Good day, everyone. Welcome to Qualys' fourth quarter 2019 earnings conference call. This call is being recorded. At this time, all participants are on a listen-only mode. Later, we will conduct a question-and-answer session, and instructions for asking a question will be given at that time. I would now like to turn the call over to Vinayak Rao, Vice President, Corporate Development and Investor Relations. Please go ahead, sir.
Good afternoon, and welcome to Qualys' fourth quarter 2019 earnings call. Joining me today to discuss the results are Philippe Courtot, our Chairman and CEO, and Melissa Fisher, our CFO. Before we get started, I would like to remind you that the remarks today will include forward-looking statements that generally relate to future events or our future financial or operating performance. Actual results may differ materially from these statements. Factors that could cause results to differ materially are set forth in today's press release and in our filings with the SEC, including our latest Form 10-Q and 10-K. Any forward-looking statements that we make on this call are based on assumptions as of today, and we undertake no obligation to update these statements as a result of new information or future events. During this call, we'll present both GAAP and non-GAAP financial measures.
A reconciliation of GAAP to non-GAAP measures is included in today's earnings press release. As a reminder, the press release, prepared remarks, investor presentation, and supplemental historical financial spreadsheet are available on our website. With that, I'd like to turn the call over to Philippe.
Thank you, Vinayak, and welcome, everyone, to our Q4 earnings call. Melissa and I are pleased to report another good quarter in terms of revenue growth and profitability. We are also very pleased to report continued acceleration in our paid Cloud Agent subscriptions with almost 31 million now, 90% growth from the prior year quarter. We continue to see good adoption of our free global IT asset inventory, discovery, and inventory application with almost 6,000 new companies signed up and over 600 using the service. We now have over 300 existing customers using it as well. We saw strong growth this quarter from our paid IT asset discovery and inventory solutions, and in fact, a leading aerospace company procured the solution this quarter in order to gain visibility of all their known and unknown assets across multiple environments, as well as the end of life of their installed software.
In term of our other newer solutions, we also saw robust growth, again, from Container Security and FIM, File Integrity Monitoring. A large software company selected Qualys FIM as well as Policy Compliance this quarter in order to build these capabilities into their DevOps and cloud environments, which they could not do with competitive products and deployments, and the deployments were simple as they utilized our existing Vulnerability Management Cloud Agents. In addition, it's worth noting that Patch Management has seen the highest customer ramp among our newest application, with particular strength in the mid-market segment. Now let's look at our product innovation. In Q4, we continue to make strong progress in our goal of achieving ubiquity for our Cloud Agent.
Our Cloud Agent is the technology platform for seven security compliance and IT solutions, namely Vulnerability Management, Policy Compliance, File Integrity Monitoring, Indication of Compromise, Patch Management, Asset Inventory, and the upcoming Certificate Management, and with more to come. Our key accomplishments this quarter to drive Cloud Agent adoption included unveiling Vulnerability Management, Detection and Response, which we call VMDR, at our user conference in QSC. VMDR takes Vulnerability Management to the next level by providing the power to continuously detect vulnerabilities and misconfiguration across the entire global hybrid IT environment and respond in real-time to mitigate or remediate assets that are vulnerable or already compromised. VMDR bundles asset discovery and inventory and vulnerability assessment and patch detection as a single app.
It's effortless to deploy on a global scale and priced as a fully bundled solution, drastically saving deployment, administration, and software subscription costs with, of course, our real-time lightweight Cloud Agent and the virtual scanners that are self-updating and easy to deploy as well. Also, announcing a partnership with Microsoft embedding Qualys Vulnerability Management and Qualys Container Security into Microsoft Azure Security Center, providing real-time visibility to secure cloud workload, provisioning, and DevOps orchestration.
Also partnering with Google Cloud to provide its customers with one-click vulnerability assessment through a seamless integration of the Qualys Cloud Agent with the Google Cloud Platform, GCP, bringing building security to Google Cloud customers with essentially no software to install or maintain. Additionally, Google Cloud customers will have access to Qualys VMDR to build a streamlined workflow to create their global IT asset inventory, continuously identify vulnerabilities across their entire environment, prioritize and remediate those vulnerabilities at a click of a mouse, drastically reducing, again, their threat exposure. This builds on our other product release earlier in 2019, including the Patch Management app, enabling IT and SecOps teams to quickly target critical Common Vulnerabilities and Exposures, then deploy the patches across endpoints on-premise or cloud assets and verify remediation, all from one single console.
IoC 2.2 app, which provides a quantum leap in IoC detection with new detection, investigation, and response capabilities that identify in nearly real time, not only known IoCs, but also suspicious devices. The FIM 2.0 app, where we have now added incident reporting, API integration, rule-based alerting, and event correlation capabilities. We have also created a lite version of FIM for customers that require compliance only, like with PCI requirements. Finally, the Qualys Gateway Service app, an important extension of our cloud agent platform, enabling customers to securely connect Qualys Cloud Agent from sensitive environment like DMZs, while also drastically reducing the bandwidth demands of large-scale deployment. Let's look at our go-to-market initiatives.
