Hey everyone, and welcome to the Qualys second quarter 2019 earnings conference call. This call is being recorded. At this time, all participants are in listen-only mode. Later, we will conduct a question- and- answer session, and instructions for asking a question will be given at that time. I would now like to turn the call over to Vinayak Rao, Vice President, Corporate Development and Investor Relations. Please go ahead, sir.
Good afternoon. Welcome to Qualys' second quarter 2019 earnings call. Joining me today to discuss our results are Philippe Courtot, our Chairman and CEO, and Melissa Fisher, our CFO. Before we get started, I would like to remind you that the remarks today will include forward-looking statements that generally relate to future events or our future financial or operating performance. Actual results may differ materially from these statements. Factors that could cause results to differ materially are set forth in today's press release and in our filings with the SEC, including our latest Form 10-Q and 10-K. Any forward-looking statements that we make on this call are based on assumptions as of today. We undertake no obligation to update these statements as a result of new information or future events. During this call, we will present both GAAP and non-GAAP financial measures.
A reconciliation of GAAP to non-GAAP measures is included in today's earnings press release. As a reminder, the press release, prepared remarks, and an accompanying investor presentation are available on our website. Starting this quarter, we are also providing a supplemental historical financial spreadsheet for analysts and investors. With that, I'd like to turn the call over to Philippe.
Thank you, Vin , and welcome, everyone, to our Q2 earnings call. Melissa and I are pleased to report another solid quarter in terms of revenue growth and profitability. We're also very pleased to report strong acceleration in our Cloud Agent subscription with almost 24 million now, 23.6 million to be precise. As we have discussed before, our Cloud Agent is the underpinning of seven security compliance and IT solutions today, Vulnerability Management, Policy Compliance, File Integrity Monitoring, Indication of Compromise, Patch Management, Asset Inventory, and the upcoming Certificate Management, and more to come. In 2008, we were one of the first companies to file a Cloud Agent patent application, and our innovation has been recognized by four issued patents and one pending continuation application.
The four issued patents cover agents, including low-footprint hosted agents or hostless agents, which perform full security and compliance assessment of endpoint servers and cumulatively include over 100 claims of varying scope. As previously discussed, our goal is to make our cloud agents ubiquitous. To that effect, we announced on Monday that we will offer our Global IT Asset Discovery and Inventory app to the community as a free service so we can all regain the visibility we lost due to the fragmented nature of IT, rapid growth of IoT, and move to the cloud. We will be showcasing this revolutionary offering next week at Black Hat, combined with a major awareness campaign. Since the announcement, we have over 800 sign-ups and received outstanding feedback from our existing customers and industry luminaries.
In fact, Global IT Asset Inventory is one of the biggest challenges, if not the biggest, for organization and is a cornerstone of security as you simply cannot effectively secure what you do not know or do not see. With our free service, companies of all sizes can automatically build their Global IT Asset Inventory across on-premise endpoint, clouds, container, and now mobile environments. Including in this free offering is our asset discovery capabilities, namely the passive scanning that provide instant visibility of any device that connects to the network. Such an integrated offering provides unprecedented and continuous visibility of both known and unknown assets. As organizations download our Cloud Agent for implementing Global IT Asset Inventory, we make it frictionless to subscribe to our paid apps because no additional infrastructure is required.
In addition to the paid solution I previously mentioned, customers utilizing our free Asset Inventory will have the opportunity to subscribe to additional paid features such as synchronization with their CMDB and full lifecycle software inventory. By distributing this free solution from our platform to generate meaningful demand of our paid app, we leverage our cloud model, which is a key element of our profitable growth, driving value for both our customers and shareholders. Furthermore, this multi-product adoption naturally increases the stickiness of our platform and helps make us impenetrable by our competition who do not offer the same breadth of solutions.
In terms of newer solutions, we saw continued growth this quarter in customers' adoption of our File Integrity Monitoring solution, as we have now added incident reporting , API integration, rule-based alerting, and event correlation capabilities, as well as created a lite version for those requiring compliance only with PCI requirements. In Q2, for example, a large online travel agency selected our FIM solution over a competing point solution in order to effortlessly leverage the Qualys Cloud Agent they had already deployed for Vulnerability Management and Policy Compliance. Now they can have a single pane of view of vulnerabilities, configuration, and file integrity. We also have a healthy pipeline in Patch Management, which we released very recently, which enable IT and SecOps teams to quickly target critical common vulnerabilities and exposures, then deploy the patches across endpoint, on-premise, or cloud assets and verify remediation, all from one console.
