Good day, everyone, and welcome to Qualys Third Quarter 2019 Earnings Conference Call. This call is being recorded. At this time, all participants are in a listen only mode. Later, we will conduct a question and answer session and instructions for asking a question will be given at that time.
I would now like
to turn the call over to Vinayak Rao, Vice President, Corporate Development and Investor Relations. Please go ahead, sir.
Good afternoon, and welcome to Qualys' Q3 2019 earnings call. Joining me today to discuss our results are Philippe Couto, our Chairman and CEO and Melissa Fisher, our CFO. Before we get started, I would like to remind you that our remarks today will include forward looking statements that generally relate to future events or our future financial or operating performance. Actual results may differ materially from these statements. Factors that could cause results to differ materially are set forth in today's press release and in our filings with the SEC, including our latest Form 10 Q and 10 ks.
Any forward looking statements that we make on this call are based on assumptions as of today, and we undertake no obligation to update these statements as a result of new information or future events. During this call, we will present both GAAP and non GAAP financial measures. A reconciliation of GAAP to non GAAP measures is included in today's earnings press release. As a reminder, the press release, prepared remarks, investor presentation and supplemental historical financial spreadsheet are available on our website. With that, I'd like to turn the call over to Philippe.
Thank you very
much, Evinie, and welcome everyone to our Q3 earnings call. Melissa and I are really pleased to report another solid quarter in terms of revenue growth and profitability. We also are very pleased to report strong growth in our paid Cloud Agent subscriptions, with almost 28,000,000 now, 93% growth from prior year quarter. As discussed before, our cloud agent technology platform for 7 secondurity compliance and IT solutions available now, namely, vulnerability management, policy compliance, file integrity monitoring, indication of compromise, Patch Management, Asset Inventory and the upcoming Certificate Management, and with more to come. In terms of our newer solution, we saw strong growth again this quarter from FIM, and we continue to build a healthy pipeline in Patch Management and Continuous Security.
At Black Hat, this quarter, we launched our global IT Asset Discovery and Inventory app as a free service. We received very positive feedback, as I think most of you know already, from our customers and industry luminaries because global IT asset inventory is one of the biggest challenges, if not the biggest challenge. For organization, visibility is the cornerstone of security as you simply cannot secure what you do not know or see. With our free service company of all sizes can automatically build their global IT asset inventory across on premise, endpoint, cloud, containers and now mobile environment as well as identified in real time everything that connects to the networks. Only 2.5 months ago after the launch, we have approximately 3 we had approximately 3,650 companies signed up with over 500 new customers using the service.
We have also been rolling out the free service to existing customers since last month and now have almost 300 existing customers using it. As a result, our goal to make our cloud agent ubiquitous is now well on its way and allows us to make the subscription to our paid app frictionless because no additional infrastructure is required. Distributing such a free solution from our platform to generate meaningful demand for our paid apps is one of the key elements of our profitable growth, driving value for both our customers and shareholders. Furthermore, this multi product adoption naturally increases the stickiness of our platform and helps make us impenetrable to our competitor. We do not offer the same breadth of solutions.
This is underscored by the fact that the gross dollar retention rates of customers who have adapted for solution or more stands at 99%. We continue to invest in expanding the capabilities of our cloud platform and developing additional solutions, and we will showcase significant new offerings at our upcoming QSC or user conference in Las Vegas on November 20 21. At the conference, our attendees will have the opportunity to listen to industry experts such as Richard Clarke, author of the 5th domain and formerly at Czar and the White House Scott Crawford from the 451-451 Research as well as Ramesh Chinta from Microsoft Azure will discuss how Microsoft is building security into Azure and of course of the role that Qualys plays in it and Charles Anderson from IBM Exros Red will talk about their efforts to automate pen testing and more quickly respond to eliminating vulnerabilities and they are a very big user of Qualys as well. You will also hear fascinating presentation from our customers, which share their experiences and best practices. Also, their views on how their security needs are evolving and our mission critical quality is becoming for them.
Our President and Chief Product Officer Soumed, which we promoted recently, and I will discuss that later, will unveil our next generation of vulnerability management offering that brings it to its next level and showcase our forthcoming EDR and data lake SIM initiatives. In addition, among other innovative solutions, we will discuss the forthcoming updates to our container security and the capabilities we have now of threat hunting with Qualys. And you could click you could go to our website and look at the agenda as well. I would like to personally invite you to both our user conference and a dedicated institutional investors and analyst session that will occur during the conference on November 20. This event will focus on our Qualys driving sustainable growth and profitable growth and will include a demonstration of our newest application as well and with a Q and A session from select Qualys customers.
