Good day, everyone. Welcome to Qualys' third quarter 2019 earnings conference call. This call is being recorded. At this time, all participants are in a listen-only mode. Later, we will conduct a question and answer session, and instructions for asking a question will be given at that time. I would now like to turn the call over to Vinayak Rao, Vice President, Corporate Development and Investor Relations. Please go ahead, sir.
Good afternoon, and welcome to Qualys' third quarter 2019 earnings call. Joining me today to discuss our results are Philippe Courtot, our Chairman and CEO, and Melissa Fisher, our CFO. Before we get started, I would like to remind you that our remarks today will include forward-looking statements that generally relate to future events or our future financial or operating performance. Actual results may differ materially from these statements. Factors that could cause results to differ materially are set forth in today's press release and in our filings with the SEC, including our latest Forms 10-Q and 10-K. Any forward-looking statements that we make on this call are based on assumptions as of today, and we undertake no obligation to update these statements as a result of new information or future events. During this call, we will present both GAAP and non-GAAP financial measures.
A reconciliation of GAAP to non-GAAP measures is included in today's earnings press release. As a reminder, the press release, prepared remarks, investor presentation, and supplemental historical financial spreadsheet are available on our website. With that, I'd like to turn the call over to Philippe.
Thank you very much, Vini, and welcome, everyone, to our Q3 earnings call. Melissa and I are really pleased to report another solid quarter in terms of revenue growth and profitability. We also are very pleased to report strong growth in our paid Cloud Agent subscriptions with almost 28 million now, 93% growth from prior year quarter. As discussed before, our Cloud Agent technology platform for seven security compliance and IT solution available now, namely Vulnerability Management, Policy Compliance, File Integrity Monitoring, Indication of Compromise, Patch Management, Asset Inventory, and the upcoming Certificate Management. With more to come. In terms of our newer solution, we saw strong growth again this quarter from FIM, and we continue to build a healthy pipeline in Patch Management and Container Security. At Black Hat this quarter, we launched our global IT asset discovery and inventory app as a free service.
We received very positive feedback, as I think most of you know already, from our customers and industry luminaries because global IT asset inventory is one of the biggest challenges. If not the biggest challenge for organization. Visibility is the cornerstone of security, as you simply cannot secure what you do not know or see. With our free service, companies of all sizes can automatically build their global IT Asset Inventory across on-premise, endpoint, cloud, containers, and now mobile environment, as well as identified in real time everything that connects to their networks. Only two and a half months ago after the launch, we had approximately 3,650 companies signed up with over 500 new customers using the service. We have also been rolling out the free service to existing customers since last month and now have almost 300 existing customers using it.
As a result, our goal to make our Cloud Agent ubiquitous is now well on its way and allows us to make the subscription to our paid app frictionless because no additional infrastructure is required. Distributing such a free solution from our platform to generate meaningful demand of our paid apps is one of the key elements of our profitable growth, driving value for both our customers and shareholders. This multi-product adoption naturally increases the stickiness of our platform and helps make us impenetrable to our competitor. We do not offer the same breadth of solutions. This is underscored by the fact that the gross dollar retention rates of customers who have adopted four solution or more stands at 99%.
We continue to invest in expanding the capabilities of our cloud platform and developing additional solutions. We will showcase significant new offerings at our upcoming QSC or user conference in Las Vegas on November 20th and 21st. At the conference, our attendees will have the opportunity to listen to industry experts such as Richard Clarke, author of "The Fifth Domain" and formerly at Czar in the White House, Scott Crawford from the 451 Research, as well as Ramesh Chinta from Microsoft Azure, who will discuss how Microsoft is building security into Azure and of course, the role that Qualys plays in it. Charles Anderson from IBM X-Force Red, who will talk about their efforts to automate pen testing and more quickly respond to eliminating vulnerabilities.
They are a very big user of Qualys as well. You will also hear a fascinating presentation from our customers, which share their experiences and best practices. Their views on how the security needs are evolving and our mission-critical Qualys is becoming for them. Our President and Chief Product Officer, Sumedh, which we promoted recently, and I will discuss that later, will unveil our next generation of Vulnerability Management offering that brings it to its next level and showcase our forthcoming EDR and Data Lake SIEM initiatives. Among other innovative solutions, we will discuss the forthcoming updates to our Container Security and the capabilities we have now of threat hunting with Qualys. You could click, you could go to our website and look at the agenda as well.