We continue to make good progress on other global solutions this quarter, including the release of our IOC 2.0 app into general availability, which provides a quantum leap in IOC detection with new detection, investigation, and response capabilities that not only identified in nearly real- time known IOCs, but also suspicious devices. IOC 2.0 includes enhanced attack detection using commercial file reputation, threat feeds, which extend the detection of attacks often missed by antivirus agents by integrating additional threat feeds directly into the platform. Second, a behavior-based scoring engine to prioritize response of malware remediation, which factors in additional behavior attributes, including file analysis, process state, and network connection to prioritize response based on how the attack is behaving in the network.
Third, a new response platform, microservices, are allowing analysts to easily configure rules for real-time alerting and action using the same query language, QQL, that they already use for two-second search visibility. Finally, API integration with third-party SIEMs, threat intelligence platform, incident handling, response system, security orchestration and automated response platform, and IT ticketing system to automate rapid sharing of threat information with security and IT operational platform. This really brings our IOC 2.0 really as the top solution to identify indication of compromise. Finally, the launch of our Qualys Canadian Cloud Platform. The addition of this new location marks another milestone for Qualys' expanding global operation, which now includes eight locations on three continents.
We continue to believe that because our cloud-based architecture and the priority we made to invest in the extensibility and capabilities of our platform, Qualys is one of the few companies well-positioned in the security market evolution. As we highlighted last quarter, we see a new generation of MSSP emerging to address the security needs of small and mid-sized customers with hybrid environments. That's why Coalfire Systems selected Qualys Vulnerability Management and Continuous Monitoring capabilities this quarter to integrate into their secure cloud automation services. We invite you to Black Hat next week to see our new technologies and campaigns. We will hold a product luncheon for investors and analysts, which will showcase the technology around IOC 2.0, as well as our future data lake solution.
As we have discussed, current incidence response solutions are quite complex and costly because they require organizations to collect disparate sets of data from multiple vendors and bring it into their SIEMs, with full contextual information. We believe we have a unique advantage in this large market because we already collect, enrich, normalize, and correlate trillions of data points across on-premise, cloud, and soon mobile, OT, and IoT environments. I should say, and now mobile and OT and IoT environments. We are also pleased to welcome Gerhard Eschelbeck, a renowned cybersecurity leader, to our advisory board. Gerhard is the former Vice President of Security and Privacy Engineering at Google and previously held CTO position at Sophos, Webroot, and Qualys. We look forward to leveraging his unique background and extensive experience as we continue to grow the Qualys Cloud Platform.
In conclusion, we are delighted to offer the community a new free prescription for security. Accelerating adoption of our Cloud Agent unlocks a significant revenue opportunity for us, and more importantly, solve painful problems for our customers, including not having clean, uniform data for a view of their Global IT Asset Inventory. The breadth of our solution across environment enable us to offer customers greater visibility, accuracy, and scalability, while ultimately enabling customers to drastically reduce their overall spend. With that, I will turn the call to Melissa to discuss our financial results.
Thanks, Philippe, and good afternoon. Before I start, I'd like to note that except for revenue, all financial figures are non-GAAP, and growth rates are based on comparisons to the prior year period, unless stated otherwise. We're delighted with our Cloud Agent adoption, which lays the foundation for future revenue growth and industry-leading profitability. Evidence of our continued progress is also reflected in our accelerated multi-product adoption and the growth in the number of customers with over $500,000 in revenues, as well as our strong growth dollar retention rate, which for enterprise customers with five products is 99%. Our Q2 financial and operational highlights include revenues for the second quarter of 2019 grew 16% to $78.9 million.
