Good day, ladies and gentlemen, and welcome to the Qualys first quarter 2016 investor conference call. At this time, all participants are on a listen-only mode. Later, we will conduct a question and answer session, and instructions will follow at that time. If anyone should require operator assistance during the conference, please press the star then the zero on your touch-tone telephone. As a reminder, this conference call is being recorded. I would now like to introduce your host for today's conference, Ms. Sheila Ennis, investor relations for Qualys. Ma'am, you may begin.
Thanks very much. Thank you and welcome to all of you. We would like to remind you that during this call, we expect to make forward-looking statements within the meaning of the federal securities laws. Forward-looking statements generally relate to future events or our future financial or operating performance. Forward-looking statements in this presentation include, but are not limited to, the following. Statements related to our business and financial performance and expectations for future periods, including the rate of our growth or of our business. Our expectations regarding capital expenditures, including investments in our cloud infrastructure and the intended uses and benefits of those expenditures. Trends related to the diversification of our revenue base. Our ability to sell additional solutions to our customer base and the strength of demand for those solutions. Our plans regarding the development of our technology and its expected timing.
Our expectations regarding the capabilities of our platform and solutions. The anticipated needs of our customers. Our strategy, the scalability of our strategy, our ability to execute our strategy, and our expectations regarding our market position. The expansion of our platform and our delivery of new solutions. The expansion of our partnerships and the related benefits of those partnerships. Our ability to effectively manage our costs. Our expectations for foreign currency exchange rates. Our plans to pursue arrangements with MSSPs, which are multi-year contracts at fixed prices. Finally, our expectations for the number of weighted average diluted shares outstanding and effective GAAP and non-GAAP income tax rates for the second quarter and full year of 2016. Our expectations and beliefs regarding these matters may not materialize, and actual results in future periods are subject to risks and uncertainties that could cause actual results to differ materially from those projected.
These risks include those set forth in the press release that we issued earlier today, as well as those more fully described in our filings with the Securities and Exchange Commission, including our annual report on Form 10-K that we filed on February 26, 2016. The forward-looking statements in this presentation are based on information available to us as of today, and we disclaim any obligation to update any forward-looking statements, except as required by law. We also remind you that this call will include a discussion of GAAP and non-GAAP financial measures. The non-GAAP financial measures are not intended to be considered in isolation or as a substitute for results prepared in accordance with GAAP.
A discussion of why we present the non-GAAP financial measures and a reconciliation of the non-GAAP financial measures discussed in this call to the most directly comparable GAAP financial measures are included in our press release issued earlier today. Joining me for today's call are Philippe Courtot, chairman, president, and CEO of Qualys; Nancy Hsiang, VP and corporate controller, who will run through our financial results from the first quarter; and Melissa Fisher, our newly appointed CFO. Philippe?
Thanks, Sheila. Welcome to all of you. As you have seen by now in our earnings press release, we kicked off the year with an excellent first quarter. We have made great progress both with customers and with partners who are shifting away from traditional enterprise security and compliance point solutions and increasing their commitment to our pure SaaS platform. In fact, in one interesting development, we have struck a new arrangement with one of our key managed security service provider. This MSSP partner has now committed to a multi-year purchase order with fixed quarterly payments, rather than the prior arrangement where each resale of Qualys solutions was accounted for separately. Our first quarter reported figures were boosted somewhat by the effect of this new arrangement. I will come back to this in a moment.
Excluding this new arrangement, our first quarter financial results were at the high end of our revenue guidance and in excess of our EPS guidance. We're also very pleased to have announced today the appointment of Melissa Fisher, our new CFO. You will hear from Melissa a bit later in this call. First, let me share some of the business highlights from the quarter. I want to underscore that I believe that each of the achievements can be tied directly to the fact that we offer a pure cloud security platform with a 100% SaaS business model. Pure cloud solutions are increasingly preferred by enterprises who understand that they must transition from reactive to proactive approaches. They understand that cloud-based solutions provide a very robust and cost-effective way to handle the massive amount of data involved in making that transition.
We believe that our platform strategy is the key driver to the rapid uptake of our newest offerings, which we are beginning to see. Let's take a look at the results. We reported 23% revenue growth over the first quarter of last year, which includes a positive impact of approximately 200 basis points from the new multi-year MSSP arrangement effected during the quarter. We also delivered strong improvement in our profitability in the first quarter of 2016, which was reflected in our 35% adjusted EBITDA, which was up from 32% in a year-ago quarter. More importantly, we're beginning to see the economies of scale of our platform provides. Being purely cloud-based enable us to release new features and functionalities continuously and as market needs emerge. We released the Qualys Cloud Agent platform for Linux in March and for macOS in April, adding to the platform's existing support for Windows.
Support for the Linux and Mac OS X operating systems is key to securing servers, endpoint and elastic cloud environments where these operating systems are predominant. Adding the ability to see these endpoints increases the size of our addressable market, drives larger revenue commitments from our customers, and this capability is a meaningful competitive differentiator. Our agent technology brings the real-time continuous security that enterprises now require. We have begun to see significant upsells, and we believe that many more of our customers could meaningfully increase their annual spend with us simply as a result of our ability to manage servers, endpoints, and elastic cloud environment with our single platform. The excitement about this new offering was quite visible at the RSA Conference in early March. In addition to demonstrating the real-time capabilities of our agents, we also unveiled ThreatPROTECT at RSA.
