Ladies and gentlemen, thank you for standing by, and welcome to the Qualys Third Quarter 2020 Investor Conference Call. At this time, all participants are in a listen only mode. After the speaker presentation,
there will be a question and answer
Please be advised that today's conference may be recorded. I would now like to hand the conference over to your speaker today, Vin Rao, Vice President, Corporate Development and Investor Relations. Please go ahead, sir.
Good afternoon, and welcome to Qualys' 3rd quarter 2020 earnings call. Joining me today to discuss results are Philippe Coutu, our Chairman and CEO and Zhu Min Kim, our CFO. Before we get started, I would like to remind you that our remarks today will include forward looking statements that generally relate to future events or our future financial or operating performance. Actual results may differ materially from these statements. Factors that could cause results to differ materially are set forth in today's press release and in our filings with the SEC, including our latest Form 10Q and 10 ks.
Any forward looking statements that we make on this call are based on assumptions as of today, and we undertake no obligation to update these statements as a result of new information or future events. During this call, we present both GAAP and non GAAP financial measures. A reconciliation of GAAP to non GAAP measures is included in today's earnings press release. As a reminder, the press release, prepared remarks and in this presentation are available on our website. With that, I'd like to turn the call over to Philippe.
Thank you, Vinayak, and welcome everyone to our Q3 earnings call. Let me begin by saying that we hope you and your families are healthy and safe. With the ongoing COVID-nineteen pandemic, our workforce continues to operate fortunate that the nature of our business allows us to successfully operate in this dynamic work environment. We have been able to adapt to the current challenges and deliver the results we have set out to accomplish last quarter. Jumi and I are pleased to report another good quarter in terms of revenue growth and profitability.
We also had strong growth in our paid Cloud Agent subscription with $50,000,000 now representing nearly 80% growth from the prior year's quarter. This multifunction lightweight Qualys Cloud Agent provides visibility across the entire hybrid environment and is the underlying technology for 7 of the security, compliance and IT solutions that are natively integrated on our platform that is: VMDR for vulnerability management, detection and response multivector EDR, endpoint detection and response, policy compliance, fine integrity monitoring, patch management, global ITSL Inventory and the upcoming Certificate Management and more to come. Qualys VMDR has taken Verity Management to the next level by providing the power to continuously detect vulnerabilities and misconfiguration across the entire global IT environment and responds in real time to remediate assets that are vulnerable or already compromised from a single platform with building orchestration. Currently, approximately 12.50 customers have adopted VNDR, which includes over 3.50 new customers. Qualys Vmdr is not only being a huge success with customers, but it's also driving further penetration of our Cloud Agents because of our Global Access Asset Inventory, which is bundled in it.
Since VFDR has proliferated our cloud agent, it in turn sets a foundation for further upsells or other paid applications. This quarter, we announced the general availability of our multi vector EDR solution. This multi vector solution unifies different context vectors like asset discovery, vulnerabilities and exploits, misconfiguration, in-depth endpoint telemetry and network which have built rich ability with our powerful backend for accurate assessment, detection and response, all in a single cloud based app. As an app built natively on the Qualys Cloud Platform, our multi vector EDR leverages its power, scale and accuracy to correlate billions of global events with threat intelligence, analytics and machine learning to provide unprecedented context and real time insight into the endpoint to carry out rapid threat hunting and response. Qualys, in fact, multi vector EDR goes beyond traditional EDR solutions by providing comprehensive response capabilities such as killing processes and quarantining files or endpoints, while also uniquely preventing future attacks by orchestrating responses such as patching vulnerabilities, removing exploits, fixing these configurations or uninstalling software before endpoints are compromised.
Since our multi vector EDR encompasses the entire attack lifecycle, it makes it easier to automate the response and dramatically reduce the number of false positives. The combination of Qualys V MDR and multi vector EDR allows us to provide a single end to end workflow that helps company greatly reduce the time to respond and allows for the consolidation of the security stack. Also, we are now providing a comprehensive two way inventory synchronization with ServiceNow, Service Graph CMDB as part of their new Service Graph Connector program. This new integration adds customers to quickly, easily and reliably load their complete and contextualized asset information into ServiceNow, enabling a consistent and consolidated data set across hybrid IT environment, thus providing with an always up to date source of truth across their hybrid environment. In addition, we continue to see good adoption of our cloud based remote endpoint protection solution, which leverages the Qualys Cloud Agent and its cloud based architecture to deliver instant and continuous visibility remote computers as well as their installed applications, obtain a real time view of all critical vulnerabilities and misconfiguration, and remotely deploy missing patches for critical vulnerabilities.
We currently have approximately 700 companies, including 300 customers prospect, actively using this free service offering. In terms of our newer paid solution, we saw solid growth this quarter with our paid global access inventory asset discovery and inventory application. In fact, a large managed healthcare organization added our Global IT Asset Discovery and Inventory paid module this quarter in order to gain visibility of all the known and unknown assets across multiple environments, identifying the end of life of the installed software and synchronize with our ServiceNow CMDB. Patch Management continued to see strong customer adoption, both in the mid market as well as with the large customers. In Q3, a leading financial services firm selected our Patch Management application of our several competing solutions given its ability to easily and effectively patch remote endpoints without using the limited bandwidth available on VPN gateways.