Platform adoption accelerated as a percentage of enterprise customers with three or more Qualys solutions rose to 44% from 37%, and the percentage of enterprise customers with four more Qualys solutions increased to 24% from 19%. Cloud Agent subscriptions accelerated to 23.6 million over the last 12 months, out of which 3.5 million Cloud Agents were purchased by a single cloud platform customer. This is up from 17.9 million for the 12 months ended in Q1 2019. New products released since 2015 contributed approximately 25% of total bookings in the quarter, up from 15%, and our average deal size increased 3%, influenced by higher growth in the total number of customer orders. Our scalable platform model continues to drive superior margins and generate significant cash flow. Adjusted EBITDA for the second quarter of 2019 was $33.4 million, representing a 42% margin versus 39%.
Q2 EPS grew 42%, and we generated strong free cash flow for the second quarter of 2019 of $31 million, and for the first half of 2019, of $66.3 million, representing year-to-date growth of 25% over the first half of 2018. In Q2, we continued to invest the cash we generate from operations back into Qualys, including $5.9 million on capital expenditures, including principal payments under capital lease obligations, and $16.2 million to repurchase 183,948 of our outstanding shares. We have approximately $91 million remaining in our share repurchase authorization. We remain confident in our model, driven by our foundation of recurring revenues and expanding suite of applications. We're maintaining the midpoint of our fiscal year 2019 revenue guidance. Our current fiscal year 2019 revenue guidance is now a range of $321 million-$322.5 million.
We are raising fiscal year 2019 non-GAAP EPS guidance from a range of $1.89-$1.94 to a range of $2.03-$2.07. We are also raising our fiscal year 2019 EBITDA margin expectations to be in the range of 39%-39.5%. For the third quarter, we expect capital expenditures to be in the range of $5 million-$6 million. We are very excited about the acceleration of our Cloud Agent subscriptions with our innovative technology demonstrated by the issuance of four patents. Looking forward, we see additional opportunity to accelerate Cloud Agent adoption with the free launch of the Asset Discovery and Inventory app. Our Cloud Agents make it frictionless to enable many of our paid subscriptions, which provide us the opportunity to accelerate revenue growth as well as expand margins in the future.
As Philippe mentioned, we look forward to seeing many of you at Black Hat for a product luncheon showcasing our upcoming campaigns and solutions. With that, Philippe and I would be happy to answer any of your questions.
Ladies and gentlemen, if you have a question at this time, please press star and then one on your touchtone telephone. If your question has been answered and you'd like to remove yourself from the queue, please press the pound key. Our first question comes from the line of Howard Smith from First Analysis. Your question, please.
Yes. Thank you. Congratulations on the solid results. Kind of two related questions on go-to-market strategy. First of all, historically, you've really kind of showed your customers the products and let them adopt it kind of one at a time. You've increasingly been going to try and do some C-level selling. Now that you have such a suite and you're getting 5+ adoptions, where are you on that kind of the C-level dictating that where you can in an organization, you're gonna use Qualys, and where are you in terms of it still being almost all bottoms up product by product?
Yes. Essentially, very good question. The fact that the launch, and I hope you could be at Black Hat, you will see the massive campaign that we're doing. This is just the beginning of that awareness campaign that we're creating, which of course at the present start bottom up. Of course, now with the Global IT Asset Inventory, we have what every CIO needs to have. We are going first, and we've already started to go to our existing customers, and you're going to see a second leg in that campaign, where we're going to have our customers speaking about value that Global IT Asset Inventory brings. When I say customers from the very top, and of course, we are going to make that resonate and essentially engage CIOs which are not Qualys customers.
That's of course the second foot or the second leg, I should say, of our campaign. It's all starting.
Great. In terms of the Cloud Agent adoption, is it really they're adopting that as you promote that, and then they see the applications it enables and start to increasingly contract for those? Or do you feel the solutions, customers are seeing those solutions and saying, " Ah, n ow I need. That's my excuse to go back and upgrade to the Cloud Agent"?
It depends. What we see today is that finally, the customers have been able to break through IT, which didn't want another agent, and now they're really pushing Qualys to essentially now say, "We need real-time." That's what the agent does instead of the standard scanning. Now it's essentially, we have earned the confidence of our Cloud Agent, with that number of Cloud Agents, there's no more issue. They are very non-intrusive, so we're breaking the barrier of the IT resistance. This is what is happening now, and this is for the on-premise, if you prefer. We're moving now more and more onto the endpoint, which in the past we're not there, so that's new. The other factor of growth is also on the cloud.