Finally, the expansion of our Cloud Platform, which now delivers an impressive suite of security and compliance solutions, as well as our build up of operations in Pune, where we have now more than 7 50 employees, was led by our Chief Product Officer, Sumit Thakkar. And I am delighted to announce his promotion to President and Chief Product Officer. Jamed started at Qualys in 2003 and through outstanding performances now runs R and D, QA, Ops, Product Marketing and Customer Support. And with this promotion, he will also run worldwide field sales operation. And as we continue to lay the foundation for our future growth, we also promoted Lori McCarthy to EVP Worldwide Field Operation.
Lori joined Qualys in 2012 and was most recently VP Field Operations for the Americas. And Lori came from one of our customers where she was running one of the absolutely extremely good program, the Verity Management Program at CVS, which was really second to none. In addition, we promoted Dileep Bagwani to SVP, Cloud Platform, Ops and DevOps. Dilip joined Qualys in 2016 and was our VP of DevOps. And finally, we welcome the addition of Mustafa, and I'm not so sure if I know how to pronounce it correctly, Mahud Dawala as our VP of Global Customer Service.
And Mustafa is coming from Red Hat. Our product and platform achievement and expansion of our management team lays the foundation for continued progress to enable customers to consolidate the security, IT and compliance stack, while drastically reducing their spend. As importantly, it is core to the highly profitable recurring and growing revenue model we have built. And with that, I will turn the call over to Melissa to discuss our financial results.
Thanks, Philippe, and good afternoon. Before I start, I'd like to note that except for revenue, all financial figures are non GAAP and growth rates are based on completeness to the prior year period unless stated otherwise. We're delighted with our increasing cloud agent subscriptions and multiproduct adoption, which lays the foundation for future revenue growth and industry leading profitability. Our Q3 financial and operational highlights include: revenues for the Q3 of 2019 grew 15% to 82,700,000 dollars Platform adoption continued to increase as the percentage of enterprise customers with 3 or more Qualys solutions rose to 46% from 39%, and the percentage of enterprise customers with 4 or more Qualys solutions increased to 26% from 20%. Paid cloud agent subscriptions increased to $27,900,000 over the last 12 months, up from $23,600,000 for the 12 months ended in Q2 2019.
2,000,000 additional cloud agents were purchased this quarter by a single cloud platform customer. New products released since 2015 contributed approximately 33% of total bookings in the quarter, up from 23%. And our average deal size continues to increase, growing 8%. Our scalable platform model continues to drive superior margins and generate significant cash flow. Adjusted EBITDA for the Q3 of 2019 was $39,200,000 representing a 47% margin versus 45%.
We continued to increase our headcount sequentially, and we benefited from attracting great talent in Pune as well as lower non salary headcount costs and lower third party expenses this quarter as compared to Q2 2019. Q3 EPS grew 34%, and we generated strong free cash flow for the Q3 of 2019 of 39,900,000 and year to date, our free cash flow has increased 36% versus the same period last year. In Q3, we continued to invest the cash we generate from operations back into Qualys, including 5,800,000 dollars on capital expenditures, including principal payments under capital lease obligations and $49,800,000 to repurchase 603,417 of our outstanding shares. Our Board has authorized an additional $300,000,000 open market share repurchase program, resulting in approximately $141,000,000 in current share repurchase capacity. We remain confident in our model driven by our foundation of recurring revenues and expanding suite of applications.
Our current fiscal year 2019 revenue guidance is now a range of $321,200,000 to $321,800,000 dollars We are raising fiscal year 2019 non GAAP EPS from a range of $2.03 to $2.07 to a range of $2.28 to 2.30 percent. We now expect to expand EBITDA margins this year, and we expect our fiscal year 2019 EBITDA margin to be between 42.5% 43%. And for the Q4, we expect capital expenditures to be in the range of $9,000,000 to $10,000,000 which includes approximately 3,500,000 for the first phase of the build out of a new Qualys office in Pune. We are very excited by the robust early adoption of our free global asset discovery and inventory application, which makes it frictionless to enable many of our paid subscriptions. This provides us the opportunity to accelerate revenue growth as well as expand margins in the future.
As Philippe mentioned, we look forward to seeing many of you at the analyst and investor session at our upcoming QSC user conference in Las Vegas. With that, I'll turn the call back to Philippe for final remarks.
Thanks, Melissa. And in summary, and as Melissa says, we're really happy with the progress made in expanding our cloud platform and the increased adoption of our solutions by our existing customers, enterprise, both large enterprise and SMB, as well as new customers. And in addition, again, like just Melissa did, let me reiterate the invitation we're extending for you to attend both our user conference and the investor session. Investor session will also be webcasted for those who cannot attend in person, so they could listen it at their own leisure. And please register on our website and period the agenda for 1 or both events.