Finally, we also saw robust growth for our Container Security application with adoption of a respected regional financial institution that has already VNDR and policy compliance. Now on the go to market front, we are expanding our relationship with the next generation of managed security service providers or MSSPs. Given the increased breadth of our product suite with the addition of EMDR and multi vector EDR, these MSP can leverage the Qualys Cloud platform to fully address the security needs of small and mid sized customers that lack in house resources to secure their hybrid environment, as well as addressing the needs of large companies. We were pleased to announce that Infosys, a global leader in next generation digital services and consulting, is integrating both the MDR and multi vector EDR into its CyberNEXT platform and managed security service offering. Powered by the Qualys Cloud Platform, Qualys VMDR and Multi Vector EDR will collect vast amount of telemetry from the Qualys Cloud Agent and multiple sensors combined with network information for a broad view of the environment going beyond just the endpoint.
This significantly reduced lateral movement of security breaches to spread across from the initial point of compromise. Infosys customers can also extend their use of the cloud agent to Patch Management, file integrity monitoring and other functionalities. In addition, Deloitte Canada is now offering Qualys VMDR via its cyber risk services offering. Deloitte Canada clients now have access to the QualityVMDR app as part of a holistic solution to meet diversity threat management, VTM requirement and provide visibility across the entire hybrid IT environment. Qualys Cloud Agents are embedded and fully integrated with the Deloitte Cyber Intelligence Center via APIs to deliver asset discovery and inventory, validity assessment, including configuration control, threat prioritization and patch detection to Deloitte's customer.
Finally, last week we announced an expanded integration of Qualys Warranty Management with Microsoft Azure Arc, allowing customers to perform vulnerability scanning on server outside of the Azure platform, including on premise and multi cloud server. This capability is available to all customers of Azure Defender for service at no additional cost. We continue to invest in expanding the capabilities of our cloud platform and aggressively developing additional solutions. Looking ahead, we are enthused about the additional solution that we plan to introduce in the next few months, that is container runtime security, which provides runtime defenses and protection capabilities for containerized application, now in GA additional detection and response offering that we call DRs such as SaaS Doctor, Cloud Doctor and Mobile Doctor, which are also coming out of beta. Granular Access Control module, an extension to our global IT asset inventory.
Multi vector EDR will be also available for Linux environment. In addition, an endpoint protection platform extension to our multi vector EDR solution will be available in Q1 2021. Major update to our passive scanning capabilities that will significantly expand our coverage of industrial control system, ICS, operational technology, OT, as well as IoT, Internet of Things Devices and finally, Data Lakes sim or what we now call or what is now called XDR platform, which seamlessly will integrate all our current and forthcoming detection and response solutions, or the DRs, has now entered beta with 10 design partners and we are planning for it to go live by the end of Q1 2021. The development of these solutions has been possible because of the massive investment we made in our cloud platform our strong engineering talent base in Pune with over now 900 employees located there. These new initiatives open significant incremental market opportunity for us and allow our customers to easily and cost effectively consolidate their stack of traditional security and compliance solutions, while providing them a single pane of glass view on all assets across on premise endpoint, cloud and mobile environment.
Similar to our efforts on the cloud platform front, we are also building a marketing platform that combined with increased investment in sales management and sales capacity will drive future profitable growth. We will showcase these new solutions at our upcoming QSC or Qualys Security Conference. I would like to personally invite you to attend this conference, which will be a 12 day virtual event from November 9 to 24 and you could also listen to the presentation at your own leisure and we currently have more than 5,000 people registered. You can access the agenda and register for the conference at www dotqualis.com/qsc/2020/virtue. As mentioned earlier, replays of the session will be available on demand at the end of the day of when they are presented.
At the conference, our President and Chief Product Officer, Sumit Thakkar, will discuss the evolution of our cloud platform, as well as our recently launched multi vector EDR solution and forthcoming data lakeanalyticsim initiative or XDR platform extension. Our attendees will have the opportunity to listen to customers such as the Head of Product Security at Zoom, Manager of Information Security Operations at Jabil and the Senior Security Engineers at Informatica. And we will also present our risk based approach to Verity Management, providing forthcoming updates to our cloud and container security solution, share our view on risk management and compliance, and discuss our next generation web application and API security solutions. Our focus remains or our focus continues to remain on balancing growth with profitability. The Qualys Cloud Platform serves as a distribution channel, enabling us to grow while maintaining industry leading margins.
Incremental future growth will be driven by our strong partnerships with MSSPs as well as further investments in sales and marketing as mentioned earlier with the addition of highly qualified and technical individuals. On the hiring front, we are pleased to welcome back David French as EVP for the Americas Field Operations. David has extensive experience in sales and business development and will play an important role in driving continued growth for the company. Finally, M and A continues to be a part of our growth strategy as we seek to accelerate our product development and expand into adjacent markets. Acquisitions over the past couple of years have complemented our organic product innovation, expanding our cloud platform to provide more comprehensive security and compliance coverage, as well as visibility across all global IT assets across again on premise, endpoint, mobile, cloud, containers and now OT and IoT environment.
