Ladies and gentlemen, thank you for standing by, and welcome to the Qualys third quarter 2020 investor conference call. At this time, all participants are in a listen only mode. After the speaker presentation, there will be a question and answer session. To ask a question during the session, you will need to press star one on your telephone. Please be advised that today's conference may be recorded. If you require any further assistance, please press star zero. I would now like to hand the conference over to your speaker today, Vinayak Rao, Vice President, Corporate Development and Investor Relations. Please go ahead, sir.
Good afternoon, and welcome to Qualys third quarter 2020 earnings call. Joining me today to discuss the results are Philippe Courtot, our Chairman and CEO, and Joo Mi Kim, our CFO. Before we get started, I would like to remind you that the remarks today will include forward-looking statements that generally relate to future events or our future financial or operating performance.
Actual results may differ materially from these statements. Factors that could cause results to differ materially are set forth in today's press release and in our filings with the SEC, including our latest Form 10-Q and 10-K. Any forward-looking statements that we make on this call are based on assumptions as of today, and we undertake no obligation to update these statements as a result of new information or future events. During this call, we present both GAAP and Non-GAAP financial measures.
A reconciliation of GAAP to Non-GAAP measures is included in today's earnings press release. As a reminder, the press release, prepared remarks, and investor presentation are available on our website. With that, I'd like to turn the call over to Philippe.
Thank you, Vinayak, welcome everyone to our Q3 earnings call. Let me begin by saying that we hope you and your families are healthy and safe. With the ongoing COVID-19 pandemic, our workforce continues to operate remotely, and our top priority remains providing support for our employees, partners, and customers. We're fortunate that the nature of our business allows us to successfully operate in this dynamic work environment.
We've been able to adapt to the current challenges and deliver the results we had set out to accomplish last quarter. Joo Mi and I are pleased to report another good quarter in terms of revenue growth and profitability. We also had strong growth in our paid cloud agent subscription, with 50 million now representing nearly 80% growth from the prior year's quarter.
This multifunction, lightweight Qualys Cloud Agent provides visibility across the entire hybrid environment and is the underlying technology for seven of the security compliance and IT solutions that are natively integrated on our platform. That is VMDR for Vulnerability Management, Detection, and Response, Multi-Vector EDR, Endpoint Detection and Response, Policy Compliance, File Integrity Monitoring, Patch Management, Global IT Asset Inventory, and the upcoming Certificate Management, and more to come.
Qualys VMDR has taken Vulnerability Management to the next level by providing the power to continuously detect vulnerabilities and misconfiguration across the entire global IT environment and responds in real time to remediate assets that are vulnerable or already compromised from a single platform with built-in orchestration. Currently, approximately 1,250 customers have adopted VMDR, which includes over 350 new customers.
Qualys VMDR has not only been a huge success with customers, but it's also driving further penetration of our Cloud Agents because of our Global IT Asset Inventory, which is bundled in it. Since VMDR has proliferated our Cloud Agent, it in turn sets a foundation for further upsells or other paid application. This quarter, we announced the general availability of our Multi-Vector EDR solution. This Multi-Vector solution unifies different context vector like asset discovery, vulnerabilities and exploits, misconfiguration, in-depth endpoint telemetry, and network reachability with our powerful backend for accurate assessment, detection, and response, all in a single cloud-based app.
As an app built natively on the Qualys cloud platform, our Multi-Vector EDR leverages its power, scale, and accuracy to correlate billions of global events with threat intelligence, analytics, and machine learning to provide unprecedented context and real-time insight into the endpoint to carry out rapid threat hunting and response. Qualys, in fact, Multi-Vector EDR goes beyond traditional EDR solutions by providing comprehensive response capabilities such as killing processes and quarantining files or endpoints, while also uniquely preventing future attacks by orchestrating responses such as patching vulnerabilities, removing exploits, fixing misconfigurations, or uninstalling software before endpoints are compromised.
Since our Multi-Vector EDR encompasses the entire attack life cycle, it makes it easier to automate the response and dramatically reduce the number of false positives. The combination of Qualys VMDR and Multi-Vector EDR allows us to provide a single end-to-end workflow that helps companies greatly reduce the time to respond and allows for the consolidation of the security stack.
We're now providing a comprehensive two-way inventory synchronization with ServiceNow Service Graph CMDB as part of their new Service Graph connector program. This new integration helps customers to quickly, easily, and reliably load their complete and contextualized asset information into ServiceNow, enabling a consistent and consolidated data set across hybrid IT environments, thus providing with an always up-to-date source of truth across their hybrid environment.
In addition, we continue to see good adoption of our cloud-based remote endpoint protection solution, which leverages the Qualys Cloud Agent and its cloud-based architecture to deliver instant and continuous visibility of remote computers as well as their installed application, obtain a real-time view of all critical vulnerabilities and misconfigurations, and remotely deploy missing patches for critical vulnerabilities.
We currently have approximately 700 companies, including 300 customers prospect, actively using this free service offering. In terms of our newer paid solution, we saw solid growth this quarter with our paid Global IT Asset Discovery and Inventory application. In fact, a large managed healthcare organization added our Global IT Asset Discovery and Inventory paid module this quarter in order to gain visibility of all their known and unknown assets across multiple environments, identifying the end of life of their installed software and synchronize with their ServiceNow CMDB.