I would like to personally invite you to both our user conference and a dedicated institutional investors and analysts session that will occur during the conference on November 20th. This event will focus on how Qualys is driving sustainable growth and profitable growth and will include a demonstration of our newest application as well, and with a Q&A session from select Qualys customers. Finally, the expansion of our cloud platform, which now deliver an impressive suite of security and compliance solution, as well as our buildup of operation in Pune, where we have now more than 750 employees, was led by our Chief Product Officer, Sumedh Thakar. I'm delighted to announce his promotion to President and Chief Product Officer. Sumedh started at Qualys in 2003, and through outstanding performances, now runs R&D, QA, ops, product marketing, and customer support.
With this promotion, he will also run worldwide field sales operation. As we continue to lay the foundation for our future growth, we also promoted Laurie MacCarthy to EVP, Worldwide Field Operations. Laurie joined Qualys in 2012 and was most recently VP, Field Operations for the Americas. Laurie came from one of our customers, where she was running one of the absolutely extremely good program, the Vulnerability Management program at CVS, which was really second to none. In addition, we promoted Dilip Bachwani to SVP, Cloud Platform, Ops and Dev Ops. Dilip joined Qualys in 2016 and was our VP of DevOps. Finally, we welcome the addition of Mustafa, and I'm not so sure if I know how to pronounce it correctly, Mahudhawala, as our VP of Global Customer Service. Mustafa is coming from Red Hat.
Our product and platform achievement and expansions of our management team lays the foundation for our continued progress to enable customers to consolidate their security, IT, and compliance stack, while drastically reducing their spend. As importantly, it is core to the highly profitable, recurring, and growing revenue model we have built. With that, I will turn the call over to Melissa to discuss our financial results.
Thanks, Philippe. Good afternoon. Before I start, I'd like to note that except for revenue, all financial figures are non-GAAP, and growth rates are based on comparisons to the prior year period, unless stated otherwise. We're delighted with our increasing Cloud Agent subscriptions and multi-product adoption, which lays the foundation for future revenue growth and industry-leading profitability. Our Q3 financial and operational highlights include revenues for the third quarter of 2019 grew 15% to $82.7 million. Platform adoption continued to increase as the percentage of enterprise customers with three or more Qualys solutions rose to 46% from 39%. The percentage of enterprise customers with four or more Qualys solutions increased to 26% from 20%. Paid Cloud Agent subscriptions increased to $27.9 million over this last 12 months, up from $23.6 million for the 12 months ended in Q2 2019.
2 million additional Cloud Agents were purchased this quarter by a single cloud platform customer. New products released since 2015 contributed approximately 33% of total bookings in the quarter, up from 23%. Our average deal size continues to increase, growing 8%. Our scalable platform model continues to drive superior margins and generate significant cash flow. Adjusted EBITDA for the third quarter of 2019 was $39.2 million, representing a 47% margin versus 45%. We continue to increase our head count sequentially, and we benefited from attracting great talent in Pune, as well as lower non-salary head count costs and lower third-party expenses this quarter as compared to Q2 2019. Q3 EPS grew 34%, and we generated strong free cash flow for the third quarter of 2019 of $39.9 million, and year to date, our free cash flow has increased 36% versus the same period last year.
In Q3, we continued to invest the cash we generate from operations back into Qualys, including $5.8 million on capital expenditures, including principal payments under capital lease obligations. $49.8 million to repurchase 603,417 of our outstanding shares. Our board has authorized an additional two-year, $100 million open market share repurchase program, resulting in approximately $141 million in current share repurchase capacity. We remain confident in our model, driven by our foundation of recurring revenues and expanding suite of applications. Our current fiscal year 2019 revenue guidance is now a range of $321.2 million-$321.8 million. We are raising fiscal year 2019 non-GAAP EPS from a range of $2.03-$2.07 to a range of $2.28-$2.30. We now expect to expand EBITDA margins this year, and we expect our fiscal year 2019 EBITDA margin to be between 42.5% and 43%.
For the fourth quarter, we expect capital expenditures to be in the range of $9 million-$10 million, which includes approximately $3.5 million for the first phase of the build-out of a new Qualys office in Pune. We are very excited by the robust early adoption of our free global asset discovery and inventory application, which makes it frictionless to enable many of our paid subscriptions. This provides us the opportunity to accelerate revenue growth as well as expand margins in the future. As Philippe mentioned, we look forward to seeing many of you at the analyst and investor session at our upcoming QSC user conference in Las Vegas. With that, I'll turn the call back to Philippe for final remarks.