Our cloud platform has now reached the level of maturity where we can potentially explore acquisitions to expand our customer base in a disciplined manner as well as continue to acquire small companies with innovative technology. In conclusion, increasing the adoption of our cloud agent and the breadth of our solution across environments enable us to offer customers greater visibility, accuracy and scalability, while ultimately enabling them to consolidate the security, IT and compliance stack and drastically reduce their overall spend. With that, I will turn the call over to Jumi to discuss our financial results and guidance for the Q4 and full year fiscal 2020.
Thanks, Philippe, and good afternoon. Before I start, I'd like to note that except for revenue, all financial figures are non GAAP and growth rates are based on comparisons to the prior year period unless stated otherwise. We're delighted with our increasing cloud agent subscription and multiproduct penetration as well as a strong adoption of EMDR, which lays the foundation for future revenue growth and industry leading profitability. Our Q3 financial and operational highlights include: revenues for the Q3 of 2020 grew 13% to 93,100,000 dollars Please note our Q3 2020 calculated current billings was negatively impacted by the timing and amount of prepaid multiyear subscription as well as requests for shorter duration invoicing. Our average deal size increased 7%.
PayU Cloud Agent subscriptions increased to $50,000,000 over the last 12 months, up from $43,000,000 for the 12 months ended in Q3 2020. 3,000,000 cloud agents were purchased this quarter by a single customer. And 34% of VM customers up for renewal in the quarter renewed into a VMDR subscription, up from 19% in Q2 and 4% in Q1. Our scalable platform model continues to drive superior margins and generate significant cash flow. Adjusted EBITDA for the Q3 of 2020 was $45,100,000 representing a 48% margin versus 47%.
Q3 EPS grew 19% and our free cash flow for the Q3 of 2020 was $48,400,000 representing a 52% margin and up 21%. In Q3, we continue to invest the cash we generated from operations back into Qualys, including $11,200,000 on capital expenditures for operations, including principal payments under capital lease obligations and $37,700,000 to repurchase 352,000 of our outstanding shares. We remain confident in our business model, driven by a foundation of nearly 100% recurring revenue and expanding suite of applications. We are delighted to be raising our full year 2020 guidance for both revenues and earnings. We are raising the bottom and top end of our revenue guidance for the full year to now to be in the range of $362,400,000 to $363,000,000 from the prior range of $3.59 to $360,500,000 We are raising our full year non GAAP EPS guidance to now be in the range of $2,850,000,000 to $2,87,000,000 from the prior range of $2,60,000,000 to $2,65,000,000 We expect to maintain industry leading margins in 2020 and continue to produce strong cash flow.
And our Q4 guidance for revenue is $94,200,000 to $94,800,000 and for non GAAP EPS is $0.69 to $0.71 For the Q4, we expect capital expenditures to be in the range of $7,000,000 to $8,000,000 which includes approximately $1,000,000 for the build out of our Pune headquarters. As Philippe mentioned, we are very excited by the robust adoption of the EMDR and the launch of our multi vector EDR solution and we remain optimistic about the company's future. We feel very well positioned during this period of uncertainty due to the value provided by our cloud platform and our 20 app as well as our underlying highly scalable and profitable operational model. With that, Philippe and I are happy to answer any of your questions. Thank
you. Our first question comes from Yoon Kim with Loop Capital Markets. You may proceed with your question.
Thank you so much. Congrats on a solid quarter, Philip and Jumi. Can you this is just a high level question from last year's user group conference. Can you update us on the partnership that you guys announced last year with Microsoft Azure, especially in regard to the integration with the Azure Security Center? I seem to recall the attendance to that particular session was especially jam packed.
Thanks.
No, this partnership is doing very well. What we've done here is remarkable, because this is the integration of our entire cloud platform with Azure Cloud Platform. And as I mentioned in my prepared remarks here is that we have now expanded that to move into Microsoft Azure Arc, which is if you prefer is their private cloud initiative as well. And so this is again the partnership goes very well. Microsoft is a very big Qualys customer as well.
So I think earning the respect of the engineering team and as importantly doing the work to fully integrate seamlessly our solution is very unique and we are of course working with other cloud providers to do the same.
Okay, great. And then, Philip, obviously, you guys have added expanded your product portfolio beyond your core VM product today. So just wondering like when you're adding new customers today, are you beginning to see more and more new customer add without the core VM product, especially as they get access to some of these more cloud based products?
Yes. No, this is a very good question. In fact, what we see clearly with our large customers is that we're becoming more and more strategic. They start to realize and a lot of these large customers wait for our what is called our XDR, the SIM platform And also the all of the Doctor that have announced what we have done very uniquely and really say very uniquely is that we're fusing detection and response into a 16:2a1 app. So you have immediately the ability to detect and immediately the ability to respond all of that in real time.