Patch Management continued to see strong customer adoption, both in the mid-market as well as with the large customers. In Q3, a leading financial services firm selected our Patch Management application over several competing solutions, given its ability to easily and effectively patch remote endpoints without using the limited bandwidth available on VPN gateways. Finally, we also saw robust growth for our Container Security application with adoption from a respected regional financial institution that has already deployed VMDR and Policy Compliance. Now, on the go-to-market front, we're expanding our relationship with the next generation of managed security service providers, or MSSPs.
Given the increased breadth of our product suite with the addition of VMDR and Multi-Vector EDR, these MSSP can leverage the Qualys Cloud Platform to fully address the security needs of small and mid-sized customers that lack in-house resources to secure their hybrid environment, as well as addressing the needs of large companies.
We were pleased to announce that Infosys, a global leader in next-generation digital services and consulting, is integrating both VMDR and Multi-Vector EDR into its CyberNext platform, a managed security service offering. Powered by the Qualys Cloud Platform, Qualys VMDR and Multi-Vector EDR will collect vast amounts of telemetry from the Qualys Cloud Agent and multiple sensors to combine with network information for a broad view of the environment, going beyond just the endpoint. This significantly reduced lateral movement of security breaches to spread across from the initial point of compromise.
Infosys customers can also extend their use of the Cloud Agent to Patch Management, File Integrity Monitoring, and other functionalities. Deloitte Canada is now offering Qualys VMDR via its cyber risk services offering. Deloitte Canada clients now have access to the Qualys VMDR app as part of a holistic solution to meet their vulnerability threat management, VTM requirement, and provide visibility across their hybrid IT environment.
Qualys Cloud Agents are embedded and fully integrated with the Deloitte Cyber Intelligence Centre via APIs to deliver asset discovery and inventory, vulnerability assessment, including configuration control, threat prioritization, and patch detection to Deloitte's customer. Last week, we announced an expanded integration of Qualys Vulnerability Management with Microsoft Azure Arc, allowing customers to perform vulnerability scanning on servers outside of the Azure platform, including on-premises and multi-cloud servers.
This capability is available to all customers of Azure Defender for servers at no additional cost. We continue to invest in expanding the capabilities of our cloud platform and aggressively developing additional solutions. Looking ahead, we are enthused about the additional solution that we plan to introduce in the next few months. That is Container Runtime Security, which provide runtime defenses and protection capabilities for containerized application, now in GA.
Additional detection and response offering that we call DRs, such as Qualys SaaSDR, Qualys Cloud Detection and Response, and Qualys VMDR for Mobile Devices, which are also coming out of beta. Granular access control module and extension to our Global IT Asset Inventory. Multi-Vector EDR will be also available for Linux environment. In addition, an Endpoint Protection Platform, EPP, extension to our Multi-Vector EDR solution will be available in Q1 2021.
Major update to our passive scanning capabilities that will significantly expand our coverage of Industrial Control Systems, ICS, operational technology, OT, as well as IoT, Internet of Things devices. Finally, data lake/analytics/SIEM, or what is now called XDR platform, which seamlessly will integrate all our current and forthcoming detection and response solutions, or the DRs, has now entered beta with 10 design partners, and we're planning for it to go live by the end of Q1 2021. The development of these solutions has been possible because of the massive investment we made in our cloud platform and our strong engineering talent base in Pune, with over 900 employees located there.
These new initiatives open significant incremental market opportunity for us and allow our customers to easily and cost-effectively consolidate their stack of traditional security and compliance solutions while providing them a single pane of glass view on all assets across on-premise, endpoint, cloud, and mobile environment. Similar to our effort on the cloud platform front, we are also building a marketing platform that, combined with increased investment in sales management and sales capacity, will drive future profitable growth.
We will showcase this new solution at our upcoming QSC or Qualys Security Conference. I would like to personally invite you to attend this conference, which will be a 12-day virtual event from November ninth to 24. You could also listen to the presentation at your own leisure. We currently have more than 5,000 people registered. You can access the agenda and register for the conference at www.qualys.com/qsc/2020/virtual.
As mentioned earlier, replays of the session will be available on demand at the end of the day of when they are presented. At the conference, our President and Chief Product Officer, Sumedh Thakar, will discuss the evolution of our cloud platform, as well as our recently launched Multi-Vector EDR solution and forthcoming data lake/analytics/SIEM initiative or XDR platform extension.
Our attendees will have the opportunity to listen to customers such as the head of product security at Zoom, manager of information security operation at Jabil, and the senior security engineers at Informatica. We'll also present our risk-based approach to Vulnerability Management, providing forthcoming updates to our cloud and Container Security solution, share our view on risk management and compliance, and discuss our next generation web application and API security solutions. Our focus continues to remain on balancing growth with profitability.