Thanks, Melissa. In summary, and as Melissa says, we're really happy with the progress made in expanding our cloud platform and the increased adoption of our solutions by our existing customers, enterprise, both large enterprise and the SME and SMB, as well as new customers. In addition, again, like just Melissa did, let me reiterate the invitation we're extending for you to attend both our user conference and the investor session. Investor session will also be webcasted for those who cannot attend in person, so they could listen it at their own leisure. Please register on our website and peruse the agenda for one or both events. Melissa, Sumedh, Laurie, and I all hope you will attend. With that, Melissa and I are happy to answer any of your questions.
As a reminder, to ask a question, you will need to press star 1 on your telephone. To withdraw your question, press the pound key. Please stand by while we compile the Q&A roster. Our first question will come from the line of Howard Smith from First Analysis. You may begin.
Yes. Thank you for taking my question. Congratulations on the continued very profitable growth. First question has to do with the share buyback authorization and activity. Seemed a little bit stepped up in Q3. I am just wondering, is there any kind of policy shift in terms of how you and the Board are thinking about using the cash return to shareholders this way?
Thanks, Howard. I'll take that one. As a framework, our share repurchase program, the objective is to minimize the dilution from grants given to employees, and that has not changed. That continues to be the same. If you look at how we've repurchased over the last couple of years, we end up being back-loaded in the second half of the year because our window for repurchasing in the first half, especially the quarter where we announce year-end earnings, end up being the shortest. Think of it a little bit more as a catch-up.
Okay, great. That's helpful. Then, Philippe, you spoke of the success of the Asset Inventory rollout. Previous to that, you had CertView, I think, as kind of a free offering. Just in general, as you've rolled out a couple of these and see the results, how are you thinking about using free versions to spur upsell, and any tweaks you might be thinking of making going forward with those types of programs?
Yeah. As opposed to CertView, which has the more limited upsell, the global IT inventory is very strategic on many fronts. It's very strategic, as we discussed, in fact, previously, because it gives that visibility that company do not have, and that's absolutely something absolutely crucial and is becoming very obvious that everybody needs to go that way. What is very unique with our global IT inventory is that it spans across your entire environment. It just doesn't look at your Windows servers or endpoints or cloud. It goes across everything that you have in your environment. From there is significant upsells opportunities. You have the one which really are directly related to the global IT inventory, which is, for example, the ability now to look at your end-of-life systems.
There's additional features about the kind of information that you can get that you do not get from the free Asset Inventory. Discovery, by the way. You can also now synchronize with the ServiceNow CMDB. We become naturally the source of truth. This we see today very strong interest, and we today probably have around 100 customers which are doing that already. Then there is also all the other upside which are related to the agent, because once you deploy the global IT inventory, you want to absolutely use the capabilities of our Cloud Agent because they give you real-time, which means anything that suddenly changes on one device where you have put the agent on one asset, immediately you know what that is, and that's exactly what you want.
Security has become an issue of both scale. It's always been an issue of accuracy, and now it's becoming absolutely an issue essentially of scale as well, and real time, which is obviously things that requires a significant platform to be able to do that. There's many, many, many upsell opportunity around that Cloud Agent, and that's what we believe is very strategic, and we see already that, yes, it is very well received. As you know, we have only rolling out to our existing customers about a month ago. The reason why we did that, because we didn't want to have suddenly all of our customers adapting it, so we're trickling and then having too much load too quickly on our platform. The reception is fantastic, and this, we'll continue.
Great. Thank you.
Thank you. Our next question comes from the line of Dan Ives from Wedbush. You may begin.
Yeah, thank you. Can you maybe just talk about in the market where you have some competitors that are starting to significantly expand their product portfolio on risk and some of the broader sort of platform approaches. Maybe talk about that in terms of what you're seeing in the market and from a product perspective, any changes? Thanks.
Yes. In term of the, again, of the competition, yes, everybody today realizes that they got to build a platform, and that platform cannot be an enterprise software platform. It has to be a cloud platform because the cloud platform gives you the scalability that you need. In that sense, we are so well ahead of the market because I'm sure, as you recall, we started that journey back in 1999. We went through all the different variations of the cloud technology, and we have been absolutely, thanks to the big investment we made in Pune, able to inject the most, the newest technology. We have Elasticsearch, we have Kafka, Cassandra, and we're building that at scales that today we don't know anybody doing anything close to the scale that we do.
We have today 28 million agents, but in reality, we also have architected hundreds of millions of agents, if not billions of agents. It's all about scale. Yes, other companies are moving into that direction, but we believe that we are far ahead, essentially, of everybody else.