And so our XDR solution will do or the analytics is fusing all these different Doctor that we just to repeat, we have done VMDR. Now we have EDR, which competes against CrowdStrike. And then, of course, then there's the SaaS Doctor, which will allow you to have the full visibility of your SaaS application like Office 385, salesforce.com. And the Cloud Doctor, which will allow you to, for example, to not only identify the S3 buckets misconfiguration, but also the ability to find the same pane of glass to fix it. So, that's the key of security today.
And you can and it's all that automation with all the workflow done for you, so you realize how much cost we eliminate. And so we as I mentioned earlier, our XDR platform now is entering beta with 10 very large customers, which have been our design partners and we are going to go in beta 2 at the early part of Q1. And then of course, looking at going GA by the end of Q1. And what is interesting with that platform is that not only it addressed the needs of the very large companies, but it's also addressed the needs of the very small company. Our platform is totally scalable.
So we see more and more us becoming very strategic to answer your question with our large customers, which of course wants to adopt more solutions from Qualys and as well as really they really are all looking at that XDR solution that is really coming out pretty soon. And then on the low end of the marketplace, of course, again, it simplifies everything. So we have absolutely an offering that cuts across the entire spectrum. And then of course, because now we have multiple application, we have multiple arrows in our quiver to attract new customers. So the Global Ios inventory is becoming also very, very interesting for many companies.
And now of course, we have more solutions. When we bring, for example, this new SaaS Doctor, which is in few weeks, in fact, SaaS Doctor and Cloud Doctor, that's a totally new ability for us to go and generate additional new customers and then grow the platform. Because once you put the platform into a customer and that has been our strategy or our agent, if you prefer, then suddenly we kind of sell. And it's all there. It's all everything is centrally managed, self updating.
And then of course, it's becoming now our marketing platform. And we are as you will see, if you can register to the user conference, we're really now building a market. So we've built a cloud platform, which is essentially the distribution channel itself. And now we're building a marketing platform to essentially bring our solutions to many, many more companies worldwide. Does that make sense?
Thank you so much. Yes, thank you so much for that detailed answer, Philip. Jumi, I have a quick one question for you. On the 7% ASP increase, is that ASP increase, is that more broad based or is that mainly driven by large customers? And then also just 34% of the customers who upgraded to VMDR in the quarter, did that contribute much to the ASP increase?
Thank you.
Yes. So 7% average deal size increase, it's more broad based, not just concentrated on the larger customers. And in terms of Vmdr adoption, we are very pleased with the increase in adoption with it increasing from 19% last quarter to 34%. With that said, as expected, the impact to revenue has been broadly neutral for a year to date and this is due to the same reason I stated before where you might see a VM only customer spending a little bit more when they renew into the MDR versus offset by customers who used to have subscribed to multiple quality solutions, they might be spending a little bit less. So overall, this year, we are seeing a broadly revenue neutral impact.
However, going forward, we really believe that this lays the foundation for continued upsell and really drive bookings growth with an increase in retention that we expect to come and witness next year.
Yes. And I
would like to one thing from the product side to what Jimmy said is that what you have to understand about BMDR, this is not only the really next generation of vulnerability management vulnerability management in a box, but this is also the application that collects all the telemetry and all the data, which is absolutely very important for ADR, which is important for many other solutions and that's what gives us the context. So if you deploy the EMDR, you have already all that data, which is there. And that's of course is going to be very significant for in our XDR platform because now we bring you the inventory, the context, etcetera, the status of any devices that connects on the network. And so this is absolutely significant. So as you can see, it's a major Trojan horse strategy that we embark when we package our vulnerability management solution become detection and response.
But behind, you have that global access inventory, which pushes the agent and also collects a lot of delivery. And this is also combined with our passive scanning, which looks at the network analysis. And that's what by the way to give you some ideas of the scale at which we operate. 7 months ago, we're indexing 3,000,000,000,000 data points for Elasticsearch clusters, which were dollars significant scale at that which is again makes us significant any of the other solutions out there.
Okay, great. Thank you so much.
Thank you. Our next question comes from Nehal Chokshi with Northland Capital. You may proceed with your question.
Yes. Thank you for taking my question. Simple question. You had a $4,300,000 Q over Q increase in revenue. I think it's the largest over the past 6, 7 years.
Is this simply the MDR adoption or is there something more going on here?
Yes, it's not attributable to the vMPR because the vMPR adoption is great as a long term strategy and we believe that it will drive the bookings growth and revenue growth overall for next year. This year it's been broadly neutral. So if you take a look at the revenue growth, we did outperform beat our high end of our revenue guidance because bookings came in better than what we had expected. We are seeing that the momentum overall, not to specific to the EMDR, with the bookings coming in and the deals closing on both the new and upsell as well as maintaining our strong retention rate.
So I guess what I'm
driving at then is why did bookings come in stronger than expected? Can you point to some sort of broad theme that you would expect to continue? Or was it one time in nature?
I wouldn't say it's one time in nature. New deals came in better than what we had expected. So typically when we guide to revenue, what we do is we take a look at the pipeline in play, right, with respect to both new customers as well as upsell and expand potential with our existing customers and of course the renewals that are coming up. And so it just so happened that this quarter, we had better linearity, we have better new bookings than what we had anticipated. And so we are seeing that growth.