The Qualys cloud platform serves as a distribution channel, enabling us to grow while maintaining industry-leading margins. Incremental future growth will be driven by our strong partnerships with MSSPs, as well as further investments in sales and marketing, as mentioned earlier, with the addition of highly qualified and technical individuals. On the hiring front, we are pleased to welcome back David French as EVP for the Americas Field Operation. David has extensive experience in sales and business development and will play an important role in driving continued growth for the company. Finally, M&A continues to be a part of our growth strategy as we seek to accelerate our product development and expand into adjacent markets.
Acquisitions over the past couple of years have complemented our organic product innovation, expanding our cloud platform to provide more comprehensive security and compliance coverage as well as visibility across all global IT assets across, again, on-premise, endpoint, mobile, cloud, containers, and now OT and IoT environments. Our cloud platform has now reached the level of maturity where we can potentially explore acquisitions to expand our customer base in a disciplined manner, as well as continue to acquire small companies with innovative technology.
In conclusion, increasing the adoption of our Qualys Cloud Agent and the breadth of our solution across environments enable us to offer customers greater visibility, accuracy, and scalability while ultimately enabling them to consolidate the security, IT, and compliance stack and drastically reduce their overall spend. With that, I will turn the call over to Joo Mi to discuss our financial results and guidance for the fourth quarter and full year fiscal 2020. Thank you.
Thanks, Philippe, and good afternoon. Before I start, I'd like to note that except for revenue, all financial figures are Non-GAAP, and growth rates are based on comparisons to the prior year period, unless stated otherwise. We're delighted with our increasing Cloud Agent subscriptions and multi-product penetration, as well as the strong adoption of VMDR, which lays the foundation for future revenue growth and industry-leading profitability.
Our Q3 financial and operational highlights include revenues for the third quarter of 2020 grew 13% to $93.1 million. Please note our Q3 2020 calculated current billing was negatively impacted by the timing and amount of prepaid multi-year subscription, as well as requests for shorter duration invoicing. Our average deal size increased 7%. Paid Cloud Agent subscriptions increased to 50 million over the last 12 months, up from 43 million for the 12 months ended in Q3 2020.
3 million cloud agents were purchased this quarter by a single customer. 34% of VM customers up for renewal in the quarter renewed into a VMDR subscription, up from 19% in Q2 and 4% in Q1. Our scalable platform model continues to drive superior margins and generate significant cash flow. Adjusted EBITDA for the third quarter of 2020 was $45.1 million, representing a 48% margin versus 47%. Q3 EPS grew 19%, and our free cash flow for the third quarter of 2020 was $48.4 million, representing a 52% margin and up 21%. In Q3, we continued to invest the cash we generated from operations back into Qualys, including $11.2 million on capital expenditures for operations, including principal payments under capital lease obligations, and $37.7 million to repurchase 352,000 of our outstanding shares.
We remain confident in our business model, driven by a foundation of nearly 100% recurring revenues, an expanding suite of applications. We are delighted to be raising our full year 2020 guidance for both revenues and earnings. We are raising the bottom and top end of our revenue guidance for the full year to now to be in the range of $362.4 million-$363 million from the prior range of $359 million-$360.5 million. We are raising our full-year Non-GAAP EPS guidance to now be in the range of $2.85-$2.87 from the prior range of $2.60-$2.65. We expect to maintain industry-leading margins in 2020 and continue to produce strong cash flow. Our Q4 guidance for revenue is $94.2 million-$94.8 million, and for Non-GAAP EPS is $0.69-$0.71.
For the fourth quarter, we expect capital expenditures to be in the range of $7 million-$8 million, which includes approximately $1 million for the build-out of our Pune headquarters. As Philippe mentioned, we are very excited by the robust adoption of VMDR and the launch of our Multi-Vector EDR solution, and we remain optimistic about the company's future. We feel very well positioned during this period of uncertainty due to the value provided by our cloud platform and our 20 apps, as well as our underlying highly scalable and profitable operational model. With that, Philippe and I are happy to answer any of your questions.
Thank you. As a reminder, to ask a question, you will need to press star one on your telephone. To withdraw your question, press the pound key. Please stand by while we compile the Q&A roster. Our first question comes from Yoon Kim with Loop Capital Markets. You may proceed with your question.
Thank you so much. Congrats on a solid quarter, Philippe and Joo Mi. This is just a high-level question from last year's user group conference. Can you update us on the partnership that you guys announced last year with Microsoft Azure, especially in regard to the integration with the Azure Security Center? I seem to recall the attendance to that particular session was especially jam-packed. Thanks.
No, this partnership is doing very well. What we have done here is remarkable because this is the integration of our entire cloud platform with Azure cloud platform. As I mentioned in my prepared remarks here, is that we have now expanded that to move into Microsoft Azure Arc, which is, if you prefer, is their private cloud initiative as well. This is, again, the partnership goes very well. Microsoft is a very big Qualys customer as well. I think earning the respect of an engineering team and as importantly, doing the work to fully integrate seamlessly our solution is very unique and we are, of course, working with other cloud providers to do the same.
Okay, great. Philippe, obviously you guys have expanded your product portfolio beyond your core VM product today. Just wondering, when you're adding new customers today, are you beginning to see more and more new customer add without the core VM product, especially as they get access to some of these more cloud-based products?