Melissa, Sumed, Lori and I all hope you will attend. With that, Melissa and I are happy to answer any of your questions.
And our first question will come from the line of Howard Smith from First Analysis. You may begin.
Yes. Thank you for taking my question. Congratulations on the continued very profitable growth. First question has to do with the share buyback authorization and activity. It seemed a little bit stepped up in Q3.
And I'm just wondering, is there any kind of policy shift in terms of how you and the Board are thinking about using the cash return to shareholders this way?
Thanks, Howard. I'll take that one. So as a framework, our share repurchase program is the objective is to minimize the dilution from grants given to employees and that has not changed. That continues to be the same. We as you see, if you look at how we've repurchased over the last couple of years, we end up being back loaded in the second half of the year because our window for repurchasing in the first half, especially the quarter where we announced year end earnings end up being the shortest.
So think of it a little bit more as a catch up.
Okay, great. That's helpful. And then, Philippe, you spoke of the success of the kind of the asset inventory rollout. Previous to that, you had CertView, I think, as kind of a free offering. And just in general, as you've rolled out a couple of these and see the results, how are you thinking about using free versions to spur upsell and any tweaks you might be thinking of making going forward with those types of programs?
Yes. As opposed to CertView, which has more limited upsell, the GlobalEye Test inventory is very strategic on many fronts. It's very strategic, as we discussed, in fact, previously because it gives that visibility that company do not have, and that's absolutely something absolutely crucial and is becoming very obvious that everybody needs to go that way. And what is very unique with our Global IT inventory is that it spans across your entire environment. It just doesn't look at your Windows servers or endpoints or cloud.
It goes across everything that you have in your environment. And so and then from there, there's significant, significant upsells opportunities. You have the one which really are directly related to the global IT segmentary, which is, for example, the ability now to look at your end of life systems. So there's additional features about the kind of information that you can get, which you that you do not get from the free asset inventory. You can and Discovery, by the way.
And you can also now synchronize with ServiceNow CMDB. And so we become naturally the source of truth. And this we see today very strong interest. And we today probably have around 100 customers, which are doing that already. And then there is also all the other upside, which are related to the agent because what once you deploy the Global IT inventory, you want to absolutely use the capabilities of our cloud agent because they give you real time, which means anything that suddenly changes on one device where you have put the agent on one asset, immediately you know what that is, and that's exactly what you want.
Security has become an issue of both scale. It's always been an issue of accuracy and now it's becoming absolutely an issue essentially of scale as well and real time, which is obviously things that requires a significant platform to be able to do that. So there's many, many, many upsell opportunity around that cloud agent and that's what we believe is very strategic And we see already that, yes, it is very well received. As you know, we're only rolling out to our existing customers about a month ago. The reason why we did that because we didn't want to have suddenly all of our customers adapting it.
So we're trickling and then having too much load too quickly on our platform. But the reception is fantastic and this is will continue.
Great. Thank you.
Thank you. And our next question comes from the line of Dan Ives from Wedbush. You may begin.
Yes. Thank you.
So can you maybe just talk about in the market, you have some competitors that are starting to significantly expand their product portfolio on risk and some of the broader sort of platform approaches. Can you maybe kind of talk about that in terms of what you're seeing in the market? And from a product perspective, any changes? Thanks.
Yes. So in terms of the again, of the competition, yes, everybody today realizes that they got to build a platform. And that platform cannot be an enterprise software platform. It has to be a cloud platform because the cloud platform gives you the scalability that you need. So in that sense, we're so well ahead of the market because I'm sure as you recall, we started that journey back in 1999.
So and we went through all the different variations of the cloud technology and we have been absolutely, thanks to the big investment we made in Pune, able to inject the most the newest technology. We have Elasticsearch, we have Kafka, Cassandra and we're building that at scales that today we don't know anybody doing anything close to the scale that we do. We have today 28,000,000 agents, but in reality, we also have architected 200 100 of millions of agents, if not billions of agents. So it's all about scale. And yes, other companies are moving to that direction, but we believe that we are far ahead essentially of everybody else.
Thanks. Could you maybe just talk about, especially in cloud with the Azure channel, obviously gaining more and more success with the JEDI win. And just how you feel think about those market dynamics playing out and how that potentially bodes well for how you guys are positioned, especially when it comes from those Microsoft deals? Thanks.