And this is part of the reason and what we've always said was that if you take a look at our revenue, it might not necessarily be in line or and the current billings might not be indicative of the business momentum because if you take a look at current billings, we indicated that it was up 8% year over year, but revenue we outperformed growing 13% year over year.
Yes. And then, which is also driving more specifics about the integration of the Patch Management, for example, is doing very well, We have our Container Security also is moving very well. And again, I mentioned, we are very optimistic about our Cloud Doctor coming, our SaaS Doctor coming. So we have all these new solutions. And what is very unique again is that they are not additional solutions.
In other words, if you look at other solutions, the companies, they end up by having 4, 5, 6 different consoles to essentially access all these different applications that they have acquired, whether they're cloud or not cloud. With us, it's a 1 single platform, 1 single UI, 1 single vision. And so, you essentially have a lot of power at your fingertips and all the workflows are integrated. So, it's coming from multiple, if you prefer, ruts and one can say that ruts create big rivers.
Okay, great. Thank you. Thank you. Our next question comes from Shelby Seyrafi with FBS Securities. You may proceed with your question.
Yes. Thank you very much. Congrats on the strong results. You said that Jimmy, you said that bookings were better than expected. But your current billings grew by 8%, down from double digits a few quarters ago.
First of all, can you say whether bookings grew by a double digit percentage? And I think you also mentioned in your script that there were changes in duration and multiyear. Do you expect those metrics to rebound soon?
Yes. So great question. So we don't guide to bookings and we haven't shared bookings previously. But what we can point to is typically we've had some negative impact from multiyear deals. So that one example that I'd like to give is, if you have a multiyear deal, on the 2nd year, because there's no change in the current deferred, the current billing the way it's reflected is not indicative of booking.
And so that's one reason and that we expect to continue because as we close multi year deals and our contracts at length increases, we do expect that impact to continue. With respect to shorter duration invoicing request, we've seen the uptick in that in Q3. We are seeing less of it in Q4 this quarter and we expect that to kind of diminish or decrease over time. And so there will be a continued puts and takes. Another reason why current billings might not be trending or be indicative of the bookings or the business upfront is because we don't manage quarterly billing.
And so because of that, we have renewals that are done not at the anniversary of the initial deal. So that might be another negative or potentially a positive impact. So, this is part of the reason why it's hard to perfectly normalize growth rates to account for all these different scenarios.
And the short term billings essentially is the COVID related thing where people are asking some payment terms and so forth. And what we do is that we very specifically mentioned that this is only for the COVID year. So, this is not to be repeated at the renewal time.
Right. And then one particular factor is, if you take a look at our customers, right, typically what we've seen historically is for the multiyear deals, we've seen over 60% might have been prepaying upfront for all the years. Now we're seeing because of the COVID one time relief and COVID will be related concessions, we're seeing less than third of that. And so right now, we are seeing both impact on current billings as well as the cash flow margin, but we don't expect this to continue to next year.
Okay. And also, can you talk about the puts and takes on the gross margin line, which declined sequentially in year to year?
Yes. So gross margin is impacted by multiple different factors. And one is, basically we're expanding our data centers and the timing in which the assets are put into service that does impact DNA. So if you take a look at our depreciation line, it increased by 6 percent quarter over quarter and it just had to do with the timing. We are expanding into new data centers like Dubai and Las Vegas.
And we do expect some headwinds as we transition over to Las Vegas. But in the longer term, we will see the benefit, right, because it is cheaper or more cost effective than the one that we have currently in California. And so that has to do with the gross margin contraction.
Okay. Thank you.
Thank you. Our next question comes from Alex Henderson with Needham. You may proceed with your question.
Thank you very much. I wanted to just delve into the commentary that you said about you built out your platform and now you're building out your capacity to go into the market and aggressively sell. That's somewhat of a change in tone around the strategy of building sales capacity as I hear it. Obviously, some of that has to do with the MSSPs and the input sys type stuff. But can you talk about what capacity additions you're doing with a little bit more granularity?
Yes. So, first of all, it's not a change in our strategy. Strategy has always been the cart before the horse. In other words, we always and the world always say that we need to really get the platform, get all these solutions integrated. That's a lot of work.
And there's no purpose of pushing sales, if you prefer, until you've got this solution really mature enough. So today, we have reached a point where the maturity of the platform is such. And of course, once we ship XDR, I would say that we have really, really completed our first goal to a lot of these solutions. There will be further expansion into more adjacent market, but that platform is really we have the engineering muscle, the platform scales. I mean, absolutely, as I mentioned today, the number that we index is impressive.
We are managing now more than we have passed the 9 petabytes. It's absolutely incredible the scale at which we operate. So today, now we're now the thing that we need to understand is, like enterprise software, the cloud platform is the distribution channel. So today, we see huge shift happening today more and more MSS to flock to quality because we create a platform they cannot build anymore before in the past they were building all of them. And of course, they have their own distribution.