No, this is a very good question. In fact, what we see clearly with our large customers is that we're becoming more and more strategic. They start to realize, and a lot of these large customers wait for what is called our XDR, the SIEM platform, and also all of the DRs that I've announced. What we have done very uniquely. I really say very uniquely is that we're fusing detection and response into one app. You have immediately the ability to detect and immediately the ability to respond, all of that in real time. Our XDR solution will do, or the analytics, is fusing all these different DRs that we have. Just to repeat, we have done VMDR, now we have EDR, which competes against CrowdStrike.
Of course, then there's the SaaSDR, which will allow you to have the full visibility of your SaaS application, like Office 365, salesforce.com, and the Cloud DR, which will allow you to, for example, to not only identify the S3 buckets misconfiguration, but also the ability to, from the same pane of glass, to fix it. That's the key of security today. It's all that automation with all the workflow done for you, so you realize how much cost we eliminate. As I mentioned earlier, our XDR platform now is entering beta with 10 very large customers, which have been our design partners, and we are going to go in beta 2 at the early part of Q1. Of course, looking at going GA by the end of Q1.
What is interesting with that platform is that not only it addresses the needs of the very large companies, but it also addresses the needs of the very small company. Our platform is totally scalable. We see more and more us becoming very strategic, to answer your question, with our large customers, which, of course, want to adopt more solutions from Qualys. As well as they really are all looking at that XDR solution that is really coming out pretty soon. On the low end of the marketplace, of course, again, it simplifies everything. We have absolutely an offering that cuts across the entire spectrum. Of course, because now we have multiple applications, we have multiple arrows in our quiver to attract new customers. The Global IT Asset Inventory is becoming also very interesting for many companies.
Now, of course, we have more solutions. When we bring, for example, this new Qualys SaaSDR, which is in few weeks, in fact, Qualys SaaSDR and Cloud DR, that's a totally new ability for us to go and generate additional new customers and then grow the platform. Once you put the platform into a customer, and that has been our strategy or our agent, if you prefer, then suddenly we can upsell. It's all there. Everything is centrally managed, self-updating.
Of course, it's becoming now our marketing platform. We are, as you will see, if you can register to the Qualys Security Conference, we are really now building a marketing platform. We have built a cloud platform, which is essentially the distribution itself. Now we're building a marketing platform to essentially bring our solutions to many more companies worldwide. Does that make sense?
Great. Thank you so much for that detailed answer, Philippe. Joo Mi, I have a quick one question for you. On the 7% ASP increase, is that ASP increase more broad-based, or is that mainly driven by large customers? Also just, 34% of the customers who upgraded to VMDR in the quarter, did that contribute much to the ASP increase? Thank you.
Yeah. 7% average deal size increase, it's more broad-based, not just concentrated on the larger customers. In terms of VMDR adoption, we are very pleased with the increase in adoption, with it increasing from 19% last quarter to 34%. With that said, as expected, the impact to revenue has been broadly neutral for year-to-date, this is due to the same reason as stated before, where you might see a VM-only customer spending a little bit more when they renew into VMDR versus offset by customers who used to have subscribed to multiple Qualys solutions, they might be spending a little bit less. Overall this year, we're seeing a broadly revenue neutral impact. However, going forward, we really believe that this lays a foundation for continued upsell and really drive bookings growth with an increase in retention that we expect to come and witness next year.
I would like to, one thing from a product side to what Joo Mi said, is that what you have to understand about VMDR, this is not only the really next generation of Vulnerability Management in a box, but this is also the application that collects all the telemetry and all the data, which is absolutely very for EDR, which is important for many other solution, that's what gives us the context. If you deploy VMDR, you have already all that data which is there, that's, of course, is going to be very significant in our XDR platform because now we bring you the inventory, the context, et cetera, you know the status of any devices that connects on the network, this is absolutely significant.
As you can see, it's a major Trojan horse strategy that we embark when we package our Vulnerability Management solution become Detection and Response. Behind, you have that Global IT Asset Inventory who pushes the agent and also collects a lot of telemetry. This is also combined with our passive scanning, which looks at the network analysis. That's why, by the way, to give you some ideas of the scale at which we operate now. seven months ago, we were indexing 3 trillion data points for Elasticsearch clusters, which were data which we were collecting. Seven months later, we are indexing now 9 trillion. Significant scale at that, which is again, makes us significant than any of the other solutions.
Okay, great. Thank you so much.
Thank you. Our next question comes from Nehal Chokshi with Northland Capital. You may proceed with your question.
Yeah. Thank you for taking my question. Simple question. You had a $4.3 million Q/Q increase in revenue. I think it's the largest over the past six, seven years. Is this simply VMDR adoption, or is there something more going on here?
It's not attributable to the VMDR because the VMDR adoption is great as a long-term strategy, and we believe that it will drive the bookings growth and revenue growth overall during next year. This year it's been broadly neutral. If you take a look at the revenue growth, we did outperform, beat our high end of our revenue guidance because bookings came in better than what we had expected. We are seeing that the momentum overall, not just specific to VMDR, with the bookings coming in and the deals closing on both the new and upsell, as well as maintaining our strong retention rate.