This allows the user to visualize and prioritize the remediation of vulnerabilities, thus minimizing exposure to the most critical threats. We can achieve this by correlating data from vulnerability scans and active threat data from multiple sources into a single dynamic dashboard. By providing customers a comprehensive and contextual view of their organization's threat exposure, they can proactively triage and apply their mitigation efforts. In addition to the expanded MSSP commitment I noted earlier, there are other signs that our platform is enabling us to become a key strategic security vendor to our customers. We announced at the RSA Conference a new OEM partnership with HEAT Software to deliver a cloud-based patch management offering to our customers globally. The partnership allows us to embed HEAT Software best-of-breed PatchLink technology within the Qualys Cloud Agents to distribute and apply patches.
The single cloud-based console is key to effective patch management, which as many of you know, is often a disjunction and therefore costly and ineffective process. This patch management offering is currently scheduled for beta release in Q4. I had the chance to speak with many of our largest customers at this important conference. Let me share with you a particularly interesting conversation I had with the CISO of one of our Fortune 10 customers. He had a high praise for the effectiveness of the four Qualys solutions they use today: vulnerability management, policy compliance, PCI, and Web Application Scanning. More importantly, he stressed how important it is for Qualys to continue to leverage our platform by adding to our suite of solutions. He's in fact eager to reduce the number of security vendors he has under contract and views Qualys as one of his key strategic vendors.
We believe market concerns about putting security solutions on the cloud platform are behind us, and this created a tremendous tailwind for our business on both the top and bottom line. As I noted, we have released on schedule and on budget, the agent technology that we believe permanently changed the vulnerability management landscape. One indicator of the pent-up market demand for new approaches is that the uptake of our Cloud Agents is an order of magnitude faster than for any other product released in our history. We believe it is our current technological lead, as well as the extensibility of our platform, that has prompted MSSPs and outsourcers to feature Qualys products in their offering. Let me describe the new MSSP arrangement we've reached in the first quarter.
For the existing base of renewing end customers we share, these MSSP has extended their commitment to Qualys by entering into a multiyear with fixed quarterly payments instead of individual contract for each customer. I'm pleased to report that this improved our revenue predictability as revenue that would have been subject to varying renewal dates is now on a quarterly program. The streamlined arrangement also reduces our costs. Expanding the scope of our capabilities also allows customers to standardize on the Qualys security platform. We're seeing more and more enterprises adopt multiple solutions in their initial contract with us.
We have already shared that the majority of our customers have more than one of our offerings. We believe that the increasing occurrence of standardization arrangements, both with customers and with partners will result in our winning a larger share of the security wallet and allows us to outpace the core VM market growth rate, which IDC pegs at 10%. I will note that these larger contracts and renewals with upsells can sometimes take a bit longer to close. At the end of the first quarter, a few renewing customers took longer than we expected to close the upsell components of the contract, which delayed the issuance of this purchase order. Most of these POs were received early in the second quarter, so the differential is days, not months. You will note the effect of their timing in lower than expected backlog growth and deferred revenues in Q1.
There is no change to the revenue we expect to recognize from these contracts for the full year 2016. With upsells becoming larger, in some cases, multiple of a customer core VM subscription, we have decided to decouple the renewals from the upsell negotiations. Renewals will be executed when they are due and upsell will be completed separately. We expect this will restore the predictability of the renewal revenue streams. In general, the timing of larger contract encompassing multiple products is harder to predict, reducing somewhat our visibility on the timing of revenue streams for new business and upsells. As it is a sign of our becoming a more strategic vendor to our customers, increasing our shares of our customer spend, this is a trade I'm quite happy to make.
We're making terrific progress in our evolution from a single product company to a strategic platform vendor with multiple integrated solutions. One key aspect of scaling up is adding talent. I could not be more pleased to introduce our newly appointed CFO, Melissa Fisher, who joined us last week. Melissa is joining Qualys at a pivotal time in our history. She brings a unique blend of tech industry operational experience and Wall Street savvy. She was most recently at Zynga, and before that at Digital River, an enterprise SaaS software company. Before moving into industry, Melissa built a tremendous amount of public markets experience in a 15-year career in investment banking. She worked with technology companies on both M&A and financings for such banks as Goldman Sachs and Bank of America. Melissa will lead all the elements of the company's financial organization, including finance, accounting, investor relations, treasury, and tax.
Welcome to Qualys, Melissa.
Thanks, Philippe. I'm thrilled to join the Qualys team at this exciting time as the company continues to leverage its cloud-based platform to be a strategic partner to its customers. I have spent most of my career working with software companies, it's unusual to find a SaaS company so focused on customer success, yet which developed early on a sustainable, scalable business model with both leading margins and multiple levers of growth in front of it. I see Qualys as a pioneer and visionary, having built a disruptive offering that eliminates the infrastructure operations and maintenance costs of traditional enterprise security software solutions. Like we have already seen with commercial software, the security industry is ripe for the adoption of cloud-based solutions and is in much need of vendor consolidation.