Yes. So that's another great question. Effectively, we always, I believe, if you recall some of the comment that I made in fact in 2,009, I was already making that comment publicly at the RSA that we need to build security into the cloud. We cannot continue bolting security on. In order to do that, you need to have the right architecture.
And this is exactly what our Cloud Agents are all about. We have all the major players all using our Cloud Agent today and millions of them to essentially ensure the have the visibility and ensure the security of their own platform. As I mentioned, I think, either on last earnings call or the one before, we have done something remarkable with Microsoft, whereby we have totally integrated our agent with the Security Center, whereby an Azure customer with the Security Center of Azure, whereby an Azure customers can essentially click on the link, go to the Security Center, click on the link, have the entire view of all of the assets they have on Azure, click on the second link and have the view of the security and compliance posture. This is thanks to the Qualys, if you prefer, embedded agent there. And then 3rd, click on the 3rd link, which has nothing to do with us, but only 100% with Microsoft, create their playbook and then remediate.
So security in this new environment have become click, click, click, nothing to install, nothing to update. It's all done for you. What a big change. And then the only thing you do then is that you bring your policies, because you are the one, the customers who decide your policies. Do you want to have a straight back at top or not?
Do you want this? Do you want that? So and then, of course, security is building. And that's where we see the future. So, of course, we're extremely well positioned.
And now that we have totally integrated, of course, our agents with Microsoft, then of course, we're very happy to have heard that they have they won the JEDI contract, because of course, we naturally go. And by the way, as you know, our solution is FedRAMP authorized. So this is for us the way we saw the future happen, and now we are so happy to see that the future is now.
Thank you. And our next question will come from the line of Chris Eberle from Nomura Instinet. You may begin.
Great, thanks. Hey guys, nice job on the quarter. Can you guys give us an indication of just now that you have the free download of the asset inventory in the market, just some early adoption with some of the attach rates look like for paying applications to that?
Yes. So in fact today, let me remind you the adoption of all of our customers the way they adopt. They always do a first proof of concept and then they start to do the deployment. And that's all that takes some time. And as you know, with our model, we take the revenue as we deliver the service.
So we don't do like some of most of our competitors, which have a big chunk of perpetual license that they can of course, that inflates if you prefer their growth. But this being said, today, we see today that even with these customers which have adopted, we're already starting to discuss with them about all the upsell capabilities that they have. And so we have seen already customers trying now all these additional capabilities. So all that are very good initial signs that what we have done. And when you really look back, everything is integrated.
So that means you don't have to install another application. You don't have to have another person managing it. All of that can be done by the same team, which is currently managing the quality solutions. So the answer is yes, we're very happy with it.
Got it. Great. Thank you.
And our next question comes from the line of Nick Yako from Cowen and Company. You may begin.
Great. Thanks for taking
my questions. You saw a nice jump in the percent of bookings from new products in the quarter. Any 1 or 2 products that you would highlight that were key drivers?
Hi, Nick. Yes, we were delighted with that jump, which was 33 percent in new solutions as a percent of bookings from 25% last quarter. It still remains mostly Cloud Agent BM and Policy Compliance. And remember, as you've discussed, it's not a perfect metric because it does include the renewal portion of VM and Policy Compliance when someone renews from the original solution into a cloud agent enabled solution. And so we did see a high amount of renewal in that metric this quarter.
Yes. And I would say some good traction now from the FIM as well.
Okay, great. Fine integrity
monitoring, which is a fine integrity monitoring.
Okay, great. And then building on an earlier question around cloud. Earlier this week, you announced the global IT asset Discovery app for the federal market. Just curious what percent for the federal market? And curious what percent of revenue does the federal government represent today?
And now that the government is embracing cloud, how you think about that opportunity moving forward?
Yes. So in fact, that has been our journey trying to convince the government to apply the cloud solution was although you had a lot of people saying about this, there's not much appetite. Finally, it's changing. So today, we have a very small percentage. I think today, if you include states, 3% around of our revenues are federal and state.
And if you peel that down to federal, it's probably about half of it. And so we have very good customers, very solid customers. They're rave about what we are. And now finally, we're starting to essentially see the government ready to take. So we're going to make some investments now because again, we've always been balancing.
It's not worth starting to invest ahead of the game, but you don't want also to invest too late either. So you have to time that as best as you can. So now we see an opportunity really with federal to really grow that market. But again, with federal, it takes time. And but I think and that JEDI contract is really I think this is going to be very interesting for us.
But again, it needs to be deployed and on and on. So it takes some time in the federal government. Today, we're not seeing any significant revenues early next year, but I think we'll have a bit now with the fiscal year being at the end of the year. So maybe we could get some nice additional thing. But today, we're not really counting that much, but we will make the investment in essentially beefing up our federal team.