I guess what I'm driving at then is why did bookings come in stronger than expected? Can you point to some sort of broad theme that you would expect to continue, or was it one time in nature?
I wouldn't say it's one time in nature.
Yeah.
New deals came in better than what we had expected. Typically when we guide to revenue, what we do is we take a look at the pipeline in play, right? With respect to both new customers as well as upsell and expand potential with our existing customers and of course, the renewals that are coming up. It just so happened that this quarter, we had better linearity. We had better new bookings than what we had anticipated. We are seeing that growth. This is part of the reason, and what we've always said was that if you take a look at our revenue, it might not necessarily be in line or the current billings might not be indicative of the business momentum. If you take a look at current billing, we indicated that it was up 8% year-over-year, but revenue we outperformed growing 13% year-over-year.
Yeah, what is also driving more specifics about the Patch Management, for example, is doing very well. We have our Container Security also is moving very well. Again, I mentioned we are very optimistic about our Cloud DR coming, our SaaS DR coming. We have all these new solutions, and what is very unique again is that they are not additional solutions.
In other words, if you look at other solutions you have acquired, the companies, they end up by having four, five, six different consoles to essentially access all these different applications that they have acquired, whether they are cloud or not cloud. With us, it's seamlessly, it's one single platform, one single UI, one single agent, and so you essentially have a lot of power at your fingertips, and all the workflows are integrated. It's coming from multiple, if you prefer, ruts, and one can say that ruts create big rivers.
That's great. Thank you.
Thank you. Our next question comes from Shebly Seyrafi with FBN Securities. You may proceed with your question.
Yeah, thank you very much. Congrats on the strong results. Joo Mi, you said that bookings were better than expected, but your current billings grew by 8%, down from double digits a few quarters ago. First of all, can you say whether bookings grew by a double-digit percentage? I think you also mentioned in your script that there were changes in duration in multi-year. Do you expect those metrics to rebound soon?
Yeah. Great question. We don't guide to bookings, and we haven't shared bookings previously. What we can point to is, typically we've had some negative impact from multi-year deals. That one example that I like to give is if you have a multi-year deal, on the second year, because there's no change in the current deferred, the current billing, the way it's reflected is not indicative of bookings. That's one reason. That we expect to continue, because as we close multi-year deals and our contract at length increases, we do expect that impact to continue. With respect to shorter duration invoicing requests, we've seen the uptick in that in Q3. We are seeing less of it in Q4 this quarter, and we expect that to kind of diminish or decrease over time. There will be a continued puts and takes.
Another reason why current billings might not be trending or be indicative of the bookings or the business upfront is because we don't manage quarterly billing. Because of that, we have renewals that are done not at the anniversary of the initial deal. That might be another negative or potentially a positive impact. This is part of the reason why it's hard to perfectly normalize growth rates to account for all these different scenarios.
The short-term billings essentially is the COVID-related thing where people are asking some payment terms and so forth. What we do is that we very specifically mention that this is only for the COVID year, so this is not to be repeated at the renewal time.
Right. One takeaway factor is if you take a look at our customers, right? Typically, what we've seen historically is for the multi-year deals, we've seen over 60% might have been prepaying upfront for all the years. We're seeing because of the COVID-19 one-time relief and COVID-19-related concessions, we're seeing less than a third of that. Right now we are seeing both impact on current billings as well as the cash flow margin, we don't expect this to continue to next year.
Okay. also, can you talk about the puts and takes on the gross margin line, which declined sequentially in year-over-year?
Yeah. Gross margin is impacted by multiple different factors, and one is basically we're expanding our data centers, and the timing in which the assets are put into service, that does impact D&A. If you take a look at our depreciation line, it increased by 6% quarter-over-quarter, and it just had to do with the timing. We are expanding into new data centers like Dubai and Las Vegas. We do expect some headwinds as we transition over to Las Vegas, but in the longer term, we will see the benefit, right? Because it is cheaper or more cost-effective than the one that we have currently in California. That has to do with the gross margin contraction.
Okay, thank you.
Thank you. Our next question comes from Alex Henderson with Needham. You may proceed with your question.
Thank you very much. I wanted to just delve into the commentary that you said about, you built out your platform and now you're building out your capacity to go into the market and aggressively sell. That's somewhat of a change in tone around the strategy of building sales capacity as I hear it. Obviously, some of that has to do with the MSSPs and Infosys type stuff, but can you talk about what capacity additions you're doing with a little bit more granularity?
First of all, it's not a change in our strategy. Our strategy has always been to put the cart before the horse. In other words, we always, and I've always said that we need to really get the platform, get all the solution integrated. That's a lot of work, and there's no point of pushing sales, if you prefer, until you've got the solution really mature enough. Today, we have reached a point where the maturity of the platform is such, and of course, once we ship XDR, I would say that we have really completed our first goal to a lot of these solutions. There will be further expansion into more adjacent markets, but now the platform is really where the engineering muscle, the platform scales. Absolutely, as I mentioned today, the number that we index is pretty impressive.