Qualys is uniquely positioned with its platform to easily enable additional features and applications, thus becoming a one-stop shop for IT security and compliance solutions for its customers, a significant competitive advantage. This added value can enable higher growth for Qualys as it enlarges its market opportunity by expanding the scope of the solution and coverage to additional devices. I look forward to leading the dialogue with our investors and analysts in the coming weeks about our competitive positioning in the market, our business, and opportunities for growth.
Thanks, Melissa. I look forward to working with you. Welcome. We're indeed at an exciting point in our history. Qualys has evolved from a point solution vendor to a strategic platform. Today, we're becoming recognized as the disruptive cloud-based security and compliance platform delivering centrally managed and self-updating security and compliance solutions. While IDC estimates that the vulnerability management market will grow at 10% in 2016, we are sustaining top-line growth at about twice that rate by offering a rich set of incremental capabilities such as Elasticsearch, dynamic dashboards, Asset View, Cloud Agents, and Threat Protect, which help our customers deploy state-of-the-art security and compliance at a much lower total cost of ownership. We are seeing strong demand for agent technology as we see both our existing and new clients driving rapid uptake rates.
We believe our platform provides us with a unique ability to benefit from the trend toward vendor consolidation, which we are beginning to see in our expanding deal sizes and the standardization on Qualys by MSSPs and outsourcers. We have enhanced our management team with the addition of Melissa, as well as new business development, sales, and product marketing talent. We'll continue to add the executives that we believe are necessary to support our next phase of growth. We could not be more pleased with the talent we're attracting. We're off to an excellent start for 2016. Nancy will now take you through the details of the first quarter financials. Nancy.
Thanks, Philippe, and good afternoon. Total revenues in the first quarter were $46.2 million, which represented 23% growth over the first quarter of 2015. As Philippe noted, our first quarter results include the benefit of the new arrangement with one of our MSSPs. The change resulted in some revenue that would have been recognized over the course of 2016, being additionally recognized in the first quarter. Excluding the effect of this change, our revenue growth would have been at the high end of our guidance at 21%. Our current deferred revenue balance was $102 million at March 31, 2016, 15.5% greater than our balance at March 31, 2015.
While there is some negative impact from the new contract terms associated with the MSSP we've mentioned, specifically the effect of quarterly billing instead of annual billing, we also had a few renewals that we expected would close in Q1 push out a few days into Q2. As Philippe noted, these delays were the result of the longer procurement processes associated with customers purchasing additional solutions on top of their renewing subscription. While the timing impacts our current deferred balance as of March 31, it does not impact our expectations for the contribution from these accounts for the full year. The U.S. represented 71% of revenues, slightly higher than the first quarter of 2015. Foreign currency continued to present a headwind, which we expect to decline over the course of the year, becoming negligible by year-end. Moving down the P&L.
For the first quarter of 2016, we are reporting both GAAP and non-GAAP results. A full reconciliation of all GAAP to non-GAAP measures is provided in the financial tables of the press release we issued earlier today and is available on the investor section of our website. To provide investors with additional information regarding our financial results, we disclose adjusted EBITDA, adjusted EBITDA margin, and free cash flows, which are non-GAAP measures. We have provided a full reconciliation table in our press release. GAAP gross profit increased by 25% to $36.8 million in the first quarter of 2016. GAAP gross margin was 80% compared to 79% in the same period last year. Non-GAAP gross margin was 80% in both periods. Adjusted EBITDA for the first quarter of 2016 increased by 35% to $16.1 million, compared to $12.0 million in the first quarter of 2015.
The MSSP contract change had a positive effect since revenues were higher, but excluding this impact, adjusted EBITDA would have still increased over the first quarter of 2015. Adjusted EBITDA margin increased to 35% in the first quarter of 2016 compared to 32% in the prior year first quarter. Margins are expanding as we add services to our platform and get better at leveraging channel partners. Net cash from operations in the first quarter of 2016 increased by 71% to $17.1 million, compared to $10.0 million in the same period in 2015. Free cash flow generated in the first quarter of 2016 was $12.8 million, compared to $3.8 million in the comparable period of 2015. The significant change is a strong indicator that our business is scaling up successfully.
In the first quarter of 2016, capital expenditures were $4.2 million, compared to $6.1 million in the first quarter of 2015. In the second quarter of 2016, we expect capital expenditures to be in the range of $5 million to $6 million. Moving on to earnings per share. For the first quarter of 2016, GAAP EPS was $0.13 per diluted share versus $0.08 for the first quarter of 2015. Non-GAAP EPS was $0.21 per diluted share in the first quarter of 2016, up from $0.15 in the first quarter of 2015, and also ahead of our guidance of $0.14-$0.16 per diluted share. Turning to guidance, starting with revenues. For the second quarter of 2016, we expect revenues to be in the range of $47.6 million-$48.3 million. At the midpoint, this represents 20% growth over second quarter 2015 revenues.