Given the increased breadth of our product suite and the launch of VMDR during RSA, we have now embarked on a few additional go-to-market initiative that leverage the efficiency and effectiveness of our cloud platform. This is, in fact, a key element of our profitable growth, driving value for both our customers and shareholders. Our go-to-market activities in 2019 included leveraging our cloud platform for lead generation. We launched our global IT asset discovery and inventory app as a free service, as you remember, from our platform to generate meaningful demand of our paid apps. With a single agent, subscribing to additional apps is frictionless. These drive multi-product adoption, which naturally increase the stickiness of our platform and helps make us impenetrable to our competition who do not offer the same breadth of solution.
Launching new targeted campaigns, which enable prospective customers to easily click and create their own trial accounts. Creating a new team of technical account representatives, which we call TARs, who onboard and support customers utilizing our free applications. Building the Qualys Canadian Cloud, which expands Qualys global operation to eight locations on three continents. Expanding partnerships. Coalfire selected Qualys Vulnerability Management and Continuous Monitoring capabilities to integrate into their secure cloud automation services. Proficio, an award-winning global managed security services provider, chose to fully integrate the Qualys suite of cloud-based solutions with Proficio's management, detection, and response capabilities. Finally, the Center for Internet Security, CIS, selected Qualys to provide its members with building visibility of their externally facing website certificates and SSL/TLS configuration.
Additionally, with VMDR, we are now increasing our focus on the small and medium enterprise market segment and are delighted to announce the promotion of Michael Solomon to VP, small and medium enterprises for the Americas and EMEA. Michael has been at Qualys since 2016 and was previously running our new business sales team for the mid-market. I'm also happy to welcome back Dan Barona as our Chief Marketing Officer, who has now significantly expanded the marketing team. Looking forward to 2020, we plan to meaningfully expand our sales and marketing efforts, giving our increased numbers of solutions, including our game-changing VMDR, which was recently highlighted in a report by Ovum, a market-leading data research and consulting firm. You can get the report on our website, very easy to find, just look for Ovum and the reports.
In essence, VMDR uniquely provides customers with full visibility across their entire global IT environment and combine these with state-of-the-art prioritization engine that also take into consideration misconfiguration and digital certificate security exposure. VMDR provide the real foundation for comprehensive risk-based vulnerability management program that does not solely rely on CVE-based vulnerabilities and arbitrary risk score, which unfortunately can give a false sense of security. You can learn more about VMDR as well as our other planned initiative solution at our user conference during RSA at the Four Seasons, San Francisco. You can register for that day, which we are going to showcase VMDR as well as some of the new innovation where we will be bringing to market in 2020. You can go to the website to register.
At the conference, we will also provide an update on our transformational data lake and EDR solutions that will leverage our robust, scalable backend and its array of sensors, which already collect, enrich, normalize, and correlate trillions of data points across on-premise, cloud, and soon mobile, OT, and IoT environments. This is an important new opportunity for our company and our industry, as current incident response solutions are quite complex and costly, requiring organizations to use multiple vendors to collect the data that is needed, and bring it into the SIEMs with full contextual information, resulting, as we all know, in what is called the alert fatigue, too many false positives. Additionally, we will host an analyst and investor luncheon on February 26th.
These events will include a demonstration of our newest application and a discussion on our 2020 product roadmap by our President and Chief Product Officer, Sumedh Thakar, and a financial update by our Chief Financial Officer, Melissa Fisher. Again, you can register on our website, please. We're happy to have you there. With that, I will turn the call to Melissa to discuss our financial results.
Thanks, Philippe. Good afternoon. Before I start, I'd like to note that except for revenue, all financial figures are non-GAAP, and growth rates are based on comparison to the prior year period, unless stated otherwise. We're delighted with our increase in Cloud Agent subscriptions and multi-product adoption, which lays the foundation for future revenue growth and industry-leading profitability. Our Q4 financial and operational highlights include: revenues for the fourth quarter of 2019 grew 14% to $84.7 million. Platform adoption continued to increase as a percentage of enterprise customers with three or more Qualys solutions rose to 48% from 41%. The percentage of enterprise customers with four or more Qualys solutions increased to 28% from 21%. Paid Cloud Agent subscriptions accelerated to 30.7 million over the last 12 months, up from 27.9 million for the 12 months ended in Q3 2019.
New products released since 2015 contributed approximately 35% of total annual bookings in the quarter, up from 26%. Our average deal size continues to increase, growing 9%. Our scalable platform model continues to drive superior margins and generate significant cash flow. Adjusted EBITDA for the fourth quarter of 2019 was $37.6 million, representing a 44% margin versus 39%. Q4 EPS grew 25%, and our free cash flow for the fourth quarter of 2019 was $25.1 million, up 9%. Excluding one-time CapEx related to the build-out of our Pune headquarters and M&A related payments, our free cash flow grew 32%.