Thanks. Could you maybe just talk about, especially in cloud with the Azure channel, obviously gaining more and more success, with the JEDI win, and just how you feel, think about those market dynamics playing out and how that potentially bodes well for how you guys are positioned, especially when it comes to some of those Microsoft deals. Thanks.
That's another great question. Effectively, we always have believed, if you recall some of the comment that I made, in fact, in 2009, I was already making that comment publicly at the RSA, that we need to build security into the cloud. We cannot continue bolting security on. In order to do that, you need to have the right architecture, and this is exactly what our Cloud Agent are all about. We have all the major players all using our Cloud Agent today and millions of them to essentially ensure they have the visibility and ensure the security of their own platform.
As I mentioned, I think either last earnings call or the one before, we have done something remarkable with Microsoft, whereby we have totally integrated our agent with the security center of Azure, whereby an Azure customers can essentially click on a link, go to the security center, click on a link, have the entire view of all of the assets they have on Azure, click on the second link, and have the view of their security and compliance posture. This is thanks to the Qualys, if you prefer, embedded agent there. Third, click on the third link, which has nothing to do with us, but only 100% with Microsoft, create their playbook, and then remediate. Security in this new environment have become click, click. Nothing to install, nothing to update. It's all done for you. What a big change.
The only thing you do then is that you bring your policies because you are the one, the customers who decide your policies. Do you want to have a strict buckets happen or not? Do you want this? Do you want that? Of course, security is built in. That's where we see the future. Of course, we're extremely well-positioned. Now that we have totally integrated, of course, our agent with Microsoft, then of course, we're very happy to have heard that they won the JEDI contract because, of course, we naturally go. By the way, as you know, our solution is FedRAMP authorized. This is, for us, the way we saw the future happen, and now we are so happy to see that the future is now.
Thank you. Our next question will come from the line of Christopher Eberle from Nomura Instinet. You may begin.
Great. Thanks. Hey, guys. Nice job on the quarter. Can you guys give us an indication of just, now that you have the free download of the Asset Inventory in the market, just some early adoption, what some of the attach rates look like for paying applications to that?
Yeah. In fact, today, let me remind you the adoption of all of our customers, the way they adopt. They always do a first proof of concept, and then they start to do the deployment. That takes some time. As you know, with our model, we take the revenue as we deliver the service. We don't do like most of our competitors, which have a big chunk of perpetual license that they can, of course, that inflates, if you prefer, their growth. This being said, today, we see that even with these customers which have adopted, we're already starting to discuss with them about all the upsell capabilities that they have. We have seen already customers trying now all these additional capabilities. All that are very good initial signs that what we have done.
When you really look back, everything is integrated. That means you don't have to install another application. You don't have to have another person managing it. All of that can be done by the same team, which is currently managing the Qualys solutions. The answer is yes, we're very happy with it.
Got it. Great. Thank you.
Our next question comes from the line of Nick Yako from Cowen and Company. You may begin.
Great, thanks for taking my questions. You saw a nice jump in the % of bookings from new products in the quarter. Any one or two products that you would highlight that were key drivers?
Hi, Nick. Yeah, we were delighted with that jump, which was 33% in new solutions as a percent of bookings from 25% last quarter. It still remains mostly Cloud Agent, VM, and Policy Compliance. Remember, as we've discussed, it's not a perfect metric because it does include the renewal portion of VM Policy Compliance when someone renews from the original solution into a Cloud Agent-enabled solution. We did see a high amount of renewal in that metric this quarter.
Yeah, I could say some good traction now from the FIM as well.
Okay, great.
File Integrity Monitoring, which is the File Integrity Monitoring.
Okay, great. Building on an earlier question around cloud. Earlier this week, you announced the global IT asset discovery app for the federal market. Just curious what % for the federal market, and curious what % of revenue does the federal government represent today, and now that the government is embracing cloud, how you think about that opportunity moving forward?
Yes. In fact, that has been our journey, trying to convince the government to apply our cloud solution, was although you had a lot of people saying about this, there's not much appetite. Finally, it's changing. Today, we have a very small percentage. I think today, if you include states, 3% around of our revenues are federal and state, and if you pin that down to federal, it's probably about half of it. We have very good customers, very solid customers. They rave about what we have. Now finally, we're starting to essentially see the government ready to take. We're going to make some investments now because, again, we have always been balancing. It's not worth starting to invest ahead of the game, but you don't want also to invest too late either. You have to time that as best as you can.