For the full year 2016, balancing the effect of the increased revenue from the new MSSP arrangement and the momentum we are seeing in the business with somewhat uncertain timing of increasingly larger contracts, we are reiterating our outlook for revenues to be in the range of $195.6 million-$198.6 million. At the midpoint, this represents 20% growth over 2015 revenues. As to earnings per share guidance, we expect GAAP EPS for the second quarter of 2016 to be in the range of $0.06-$0.08 per diluted share, and non-GAAP EPS is expected to be in the range of $0.15-$0.17 per diluted share. For the full year of 2016, we are reiterating our expectations for GAAP EPS to be in the range of $0.36-$0.41 and non-GAAP EPS to be in the range of $0.74-$0.79.
Our second quarter EPS estimates are based on approximately 38.4 million weighted average diluted shares outstanding, and our full-year 2016 EPS estimates are based on approximately 38.9 million shares outstanding. For the second quarter and full year 2016, we have used an expected effective GAAP tax rate of 37% and an expected effective non-GAAP tax rate of 36%. With that, Philippe and I would be happy to answer any of your questions. Operator?
Thank you. Ladies and gentlemen, if you have a question at this time, please press the star then the one key on your touch-tone telephone. If your question has been answered or you wish to remove yourself from the queue, please press the pound key. As a reminder, please limit yourself to one question. Our first question comes from the line of Sitikantha Panigrahi of Credit Suisse. Your line is now open. Please go ahead.
Thanks. Melissa, congratulations on your role as CFO.
Thank you.
Philippe, I just wanted to dig into this billings weakness. How much of that, the MSSP R&D, you're saying, how much of that as a percentage of your business? Also, you talk about some of the deals missed. Did you close all the deals that are in Q2? Just I have a follow-up.
Essentially, as you just said, it's a combination of the fact that we wanted quarterly payments instead of yearly payment with these large MSSP, that's one factor. The other factor, which is a good thing, is that we are seeing larger upsell with our renewals, and some of these renewals, which arrive at the end of the quarter, are just dragged because of these additional purchases, which put them back into procurement, and that's few delays. That shifts the business. As I mentioned in the script, this is not months, this is days. In fact, yes, we did receive the majority or most of these orders, if not all, and we expect to have them all.
This is why we took some measures now to decouple the revenues, the renewals from the upsell and insisting that our customers renew at the date at which they will renew. If the upsell come later, then so be it, instead of having to drag everything together. That's a new measure that we've implemented with our sales force.
Just digging into the VM market, you said it's growing around 10%. What is the growth rate for you guys in Q1? If you could give some color in terms of what you're seeing in the market in terms of competition or pricing pressure or anything you're seeing there.
Yes. In fact, IDC projects that the growth rate of the overall vulnerability management and application is about 10% growth rates, we're essentially growing. We have been, by the way, growing at that rate for the last eight, nine quarters, two years. We believe we can absolutely maintain, if not exceed that growth rate. It's because of the addition of the new services which now fall into the bucket of VM, such as continuous monitoring, the Cloud Agents and our Threat Protection, which by the way, went GA, as we had announced, went GA this month. We're expecting quite a big uptake from Threat Protection. We have already a big pent-up demand and quite a few trials, which I think will turn into purchase order pretty quickly. That's the new dynamic, if you prefer, on VM.
As I mentioned also earlier, our Cloud Agents are not only a significant upsell potential for the VM, but also brings real-time capabilities to VM and have become a significant differentiator. While we see our competitors fighting and trying to reduce the price as they compete with themselves, we'll be capable of really maintaining our pricing.
Just to clarify, Siti, when we're talking about the market versus our growth rate, we've been growing at double the market rate, we don't see any reason that should slow down.
Correct. That's what I think I said. Yeah. Mm-hmm.
Thank you.
Thank you. Our next question comes from the line of Steve Ashley of Robert W. Baird. Your line is now open. Please go ahead.
Terrific. Just like to go back on Siti's question regarding the impact of the slipped deals and then the one MSSP deal on deferred revenue. Can you give us any idea how many millions of dollars we're talking about associated with those events? Is it a couple million dollars? Is it more than that? Any quantification there would be helpful.
Yes, we're in the couple of millions of dollars. Yes.
Okay. Perfect.
It's the combination of both.
Right.
Excluding the impact of the MSSP as well as the slipped deals, deferred revenue growth would've been largely in line with the historical periods.
Yeah. Maybe a couple million higher. That's terrific. Then I was just gonna ask on the Cloud Agent business, what was the impact in the period? Meaning, was there actually billings, and did you sign deals, and can you tell us a little bit more color on that?
Oh, yes. No, we did sign deals. They are part of the billings. We see a significant pent-up demand to give you. This is something that we expect to accelerate and to continue. A huge success. Huge success from, by the way, every components of our business, which means the large enterprise, the mid-market, and the SMB. Everybody's taking on the Cloud Agent. We saw, first of all, to be a bit more, we see more today an uptake on the Cloud Agent for the VM, and now we're starting to see an uptake on the Cloud Agent on the policy compliance application as well.
Perfect. Thank you.
Thank you. Our next question comes from Sterling Auty of J.P. Morgan. Your line is now open. Please go ahead.
Yeah, thanks. One question, one follow-up. I guess it wasn't clear. You usually give vulnerability management as a percentage of the total. What was the percentage this quarter?