In Q4, we continued to invest the cash we generated from operations back into Qualys, including $5.3 million in capital expenditures for operations, including principal payments under capital lease obligations, as well as $3.2 million in capital expenditures for the build-out of our Pune headquarters, and $12.5 million to repurchase 145,000 of our shares. Looking back on the year, we are proud to have continued our product leadership while meaningfully growing earnings and cash flow for our shareholders. In 2019, we released several new products, features, and enhancements. The number of customers spending $500,000 or more accelerated. Cloud Agent adoption grew almost 90%, from 16.2 million Cloud Agent subscriptions to 30.7 million. New products released since 2015 sharply increased to approximately 30% in 2019, up from approximately 20%. We achieved record EBITDA margins of 44% and grew free cash flow 30%, even as we continued to invest for growth.
Excluding one-time CapEx related to the build-out of our Pune headquarters and M&A related payments, our free cash flow increased 35%. We utilized $86.4 million of our cash to repurchase approximately 1 million of our outstanding shares, offsetting dilution to our shareholders from equity grants. Looking to 2020, we are excited about the revenue growth opportunities from our new solutions, including the upcoming VMDR. Because our VMDR solution packages the ability to detect vulnerabilities with response in a single app, we see an opportunity to further drive Cloud Agent deployment, as well as increase our strong renewal rates. Adoption of our Cloud Agents is important because it is the technology platform for seven of our security compliance and IT solutions and lays the foundation for future revenue growth.
We expect full-year revenue in 2020 to be in the range of $364 million-$369 million, which represents a growth rate of 13%-15%. Our Q4 2019 calculated current billings did benefit from a few large deals that were invoiced in Q4 this year rather than at their anniversary in Q1 2020. In terms of 2020 profitability, we expect to maintain industry-leading margins, leveraging our highly profitable operational model while preserving the ability to further invest to drive future revenue growth. We expect full-year GAAP EPS in 2020 to be in the range of $1.60-$1.65, and we expect full-year non-GAAP EPS in 2020 to be in the range of $2.57-$2.62.
We expect capital expenditures from operations in 2020 to be in the range of $25 million-$30 million, and we expect to spend an additional $5 million in the first half of 2020 for the build-out of our Pune headquarters. For the first quarter of 2020, we expect capital expenditures to be in the range of $8 million-$10 million, which includes $3 million for our Pune headquarters. As Philippe mentioned, we look forward to seeing many of you at the Analyst and Investor Luncheon during RSA in San Francisco. With that, Philippe and I are happy to answer any of your questions.
Thank you. As a reminder, to ask a question, you will need to press star one on your telephone. To withdraw your question, press the pound key. Please stand by while we compile the Q&A roster. I show our first question comes from Daniel Ives from Wedbush. Please go ahead.
Yeah, thanks. Solid quarter into the year. Philippe, maybe you can just talk specifically about when you think about what we're seeing on deal scope and size, you're starting to see more just strategic deals in the pipeline. I know you don't guide to larger deals. Maybe you can just talk about that in terms of just maybe difference to where we are today versus six, 12 months ago.
Yeah, no, we are clearly, as you know, we have a very significant penetration of the very high end of the market with about 70% of the Fortune 100, which have truly standardized on Qualys. With these companies, we are seeing by them size more and more strategic. Not only vulnerability has been, is now people realize that you've got to absolutely pay attention to vulnerabilities, but just not only across your traditional servers and so forth, but across the entire spectrum. That's really what makes us significantly strategic. Of course, the ability to create a global IT asset inventory, which is a foundation, is also very attractive for them. We are really seeing as more and more strategic.
Of course, with what is it in our roadmap, like, of course, the SIEM, the next generation SIEM and EDR, which we're currently building and hoping to deliver to market sometime at the end of this year. That also makes us even more strategic. As a result of more deployment, then, of course, we become more strategic for them. At the time also, where they have to consolidate their stack, they cannot continue with all that many disjointed enterprise traditional security solution. At the same time, moving aggressively into the world of digital transformation and the world of DevOps. Our product line fits absolutely perfectly the DevOps environment.
In addition to that, what we see today, especially, VMDR has been received, of course, we have presented VMDR already to many of our customers, and it's extremely well-received because it simplified not only it consolidate even further everything into a lot of these application to one single app with what we call transparent orchestration, so you don't have to add these another solutions like SOAR. It's all done for you. It's all integrated. It's all seamless. Also, of course, the fact that now we price that on a per asset basis, which is much more interesting for large corporation, which have a very complex environment and global. What we see also very clearly is VMDR make us extremely competitive today at the lower end of the marketplace because, again, of the packaging, but also of its pricing as well.
We see also a very big demand from VMDR from our mid-market and the SME business as well.
Okay, great. Just a question for you, Melissa. In terms of just spending, obviously, you've done a great job on margins and just containing costs, which is well known. As you look ahead, just talk about that balance going into this year in terms of plugging more into sales and marketing, while continuing to focus on, obviously, margins. Just talk about that balance, is it different now, just given some of the opportunities? Maybe just talk about that. Thanks.
Yeah. The implied margin guide from our EPS guidance is a modest contraction, a little bit over 100 basis points. We're proud of the fact that we have a highly profitable operational model that allows us to continue to further invest, as well as while still maintaining strong margins. We expect to be investing, frankly, broadly on the technical side, as well as Philippe mentioned in his prepared remarks, expanding sales and marketing efforts. We'll be able to do that while still holding margins strong.
