for revenues, bringing our current guidance to a range of $197.6 million-$198.6 million. For the full year of 2016, we are raising our guidance for both GAAP and non-GAAP EPS. Our current guidance for GAAP EPS is now $0.41-$0.42, and for non-GAAP EPS, $0.79-$0.80 for the full year of 2016. We expect GAAP EPS for the fourth quarter of 2016 to be in the range of $0.06-$0.08 per diluted share.
While non-GAAP EPS is expected to be in the range of $0.16-$0.18 per diluted share. We expect our operating expenses to sequentially increase in Q4 as we are continuing to invest in our business as we scale for the rollout of additional solutions to our platform because we have a highly profitable operational model. Our fourth quarter EPS estimates are based on approximately 39.2 million weighted average diluted shares outstanding and our full year 2016 EPS estimates are based on approximately 38.5 million shares outstanding. For the fourth quarter and full year 2016, we have used an expected effective GAAP tax rate of 37% and 38% respectively, and an expected effective non-GAAP tax rate of 36%. Like Philippe, I was delighted to see such strong customer response by both partners and customers at our user conference.
Customers are looking for fully integrated, cost-effective and scalable security and compliance solutions which provide instant visibility across all of their global IT assets, whether on-premise, on endpoints or on elastic cloud environments. Qualys is the best position to fill those needs. With that, Philippe and I would be happy to answer any of your questions.
Thank you, ladies and gentlemen. If you have a question at this time, please press the star then the one key on your touch tone telephone. If your question has been answered or you wish to remove yourself from the queue, press the pound key. Remember, please limit yourself to one question only, then re-queue if you have more questions. Our first question comes from Bill Choi with Wunderlich. Your line is open.
Yes, thank you. I guess if I had to stick to one question, it would be largely trying to understand the traction you're getting currently on bookings for the new products. You talked about ThreatPROTECT and the agent. Yet when we look at your guidance for revenue, understanding maybe there's some FX pressures there, the sequential growth rate here looks weaker than what you normally see into Q4. It's what, 2%-4% sequential growth. I just wanted to get some sense of when you talk about these new products, how big are they and are they making an impact yet meaningfully to revenue? Thanks.
Let me answer that by addressing a couple of points, Bill. First, Q4 is a big quarter for us. As in general, we've been seeing increasingly larger up-sells. We continue to see that in the pipeline for Q4, we guide appropriately based on the fact that larger up-sells are a little bit less predictable for us in terms of which quarter they're ultimately going to get signed in. We are also, as I mentioned, negatively impacted by FX in Q4, which is actually going to outweigh the positive impact from the MSSP by about impacting our growth rates to such that it would be 0.5% lower. Those are the data points then. We are seeing, as you pointed out, good traction early in the new services.
Again, it's going to take time because of our SaaS ratable revenue model for it to flow through on the revenue line.
Our next question comes from Gur Talpaz with Stifel. Your line is open.
Hi, this is actually Chris Spiros on for Gur. Thanks for taking my question. Can you talk about what the pipeline is looking like for the Cloud Agent and the mix of that pipeline in regards to new versus current customers?
We don't have really the mix between the new and the existing customers. What we can say is that we see a continued adoption, very strong adoption by all of our existing customers. There's no question about that. In fact, Melissa gave you some statistics before that. As far as the new is concerned, we see mainly more and more of the new business coming with the agent.
Yes.
It's very clear that the agent becomes the differentiator. I don't have the exact percentage to give you, but it's significant.
When we report the Cloud Agent statistics, we are seeing that both from existing customers as well as from new customers to be clear, and it is going to skew more towards existing because as our renewal base grows, our opportunities for up-sell continue to increase, especially with these additional solutions. Our business always tends to skew towards existing as well as because of how large our customer base is already.
Thank you. Our next question comes from Craig Nankervis with First Analysis. Your line is open.