Thank you.
And our next question will come from the line of Matt Hedberg from RBC Capital Markets. You may begin.
Hey, it's Dan Bergstrom for Matt Hedberg. Thanks for taking our questions. So on the go to market traditionally, you adopt new products through the platform, but Black Hat and around the event, around the global IT asset discovery and inventory launch, there was a significant awareness and marketing campaign, very noticeable to us that attended, I think, more of a start to market to and engage CIOs. Could you talk a little bit about that strategy? And then any early engagements from that?
Yes. So that's in fact absolutely, because that's in fact the opportunity that we have today. So now what you're going to see is the 2nd leg of our campaign. The first campaign, as you rightly characterized it, was an awareness campaign. This is what we have for you guys.
And okay, so come and see it. But now we have enough adopters, so we're now going to have our adopters speak And they are going and that's the 2nd campaign we're preparing. And they are the one who are going to describe the benefits and what they have done and achieved. And you're going to see some of that at our user conference or where we are going to have some of our users talking about it. And you will also see an interesting panel to answer your question about the CIO.
So we have a very interesting panel that now our President and Chief Product Officer Sumeet will moderate where we have in fact Wendy Pfeiffer, which is the CIO of Nutanix, which is on our Board now, which is also part of creating awareness to the CIO, fact, he's going to be on the panel and they're going to discuss she's going to give a view as a CIO of how do they see the evolution of security and we have also some other very good representative of the company. So I think we're just at the beginning of that, but that's definitely the direction that we are continuing to take, and you will see acceleration of our awareness effort toward the CIO and the CTO conference because one other thing I want to mention, the game in security is changing. The theme of our user conference is Security at the Crossroad Part 2. Why do they say Part 2? It's because Part 1 is what I said last year about telling this is where we see the marketplace going And part 2 will be the market is now there.
What are the implications for the security industry? So we'll go into more details. And one of the implication is that and we see that very clearly in large companies, which goes very well for us is that now it's DevOps who is taking over the security component as well as of course additional transformation. And so it's a very different mentality. These are engineers.
They don't do this big enterprise purchase. They want to make sure that your solution fits their need. And the big change is that you cannot go to them and describe your road map. They don't care about your road map. They want to discuss you to discuss with them about their road map.
So it's a totally different game, which is really happening today in the industry. And again, this is what I had predicted in 2,009. But of course, it took significantly longer than I thought. I know why now, but that's we are there now. Big change is happening.
And having a technical sales force and a very strong engineering group that we have, it really puts us very, very in absolutely in a very well position for this new that new era to come.
Very, very prophetic nonetheless. Maybe one for Melissa. Melissa, you indicated an FX headwind about 100 basis points each quarter here in the second half previously. Any changes to that or incremental FX pressures to call out?
Yes. So it's roughly still the same, but we are expecting a little bit more in Q4 than we originally projected. But on the margin, it's still going to be roughly a little less than 100 basis points headwind to the growth rate.
And our next question will come from the line of Gur Tautis from Stifel.
Philippe, over the past few months you talked about a pretty broad question in the first half of next year into some pretty significant markets, SAM, EVR, broader endpoint solutions. Can you talk about the development path for these products? How your comfort level about pushing it to some of these pretty significant markets? How you think it will differentiate both the other solutions out there?
Yes. So of course, you know the so if you look at what UQALYS is all about. So we are absolutely using Internet technology for scale, accuracy and everything. And one of the reasons why I realized it took longer because I figured out finally and I said, oh my God, I should have figured that out quite a few years ago, but is that what is today fueling this digital transformation is the fact that the Google, the Facebook, etcetera, have very similar to what IBM did when they invested $1,500,000,000 in Linux many, many years ago, so they could essentially rearchitect their entire mainframe business that these companies, they didn't want to depend on enterprise software. So they had to build search at a huge scale and that's where Elasticsearch came.
Now you have Kubernetes and so forth. I would have thought that all this technology and they put that in open source. Why? Because I had the opportunity to discuss many, many years ago with Steve Mills and say, why you didn't acquire Linux, which was a fifty people company at the time and you invested $1,500,000,000 His answer was because I didn't want to kill them. And that's exactly the same thing and it took me a long time to realize that, that the Googles and company have thought about it.
However, they didn't want to put their significant technology enhancements too early because then they will have essentially enabled competition. So it took them a certain time to bring that into open source. But now today, oh my God, they are coming right and left. Who would have thought that containers will be there like even 3 years ago? Today, they are taking the world by storm.