This is because of the model itself. We have the advantage of being a pure cloud-based solution, is that, of course, we can make our solution available for trial, et cetera, at a minimum cost, and that's why we are putting a lot of investment in creating a lot of lead generation campaigns, try and buy. Of course, the installation, everything is self-updating, so you don't need significant expensive, you don't need professional services, et cetera. All of that at the end makes that, and the additional growth, a big chunk of it comes down into the bottom line, and that's essentially the model that we have built and proven over time. This is not something new.
Awesome. Thanks.
Thank you. Our next question comes from Nick Yako from Cowen and Company. Please go ahead.
Great. Thanks for taking my questions. Philippe, you mentioned increasing your focus on the mid-market going forward. Just wondering if you expect to maybe leverage the channel community or partners more so than you have in the past.
That's a good question because we are today, as you very well know, when you have a major computing shift, the channels are the one which takes it on the chin first, and they have to adjust. What we see today is that a significant renewed interest from some of these traditional channel to really move and becoming an MSSP. Qualys in that sense, we can enable them to become a managed security service providers absolutely very quickly because they don't have to worry about building all the solution. We deliver them all made. Yes, in that sense, to answer your question, we see a huge opportunity with managed security service providers to bring our solution to the mid-market.
They have the customer base typically, especially these large companies, it's just a question of bringing our solution, which are already available and ready-made, to that market. We see that, absolutely.
Okay, that's helpful. Also, could you maybe remind us of the revenue and customer mix between enterprise and mid-market today?
Yeah. Go on, Melissa.
Yeah. It hasn't moved significantly. It's roughly 20% of the customers and 80% of the revenues, the enterprise. It's bigger dollars.
Okay, great. Thank you.
Thank you. Our next question comes from Melissa Franchi from Morgan Stanley. Please go ahead.
Yes, thanks for taking my question. I wanted to ask on VMDR. You noted that there is potential within the mid-market, low-end enterprise, but it seems like it could be compelling for the enterprise space as well. What are you expecting in terms of enterprise adoption? I know it's early, but what kind of uplift do you get from VMDR versus just a regular VM sale?
Let me answer the first question first. The second is a bit more complex, and I will explain that. The first one is we have absolutely significant interest from both the mid-market and as well as the large enterprise. It's exactly what they wanted. They have been asking us that for a long time. What you have to realize is for us to deliver that was not that easy. That's a major significant engineering effort because, on one hand, we had to expand our platform to scale significantly, as we mentioned many times. We currently index 3 trillion data point on Elasticsearch, returning results in 100 milliseconds. Expanding to cover not only just the traditional network, but also the cloud and containers and everything. That was a huge technological effort.
In addition to that, building these best-of-breed because today we consider that the application that we have are best-of-breed because they have the benefit of being able to essentially receive data from multiple sources and correlate that data so we can essentially eliminate better than anybody, false positive and false negative, which is really what makes a security application best-of-breed. Now we have built all of that, and now what we're doing with VMDR is now suddenly bringing them all together into one single application with a workflow, which are all integrated. That's what we're doing and finishing as we speak. Those two are now that one single platform that allows you to one, any device that connects instantly, we picked it up. Second, we can build from there the global IT inventory automatically.
From there, we can identify vulnerabilities across that entire hybrid environment. We have made significant extension to our prioritization engine, which unlike, as I mentioned in my talk, instead of solely relating on or depending on CVEs and some kind of scores that are made up, I would say. Now we have a lot of information we can correlate to essentially prioritize those vulnerabilities which must be absolutely mitigated or eliminate first. Of course, doing the remediation, which today we do that with Patch Management and remediation very soon with the ability to essentially quarantine the device, which is about to come in a few weeks. We have the complete end-to-end solution for Vulnerability Management, well beyond what anybody has on the market. That's appealing significantly to both markets. Different nature.
For the large enterprises, that packaging, that ease of different, of course, that they can do. That's why we went to an asset-based price, so they don't have to count the number of agents and this and this and that. For the mid-market is the fact that now today, they got it all in one, which as you know, there are very little resources, and it's also very well priced at the low end. That's for the adoptions, which we know today it's going to be significant. In fact, we will be reporting on the adoption of VMDR, both on our existing customers and the new customers.
Now, in terms of what it will do in terms of potential of sales, if on one hand we bundle in VMDR things like ThreatPROTECT, which is our prioritization engine, on the other hand, we can see already that it will absolutely help us to populate the agent everywhere. Therefore, now increasing the ability to upsell at the endpoint, to upsell SIEM, to upsell all these other services, which, of course, depend on the agent. The net of all of that, we believe that VMDR is the foundation, fundamentally change the game. It's a totally game changer and really make vulnerability management what it should have been. It has been a long road. Today we have the solution, and we believe it's going to allow us to displace. As you know, the vulnerability management market is a displacement market, essentially.
To displace much more easily because we bring more value to the customers. We simplify their lives and as well as expanding our market in the mid-market, which is where we typically, historically and always competing against the Tenable and the Rapid7, which of course, were more low-end solution, when we were, in fact, the one having the solution that could scale. Today we cover with one single solution, VMDR, from the very low end of the marketplace to the very large market. This is significant.