We start to see now more and more adoption of our agents in the cloud environment because they're ideal for that as well. That's the way it starts. Then, as you just mentioned, is now customers say, "Wait a minute, that agent, I can do this, I can do that," and there's nothing to really install. It's already installed. Everything is centrally managed, self-updating. You don't have to have additional servers. Now, of course, you start to look at the cost advantage, and also the fact that everything comes into one single platform. If you come at Black Hat, I strongly urge you to come and see the demo of our Global IT Asset Inventory at your fingertips.
Not only you can, in 400 milliseconds, find any devices on your environment and identify everything, the open ports, you can identify everything, and as well as all the vulnerabilities, the Indication of Compromise, and all these additional services, they all come at your fingertips. That has been the fruit of many, many years of effort. Essentially, we adapted the cloud, as you know, very early. Compared with our traditional competitors, they've got to re-architect everything to just catch up to where Qualys is. That's finally arriving to where we wanted to be. That was a long road, but I think we're very extremely happy.
Great. I appreciate the color. Thank you.
Thank you. Our next question comes on the line. Dan Ives from Wedbush. Your question, please.
Yeah, thanks. Can you just talk about new products in terms of the trajectory there going into the rest of the year? What type of traction do you guys have factored in there in terms of even quantitatively or qualitatively?
I think as we mentioned in the press release, our File Integrity Monitoring, now that we have added additional bit of the functionalities, is starting to really get very good traction. Now we also believe that with the detection of Indication of Compromise, we have really brought that at a significant new level. We are really looking toward that. Of course, our Patch Management is doing really well. We have a really big pent-up demand on the Patch Management because, again, everything is out of the same console. You don't have to deploy another application, and you have the immediacy, which is what we offer. We're very happy with these new services. I would say they are coming of age. Of course, we are working on more solutions. We are also very looking forward on Indication of Compromise.
We're also moving into the endpoint EDR market, and you're going to see a lot of new things coming in 2020, again, out of that one single platform, and that's really the big differentiation we have.
Just to add on to that, as I mentioned, our new products as a percent of bookings was 25% this quarter, which we feel very good about. We're really excited about the opportunity to accelerate Cloud Agent adoption with the additional features that were added to both FIM and IOC, as well as the release of the free A sset Discovery and Inventory app. As we've said, we're potentially eliminating the resistance from IT and actually providing an incentive for them to download the Cloud Agent, and then it's frictionless for users to subscribe to additional paid apps. As I've historically said, we don't assume contribution into revenues from new solutions that are not materially contributing yet. To date, most of the new products as a percent of bookings are still Cloud Agent, VM, Policy Compliance, and Threat Protection, but we see a great opportunity.
Yeah, I will add, our passive scanning, which is essentially the component of our discovery, or if you prefer, the direct competition to Forescout is now in beta, will be GA on September 5th, and with the component of our free offering. From there, we have a significant upsell, which is the quarantine capabilities, which will be a big upsell. By giving something of real value to the market, I believe we have created a significant disruption in the market. I'm receiving every hour now, messages from industry experts who say, "Oh, what you have done is fantastic." I think we're very, very happy.
Thank you.
Thank you. Our next question comes from the line of Chris Eberle from Nomura Instinet. Your question, please.
Yeah. Hey, guys. Thanks for taking the questions. This quarter, Cloud Agents, from a net add perspective, seemed like a pretty big move up, relative to the last couple of quarters of just 1 million or so a quarter. Did you guys change anything this quarter that kind of drove that increased adoption? Just the second part of that. Once you start to see the Cloud Agent downloaded, what's the lag time between downloading the agent and then the greater adoption of further applications?
Sure. We're very excited about how our Cloud Agent subscriptions, with the adoption was this quarter, we actually saw acceleration, as I highlighted in my comments. Out of the ads, $3.5 million were for a cloud platform customer. Even without that, you would have seen acceleration. We really see what we offer taking hold in the marketplace. Our customers purchase the agent in conjunction with the solutions. They're not downloading the agent separately. It comes with a solution that they're using. The time in terms of adding additional solutions vary. There are customers who are buying multiple solutions at once, and there's times you add on over time.