We are using containers in our platform and we have already replaced 70% of our dependency on the VMware virtualization layer. So we are builders of technology of scale like the Google, like the Amazon, like the we're all the same, we're all the same breed. So for us, essentially, when we move into that space, this new space like EDR and anything that we do whether it's the SIEM that's what is in our mind scale, accuracy and elimination of false positive and false negative. So when I look at how are we going to compete with the in the SIEM market, we are going to compete because we'll have a better scale, we'll have, of course, significant bigger elimination of false positive, which is a problem today that every SIEM has. And then, of course, a better price, because we are using newer technology, which, of course, allows you to do more with less.
And same thing with the EDR market. And so and of course, we have the benefits, very unique benefits. Everything we do in a way is through a certain logic whereby because we capture the data like nobody does, then of course, it puts us in a significant position to, of course, now create that next generation, if you prefer, of SIEM and even of ER. And of course, one of the interesting strategy that is that if we can put our agent everywhere realize the telemetry that we're going to get. And already, again, we have 28,000,000 of them.
They go everywhere. And that puts us in a very unique position. So the rest, it's all about scale. That's what I mentioned earlier that we have architected our back end not to handle a few millions or tens of millions of agents, but hundreds of millions, if not billions, of agents.
Hope that answers your question. That's very helpful. That does. Thank you very much. Maybe one follow-up for Melissa building on that.
You've been very capital efficient. When you look at your current level of spend, do you think you have enough right now to support the development and the go to market and the ramp of these new initiatives?
Yes. Thanks, Kare. We're very proud of our industry leading margins and as well as our strong growth in cash flow of this quarter as well as year to date. As you can see from the implied guide for Q4, we do plan to continue to invest and these projects are part of that.
And I would like
to what Melissa said too is if you look from a cost or profitability standpoint. On the engineering side, the decision Sumeet and I made essentially in 2007 to go to India, now today, we could say, oh my god, that was the right decision because not only we're going to get the talent, huge pool of talent, but we also have a significant cost advantage that's by an order of magnitude. So that's for the engineering. So we have the engineering power to really continue doing what we do and maintain, of course, that margin that we have and in fact seeing as a percentage. Our percentage of expense in engineering should certainly not grow, but you could see after some point, you have the scale as well.
Now on the go to market, the big advantage we have here is the model itself. The cost of distributing free of charge our global ITS inventory is very it's equal to nothing. We have today to support that marketing effort. We have built what we call the TARs, the technical account representative in India, which are people which we young people we hired from the technical schools, and then they are the one essentially onboarding people on these free services to make sure that there's a good experience from the get go. And then after that, of course, now, suddenly, we kind of sell these customers and again, in a very, very not aggressive way, but essentially informing them of all the services they can have get more value from it and which is our model.
So this is very efficient from a sales point. And that's the nature of our model. And for the customers, it's fantastic because everything is already in the platform. They don't have to install anything. They just have to be educated.
So another investment we're starting to make is really to try to get more and this is something, for example, Splunk has done very well is all the libraries of training of use cases. So it becomes even easier and easier for our customers to essentially implement, if you prefer, deploy it's pretty easy, but then to configure and take advantage of our solution for their needs.
That's very helpful. Thank you both.
Thank you. And our next question will come from the line of Melissa Franchi from Morgan Stanley. You may begin.
Thank you for taking my question. Melissa, I wanted to ask you about the guidance for Q4. You modestly lowered the high end of the FY 2019 guidance, although it seems like things are going pretty well for you all. So I'm just wondering if you can talk about what's driving that and the puts and takes that's embedded in that outlook?
Yes, sure. Thanks, Melissa. We had a very good quarter. We were delighted with the acceleration in Cloud Agent apps and the increase in multi product adoption. We did take down the high end.
It was driven by a couple of factors. One is, as I earlier mentioned, the incremental FX headwind we expect to see as well as the fact that as we've discussed, we're leveraging our leadership position to match competitor pricing where it makes sense because we have so much upsell opportunity in front of us.
Okay. Got it. And then just another follow-up for you. Looking at billings growth, we did see a slowdown modestly, but current billings was better. So can you maybe talk about what you saw for durations this quarter?
Yes. So if you're referring to the total billings, remember that includes the multiyear prepaid, which we don't manage to because we don't incent our sales force for that. We really let that be driven by our customers. So for in that specifically the multiyear prepaid, which affects the long term deferred revenue, We had a bigger dollar value increase in the quarter a year ago than in this quarter. In terms of the current billings, as we've talked about, we don't manage to it because there's multiple scenarios in which a renewal doesn't happen at the same time of the initial signing of the deal.