Okay. Yeah, sounds like it. Well, thank you for that. Melissa, I just wanted to follow up on your comments on investing in sales and marketing next year. I'm wondering if you could talk about how you're investing in the sales part versus marketing, and particularly what you're expecting in terms of sales head growth next year. Thank you.
Yeah. We're happy with our sales force. As we discussed last quarter, we promoted Lori, our VP of North America, to head of worldwide sales. We have a lot of people in place. We're always looking to add here and there, but there's no significant needs to the sales force. We look for the right people. As Philippe mentioned, we've just added significantly on the marketing side. There'll be a few places on the sales side to fill in, but nothing significant.
You will see more partnerships also, essentially. We are really the ideal solutions for partners. I mentioned the MSSPs because today, and also because we are moving into response, and that's the thing that MSSP absolutely needs to really provide a good application, is the ability not only to detect but to respond. We have expanded significantly our capabilities of responding. We're going to do more, as now our agent, for example, soon will have the capabilities to also be capable of being interventionalist, if I don't know the term in English. You could certainly remotely remove processes, kill some processes, and you could really do microsurgery remotely, which is very important, if you want to automate things.
I think we see today, and the partners who have already, and then there's quite a few more which are coming our way because they say, "We need the scale. We need all of that done for us. We don't have the time to build all of that." We are not competing with them because unlike other companies, as you very well know, like, for example, Rapid7, which have a Managed Security Service Providers, we don't, and we will never have one, I can tell you, because it's not really profitable or as profitable, I should say. They can deliver their service and their additional added value.
What we see also is that they're all looking to our SIEM, because the problem they all have with the SIEMs is that they are using existing SIEM, which I'm not going to mention, which are very expensive for them and do not scale. We have embarked already having few of them as our design partner, and I think our SIEM will be another game changer as well. The ability to do also a very scalable EDR solution at a much lower cost than the existing solution today. All of that is in the making. As you know, we have built a significant engineering force in India, where we have more than 750 people now. We're moving in May into a brand new headquarter, which is going to allow us.
We are in the process, by the way, of expanding to go to be specific, expanding our marketing capabilities, what I call that we are building a marketing platform. We have built a technical platform. Now we're building a marketing platform in part out of India. We could really scale that business, and really leverage all with the new media. In fact, we just hired a director of new media platform. We're about to hire a VP of digital marketing in India as well. We're really now gearing up. I've always, and I've mentioned that so many times, that instead of trying to grow at any cost before you have the solutions, I've always taken the approach, you know the company I've made, which all have been extremely profitable for that reason. I've been always careful not to put the cart before the horse.
We've got a horse now. We've got a fantastic cart. Now we're putting the horse, and that's more on the marketing. When you do that, you don't have to spend as much money because the product is packaged and on, and you have the delivery model, and that's why we can continue showing very good margin while expanding our sales and marketing efforts. I'm going to write a document about that. I didn't want to do that until we're there, but I'm going to explain the power of the model that we have really built today, leveraging the cloud, of course, technology.
Great. Thank you very much.
Thank you. Our next question comes from Gur Talpaz from Stifel. Please go ahead.
Okay, thanks for taking my question. Philippe, I actually want to follow up on some of your commentary that you just offered. You're pushing into SIEM and EDR, those are two very large and very significant markets in the enterprise and really across security in general. When you think about your push into these new markets, how do you think about your differentiation, what you're going to bring to the table that's ultimately different than what's already out there?
It's a very good question, and it's a differentiation on multiple levels. The first one is the scalability, the unique scalability that we have. What we have done, instead of, for example, depending on an AWS backend and so forth, which of course gives you instant scalability in a way. You don't have to build all that infrastructure yourself. The problem it gives you is that now you're suddenly much more dependent on them and the pricing structure. When we took the other route of really building essentially our own, if you prefer, little AWS, going microservices, bare metal, huge scalability, absolutely building everything ourselves using open source engine. That offered us unique capabilities and as you can see because of that, and the reason is why Google, Microsoft, Oracle, Amazon, they're all using us to secure their own platform.
We can also put our data centers, if we all our platform in Azure, in Amazon, anywhere without being dependent as much of their solutions. We have much more flexibility, which is very important when you look on the global scale. That's one element is the scalability. We're far above anybody that we know. The second element is the fact that unlike anybody, we have much more information. We collect the data that they don't. If you look at some EDR solution, the only thing they know is the endpoint. They have no idea of the context and the rest of the environment. That lends into more false positive, et cetera. Then you have the challenge, of course, of scale and the challenge of remediation.
Qualys has always taken the longer road of architecting things the right way instead of trying to find the shortcuts, and that's why it took us so much time to get there. Now today, we are almost there, and in fact, we are going to discuss that in more detail as well as our invest today. Again, we're very confident that we are going to deliver these two major new applications, if you prefer, which are essentially extensions of the platform. When you look today at an EDR solution, for us, it's an application on the Qualys platform. It's not another point solution. That's the problem with all of these other solutions. They're all point solution looking at one single element when we are true very broad platform.