The split between VM and non-VM is still largely about 80/20, as we have with previous periods. We wanted to point out that the characterization is changing. The VM business is evolving, a lot of our new services are VM-related, continuous monitoring, Cloud Agent, Threat Protection. We expect that VM and non-VM will continue to both grow at similar paces. It may still be 80/20.
Yeah. I could add even some more specifics, Sterling, I think we discussed that as well at the last earnings call. If you look today at the agent, the agent does two things. One is that it increased the value of our existing renewal base as people are adding the agent to the devices that they are currently scan, and that essentially creates an uplift to our subscription. They also bring us now to two new market for us, which are the endpoints and as well as the elastic cloud environment. That's a significant new driver of our business. Other example, like the continuous monitoring, which we see a continuous adoption of the continuous monitoring, added about 20% of the VM subscription for those who adopt the continuous monitoring. Threat Protection, we have priced that at 30% of the current subscription.
As you can see, we have built significant accelerator around our VM business. The thing to point out here is that this is an extremely leveraged business. It doesn't cost us significantly more to essentially add, provide these new capabilities to our customers. The purchasing for them is very easy. They do the trial, they like what they see, then they just send us a purchase order. It's very efficient and effective model that we have built. Okay?
Got you. As the follow-up, if I add a couple million into kind of the revenue plus change in deferred revenue, I'm still seeing a pretty healthy deceleration. I want to connect the dots between that, along with sales and marketing, I imagine was a little bit light as some commission expenses probably slipped into the second quarter on the timing of those deals, but also the commentary about deal sizes growing and some of the factors that would intimate that maybe we're seeing some acceleration in the fundamental business.
I'm not so sure that I understand here, your meaning, the acceleration that you mean. I'm not sure that I understand exactly the point here.
If I add $2 million into, if I look at revenue plus the change in deferred, if I add $2 million to account for the MSSP deal and the slipped deals, it would put kind of a proxy for billings at about $50.3 million, which would be up about 14%, as compared to through most of the last year, it was growing anywhere between 20%-29%. I didn't know if there was other structural changes in terms of the billings on other contracts that just aren't showing up in deferred revenue, because I wonder, what's going to be the better indication of the top-line revenue growth sustainability? Is it what's the top line growing today, or is the revenue plus change in deferred maybe a leading indicator of perhaps some slowdown in revenue growth as we move through the year?
I think the couple million, it's actually a little low. It's probably the combination of both the MSSP deal plus the slipped deals into Q2 is a little bit more than that. I think the other thing that we should be considering as well is that, historically, most of our subscriptions have had annual billings. This MSSP deal specifically was a quarterly billing arrangement. That changes a little bit of how we look at deferred revenue.
Yeah. I will add also that we have a very healthy pipeline. As we see, we see still a very strong business. I think this is more the fact that today timing is becoming a much bigger element than it used to be in the past. I think we discussed that also earlier on. The timing of big deals, when they arrive, whether they arrive at the end, in the beginning or in the middle of the quarter, all of that are starting to be significant as we do $1 million of sales, for example, today, which was a year ago, was essentially extremely rare. Our business has changed in many ways and for the better. I think we have a very strong pipeline. We see the market fundamentally coming our way.
Let me re-emphasize again that we don't see our VM market going down as some people have predicted. We see the market growing up significantly. The VM market is becoming very strategic and for one very simple reason. Today, companies are realizing that you cannot secure what you don't know. What vulnerability management does is allowing you to identify all of your global IT assets, and Qualys does that better than anybody else. From there, you want to ensure that you have a good view on the security and compliance of those assets, that you understand the vulnerabilities. Now with Threat Protection, we allows you to prioritize the remediation according to the threats out there. That's another significant enhancement. It's totally native.
Our current customers today could only do that by either buying additional solution or just putting the data into Splunk and doing the correlation themselves. Now all of that is native on Qualys. That's what I've mentioned earlier, that we see a significant pent-up demand for this solution, Cloud Agent and Threat Protect. Okay?
Thank you.
Thank you. Our next question comes from the line of Michael Kim of Imperial Capital. Your line is now open. Please go ahead.
Hi, good afternoon, guys, and welcome, Melissa, to your new appointment, to your new position.
Thank you.
Regards to the MSSP channel, do you see an underlying shift towards multi-year and quarterly billings away from annual and more broadly with the indirect channel? Are you continuing to see that becoming a larger portion of the mix?
Yes. In fact, the MSSP's channel, we like it very much and as you may recall, we have already a significant share of the MSSPs, and we believe we're going to continue adding more. For us, we're becoming very strategic for them because it's a natural complement, or the services that we provide are a natural complement of their business. We also add additional profitability, and that's the reason why we see them more and more looking, instead of having like they were doing in the past, buying a customer at a time, they're already coming to us to essentially negotiate a longer-term contract, which, of course, again, some preferable treatment in terms of the pricing that give us significantly more predictability and I would say add exclusivity also to our contract because, of course, they are not going to provide any other solution than Qualys.
We see that as a recognition, one of the fact that we are out-of-the-box essentially highly scalable, we deploy globally, we integrate very easily with their services. That's a huge position of strength and of predictability. It's also very cost-effective for us because we don't need, of course, to have salespeople out there pushing our solution as they come with the managed security service providers offering. They have huge salesforce as well. We see that same trend now happening with the outsourcers, which see Qualys as a very strategic component. To finish on the channel, we see the traditional enterprise channel, which are very much interested of Qualys because now the breadth of product and because of the platform. We see also the traditional channel coming our way.