Thanks. Good afternoon. Nice quarter, folks. You've had, for 2 quarters now, some nice growth in your average deal size, which I believe is a bookings metric. Can you talk about that? Here's another existing versus new customer question, which is influencing that more? Is it multi-product sales? Is it larger initial deals? What can you say about these last 2 quarters and the growth of your average deal size?
It's going to be driven more by existing because one thing Philippe and I have discussed that's maybe different in our business model than some other companies is this nomenclature of new versus existing is a bit artificial because often we'll get new customers in. It can be a very small initial dollar volume. It could be a PCI-only customer who then we upsell for close to $1 million. You would see the increase coming more from the existing customer base.
Yeah. No, absolutely. To give you some colors, for example, we have a large financial institution which was essentially spending about $200,000 a year for Qualys, and the upsells became $1.4 million. You can see the big advantage we have. In a way, we take our customers young, if you prefer, and then we grow them, our business would be always tilted toward the upsell. Especially that we have more and more services, you have even that compounding effect.
Right.
Again, if you have a question at this time, please press the star then the 1 key on your touchtone telephone. Our next question comes from Steve Ashley with Baird. Your line is open.
Good afternoon. This is Matt Lemenager on for Steve Ashley. My question was around the 4Q guidance, implying the EBIT margins would be down sequentially. Just looking at it the last few years, seasonality has kind of seen an increase in the EBIT margin 3Q to 4Q. I realize you came in nicely ahead of margins this quarter, maybe some of it is expenses that pushed to 4Q. You talked a little bit about extra expenses or investing in R&D and things in the fourth quarter. I was just wondering if maybe you can comment or provide color on the implied guidance for the fourth quarter around expenses and the implied EBIT margin.
Yeah, that's right, Matt. We do expect our expenses to sequentially increase, which as I had highlighted, we had expected for the Q3 and ended up coming in a little bit lower. We are investing across all the functions, R&D and operations, sales and marketing, and G&A. That's what our guidance is based upon.
Our next question comes from Srini Nandury with Summit Redstone Partners. Your line is open.
Hi, this is Jonathan Kees. I'm actually speaking for Srini Nandury. Thanks for taking my questions. I just have two. First one is a follow-up. I guess in regards to that Q4, you talked about the OpEx going up. Should we think that GM will stay relatively flat with Q3? That most of the increase is just going to be in the OpEx line? The second question, a more high-level question, is that you're talking about providing services as a differentiator, and earlier you mentioned that finding the right personnel with security expertise has been difficult for your clients. Is that something that you're providing that is going to be something that's going to move the needle for you in how you differentiate relative to your competitors?
No. On your second question, one of the unique things that Qualys does, because we have adopted that cloud model, the cloud model has allowed us to package our solutions a bit like salesforce.com and all these cloud solutions, we don't need all that professional services. That's one of the other reason of our profitability. In fact, we have no professional services, zero, since the inception. What I was referring to about it is our customers today, which have now the big advantage of Qualys today, is that the same platform offers you 10 traditional security and compliance solution totally integrated. You need significantly less people to operate.
The complexity to operate this different solution is also reduced, as opposed to having, if you line up all these different best-of-breed enterprise on-premise security solutions, you need to have one infrastructure for that application, another one for the other one, and on and on. You have to deploy and maintain different architecture. On the top of that, you have to maintain and operate all of these different solutions independently. In order to make a better sense of your security and to get the overall security posture of your company, you need now to integrate those one. You end up now using another solution where you integrate all that information, which again costs a lot of money. You need to find the people for you to be able to do that. That's what Qualys essentially fundamentally eliminates.
On the first question, which I forgot.
I'll take over.
Okay. Melissa will answer.
Yeah. I was thinking about expenses broadly because we don't guide by functional area. As Philippe mentioned, he went into some of the details around how we're investing in the operations in the back end. You can use that guidance for building out your model. Where we've tried to be clear is on the one-time effects of guidance around things like the MSSP contract, which, as you guys are aware, we shared the information about how it's impacted our top line positively, but obviously, we won't have for 2017. I'm sure as you're thinking about your models going forward, you'll be taking that into account as a headwind as well.