Now we see an opportunity really with federal to really grow that market. Again, with federal, it takes time. That JEDI contract is really, I think, this is going to be very interesting for us. Again, it needs to be deployed and on and on, so it takes some time in the federal government. Today, we're not seeing any significant revenues early next year, but I think we'll have a bit now with the fiscal year being at the end of the year, so maybe we could get some nice additional thing. Today we're not really counting that much, but we will make the investment in essentially beefing up our federal team.
Thank you.
Our next question will come from the line of Matthew Hedberg from RBC Capital Markets. You may begin.
Hey, it's Dan Bergstrom for Matt Hedberg. Thanks for taking our questions. Sumedh, the go-to-market, traditionally, you adopt new products through the platform, but at Black Hat and around the event, around the global IT asset discovery and inventory launch, there was a significant awareness and marketing campaign, very noticeable to us that attended, I think more of a start to market to and engage CIOs. Could you talk a little bit about that strategy and then any early engagements from that?
Yes. That's in fact, absolutely, because that's in fact the opportunity that we have today. Now what you're going to see is the second leg of our campaign. The first campaign, as you rightly characterized it, was an awareness campaign. This is what we have for you guys and okay, come and see. Now we have enough adopters, we're now going to have our adopters speak. That's the second campaign we're preparing. They are the ones who are going to describe the benefits and what they have done and achieved. You're going to see some of that at our user conference, or where we're going to have some of our users talking about it. You will also see an interesting panel to answer your question about the CIO.
We have a very interesting panel that now our President and Chief Product Officer, Sumedh, will moderate, where we have, in fact, Wendy Pfeiffer, who is the CIO of Nutanix, which is on our board now, which is also part of creating awareness to the CIO. In fact, she's going to be on the panel, and they're all going to discuss. She's going to give her view as a CIO of how do they see the evolution of security. We have also some other very good representative of the company. I think we're just at the beginning of that, but that's definitely the direction that we're continuing to take, and you will see acceleration of our awareness effort toward the CIO and the CTO conference. One of the things I want to mention, the game in security is changing.
The theme of our user conference is Security at the Crossroad, part 2. Why did I say part 2? Is because part 1 is what I said last year about telling this is where we see the marketplace going. Part 2 will be the market is now there. What are the implications for the security industry? We'll go into more details. One of the implication is that, and we see that very clearly in large companies, which goes very well for us, is that now it's DevOps who's taking over the security component as well as, of course, the digital transformation. It's a very different mentality. These are engineers. They don't do this big enterprise purchase. They want to make sure that your solution fits their need. The big change is that you cannot go to them and describe your roadmap.
They don't care about your roadmap. They want you to discuss with them about their roadmap. It's a totally different game, which is really happening today in the industry. Again, this is what I had predicted in 2009, of course it took significantly longer than I thought. I know why now, we are there now. Big change is happening, having a technical sales force and a very strong engineering group that we have, it really puts us absolutely in a very well position for that new era to come.
Thanks. Very prophetic nonetheless. Maybe one for Melissa. Melissa, you indicated an FX headwind about 100 basis points each quarter here in the second half previously. Any changes to that or incremental FX pressures to call out?
It's roughly still the same, but we are expecting a little bit more in Q4 than we originally projected. On the margin, it's still going to be roughly a little less than 100 basis points headwind to the growth rate.
Thank you.
Our next question will come from the line of Gur Talpaz from Stifel. You may begin.
Okay. Thank you very much. Philippe, over the past few months, you talked about a pretty broad push in the first half of next year into some pretty significant markets, SIEM, EDR, broader endpoint solutions. Can you talk about the development path for these products, your comfort level about pushing it to some of these pretty significant markets, how you think you'll differentiate with other solutions out there?
Yes. If you look at what Qualys is all about, so we are absolutely using internet technology for scale, accuracy, and everything. One of the reason why I realized it took longer, because I figured out finally and I said, "Oh my God, I should have figured that out quite a few years ago." Is that what is today fueling this digital transformation is the fact that the Googles, the Facebook, et cetera, have very similar to what IBM did when they invested $1.5 billion in Linux many years ago, so they could essentially rearchitect their entire mainframe business, that these companies, they didn't want to depend on enterprise software. They had to build search at a huge scale. That's where Elasticsearch came. Now you have Kubernetes and so forth.
I would have thought that all this technology, and they put that in open source. Why? Because I had the opportunity to discuss many years ago with Steve Mills and say, "Why you didn't acquire Linux?" which was a 50-people company at the time, and you invested $1.5 billion. His answer was, "Because I didn't want to kill them." That's exactly the same thing. It took me a long time to realize that the Googles and company have thought about it. However, they didn't want to put their significant technology enhancements too early because then they will have essentially enabled competition. It took them a certain time to bring that into open source. Now today, oh my God, they are coming right and left. Who would have thought that containers will be there even three years ago? Today, they are taking the world by storm.