What we believe is, of course, by having offered the free Global Asset Inventory, this is a godsend for our existing customers, which love it. Also, it's a very cost-effective way of gaining new customers as well, because of course, once they deploy the agent, suddenly they can immediately try all these additional services without having to install anything else. Again, installing our agent, by the way, is not difficult at all. We're putting, by the way, additional packaging to make that much even easier so people know exactly what they need to do. We have put a very big effort on the packaging.
I've also now a team in India of what we call the technical account representative, which are essentially onboarders, which are technical people, which are there not to sell, but are there to make sure that the customers have a first good experience. If they have any question, we have also now a robot, a bot, which comes automatically as soon as somebody wants to download something so we can establish the communication with the customer. As you can see, behind the scenes, we've been gearing for scale. That's essentially what Qualys is all about. When you look today at our platform, our platform answers now in 400 millisecond a query, if you want to know anything about a device, 400 milliseconds later, you've got that. That's because we have indexed 3.3 trillion data point on our ElasticSearch clusters.
We index everything, all the data that we capture. Again, this is all about scale, ease of deployment, and as a result of that, frictionless adoption. I think we're getting there.
Just to reiterate something Philippe said in his prepared remarks, which is a key theme we've talked about, which is the ability to leverage our platform as a distribution channel is a key element of our profitable growth. You see the release of the free Asset Discovery and Inventory app as a perfect example of that.
Got it. Can you just update us on the percent of the customer base that's using Cloud Agent today? I think it was at 18%, you said last quarter.
Yeah, it's still a really meaningful opportunity. It's only in 20% as of this quarter. Again, as we've talked about in the past, it's still early, in the sense of deployments on the endpoint. Within that 20% of the customer base, still think there's a meaningful opportunity for expansion and the free Asset Inventory and Discovery app potentially will accelerate that.
Got it. Great. Thanks.
Thank you. Our next question comes from the line of Jonathan Ruykhaver from Baird. Your question, please.
Yeah, good afternoon. Melissa, you just mentioned endpoint, and so I'm wondering if you could help us understand maybe some of the obstacles in terms of adoption there. I think you've had an endpoint application for 18 months or so, you can correct me on that. Just what you've seen and how much runway, it seems like there's a lot of runway, but I think more importantly, what are the challenges to adoption?
I think the challenges are, I believe, are starting to be behind us, as I mentioned earlier. In the beginning was the fact that if you look at these enterprises, they have like nine agents as an average. Today, we see, interestingly enough, that some companies today have only now reduced that to two agents, which is the CrowdStrike agent or the Qualys agent. We have few example of those because our agent replaced already quite a few agent already. Of course we are also moving into the CrowdStrike space as you will see during the early part of next year as well with the IOC, with the enhancement we made to IOC. I think these barrier are now starting to fall down. The fact that especially we have now an agent on all the mobile, which is part of that Asset Inventory.
In Q4, we are going to invest another very big requirement for customers, having the ability to also look at their mobile devices, essentially tablets and phones. I think that resistance, which was huge in the past, now today is diminishing. Furthermore, because our Global IT Asset Inventory serves both the security and the compliance and the IT people, now they have that visibility, the three of them, of course, they look at things differently. The beauty of our architecture is that we bring all the information into one place. From there you can have the IT view, the security view, and the compliance view out of that one single platform. That's the big difference again.
I think we're very confident that we are going to see acceleration of the Cloud Agent deployment, of course, as that free Global IT Asset Inventory , including with the passive scanning capabilities, I think is really what we believe will make that happen.
I guess that leads to my second question, Philippe. The feedback around the Global Asset Discovery and Inventory services has always been very strong, and there's a clear need in the market for that type of visibility. I'm just trying to understand. It seemed like it was an easy monetization opportunity. Now that you're giving it free, what are the specific paid products that we should look to initially as kind of demonstrating the success of that free strategy?
Yeah. That's a very good question, in fact, and this is really at the core of our strategy. On one hand, we know that by giving that free, we have a lot of goodwill in our industry because that's a problem which absolutely has never been really well solved. The second thing, if you look now from a business model standpoint, if you look today, as I mentioned earlier, currently today, our Cloud Agent enables seven different services, and I named them. Vulnerability Management, Policy Compliance, File Integrity Monitoring, detection of Indication of Compromise, et cetera. If you look at the cost. Today, at large- scale, and I'm going to give you numbers like if we are a big deployment. The cost for us to really give the agent free of charge for that Global IT Asset Inventory is about $0.20.