Our last question comes from Sterling Auty with JPMorgan. Your line is open.
Hi, guys. It's Jackson Ader on for Sterling tonight. One really high-level question from us, that is, are you seeing any either increased demand or interest from customers after some of the recent attacks like.
I think we're thinking mostly the Dyn attack that came out last week.
In fact, I will not say maybe directly because of that, but this is what we see at a very macroeconomic level. Today, as we all know, most large companies have embarked into what is called the digital transformation. What is happening today is that now they realize, and we see that speeding up, which is essentially using newer technology, retooling their IT infrastructure to reduce costs and increase agility from a business standpoint. What we see today happening at the macro level is that these divisions in these companies are starting to realize that today, securing the current computing environment is becoming more and more and more expensive and diminishing returns. There's now a demand that we see, and that favors Qualys significantly, and we already have quite a few very significant example about that.
They see that if they move it, if they accelerate and where, for example, that example of a very large bank in Europe, which has publicly announced that they accelerate the digital transformation from a five-year plan down to a three-year plan. Qualys now is becoming critical for helping them securing the new infrastructure because the current solution, security compliance solution, were designed for that, if you prefer, client-server typical computing environment and not at all for these now more cloud-based computing environment. That's where we see the demand for our solutions. That ability that we have today to provide you with a two-second visibility across your entire global IT assets, this is really what differentiate us. In addition to that, we can now provide you with a continuous view of the security and the compliance.
That's quite significant and next year, as I've indicated in my introduction here, that we're going to able to allow you also to detect where you have zero days almost instantly without having you to search. We will tell you exactly where you're exposed to zero days, and we're going to tell you where we have identified assets which have been already compromised or assets which we highly suspect that they've been compromised. All of that out of one single platform, eliminating significant, for large corporation, you speak about millions of dollars of cost that we can eliminate. That's where Qualys is extremely well-positioned, and that's what really make us very, very positive about the future of Qualys.
Our last question comes from Steven Carcetti with Stephens. Your line is open.
Yeah. I figured I'd sneak in here at the end. This is Steven on for Jonathan. With regards to adoption of the Cloud Agent, is the primary service that benefits from increased adoption, whether it's from a new client or an existing client, is that VM that primarily benefits from that, or are you also seeing the Cloud Agent being utilized for other services? Thanks.
Yes, a very good question. We have in fact, yes, it does benefit immediately, very strongly, VM because it eliminates the need to scanning Windows, it eliminates the need to fetch credentials, and it give you real time. That's, of course, very important. It also benefits for the same reason, by the way, the Policy Compliance application. Now what we see is a very strong adoption of our agent for providing the asset inventory. We really believe that today, the number 1 issue that large corporation has is that they do not know what they have, who owns them, where are they, and of course, you cannot secure what you don't know. There's a new understanding because of the breaches, that despite all the billions of dollars that we're pouring into securing that environment, the breaches are not stopping, very clearly.
Now there's a very clear conscience that you need to know what you have, which is having a global and continuous view of your global IT assets. Again, the world is changing. Whether you have existing assets on-premise, whether it's your endpoints or again, whether it's your now cloud environments. Again, what we did with that, absolutely, integration. Our agents now are pre-installed in the Microsoft Azure platform, which is quite significant. That's what we offer today. This is where we see, if you prefer, that demand. The fact that we see a very strong deployment of our agent for asset inventory, this really underscores that capability that we now have.
Thank you. Thank you everyone for attending our Q3 earnings call. As mentioned in our press release earlier today, our Analyst and Investor Day will be held in New York on November 17th. At the event, we will discuss the company's vision, strategy, product roadmap, and investment highlights, as well as showcase our new services. We are delighted that Mark Butler, Enterprise Information Security Officer at Pfizer, will be with us to present his perspective on the industry and Qualys' competitive position in the marketplace. We look forward to seeing you then.
Ladies and gentlemen, thank you for participating in today's conference. This concludes today's program. You may all disconnect. Everyone, have a great day.