That's very helpful, Philippe, and thanks for that color. Melissa, just one question for you. I know last quarter you touched upon the notion of some changes in competitive pricing dynamics and your ability to sort of to match on renewal. Did you see any changes this quarter on that front?
What we talked about last quarter was the fact that in certain cases we were leveraging our position to be more aggressive. I think the VMDR package itself is going to make us more impenetrable because we're providing all these solutions bundled in a single app. Really, the way I think of it is the end-to-end life cycle of vulnerability management through remediation. We think that'll provide us with a lot of strength.
It does, and we see that already. I will not use the term bundle because, yes, it's bundled, but it's more than bundled. As you will see when you see the app itself, it's all integrated in one single app. It's not really bundling and putting together these different apps that we already have and then giving you a better price. It's essentially putting all of that as one single app, and that's where we call it transparent orchestration or building orchestration, if you prefer. It's all building. You move from one app to the next, it's all one single thing. That's the big differentiator, and that you will see that for yourself.
Once the customers, which already have seen some of it, but when we start to really market that, you're going to see videos, you are going to see a very big marketing effort to show because the solution will sell itself at the end of the day. When you look at it and say, "Wow, this is absolutely what we need. I don't need to have that one application and that screenshot, and go this here and go there." It's all done for you. That's very, very important. Again, it didn't come just like that. This is the work of many years of effort of trying to expand the platform, as I said earlier, and building best of breed solutions. Now what we're doing is integrating them, all of them, into one single solution.
It makes a lot of sense. Thank you very much for all the color.
Thank you. Our next question comes from Matt Hedberg from RBC Capital Markets. Please go ahead.
Hey, it's Dan Bergstrom for Matt Hedberg. Thanks for taking our questions. You've had a number of large agent purchases by the cloud providers in the past. You mentioned the recent partnership with Google to embed the cloud agent into GCP on the call. Could you talk a little bit more about that partnership? How did it originate? What are you looking for from it? What does it mean from a validation perspective? I guess, is it live in the marketplace currently?
Yes. It's not very simply that both Google, Microsoft, Amazon, et cetera, were already using the Qualys agent for their own needs, for securing their own platform. From there, of course, that means we have the right architecture. This kind of company at the scale at which they operate, of course, you have to have the right platform, the right architecture. You speak of millions of agents here at the end of the day. For us now, what we did is to now go to their customers and doing exactly what we're doing for them, now for their customers. The answer is yes. I think today it's well integrated with Microsoft. I don't know exactly where we are with Google, but I think it's done. If it's not done now, it will be done. That we need to check, I don't remember.
We're discussing with many other vendors as well in the cloud, because today there is nobody who has the architecture that Qualys has done. Again, remember these agents, and we have patents, by the way, around these agents. That we build these agents. They didn't come, again, just a few weeks ago. That has been a long time in the making. To get the scale to the self-updating capabilities, the fact that they also need to be very secure, all of that is just not easy work. We've been working at that for many years now. Starting to have 30 million agents is already. Of course, our goal is to have an agent on every endpoint. Now we have the agent, which we are now rolling out onto the Android, the mobile platform.
Our agent now today, very soon, they are going to go on containers as well. Our agent architecture, if you prefer, again, that's the way we look at it. It essentially spans across all these different environment and also to the OT and IoT environment as well. We're just at the beginning, and that's what I speak about ubiquity of our agent. We're just at the very beginning. We are the one who really build this agent technology better than anybody else. Again, we have been working at that. I don't remember exactly the time, but I think our first agent was 2007. I don't remember. It's a long time ago. I would think it's a long time ago that we built these agents.
Great. Thanks. Melissa, gross margins were impressive here this quarter by 82%. They've trended higher sequentially through the year, four quarters in a row now. Can you talk about what's driving that? Then maybe any thoughts about how we should think about gross margins with the evolving model here and into calendar year 2020?
Absolutely, Dan. We're very proud of our revised gross margins, but we did benefit from mix shift to India. We do have a lot more investment going forward. We're looking at adding some shared platforms potentially in other parts of the world. I would expect there to be more investment in the cost of revenue lines, putting some downward pressure on gross margins because it is at very high level. We don't guide to gross margins, so I'm not going to give you a range, but you can imagine that it'll stay at best of class, but not necessarily at the current levels.
On the gross margin also, the fact that we have re-architected and we are benefiting also of significant cost reduction. For example, we have eliminated 70% of our VMware layers and to go bare metal with containers and microservices. That's the beauty also of our engineering driven, if you prefer. We have copied on what Facebook did and what all these big guys done. We have not invented anything here, but we have been very good students of how the Google, the Facebook, et cetera, did scale their platform and reduce their cost. We have done our own DevOps, the digital transformation in quite significantly. That's a big advantage that we have looking forward when a lot of our competition have not even started.
Great. Very helpful. Thank you.
Thank you. Our next question comes from Howard Smith from First Analysis. Please go ahead.
Yes, thank you for taking my question. Just wanted to follow up on the prepared comments regarding the Technical Account Reps or TARs, which is kind of new for you last year. How do you assess where you are in their development and the progress seen to date? Just some commentary about that would be appreciated.