We are matching now more than. We have passed the 9 petabytes. It's absolutely incredible, the scale at which we operate. Today, now the thing that you need to understand is like enterprise software, the cloud platform is the distribution channel. Today we see huge shifts happening today. More and more MSS flock to Qualys because we create a platform they cannot build anymore. Before the past, they were building all of it. Of course, they are their own distribution. Also today, the platform itself is becoming also a distribution that we're going to provide more content, more reach out, more lead generation, more this, more that. In fact, I strongly urge that you register into our user conference because you see that platform which now distribute content very cost-effectively.
Speed has been, in fact, I always knew that, in fact, et cetera, has been very for that, of course, very fortunately. Zoom everywhere, and the cost. We'll see that user conference, the quality of the content, presentation. Now, of course, we can now slice and dice, reach out to advertise our solution. I used to say it's not good enough to be good to tell. The thing is that you don't want to tell too early, and you don't want to tell. The time has come, and I've always said that that time would come. Specifically, what we're doing now to answer your question about the expansion, we are now, of course, we are beefing up our strategic alliance team, we could now essentially embark in having more MSSP. This is our focus, as we discussed earlier.
The second is management. We have now a VP of EMEA, VP and General Manager for EMEA. For the Americas. We have also added significant, what we call Executive VPs or VPs for by product line. Only be there to look at the sell, but the go-to-market. We're also expanding our marketing capabilities. Because of our highly scalable platform, we don't need to also spend the amount of dollars to which have more a financial profile, if you prefer, structure, a goal. Spend it on 50% in marketing. That's where we are. That's what I call it. Now we're building the marketing platform. Of course, it's much easier and much quicker to build the marketing platform than it is to build an engineering platform.
If I could follow up. Can you talk a little bit about when you start moving into protecting cloud platform or cloud application workloads? Are you seeing that predominantly around what I would describe as the more traditional applications when they move to the cloud on digital transformation? Or are you seeing it coming in from more modern applications, Kubernetes-driven, DevOps-driven?
Oh, that's a good.
Code as infrastructure-driven.
Yeah. This announced this morning, the fact that now finally, I don't know if you recall the Layered Insight acquisition that we made. It took us a bit longer than what we have thought to fully integrate the view into containers. That's really when you look at application today, containerization is really what allows you to distribute microservices containerization. We ourselves made a huge DevOps change on our entire platform, which was absolutely at the scale at which we do. We are one of the today, which are really operating DevOps scale. Yes, it's both ways. You have, in fact, when you look at the web application, you have to take care of the existing ones.
You have to take care now more and more of the APIs and of course, all that containerization of the application releases that we make today, which is absolutely differentiators from every other Container Security solution, because now we can do detection. Again, the same philosophy, that notion of DR, detection, we analyze, but then respond to be sure. That's today we've got. That's another DR that it's avoided customers where detecting if you cannot really protect or if the protection is very complex or very costly, what's the purpose of detecting? If you can automate that detection, that response, it's really allowed save and of course, protection point that this is the analogy I always give between diagnostics and cure.
Is the answer to that you're seeing cloud-first, born in the cloud customers coming to you as well as?
Yes
traditional customers coming to you for cloud? I'm not sure I understood the exact answer is.
No. Both.
Clearly, if the legacy guy comes, he's going to eventually move to more modern applications.
Exactly.
You're also seeing cloud customers. Can you talk about the penetration of born in the cloud companies that are moving to your system and your technologies, your platform that are starting from a Kubernetes-centric viewpoint only? Is that a meaningful percentage of your adoption?
No, it's not a meaningful percentage. That's pretty new. We have pretty big customers that Google, et cetera, which we're working with them. Remember, they are using currently our agent technology platform and Amazon as well, Oracle, on and on. Already the big fish in that thing. There's, of course, coming in too. That should, It's changing. There's no question about that. We're extremely positioned for that change. Take care of the old and of the new into one single platform.
Now, of course, we are moving OT and IoT as with the announcement that just on the ICS, and we're very unique to having customers so are very an IoT capability. I think we're extremely major investment that not the old guard really create state-of-the-art platform. Nobody today has that. Some company will not be able doing it in time to do that at the scale of the Internet. Be happy if you prefer to become extremely disruptive.
Okay. Thank you very much.
Thank you. Our next question comes from Hamza Fodderwala with Morgan Stanley. You may proceed with your question.
Hey, guys. Thank you for taking my question. Philippe, maybe the first question for you. It seems like the platform is really coming together. There's been good traction with VMDR. From a go-to-market perspective, you've obviously brought on David now as the new EVP of Americas. I'm wondering, are there any sort of broader restructuring of the sales org that has to be done to align the sales organization to selling multiple products or selling a broader platform? Do you expect maybe some tweaks around the edges as you try to expand on this platform story?
This is a very good question. It's not so much just the sales force. What we're essentially doing with the sales force is essentially strengthening the management of that sales force so we can now essentially speak more. We have been selling bottom-up in the past. We have a technical sales force that remains, no change in that. We're really now in a position to really speak with the C-level much more because we have more to offer than, of course, in the past when we were just vulnerability management. Quite frankly, the C-level is not that much interested in vulnerability management. In their view, they got bigger fish to fry. The digital transformation, for example, preoccupies them significantly more. We have now all these pieces coming together.