We're using containers in our platform, and we have already replaced 70% of our dependency on the VMware virtualization layer. We are builders of technology of scale like the Google, like the Amazon. We're all the same. We're all the same breed. For us, essentially, when we move into that space, this new space like EDR and anything that we do, whether it's the SIEM, that's what is in our mind, scale, accuracy, and elimination of false positive and false negative. When I look at how are we going to compete in the SIEM market, we're going to compete because we'll have a better scale. We'll have, of course, significant bigger elimination of false positive, which is a problem today that every SIEM has. Of course, a better price because we are using newer technology, which of course allows you to do more with less.
Same thing on the EDR market. Of course, we have the benefits, very unique benefits. Everything we do in a way is through a certain logic whereby because we capture the data that nobody does, then of course it puts us in a significant position to, of course, now create that next generation, if you prefer, of SIEM and even of EDR. Of course, one of the interesting strategy that is that if we can put our agent everywhere, realize the telemetry that we're going to get. Already, again, we have 28 millions of them. They go everywhere, and that puts us in a very unique position. The rest, it's all about scale.
That's what I mentioned earlier, that we have architected our back end not to handle few millions or tens of millions of agents, but hundreds of millions if not billions of agents. Hope that answers your question.
That does. Thank you very much. One follow-up for Melissa building on that. You've been very capital efficient. When you look at your current level of spend, do you think you have enough right now to support the development and the go-to-market and ramp of these new initiatives?
Yeah, thanks, Gur. We're very proud of our industry-leading margins and as well as our strong growth in cash flow of this quarter as well as year to date. As you can see from the implied guide for Q4, we do plan to continue to invest, and these projects are part of that.
I would add to what Melissa said too, is if you look from a cost or profitability standpoint. On the engineering side, the decisions Sumedh and I made essentially in 2007 to go to India, today we can say, "Oh my God, that was the right decision." Not only we can get the talent, huge pool of talent, but we also have a significant cost advantage that's by an order of magnitude. That's for the engineering. We have the engineering power to really continue doing what we do and maintain, of course, that margin that we have. In fact, seeing as a percentage, our percentage of expense in engineering should certainly not grow, but you could see up to some point you have the scale as well. On the go-to-market, the big advantage we have here is the model itself.
The cost of distributing free of charge our global IT Asset Inventory it's equal to nothing. We have today to support that marketing effort, we have built what we call the TARs, the Technical Account Representative in India, which are young people we hired from the technical schools. They are the one essentially onboarding people on these free services to make sure that there's a good experience from the get-go. After that, of course, now suddenly we kind of sell these customers, and again, in a very not aggressive way, but essentially informing them of all the services they can have and get more value from it, and which is our model. This is very efficient from a sales point. That's the nature of our model. For the customers, it's fantastic because everything is already in the platform. They don't have to install anything.
They just have to be educated. Another investment we're starting to make is really to try to get more, and this is something, for example, Splunk has done very well, is all the libraries of training, of use cases. It becomes even easier and easier for our customers to essentially implement if you prefer. Deploy it's pretty easy, but then to configure and take advantage of our solution for their needs.
That's very helpful. Thank you both.
Thank you. Our next question will come from the line of Melissa Franchi from Morgan Stanley. You may begin.
Thank you for taking my question. Melissa, I wanted to ask you about the guidance for Q4. You modestly lowered the high end of the FY 2019 guidance, although it seems like things are going pretty well for you all. Just wondering if you can talk about what's driving that and the puts and takes that's embedded in that outlook.
Yeah, sure. Thanks, Melissa. We had a very good quarter. We were delighted with the acceleration in Cloud Agent adds and the increase in multi-product adoption. We did take down the high end. It was driven by a couple of factors. One is, as I earlier mentioned, the incremental FX headwind we expect to see, as well as the fact that as we've discussed, we're leveraging our leadership position to match competitor pricing where it makes sense because we have so much upsell opportunity in front of us.
Okay, got it. Just another follow-up for you. Looking at billings growth, we did see a slowdown modestly, but current billings was better. Can you maybe talk about what you saw for durations this quarter?
If you're referring to the total billings, remember that includes the multi-year prepaid, which we don't manage to because we don't incent our sales force for that. We really let that be driven by our customers. In that specifically the multi-year prepaid, which affects the long-term deferred revenue, we had a bigger dollar value increase in the quarter a year ago than in this quarter. In terms of the current billings, as we've talked about, we don't manage to it because there's multiple scenarios in which a renewal doesn't happen at the same time of the initial signing of the deal. We point to the trajectory of our annual revenue guidance as the best proxy for business momentum because certainly our current bookings inform our guidance there.