Also today, the platform itself is becoming also a distribution that we're going to provide more content, more reach out, more lead generation, more this, more that. And in fact, if you I strongly that you listen that you register into our user conference because you see that platform which now distribute contents very cost effectively. Speed has been in fact I always knew that that and in fact, etcetera has been very, very for that, of course, very good for many other, unfortunately. But zoom, zoom, zoom everywhere and the cost. So we are that user conference the quality of the content of presentation.
Now of course, we can now slice and dice the product and reach out to advertise our solution. I used to say it is not good enough to be good, you need to tell. The thing is that you don't want to tell too early and you don't want to take but the time has come and I've always said that that time will come. So specifically what we're doing now to answer your question about the expansion. So we are now of course we're beefing up our strategic alliance team.
So we could now essentially embark in having more MSSP. This is our focus as we discussed earlier. The second is management, to have now a VP of EMEA, VP and General Manager for EMEA for the Americas. We're also added significant what we call executive VPs or VPs for by product line only be there to look at the go to market. So we're also spending on marketing capabilities.
So the biggest part of our highly scalable platform you'll need to also spend the amount of dollars to Europe which have more financial price if you prefer structure go spend it of 50% to 50% in marketing. So that's where we are. So that's what we're doing. That's what I call it. Now we're building the marketing platform.
And of course, it's much easier and much quicker to build the marketing platform than it is to build an engineering platform.
If I could follow-up, can you talk a little bit about when you start moving into protecting cloud platform or cloud application workloads, are you seeing that predominantly around what I would describe as the more traditional applications when they move to the cloud on digital transformation? Or are you seeing it coming in from more modern applications, Kubernetes driven, DevOps?
That's a good question.
That's a good question.
Infrastructure driven?
Yes, yes. This morning, the fact that now finally, I don't know if you recall the inside layer acquisition that we made. It took us a bit longer than what we have thought to fully integrate the into containers. And so that's really when you look at application today, container containerization is really what allows you to distribute microservices containerization. So we are ourselves made a huge DevOps change on our entire platform, which was absolutely at the scale at which we do.
So we are one of the today, which are really operating dev ops if you prefer. So, yes, it's both ways. So, you have in fact, when you look at the web application, you have to take care of the existing ones. You have to take care now more and more of the APIs and of course, all of that containerization of the application release that we make today, which is absolutely differentiates us from every other container security solution, because now we can do detection. So again, the same philosophy, that notion of Doctor detection, we analyze response if you prefer.
So that's today we've got. So that's another Doctor. That's it's avoided customers were protecting if you cannot really protect or if the protection is very complex or very costly was the purpose of detecting. So but if you can automate that detection that response really allowed to save and of course protection point that this is the analogy I always give between diagnostics and cure.
So is the answer to that you're seeing cloud first point in the cloud customers coming to you as well as more additional customers coming to you for cloud. I'm not sure I understood the exact answer. Clearly, the legacy guy comes, he's going to eventually move to more modern applications. But you are also seeing cloud customers. Can you talk about the penetration of born in the cloud companies that are moving to your system and your technologies, your platform that are starting from a Kubernetes centric viewpoint only.
Is that a meaningful percentage of your adoption?
No, it's not a meaningful percentage. However, we have big no, it's not a big difference. Okay, that's pretty new. Working with them. Remember, they are using currently our agent technology platform.
So and Amazon as well. Oracle on and on. So already the big fish in that thing. And then there's of course coming in, B2. And so that's the decision.
This is the decision that we're making. There's no question about that. And we're extremely in a position for that change, because we're going to take care of the old and of the new into one single platform. And now of course, we're moving IoT and IoT as well as with the announcement that just on the LCS and we are very unique to having customers not the old goodwill, but really created a bit of the art platform nobody has a lot of opportunity to do that at the scale of the Internet. Some companies will not be able to be doing it in time to do that at the scale of the Internet.
We're happy if you prefer to become extremely disruptive.
Great. Thank you very much.
Thank you. Our next question comes from Hamzah Fodderwala with Morgan Stanley.
You may proceed with your question.
Hey guys, thank you for taking
my question. Philippe, maybe first question for you. So it seems like the platform is really coming together. There's been good traction with the EMDR.
But from a go
to market perspective, you've obviously brought on David now, as the new EVP of Americas. I'm wondering, are there any sort of broader restructuring of the sales or that has to be done to align the sales organization to a more to selling multiple products or selling a broader
So, it's not
yes, no, this
is okay, this
is a very good question. So it's not yes, no, this is a very good question. It's not so much just the sales force. So what we're essentially doing with the sales force is essentially strengthening the management of that sales force, so we can now essentially speak more. We have been sitting bottom up in the past.
We have a technical sales force that remains no change in that, but we're really now in a position to really speak with the C level much more because we have more to offer than of course in the past when we were just for the management, because quite frankly, the C level is not that much interested in volatility management. In their view, they got bigger fish to fry. The digital transformation, for example, per occupies significantly more. So we have now all these pieces coming together. So we have essentially expanded the management of our sales force and of course, we're going to add a few more.