Bottom line, as I mentioned earlier, we do anticipate to see more, and we have been seeing an increased volume from our channels. We don't see that yet that much on the revenue side because we, as I mentioned earlier, are doing very big upsell with our current and large customers. That in a way masks the fact that a lot of new business, for example, is coming now through our channel partners. It's not yet enough volume of growth there to compensate for the big large upsell that we're seeing with our current install base, and direct partners, which again, is quite sizable as we have 60% of the Fortune 100 today.
With regards to the upsells, can you characterize what's driving the larger upsells? Is it primarily focused on VM or are they taking on additional Qualys solutions, Policy Compliance or Web Application Scanning? Any color would be helpful.
It's a combination of everything. As we mentioned many times, we are still far being penetrated fully with all of our customers. We have some customers, large financial institution that deployed Qualys and that resulting in seven times the initial VM subscription. It has been a long process to get to this huge deployment. The advantage of Qualys here is that we deploy at the scale that no competitor can follow us. That's very good for us. We have very large upsell on VM, some customers are now suddenly adding the Policy Compliance, the Vulnerability Management application, again, the Cloud Agent, and very soon, Threat Protection. All of that creates naturally large upsells on a customer base, which today is pretty big.
We have very good upsells on the enterprise market, on the mid-market, much less upsells on the low end of the marketplace, the SMB, because this is more like an all-in-one solution. On the SME and the enterprise, we see a very healthy business of upsells.
Great. Thank you very much.
Thank you. Our next question comes from the line of Rob Owens of Pacific Crest. Your line is now open. Please go ahead.
Great, thanks for taking my question. Curious how the quarter played out from a linearity standpoint.
Okay. Nancy,
In Q1, it actually was okay. Excluding the impact of MSSP and these large deals, our revenue actually ended up in the high end of the guidance anyway. It means that the activities this quarter really didn't have a huge impact on linearity. It does a little bit going forward. The timing of when these larger deals are closed will have an impact, but in Q1, it didn't have much.
To that point then, Nancy, what happened to DSOs? Because they seem to slip quite a bit, and I would think given the relationship with the MSSP and the payment terms associated with that, you would have shown better DSO, but given that slippage, it points to weaker linearity. Just trying to, I guess, understand the two different comments.
I'd have to take a look at the DSOs, but I
From a revenue standpoint, it didn't really have an impact. I think we have had continued work to do on the collection side of things that carried over a little bit from year-end, that you're probably still seeing a little bit of that impact or you're still seeing some of that on the March 31st balance sheet.
Okay, great. Then in terms of the growth, the 20% year-over-year, can you help me understand what's coming from existing customers in terms of renewal with upsell or expanded opportunities versus new customers and what they're driving in terms of growth? I know it's not something you've historically split out, but any color would be helpful. Thanks.
Yeah. What I would say here, this is part of maybe a much bigger discussion here, as it's very clear that some of the guidance that we provide, we'll revise that because they do not represent anymore really the Qualys business. One example of that is the number of customers which have acquired more than one solution, which was around 62%, if I remember correctly. That doesn't represent at all anymore the adoption. We know that most of our customers, if not the majority, they are adopting our new solution. The SMBs, again, being an all-in-one, there's not much upsell there. They do represent the fast-growing segment of our customer base. We do not have provided the mix between existing customers and new customers.
I think now with Melissa coming on board, I think one of her tasks will be to really sit down and absolutely look at what is the guidance, the color that we should be providing with you guys.
Great. Thanks for taking my questions.
Thank you. Our next question comes from the line of Gur Talpaz of Stifel. Your line is now open. Please go ahead.
Great. This is actually Chris Speros on for Gur. Can you guys talk about the traction you're seeing with your secondary solutions, specifically the WAF? Are customers outside of your VM install base expressing interest in those products?
Okay. The WAF specifically, as we discussed last time on the earnings calls, it's doing well. We are expecting that component of the marketplace to accelerate with the combination of our WAF. If you recall, we had introduced the WAF, the Web Application Firewall, quite a while ago. We put it back because we wanted to do some more engineering work on it. We still believe that we are on track to bring that at the end of the summer. I think the combination of WAS and WAF will essentially bring us into defining a new category, which will be the web application security, instead of making the distinction between web application scanning on one hand, which is to identify the vulnerabilities on your web application, and Qualys does that at a scale that, again, none of our competitors follow.
Adding the WAF, which is the remediation. Having essentially WAS and WAF together, that, I think, will really provide a very strong offering in the marketplace.
Great. One follow-up, if you don't mind. Are you guys seeing any benefit from McAfee's discontinuing of their VM product?
Significant. In fact, today, we have been replacing gradually the large installation of McAfee. I could divide that McAfee market into two, the large accounts and the more smaller accounts. On the large accounts, Qualys was always essentially the market dominant, but it was taking time because to displace this kind of solution once they've been established takes time. Now, of course, with the fact that they have thrown down the gauntlet or abandoned that marketplace, this is in fact accelerating the demand for the Qualys solution for the large accounts. There we're very uniquely positioned against our competition because of scale, again. On the mid-market, that's where we're competing more actively with our competitors there.