And so we point to the trajectory of our annual revenue guidance as the best proxy for business momentum because certainly our current bookings inform our guidance there.
And then we had another thing, Melissa, it's nice to have you back.
Thank you very much. And thank you, Melissa. Thanks.
Thank you. And our next question will come from the line of Alex Henderson from Needham and Company. You may begin. Hi.
This is Roger Boyd on for Alex. Thanks for taking our questions. I was wondering if you could comment on what percent of the customer base using the Cloud Agent? I think last quarter you said it was 20%. But then have you seen any incremental penetration from customers who started off late deployment?
Or is most of the growth coming from new customers trying out Cloud Agent?
Yes. So it's now in 22% of the customer base. So there's still a significant opportunity, not only in the customers that don't have it, but also as you've discussed, we know that our customers who are using Cloud Agent are not fully deployed in their environments. In terms of this quarter, where the volume was from, it kind of varies quarter to quarter. But actually this quarter, the percent of bookings from new products, which as I said was mostly Cloud Agent, was actually a bit higher in new than existing customers.
Got it. Makes sense. And then is it just maybe really quickly, is it fair to assume that the customers you're seeing pick up the free version of asset inventory tend to be the SMB customers? Are you seeing enterprise customers try that out as well?
No, it's all walks of life. I mean, because that's a universal problem. So for the it's all of them. The enterprise in fact, today have a bigger need than the low end of the market because in the low end of the marketplace, especially on the SMBs, you got one guy and maybe 50 PCs or 20 PCs and some sorry, they can do that or steal manually on spreadsheets. The enterprise cannot.
The problem that the enterprise has is that they need the enterprise today and the enterprise is the large enterprise is fundamentally changing. The silos are crumbling. That's the message finally. Again, that's what I thought that would have happened 10 years ago, but it's happening now. So the silos were very, very jealous of their tools.
So the window team having their tool to do their own inventory, and the these, and the that. And now today, again, the silos are crumbling. You need to everybody needs to accelerate their transformation. So today, we find that that visibility is starting to become very high on the mind of the CIOs and the CISOs who do not really, really wants to still resist and continue with their own tools that they add and they are familiar with, they are getting more and more replaced. When you look at the tenure, the average tenure of CISOs today in the large enterprise is about 1.2 years.
So a huge movement. And of course, DevOps is the one behind changing things. On the mid market, I think this we see a very good adoption because then they have bigger networks, more complexity. Even if I look at Qualys today, you would be amazed. I gave the demo real time of our own inventory and we're using, of course, our own agent and discovery.
I could not believe the complexity of the environment that we have with a company of 1300 people. And so that's so for the SMEs, it's a much more something they want to do now. When on the enterprise, they know they've got to do it, but they really got to go and you need to have the momentum a little bit from the top because the silos are resisting.
And just to add on to that, and this falls on with what Philippe said, we're seeing more of the enterprise customers using it in the existing. So about 40% of those using it. This is just in a couple of months since launch. So it's sort of an early still early data. It's from the enterprise, and it's closer to 10% in the new.
And that's because many of these existing enterprise customers already have Cloud Agent solutions, which we see as a very positive sign because once they then deploy the agent globally for the purpose of free asset discovery and inventory, it's very easy for them to add on to these additional paid solutions, some of which they may be using in small amounts. Now they can turn it on for their full environments, like we've talked about with the opportunity to extend VM and policy compliance on the endpoints.
Yes, absolutely.
Great. Thank you. I appreciate the color.
And our next question will come from the line of Shirlin Auty from JPMorgan. You may begin.
Hi, this is Sahil on for Sterling. Thank you for taking my question. So how was the EMEA business in the quarter given the macro backdrop?
So very, very similar, very good. Nothing really to report. Still, we have a very good penetration in Europe, as you know. And what we see conversely, we've seen a little bit of pickup in Asia. I think today, the cloud now is starting to be a little bit more appealing to Asia, when in the past, it's all about the I want my own premise.
Europe is doing very well, so is the U. S. So is we see a kind of a slowdown in Brazil and in Latin America. And that's about the only place where we see today a real slowdown.
Thank you. And I apologize if I missed this in the prepared remarks, but do you give the split for vulnerability management in the quarter?
It's about the vulnerability management family still continues to be about 73% of the revenues.
Thank you. That's all from my side.
Thank you.
And our next question will come from the line of Eun Kim from Rosenblatt Securities. You may begin.
Thank you. Congrats on another solid quarter. Just going back to the cloud phasing adoption, it seems like that's going pretty well consistently for some time. Can you just describe to us what kind of pricing uplift that you may be seeing for customers with cloud agents versus those who do not? And if there is a meaningful pricing uplift, what is driving that?