We still have that model of hunter and farmers that no change. But we're doing around that is that now that we got a much broader solution, while expanding what we call our subject matter experts, people who are specialized in EDR, specialized in these, which are there to support our partners and of course our sales force. And then we also have beefed up from the engineering standpoint, as I mentioned briefly in my prepared remarks, with having now people in charge of the product line. So we have attracted somebody now today, who is in charge of the VNDR product line. We have attracted somebody who is now is in charge of the EDR product line, somebody who is in charge of the global ITs inventory product line, somebody is in charge of the policy compliance product line, and we're going to add a few more like that.
So what they have under them is, of course, the product managers as well as the subject matter experts. And their mission is live, it's just not to ensure that we do the right thing from an engineering standpoint, but that we also they are in fact the regional celebrity of the go to market. So that's the more important structured change here that we are doing in the company as we now today have essentially a very again, as I mentioned, again, a very broad and very disruptive platform. And this is going to show, we believe, very soon.
Right. And then maybe just
a follow-up for Jimmy, if I may.
Jimmy, so I appreciate
the commentary on billings versus bookings. So you mentioned that bookings in Q3 improved sequentially and you're seeing pretty healthy pipeline in Q4 so far. But just if you could maybe from a qualitative standpoint, give us any color as to how we should think about the pace of revenue growth going forward, right? Because it seems like, obviously, some of the investments that were supposed to be made from a sales perspective are likely to be pushed out into next year and that's going to continue to generate strong bookings from a Vmdr and some of the newer products that you guys have had. But from a revenue growth perspective, how do you think about the pace of that going forward?
For Q4, it ended 11% to 12%.
Hey, Jimmy, I think you're breaking up on my end.
Okay. I can
hear you now.
In terms of new product adoption, it's hard to tell and assess when the impact on revenue will be. So typically when we guide, we think that it's prudent for us to be a little bit cautious. So we don't bake into the revenue guidance, the new product adoption and the contribution to revenue that we expected to have. So for example, for Q4, we assume that for from the EMDR, it will be similar as now where it will be mostly revenue neutral. However, next year is a year that we really think that with all the new product adoptions and product launches that we're seeing this year as well as going into Q1 and the first half of next year, we do expect some meaningful contribution to revenue and the acceleration in bookings to come from new products in addition to the continued business growth as is from existing customers as well as new opportunities.
Thank you.
Thank you.
Our next question comes from Brian Essex with Goldman Sachs. You may proceed with your question.
Hi, good afternoon and thank you for taking the question. Philippe, I wonder if maybe if you could give us a little bit more color around MSSP and the traction that you're seeing in that market. Any way you can quantify the percentage of revenue associated with that channel? And how might we anticipate customer adoption as you go through that channel, particularly as you may add more kind of smaller customers onto your platform versus the large enterprise customers that may be in your installed base?
Yes. So that's a good and broad question. So let me so we essentially mentioned essentially that we have about we have an hybrid model whereby we sell directly and we also sell through channels, which essentially I don't remember exactly the mix, but it's about 60%, it's 60%, 40%, 60% direct and 40% channel. Now within disclose is the amount of MSSPs 40%. However, what I can tell you and that probably at some point in time, we could.
So, we see that the traditional channels with more than resellers starting to of course be under significant pressure. And what is their added value. Their added value today is essentially there is no more access to push. And then their added value is actually passing part of the margin the vendors give to them to the customers. That's not really sustainable for the large would rather have, when it comes to direct relationship with the customer with the vendor, especially if that vendor consolidates multiple application.
You have to renegotiate 7 other agents. That's quite significant, very important for companies, because they cannot more with all the agents. So what we can see today is some of these companies, which were in fact served by sellers coming direct to us. And then on the other hand, we would now to see that the MSSPs are more coming to us as well because we can offer them which significantly essentially will reduce today they can't be spending and all of the taking a little bit of strength here, a little bit of this here, a little bit of putting all pieces together. It doesn't work anymore.
So, we foresee or we are looking at back at this that next generation as I call it of managed security service providers. Some the decision and we see that already some managed security service providers say that's not anymore a good business for us. So why don't we become like Qualys. So we have seen some companies doing that, but we see the immense majority of the MSR, we say, more than glad Qualys is coming here and now we can focus on our customers and the value added that we provide and especially that Qualys allows us to do the detection and response. The problem of the managed security service providers in the past has been, is that they got to build that huge platform, which they are not really equipped for, but then they can really not do well the so then you need to have teams in these companies that they provide the services, now that this company needs to have as well as the team.
All that omission we are providing now on the response, we're really answering what is managed security service providers. So, the bottom line here is that we anticipate to see our revenues from these traditional sellers shrinking and then of course the revenues coming from the managed security service providers increasing. And the best example of that is what we did announce is essentially Infosys, which is now which has been building a managed security service now adopting VMDR and EDR together replacing this more, if you prefer, public company on the EDIAR side, because it's a platform. We as Deloitte etcetera, so we have more MSSPs knocking on our doors. And so you will see more enhancement to come.
That's the bottom line.