We have essentially expanded the management of our sales force, and of course, we're going to add a few more. We still have that model of hunter and farmers, no change. What we're doing around that is that now that we got a much broader solution, we're expanding what we call our subject matter experts, people who are specialized in EDR, specialized in this, which are there to support our partners and, of course, our sales force. Then we also have beefed up from the engineering standpoint, as I mentioned briefly in my prepared remark, with having now people in charge of the product line. We have attracted somebody now today who is in charge of the VMDR product line.
We have attracted somebody who now is in charge of the EDR product line, somebody who's in charge of the Global IT Asset Inventory product line, somebody's in charge of the Policy Compliance product line. We are going to add a few more like that. What they have under them is, of course, the product managers as well as the subject matter experts.
Their mission in life is just not to ensure that we do the right thing from an engineering standpoint, but that they are, in fact, the responsibility of the go-to market. That's the more important structural change here that we are doing in the company as we now, today, have essentially a very, again, as I mentioned, a very broad and very disruptive platform. This is going to show, we believe, very soon.
Right. Maybe just a follow-up for Joo Mi, if I may. Joo Mi, I appreciate the commentary on billings versus bookings. You mentioned that booking in Q3 improved sequentially, and you're seeing a pretty healthy pipeline in Q4 so far. If you could maybe from a qualitative standpoint, give us any color as to how we should think about the pace of revenue growth going forward, right? It seems like obviously some of the investments that were supposed to be made from a sales perspective are likely to be pushed out into next year, and that's going to continue to generate strong bookings from a VMDR and some of the newer products that you guys have had. From a revenue growth perspective, how do you think about the pace of that going forward?
For Q4 is in the 11 to 12-
Hey, Joo Mi, I think you're breaking up on my end.
Okay.
I can hear you now.
In terms of new product adoption, it's hard to tell and assess when the impact on revenue will be. Typically when we guide, we think that it's prudent for us to be a little bit cautious, so we don't bake into the revenue guidance, the new product adoption, and the contribution to revenue that we expect it to have. For example, for Q4, we assume that from VMDR, it will be similar as now, where it will be mostly revenue neutral.
However, next year is a year that we really think that, with all the new product adoptions and product launches that we're seeing this year, as well as going into Q1 and the first half of next year, we do expect some meaningful contribution to revenue and the acceleration in bookings to come from new products, in addition to the continued business growth as is from existing customers as well as new opportunities.
Got it. Thank you.
Yeah.
Thank you. Our next question comes from Brian Essex with Goldman Sachs. You may proceed with your question.
Hi, good afternoon, and thank you for taking the question. Philippe, I wonder if maybe if you could give us a little bit more color around MSSP and the traction that you're seeing in that market. Any way you can quantify the % of revenue associated with that channel, and how might we anticipate customer adoption as you go through that channel, particularly as you may add more kind of smaller customers onto your platform versus the large enterprise customers that may be in your install base?
Yeah, no, that's a good and broad question. We essentially mentioned that we have an hybrid model whereby we sell directly and we also sell through channels, which essentially, I don't remember exactly the mix, but it's about 60-
60/40
It's 60/40. 60% direct and 40% channel. Now, within what we disclose is the amount of MSSPs, 40%. However, we see that the traditional channels with more of the resellers starting to, of course, be under significant pressure. What is their added value? Their added value today is essentially there is no more to push.
Their real added value is actually passing part of the margin that the vendors give to them to the customers. That's not really sustainable for the large companies would rather have, many times, the direct relationship with the customer, with the vendor, especially if that vendor consolidates multiple applications. You have to consolidate seven other agents. That's quite significant. Very important for companies, because they can adjust more with all agents.
What we can see today is some of these companies which were, in fact, served by sellers coming direct to us. Obviously, we would now like to see that the MSSPs are more coming to us as well, because we can offer them, which significant, essentially will reduce. Today, they can't find the, and be all of the little bit of Splunk here, a little bit of this here, and then putting all these pieces together. It doesn't work anymore.
We foresee, or we are looking at back at this, that next generation, as I call it, of managed security service providers, some the decision, and we see that already some managed security service providers say, "That's not anymore a good business for us, so why don't we become like Qualys?" We have seen some companies doing that, but we see the immense majority of the MSSP say, "Oh, thank Lord, Qualys is coming here, and now we can focus on our customers and the value added that we provide, and especially that Qualys allows us to do the detection and response." The problem of the managed security service providers in the past has been that they've got to build that huge platform, which they are not really equipped for. You need to have teams in these companies that they provide the services, now that this company needs to have as well to have team.
All that automation we are providing now and the response, we're really answering what is managed security service providers. The bottom line here is that we anticipate to see our revenues from these traditional, if you prefer, sellers shrinking, and then of course, the revenues coming from the managed security service providers increasing.
The best example of that is what we did announce is essentially Infosys, which has been building a managed security service, now adopting VMDR and EDR together, replacing these more, if you prefer, public company on the EDR side because it's platform with us, Deloitte, et cetera. We have more MSSPs knocking on our doors. You will see more announcement to come. That's the bottom line.