Oh, very much so, Howard. This is something that I personally am very much involved because it's about scaling not only just every aspect of our business. This Technical Account Representative, for those who may not remember, we realized that today it's all about making life easy for people to adopt, to make your solution not only easy, but that you have all the information at your fingertips. We build a team of Technical Account Representative in India, which are people that we hire, very junior people, but yet from the good technical schools. Of course, because we have a huge engineering team there, we train them. They have all the technical resources, and their job is not to sell. Their job is via what we call the Qualys Q agent, like in the James Bond movies, Mr. Q.
You have the Q agent who comes in immediately and is there to help you. Behind you have the TARs, technical account representative. Where there's a huge pool of talent in India that we can attract. The cost is absolutely, we pay about $700 a month. We give them more than that. We give them a career path. We have a highly skilled, motivated technical people which are there to help the customer on board. That's all what they do. Now we're putting the systems around in place so we could automate a lot of that as much as possible, get all the feedback which goes back into engineering and marketing to understand what the difficulty customers may have in deploying the agent, for example, whatever that is. All that information is essentially more and more automated.
We have today a fantastic guy running that team. That team will not report to sales because we don't want to have them being salespeople, but they also are helping us to qualify leads. Then we pass that then automatically to what we call our technical account managers, who are the pre- and the post-sales people, which are now the one which engage the customers to sell them or upsell them. That's the system again we have put in place. Again, in India we can scale. We have today, about a group of about 10 people already, and we can bring it to 100 to 200, whatever the number is. The manpower is there. Trying to do that in the U.S. is almost impossible. In California, it's impossible. You could not even keep them, even if you would build that. A year later, they would be gone.
I think doing that out of India is very good. It doesn't cover the entire world because you have the issue of the language, but it covers a lot of English-speaking countries. What we do for Europe, we do a kind of a hybrid solution where we may do that function with a partner in Europe, which of course, is a managed security service, and essentially, but they could benefit of the entire machine that we have put in place. Does that make sense?
Yeah. I hadn't realized the full distinction between them and sales and how they generate the leads. That's helpful, Courtot. Congratulations on a solid year.
Thank you.
Thank you.
Thank you. Our next question comes from Sterling Auty from JPMorgan. Please go ahead.
Hi, guys, this is Matt on for Sterling. Thanks for taking our question. Looking at the March guide, for revenue, that 14.5% growth, the midpoint of the range is about the same as this past quarter. Does that mean that the seasonality throughout the year is expected to be even quarter-to-quarter?
Yeah, I don't think they're actually related. There's nothing in our business that's changed that our seasonality would be different necessarily than prior years.
Okay.
Yeah. We don't have much seasonality anyway. We have some, but it's really minimum.
Right.
Remember, for us, we're very pure in the sense that we do not sprinkle in our projection any kind of perpetual license. We don't have professional services either. There's none of that. It's all recurrent, 100% recurrent, and which of course, as you know, it's a little bit harder to really grow a recurrent model. On the other hand, it's a much more predictable and more profitable model than pushing and having a kind of a mixed bag. I don't think it's very misleading for the investors, but that's not our case.
Great. Thanks, guys.
Thanks.
Thank you. As a reminder, to ask a question, you will need to press star one on your telephone. To withdraw your question, press the pound key. Our next question comes from Patrick Colville from Arete Research. Please go ahead.
Hi, there. Thank you for taking my question. Can I ask you about CrowdStrike and Tenable? They are articulating more aggressively about their vulnerability management features, and I was just wondering what you make of those guys and whether you see them as competition or whether they are kind of complementary to Qualys. Thank you.
Okay, very good question. Let's start with the Tenable, which is more of a direct competitor since many, many years. The big difference between Tenable and Qualys is that essentially they have a very disjointed architecture. They have the Tenable.io, which is a cloud-based solution, then they have the security center, which is an on-premise and other solutions, and these are very different solutions. For them, essentially, their biggest challenge that we see ahead for them is, essentially, they will have to really bring all these different solutions together into one single platform, which is going to really, of course, take time and very expensive. Today, as many people know, they have been essentially pushing Tenable.io into their existing customer base. They have a very good customer base with Nessus. They're very loyal. They're trying to push Tenable.io.
They have hired a lot of salespeople and marketing. That's what they do. For us, I think VMDR is absolutely, again, a game changer. We can anticipate that we are now going to be able to compete very well at the lower end of the marketplace. We see that already happening. As I mentioned earlier, on the high end of the marketplace, now it becomes very difficult to displace, and you cannot play some of the tactics that they did, which is dumping the price, because now we offer so much more into one single application. I think it makes us more inoculated, if you prefer, against these kind of viruses. That's for Tenable. We are competitor with them head-to-head, and we offer significantly more than what they do in the world. That's for them. CrowdStrike is a little bit different.
CrowdStrike, as you all know, have done a very good job at essentially cornering that EDR market, which there's so many players, but I think they really did a very good job at essentially differentiating themselves from these other player. A combination of having a very good, strong technical team, which really understand the problem. Also creating a managed security service on the top of it, which has been the problem for a lot of these other solution. The problem with EDR is that you have all these endpoints which are roaming the world and the seven seas on the Internet, and then suddenly you discover that one of these endpoint is compromised at 2:00 A.M. in the morning, local time, but know that device is in Singapore. How do you mitigate, remediate, prevent, quarantine that device? You need to have people watching these devices.