Yes. So it really depends on the nature of the application that people use the Cloud Agents for because people don't purchase the Cloud Agents standalone. So what we've talked about is if someone was a previous VM or policy compliance customer and then renewed or added on, let's say, Cloud Agent for the purpose of doing those applications, they would pay about an additional 20%. For example, if they were subscribing to file integrity monitoring, which is a solution enabled by the cloud agent, that's a much higher priced solution. So it really depends on the nature of the solution that they're using.
Okay. And does the new I'm trying to better understand how the new asset inventory product, it seems like it should help drive the incremental cloud agent adoption, right?
That's yes, that's the second purpose. The first purpose is to give the much needed visibility that the company must have. And of course, the advantage for us is that, of course, we now see the market with the cloud agent where then you can have said to all of these other services that we have, all these other functionalities. Yes.
Got it. Great. Thank you so much.
And our next question will come from the line of Patrick Colwell from Arete Research. You may begin.
Thank you for taking my question and congrats on a solid set of results, especially on the profitability. I mean, just incredible profitability, to be honest, really market leading. Can you just talk through the puts and takes, if possible, on the gross margin side and then the operating margin side? Just what happened in the quarter to kind of print such a strong performance?
Yes, happy to do so. I'll repeat that. We're very proud of our industry leading profitability. On the gross margin, we did have additional expenses related to data center capacity and software and maintenance, but they're offset by an increased mix in Pune, which we've talked about is really we're getting a lot of our great engineering talent. With regards to the other areas, we really benefited from a number of factors.
It was hiring in Pune, it was lower net hiring than expected, lower non salary headcount costs, things like vacation accrual, payroll taxes, as well as lower third party spend, such as legal services, consulting and travel.
Okay. Nice one. And can I ask about the buybacks? Because that was something that you briefly touched on earlier, but a pretty major change versus prior quarters. So if I do my math right, it's 50 $1,000,000 bought back in the 3rd quarter, which is double the amount bought back in the whole of first half this year.
I mean, is that something we should expect going forward, call it to be more aggressive on buybacks and to use the cash on the balance sheet to lower that share count?
Yes. So great question. And we're delighted that we have such strong cash flow that we can do this for our shareholders. Again, the objective is to minimize our dilution and so that's really our primary what we're trying to achieve because we are preserving capacity for M and A. We continue to be active at looking in the market.
So I would not suggest that $50,000,000 is indicative of what we're going to do every quarter. If you look at sort of the average of what we've been doing here, our Board has been authorizing $100,000,000 And so I think that's really more of the way to think of it. As I said, again, depending on the timing of when we're buying and the amount we can do in each quarter, it ends up varying.
Yes. Let me repeat the 2 things I'll say. One thing is that the quarter was a little bit not normal because we had a very small window the previous quarter. So in a way, it was a kind of a catch up because the goal, in fact, we had and this came from discussion we had from our long term investors when we discussed about capital allocation. So essentially, first in the beginning, they say, what is your strategy?
They say, 1st of all, let me get the cash. And then when we'll have the cash, we'll discuss about cash allocation and capital allocation. And then, of course, their number one requirement said, look, Philippe, it's this is exactly what they told us. Look, for us, if you could minimize the dilution because, of course, we continue looking for talent. And you know that talent, you need to incentivize them.
I personally prefer the option to the RSUs, but that's another discussion. And then essentially, okay, so we I said, let me think about, and then Melissa and I, we discuss with the Board and we say, okay, we're going to essentially answer the what our long term investors. And we're committed, we will do that. So it's not about pumping up the stock. It's just about the goal is to essentially minimize the dilution that we do through the SBC.
And we are fruitful to that. Now today, we gained some additional flexibility because in the past, we're in a way limited also, which limited on the windows. And now today, we have expanded the capabilities to buy on the open market essentially that the Board authorized. And that's about the only change that we made, but no change whatsoever in the underlining philosophy.
Thank you. And I'm not showing any further questions at this time. I'd like to turn the call back over to Vinayak for closing remarks.
Thank you all for attending our Q3 2019 earnings call. We look forward to seeing you at Stifel's Midwest 1 on 1 Group Conference in Chicago and Needham's Security, Networking and Communications Conference in New York in November. We'll also be at NASDAQ's Investor Conference in London, Wells Fargo's TMT Summit in Las Vegas and Cowen's Annual Networking and Cybersecurity Summit in New York in December. Thank you.
Ladies and gentlemen, this concludes today's conference call. Thank you for participating. You may now disconnect.