Great. That's very helpful. Thank you for that. Maybe, Joo Mi, just to follow up. Just playing with the model, looking at triangulating to guidance range, it looks like similar to last quarter, to get to guidance, we need a pretty steep ramp-up in spending for OpEx. I understand that, I guess, last quarter seemed as though that there was some element of return to normal operating environment baked into that guide. Is that similar for 4Q? If so, where might some of that flexibility, for upside to margins or maybe lower than expected spending might come from? Is that mostly sales and marketing, or is it kind of across the board?
For Q4, it's mostly on the sales and marketing side. In Q3, some of the spend or investment opportunities that we thought that it would incur in Q3 was pushed out to Q4. In Q4, we have QSC, even though it's virtual, we have some additional one-time expenses that's going to be occurring in Q4, as well as the Pune expansion was pushed out to Q4.
We had thought that we would be moving into the Pune office in Q3, but unfortunately, that had to be pushed out. There are some other one-off expenses related to employees and COVID related reimbursement that we expect to happen in Q4. Overall, the implied margin, EBITDA margin for Q4 is in the mid-40s. For the ending of the year, we expect to end the year with EBITDA margin above the mid-40s.
We anticipate there's always an upside to margin given our scalable business model. With that said, we did hire some new leaders in the sales, including David French. We expect to continue to invest and identify right employees and to onboard them so that we can effectively drive the sales force.
Got it. Okay. That's really helpful color. Thank you.
Thank you. Our next question comes from Sterling Auty with JPMorgan. You may proceed with your question.
Hi, guys. This is Matt on for Sterling. Thanks for taking the question. You talked about expanding the relationships with MSSPs. Wondering if you could give any more additional color on what geographies you're really focused on expanding for that relationship. Thanks.
Well, that's Yeah, no.
Hey, Philippe. I can't hear you.
Oh, okay. Is that better now?
Yep. Now I can hear you.
Okay. What I was saying is that you have two kind of MSSPs, the global ones and the more regional ones. Really, we see all of them coming to us, whether they are regional or global, and we're totally a global company. We have already, for example, a lot of telcos, which are our customers worldwide, and of course, we have a lot of local MSSPs as well. We have a significant portion of MSSPs. They were not generating that much dollars in the past because it was just all about VMDR. We have, for example, IBM as a very good MSSP customer for Qualys.
Now today, with the platform and all these other things that we have, they are even more interested in Qualys because not only of the consolidation, which reduce their cost to operate and on and on and on, but the fact that they can generate more revenues, make their customers more sticky. As a result of that, because we are now providing the response capabilities, they can offer a better service and therefore gain a business which is becoming more profitable at the end of the day. The problem with the MSPs has been, this is not a very profitable business because of the human cost that you need to have. If you cannot remotely respond, then it's very difficult to send people. The companies need locally that can respond.
Be cost effective for both companies. Well, we knew since the beginning, except that to put the pieces together at the scale at which we need to put them was just not a walk in the park, which also give us a significant barrier to entry that we have created for ourselves.
Great. That's very helpful. One last question from our side. You've talked about the dynamics between the billings and bookings growth. I was wondering if, obviously, not really asking for committed guidance on 2021, how should we think about some of the targets that you laid with regards to revenue growth? Do you think that the trends that you're seeing here would indicate that revenue could accelerate in 2021? Thanks.
We're very optimistic given the new product launches and what we're seeing in terms of the momentum. We do think of next year as an investment year. We do expect some positive impact on bookings from the new product launches, including the VMDR, because we really believe that it lays a foundation for increased retention as well as cross-sell and upsell opportunity. Of course, once the budget opens up post-COVID-19. With that said, we will be providing more color next quarter when we give the full year guidance for 2021.
Great. Thanks, guys.
Thank you. I'm not showing any further questions at this time. I would now like to turn the call back over to Philippe Courtot for any further remarks.
Thank you very much to all of you for attending our earnings call and for your questions. Despite the very challenging environment that we are all in, unfortunately, we do feel fortunate that we are very well-positioned, as we discussed with our cloud platform and the apps fully integrated, and we're very pleased with our progress this quarter. We're also looking at next year in a very positive way, as we just discussed again. Our broad suite of IT security and compliance applications, including VMDR, Multi-Vector EDR, et cetera. Our forthcoming XDR, admin, we believe, position us extremely well. I, again, encourage you to really attend our user conference.
I guarantee you the big advantage is that we have really skinned that cat in many different sessions that you don't need even to attend when they run, because you can have the link to the recording, you can really select what you want. Again, you will look at that as the beginning of a marketing platform that we're really creating, which will allows us to distribute not only training, but also the content, trials, et cetera. Of course, this is, as you would see, very effective. It's very good for the customers, for everybody wins here. That's again, that's what we see in the broad market, with what is happening today, with the way you buy things.
In my house today now I put a lock, an automatic lock on my door, so when somebody delivers a package, I can open the door with my finger. That's the response. That's essentially what Qualys is doing for security. With that, again, thank you very much, and looking forward to continue the discussion. Okay. Thank you.
Thank you. Ladies and gentlemen, this concludes today's conference call. Thank you for participating. You may now disconnect.