Very few companies are capable to follow their own endpoints everywhere in the world. By Overwatch, they're really essentially, it's a managed security service in disguise. They have, of course, it gives them very good revenue growth. The problem with that is that suddenly it's very expensive to both, on one hand, develop your own platform, and on the other hand, to have a managed security service on the top of it. You become very dependent on people, which is, of course, do not scale. Also their backend is essentially on AWS, they have essentially AWS, they have Splunk, and they have Cassandra as the backend. All of that, again, to make scale and the cost, it's very hard to do. We, again, do not depend on all of that. In fact, today we use a Cassandra backend.
We're pumping 1 million writes per second in our Cassandra backend. We have Elasticsearch, again, 3 trillion data points. All of that is our own technology. Now the advantage, so yes, they are trying to move, they of course, they can do Vulnerability Management on the endpoint by just knowing what is the application that you have, but that's not enough. Of course you need to have more context about that endpoint to really eliminate all the potential vulnerabilities on that device. In fact, what we see today happening in many of our large customers, which is interesting, is that they have two agents today on their endpoints. They have the Qualys agent and they have the CrowdStrike agent, and they don't need any other agent because the CrowdStrike agent, of course, provides essentially also antivirus and all these other capabilities.
We are today working very hard at delivering exactly all the functionalities that CrowdStrike has on the endpoint. We already have with our IoC 2.2.0, we have threat hunting capabilities, et cetera. What are we missing? We're missing an antivirus solution and a few other things. We have also the backend to our advantage plus the entire context. That's essentially how we are going to differentiate themselves. I would say that we'll be by far into their turf far before they can come into ours, unless they start to acquire companies who do what we do, then they will have to integrate all of that, which is not a walk in the park. I think, this is where we are. We are working towards providing that additional functionalities to our customers.
Our go-to market will be very different is that we do not want, and we will not have a managed security service. We are going to leverage all the partners that we have. We have most of the managed security service providers are today Qualys customers. They are the one which are going to deliver the service. We will enable them. This is fundamentally the difference. Does that make sense?
Yeah, very clear. Then can I ask a question for Melissa, please? The current billings in the quarter was very impressive, a 15% growth based on my numbers. You mentioned in your prepared remarks there was a small benefit from large deals closing in the quarter that may have typically closed in the first quarter. Can you give us an idea of what the impact on growth or dollars those large deals could have contributed?
That's correct. What I talked about in my prepared remarks was the fact that some deals were invoiced in Q4 that should have at their anniversary in Q1. Just as we've been forthcoming when deals slip out a quarter, we wanted to be transparent when deals move in. Given that there's multiple scenarios when the renewal happens or doesn't happen at the same time as the anniversary of an initial deal, it's really hard to normalize for comparison purposes, and that's why we point to the trajectory of our annual revenue guidance as the best proxy for business momentum.
Yeah, I would add one thing because Melissa is using the term that deals slip out of the quarter. This is an enterprise term, does not apply with us. We really work clearly. For us, is well driven by the customers. If the customer sometimes, and we have some of these deals which have been flipping from December 31st to January 1st, depending on the budget cycle of the customer, which may have changed. They are the one requesting that to us. For us, we don't care because it doesn't impact the revenue. That's the reason why we always said the way our billings are not really representative of what is happening in the quarter. What happened here as mentioned, and that's why we disclose whenever when the billings are very strong over a week, we explain, this is what happened.
Sometimes the customers may move the deal. For example, if they early renew or there's so many variables, it doesn't change the revenue, but it absolutely changes the billing cycle. That's the very way we build the model, which again, it's an element of our profitability because when we go at the end of these quarters and we got procurement saying, "Okay, guys, if you want me to close the deal, you need to give me a better price." We say, "Sorry, guys, the renewal is now, so we could either shut down the service, but well, not like that, but by the way, we don't really care." Whether we close now, as long as you renew, and we don't care. Because it doesn't really impact our revenues, and that's what makes us very different from quite a few other companies.
Great. Thank you for taking the questions and see you at RSA.
Okay, thank you.
Okay, thank you. Night.
Thank you. I show no further questions in the queue at this time. I'd like to turn the call over to Philippe Courtot, for Chairman and CEO, for closing remarks. Please go ahead, sir.
Thank you very much. In fact, thank you very much for attending our earnings call and for your questions. Again, one of the things that I mentioned earlier is that we'd be really happy at the next earnings call to discuss about the adoption of VMDR from our existing customers or from, as well as from new customers. Looking forward to see you or all of you, I hope, if you can make it, the RSA. The Four Seasons is a beautiful hotel. There's much less noise there than at RSA and we have our customers there also. If you could attend our event, you will see VMDR in action. You could also speak with our customers directly, and you're more than welcome to do that. Thank you very much.
Thank you.
Ladies and gentlemen, this concludes today's conference call. Thank you for participating. You may now disconnect.