Let me add another thing, Melissa, it's nice to have you back.
Oh, thank you very much. Thank you, Melissa. Thanks.
Thank you. Our next question will come from the line of Alex Henderson from Needham & Company. You may begin.
Hi, this is Roger Boyd on for Alex. Thanks for taking our questions. I was wondering if you could comment on what % of the customer base uses in the Cloud Agent. I think last quarter you said it was 20%. Have you seen any incremental penetration from customers started off with light deployment, or is most of the growth coming from new customers trying out the Cloud Agent?
It's now in 22% of the customer base, so there's still a significant opportunity not only in the customers that don't have it, but also as we've discussed, we know that our customers who are using Cloud Agent are not fully deployed in their environments. In terms of this quarter, where the buying was from, it kind of varies quarter to quarter, but actually this quarter, the percent of bookings from new products, which as I said was mostly Cloud Agent, was actually a bit higher in new than existing customers.
Got it. Makes sense. Just maybe really quickly, is it fair to assume that the customers you're seeing pick up the free version of Asset Inventory or tend to be the SME, SMB customers, or are you seeing enterprise customers try that out as well?
No, it's all walks of life. That's a universal problem. It's all of them. The enterprise, in fact, today, have a bigger need than the low end of the market, because in the low end of the marketplace, especially on the SMB, you got one guy and maybe 50 PCs or 20 PCs. They can do that still manually on spreadsheets. The enterprise cannot. The problem that the enterprise has is that the enterprise today, the large enterprise is fundamentally changing. The silos are crumbling. That's the message. Finally, again, that's what I thought would have happened 10 years ago. That is happening now. The silos were very jealous of their tools. The Windows team having their tool to do their own inventory, and the this and the that. Now today, again, the silos are crumbling.
Everybody needs to accelerate their digital transformation. Today we find that that visibility is starting to become very high on the mind of the CIOs and the CSOs, who do not really want to still resist and continue with their own tools that they had and they are familiar with. They are getting more and more replaced. When you look at the tenure, the average tenure of CSOs today in the large enterprise is about 1.2 years. A huge movement. Of course, DevOps is the one behind changing things. On the mid-market, I think this we see a very good adaption because then they have bigger networks, more complexity. Even if I look at Qualys today, you would be amazed. I give the demo real time of our own inventory and we're using, of course, our own agent and discovery.
I could not believe the complexity of the environment that we have with a company of 1,300 people. For the SME, it's a much more something they want to do now, when on the enterprise they know they've got to do it, but they've really got to go, and you need to have the momentum a little bit from the top because the silos are resisting.
Just to add on to that, and this follows on with what Philippe said, we're seeing more of the enterprise customers using it in the existing. About 40% of those using it, that's just in a couple of months since launch, so it's sort of still early data, is from the enterprise, and it's closer to 10% in the new. That's because many of these existing enterprise customers already have Cloud Agent solutions, which we see as a very positive sign, because once they then deploy the agent, globally for the purpose of free asset discovery and inventory, it's very easy for them to add on to these additional paid solutions, some of which they may be using in small amounts. Now they can turn it on for their full environments, like we've talked about, with the opportunity to extend VM and Policy Compliance on the endpoints.
Yeah, absolutely.
Great. Thank you. I appreciate the call.
Our next question will come from the line of Sterling Auty from JPMorgan. You may begin.
Hi, this is Sahil on for Sterling. Thank you for taking my question. How was the EMEA business in the quarter given the macro backdrop?
Very similar, very good. Nothing really to report. Still, we have a very good penetration in Europe, as you know. What we see conversely, we've seen a little bit of pickup in Asia. I think today the cloud now is starting to be a little bit more appealing to Asia, when in the past it's all about the, "I want my own premise." Europe is doing very well, and so is the U.S. We see a kind of a slowdown in Brazil and in Latin America. That's about the only place where we see today a real slowdown.
Thank you. I apologize if I missed this in the prepared remarks, but do you give the split for Vulnerability Management in the quarter?
The vulnerability management family still continues to be about 73% of the revenues.
Thank you. That's all from my side.
Thank you.
Our next question will come from the line of Yoon Kim from Rosenblatt Securities. You may begin.