For us, it's very good news because it accelerates the adoption of Qualys by these large McAfee accounts since they have abandoned them, and we are currently bidding quite a few of them.
All right. Thank you.
Thank you. Our next question comes from the line of Srini Nandury of Summit Redstone. Your line is now open. Please go ahead.
All right. Thank you for taking my call. Philippe, can you talk about the competitive landscape for a moment? How do you see Rapid7 and Tanium in the market, do you see them in your accounts? Can you talk about the win-loss rate if you're competing against them? In general, can you also talk about your deal cycles the last one year? Have you seen any lengthening of the deal cycles over the past one year? Thank you.
What was the last question? If I've seen the deals increasing or in size?
No, the deal cycles.
Oh, the deal cycle. Okay, to speak about the competition, today we see Rapid7, they're strong where they always have been strong, which is in the mid-market, and we compete very actively against them, and I would say successfully. We do not see them being really capable of moving into the cloud because that's a huge undertaking. They have made, as I'm sure you know this, since that's been published by them, they're trying to move more into analytics as a company, so that's the direction they take. Ultimately, I think this is their goal, competing against Splunk. Of course, this is not the direction that we have taken. Regarding, you mentioned Tanium. Tanium is trying to enter the security market. Tanium is not really a security play.
Tanium, at dawn, it was a replacement of BigFix, where instead of having to build this enterprise, if you prefer, infrastructure to deliver the BigFix agent, they went with a peer-to-peer architecture, which makes it much easier to deploy patches and also to query these agents to identify. We compete extremely well now with Tanium, with our asset view capabilities, so we can give enterprises a two-second visibility on their global IT assets. We're entering their market, essentially. On the vulnerability management and policy compliance side, we have a far better solution than Tanium, but they are trying to enter our market. I think we do not see them ultimately as a long-term competitor there.
We have essentially another competitor, which is Tenable, which is not public, and which is trying to move into the cloud, but that's a huge undertaking for them. They are not also very present of the large enterprise, which is a marketplace that we dominate, and we compete with them much more on the consulting side, and as well as the federal side, which for us is a very new market that we are entering. As we indicated earlier, we are not counting on much revenues from the federal side in 2016. We are very now focused at essentially getting our share of the federal market.
Philippe, what about the deal sizes?
The deal sizes, deals have increased significantly. We start to really do deals which, from the get-go, are half a million dollars and up, which is something relatively new with Qualys. As far as the selling cycle, I think it's about the same. I don't see the selling cycle having changed much. It varies, of course, depending on a large enterprise, it's typically a one-year selling cycle, and on the mid-market, it's about less than six months, and on the SME market, it's less than three months.
All right. Thank you. Thank you very much for the detailed explanation.
Thank you. Our next question comes from the line of Jack Andrews of D.A. Davidson. Your line is now open. Please go ahead.
Good afternoon. Thanks for taking the question. You announced the addition of a new chief marketing officer during the quarter. I was just wondering if you could talk a little bit about what his priorities and strategic initiatives are going to be focused on.
As I mentioned earlier, we have embarked into the positioning of Qualys as much more as a platform. The philosophy of Qualys has been always that we don't advertise things until we have reached a point where we can really claim it. Today, as you will see, essentially a new positioning of Qualys as the disruptive cloud security and compliance platform, which essentially consolidates today about six security and compliance enterprise solution. Of course, more to come. That's the new positioning that we're taking, which you are going to see starting at the Gartner conference. That's where we're focusing essentially on the positioning of Qualys. All that will be followed by a reach out to the CIOs, as today we can essentially answer the question that any CIO has, which are these three question.
We can give them the global view of their asset inventory. Second, we can provide them with a continuous view of the security compliance posture of those assets. Third, we can essentially aid them in their vendor consolidation efforts and save them millions of dollars because we eliminate a lot of these enterprise security and compliance solution, which have their own infrastructure that companies have to deploy and to maintain. I think we're extremely well-positioned here, as we mentioned earlier.
Thank you. Just as a quick follow-up, you mentioned that foreign exchange was a modest headwind in the quarter. Are you able to quantify that at all?
No, we didn't say it was a modest effect. In fact, if you refer last year, because we have a very strong presence in Europe today, we had a big foreign exchange start headwind last year, it continues essentially in Q1 and in Q2, will gradually disappear by the end of the year. That's where we are, what we're talking here about a little bit less now than the couple.
Thank you. Our next question comes from the line of Matthew Hedberg of RBC Capital Markets. Your line is now open. Please go ahead.
Thanks. This is actually Matthew Swanson on for Matt. You talked a lot about the strong customer reaction to Threat Protection. Could you maybe go over some of the key features that are making that such an attractive solution? With that large pipeline, maybe how you see that materializing throughout the year?