Great. That's very helpful. Thank And maybe, Jim, me just to follow-up. Just playing with the model, looking at triangulating to guidance range, it looks like similar to quarter, to get to guidance, we needed a pretty steep ramp up in spending for OpEx. But I understand that, I guess last quarter seemed as though that there was some element of return to normal operating environment baked into that guide.
Is that similar for 4Q? And if so, where might some of that flexibility for upside to margins or maybe lower than expected spending might come from? Is that mostly sales and marketing or is it kind of across the board?
Yes. For Q4, it's mostly on the sales and marketing side. So in Q3, some of the spend or investment opportunities that we thought that it would incur in Q3 was pushed out to Q4. In Q4, we have QSC, even though it's virtual, we had some additional one time expenses that's going to be occurring in Q4 as well as the Pune expansion was pushed out to Q4. We had thought that we would be moving into the Pune office in Q3, but unfortunately that has to be pushed out.
And there are some other one off expenses related to employees and COVID related reimbursement that we expect to happen in Q4. But overall, the implied margin EBITDA margin for Q4 is in the mid-forty and for the end of the year, we expect to end the year with EBITDA margin above the mid-40s. And so, we anticipate there's always an upside to margin given our scalable business model. But with that said, we did hire some new leaders in the sales, including David Friend. So we expect to continue to invest and identify right employees and to onboard them so that we can effectively drive the sales force.
Got it. Okay, that's really helpful color. Thank you.
Thank you. Our next question comes from Sterling Auty with JPMorgan. You may proceed with your question.
Hi, guys. This is Matt on for Sterling. Thanks for taking the question. You talked about expanding the relationships with MSSPs. Wondering if you could give any more additional color on what geographies you're really focused on expanding for that relationship?
Thanks. Hey, Philippe, I can't hear you.
Okay. So this is is that better now?
Yes. Yes.
Now I can hear you. Okay. So what I was saying is that you have 2 kind of MSSBs, the global ones and the more regional ones. So really our we see all of them coming to us whether they are regional or global and we're totally a global company. So we have already, for example, a lot of telcos, which are our customers worldwide.
And of course, we have a lot of local MSSPs as well. So we have a significant portion of MSSPs. Now, they were not generating that much dollars in the past because it was just all about the MDR. We have pulling up on IBM as a very good MSSP customer for Qualys. So but now today with the platform and all these other things that we have, they are even more interested in Qualys because not only of the consolidation, which reduce their cost to operate and on and on and on, but the fact that they can generate more revenues make their customers more sticky.
And as a result of that, because we are now providing the response capabilities, they can offer a better service and therefore gain get a business which is becoming more profitable at the end of the day because the problem of the MSSPs has been this is not a very profitable business because of the human cost that you need to have. And if you cannot remotely respond, then it's very difficult to send people. So then the companies locally that can respond. It's cost effective for both companies with the plan and we knew since the beginning, except that to put the pieces together at the scale at which we need to put them was just not a walk in the park, which also gave us a significant barrier to entry that we have created for ourselves.
Great. That's very helpful. And then one last question from our side. So you've talked about the dynamics between the billings and bookings growth. I was wondering if obviously not really asking for committed guidance on 2021, but how should we think about some of the targets that you laid with regards to revenue growth?
Do you think that the trends that you're seeing here would indicate that revenue could accelerate in 2021? Thanks.
Yes. We're very optimistic given the new product launches and what we're seeing in terms of the momentum. We do think of next year as an investment year. We do expect some positive impact on bookings from the new product launches, including the Vmdr, because we really believe that it lays a foundation for increased retention as well as cross sell and upsell opportunity. And of course, once the budget opens up post COVID.
With that said, we will be providing more color next quarter and when we give the full year guidance for 2021.
Great. Thanks, guys.
Thank you. And I'm not showing any further questions at this time. I would now like to turn the call back over to Philippe Courto for any further remarks.
Okay. So thank you very much to all of you for attending our earnings call and then for your questions. And despite the very challenging environment that we are all in, unfortunately, we do feel fortunate that we are very well positioned as we discussed with our cloud platform and the apps fully integrated. And we are very pleased with our progress this quarter. We're also looking at next year in a very positive way as we just discussed again.
And essentially our broad suite of IT security and compliance applications including VMDR, multi vector ADR, etcetera, etcetera are our forthcoming XDR admin, we believe position us extremely well. So I again encourage you to really attend our user conference. I guarantee you the big advantage is that we have really skinned that cat in many, many different sessions that you don't need even to attend when they run because you can have the link to the recording. So you can really select what you want. And again, you will look at that as the beginning of a marketing platform that we're really creating, which will allow us to distribute not only training, but also the content, trials, etcetera, etcetera.
And of course, this is, as you would see, very effective. It's very good for the customers, for everybody. So everybody wins here and that's again. That's what we see in the broad market with what is happening today with the way you buy things. And then in my house today, now I put a lock, automatic lock on my door.
So when somebody delivers a package, I can open the door with my finger. That's the response. So that's essentially what Qualys is doing for security. So with that, again, thank you very much and looking forward to continue the discussion soon. Okay.
Thank you.
Thank you. Ladies and gentlemen, this concludes today's conference call. Thank you for participating. You may now disconnect.