Thank you. Congrats on another solid quarter. Just on going back to the Cloud Agent adoption. Seems like that's going pretty well consistently for some time. Can you just describe to us what kind of pricing uplift that you may be seeing for customers, with Cloud Agents versus those who do not? If there is a meaningful pricing uplift, what is driving that?
It really depends on the nature of the application that people use the Cloud Agents for, because people don't purchase the Cloud Agent standalone. What we've talked about is if someone was a previous VM or Policy Compliance customer and then renewed or added on, let's say, Cloud Agent for the purpose of doing those applications, they would pay about an additional 20%. For example, if they were subscribing to File Integrity Monitoring, which is a solution enabled by the Cloud Agent, that's a much higher price solution. It really depends on the nature of the solution that they're using.
Okay. I'm trying to better understand how the new Asset Inventory product, it seems like it should help drive the incremental Cloud Agent adoption, right?
Yes, that's the second purpose. The first purpose is to give the much needed visibility that the company must have. Of course, the advantage for us is that, of course, we now feed the market with the Cloud Agent, where then you can upsell to all of these other services that we have, all these other functionalities. Yes.
Got it. Great. Thank you so much.
Our next question will come from the line of Patrick Colville from Arete Research. You may begin.
Thank you for taking my question and congrats on a solid set of results, especially on the profitability, just incredible profitability, to be honest, really market leading. Can you just talk through the puts and takes, if possible, on the gross margin side and then the operating margin side, just what happened in the quarter to print such a strong performance?
Yes, happy to do so. I'll repeat that we're very proud of our industry-leading profitability. On the gross margin, we did have additional expenses related to data center capacity and software and maintenance, but they're offset by an increased mix in Pune, which we've talked about is really where we're getting a lot of our great engineering talent. With regards to the other areas, we really benefited from a number of factors. It was hiring in Pune, it was lower net hiring than expected, lower non-salary head count costs, things like vacation accrual, payroll taxes, as well as lower third-party spend, such as legal services, consulting, and travel.
Okay. Nice one. Can I ask about the buybacks? That was something that you briefly touched on earlier, but a pretty major change versus prior quarters. If my math right, it's $50 million bought back in the third quarter. Which is double the amount bought back in the whole of the first half of this year. Is that something we should expect going forward, Qualys to be more aggressive on buybacks and to use the cash on the balance sheet to lower that share count?
Yeah. Great question, and we're delighted that we have such strong cash flow that we can do this for our shareholders. Again, the objective is to minimize our dilution, and so that's really our primary, what we're trying to achieve because we are preserving capacity for M&A. We continue to be active at looking in the market. I would not suggest that $50 million is indicative of what we're going to do every quarter. If you look at sort of the average of what we've been doing a year, our board has been authorizing $100 million. I think that's really more the way to think of it. As I said, again, depending on the timing of when we're buying and the amount we can do in each quarter, it ends up varying.
Let me repeat the two thing I'll say. One thing is that quarter was a little bit not normal because we had a very small window the previous quarter, so in a way, it was a kind of a catch-up. The goal, in fact, we had, and this came from discussion we had from our long-term investors when we discussed about capital allocation. They say, "What is your strategy?" I say, "First of all, let me get the cash, and then when we will have the cash, we'll discuss about cash allocation and capital allocation." Their number one requirement, say, "Look, Philippe." This is exactly what they told us, "Look, for us, if you could minimize the dilution," because, of course, we continue looking for talent, and you know that talent, you need to incentivize them.
I personally prefer the option to the RSUs, but that's another discussion. Essentially, Melissa and I, we run, we discuss with the board, and we say, "We are going to essentially answer what our long-term investors," and we committed we will do that. It's not about pumping up the stock. It's just about the goal is to essentially minimize the dilution that we do through the SBC. We are truthful to that. Today, we gain some additional flexibility because in the past, we're in a way limited also, which limited on the windows. Today, we have expanded the capabilities to buy on the open market, essentially, that the board authorized, and that's about the only change that we made, but no change whatsoever in the underlying philosophy.
Very clear. Thank you very much.
Thank you. I'm not showing any further questions at this time. I'd like to turn the call back over to Vinayak for closing remarks.
Thank you all for attending our third quarter 2019 earnings call. We look forward to seeing you at Stifel Midwest One-on-One Growth Conference in Chicago and Needham Security, Networking, and Communications Conference in New York in November. We'll also be at Nasdaq Investor Conference in London, Wells Fargo's TMT Summit in Las Vegas, and Cowen Annual Networking and Cybersecurity Summit in New York in December. Thank you.
Ladies and gentlemen, this concludes today's conference call. Thank you for participating. You may now disconnect.