One of the challenges that we had before, if you look at our customers, the number one challenge that, especially large customers, it's a bit less true or a bit still there for the smaller customers. Large customers, you're now dealing with millions of vulnerabilities, in some cases hundreds of thousand, and you need to prioritize. You cannot do everything at once. Anything which can help customers prioritizing the remediation of their vulnerabilities is something which is absolutely needed. In the past, because we didn't have Elasticsearch, sifting through large volumes of vulnerabilities and matching that, correlating that with threats which are known out there. Like for example, we know there's an exploit leveraging vulnerability XYZ. For us to do that natively into Qualys was very difficult because we didn't have built into our platform, Elasticsearch capabilities.
What our customers were doing, they had two solutions, either to go to solutions, like we're providing these capabilities by extracting the data from Qualys, correlating the data from threat sources, and providing them that ability then to sort through. That was one way, which of course added dollars, significant dollars to the subscription, plus of the fact that having to maintain another application, another database, et cetera. The other way they could do it was to go to Splunk and take the data of Qualys, put that into Splunk, and bring into Splunk the threat information and themselves doing the correlation of that information. Again, another additional cost, significant additional cost, as well as having to maintain and build all of that. Today, all of that is native on Qualys.
Needless to say, those customers who are already using this solution that I mentioned are very eager to switch to Qualys, that's an easy sell. It's almost an ROI that we can make here. New customers are very attracted to that because, again, it's native into the platform. We have today, and we know that for a fact, we have a big demand. It went GA at the end of this month, and we're expecting to see orders materialize. Of course, it's too early for us to give some trend. I mentioned earlier that we charge about 30% of the VM subscription of our customers, that's not an insignificant upsell. Still, at that pricing, it's more cost-effective than using Qualys than going through other solutions.
It's safe to say at this point it's not included in any guidance?
We never typically do, in our guidance, include any kind of new services. We're cautious about that because until we have enough data points, it's much more difficult to predict the curve and then of course from ACV, translate that into revenues. As you know, that's one of the disadvantage of the SaaS model is that we just don't take the revenue up front, like enterprise software. We just take the revenue across. All that makes that in terms of translating into revenues, it takes some time.
All right. Thank you for your time.
Thank you. Our next question comes from the line of Erik Suppiger of JMP. Your line is now open. Please go ahead.
Thanks for taking the question. A couple of questions on this MSSP. Can you explain how the nature of that relationship changed? Did they become a much bigger MSSP customer, or is it just that you wanted a more consistent revenue stream? Well, first I'll let you answer that, and then I've got a follow-up.
The answer to this question is both. Yes, it give us more predictability. It's a win-win for both. This was at their request, by the way, to us. Essentially, they see Qualys more strategic. They are committed to us, they believe they can essentially grow more business, I think it's a win-win for both of us.
Was the impact from the MSSP, in terms of the deferred revenue, was the impact from the MSSP bigger or smaller than the impact from the deals that had slipped?
Smaller.
That was a smaller portion? Okay.
Right.
Can you give us a sense for what the growth was with your traditional emerging products, the web app scanning and the policy compliance?
We've been essentially growing the VM in the 20% range and these other ones were around 30% growth rates.
Okay.
Again, it varies today because we do bigger upsells today, it varies. We're not anymore, again, this is a business which has become, which is a good thing, which has become a little bit more lumpier in the sense that we do these bigger upsells, both in WAS, both in policy compliance, et cetera. It varies from quarter to quarter now.
Our next question comes from the line of Robert Breza of Wunderlich Securities. Your line is now open. Please go ahead.
Hi. Thanks for taking my question. Nancy, I was wondering if you can help us reconcile the EPS beat. You take your guidance, you beat by about $0.06, yet left the full year unchanged. Essentially it would tell me that you're expecting those costs that you were able to avoid in the first quarter to occur throughout the remainder of the year. Can you just help us reconcile the $0.06 beat and not passing that beat on through to the full-year number? Thanks.
The revenue guidance for full year hasn't changed. We still expect to increase our expenditures in absolute dollars sequentially in the rest of the year. Really at this point, we're still relatively early in the year. We've got a new CFO on board. We just thought it'd be better judgment to just sort of maintain our EPS guidance for full year.
Okay, then maybe as a follow-up, I think it's given the commentary and the questions around the MSSP and Qualys, can you just quantify what the MSSP impact was to the quarter and the full year?
No, that's not something that we're going to provide in detail because we talked about it having an impact in Q1, and it is going to have an impact on the rest of the year as well. Given the momentum of the business, the uncertainty of timing in larger deals, we've left our revenue guidance as is as well. This is something like, as I said, we're still relatively early in the year, and we'll look at this as the year progresses.
Thank you.
Thank you. I'm showing no further questions at this time. I would now like to turn the call over to Mr. Philippe Courtot for closing remarks.
Okay, thank you very much. Again, we have a very strong pipeline. As I mentioned in the last call, we are now seriously looking at some potential acquisitions or partnerships or OEM relationships so we could accelerate some of the engineering developments that we currently have or accelerating our entrance into new markets with our VP of corporate development. I thank you for attending our Q1 earning call, and we look forward to seeing all of you in early June and at the D.A. Davidson Technology Forum in New York City, at the Bank of America Technology Conference in San Francisco, and the Robert W. Baird Conference in New York City. With that, good afternoon. Thank you.
Ladies and gentlemen, thank you for participating in today's conference. This concludes today's program. You may all disconnect. Everyone have a great day.