In return, the aggregate value of these services will be net, again, of storing, et cetera, and updates, et cetera, will be about $10. You have effectively a 50x return on your investment in, I would say, across three to four years at the most. That's, at the end of the day, the potential that we have created for ourselves here with a solution that deploys, that instantly provides you value. Because what's very unique with our Global IT Asset Inventory is that you, the customers, have nothing to do. It's our solution which automatically categorizes, tells you how many Windows you have, how many Mac you have, how many database you have, what type of database. You have also the ability to find end-of-life, all of your Java instances, et cetera. All of that is at your fingertips.
Now, we don't give everything free, but we give the core component free so you can have your automatically created, your Global IT Asset Inventory in a very continuous way. Every time there's a new change, automatically it's updated. You can, for a little bit more dollars, you can now upgrade and synchronize with your CMDB. Today, we have the full two-way integration with ServiceNow. Our goal here is to become the source of truth, and we can earn that. Again, if you could come at Black Hat or if not, we'd be very happy to give you a real live demo of that. You're going to be absolutely floored by how much information we capture, how quick it is, and how comprehensive it is.
Just to add onto that, I think, from a financial point of view, where you would see that is in, you would see that manifest itself in revenue growth. The reason I say it that way is because the adoption of this free A sset Discovery and Inventory app could accelerate both, what I'll call older products as well as new. Older because, again, this eliminates the resistance to putting the agent on endpoints. You could see many companies that haven't yet done VM or Policy Compliance in the endpoint starting to do that. Again, it also may propel new solutions being adopted. We have multiple vectors of revenue growth.
Right. No, that's helpful. Thank you very much for the insight.
Thank you. Our next question comes from the line of Nick Yako from Cowen & Company. Your question, please.
Thanks, guys. You mentioned a major awareness campaign in the prepared remarks, are there any more details you can share around just the overall strategy to drive awareness of the free Asset Inventory app?
Oh, yes. I could be specific. I can tell you that. When you will arrive in Las Vegas at the airport, you're going to see huge banners everywhere. You're going to go to your taxis, you're going to see that, what we call that new prescription for security. As you walk through the halls of Black Hat, you're going to see, of course, again, that campaign as you want to arrive into our booth. Another thing that I will mention is that there is also multiple, if you prefer, legs into that campaign. If you read the press release, you will see that the Cloud Security Alliance has essentially endorsed Qualys and are bringing that to their 95,000 members because, again, it's good for the community. This is just not good for Qualys. It's good for the community. That's the first part of the campaign.
From there, we're going to do a lot of, I mentioned earlier, we have now a team in India which can absolutely onboard customers, so we're gearing up for large volume. I mentioned earlier, the first two days, we have more than 800 sign up, essentially, to our service. We're geared up to have the technical people behind to ensure that customers are properly onboarded. We have also made a big effort on the packaging so they could really see very easily how it is to download the agent, what they need to do, et cetera. Of course, after that, we are going to see more lead generation campaign. This is the bottom up. There is a question before. You're going to see us now doing seminars, webinar to go.
In fact, we have one on Friday, starting on Friday, with about 100 CIOs and CISOs of the healthcare industry were essentially present and essentially are going to advertise the benefits of that Global IT Asset Inventory. We can essentially go now today to every CIO in the world, essentially tell them, now with Qualys, you can have the full view of what you have. Second, you can have the continuous assessment of the security compliance posture of those assets. You can identify those which are vulnerable to zero days, those which are compromised, or those that we suspect are compromised. You can essentially quarantine them. Then, of course, you can consolidate your stack, which is what large companies must do now, save significant amount of dollars.
On the top of that, our architecture brings you and helps you to secure your digital transformation as we're doing with Google, with Microsoft, with Oracle. As you know, they're all our customers. We help them secure their own platform, and now we're building that security into their environment for the customers, which we have done extremely well with Microsoft, and we're doing that with everybody. Again, that didn't happen in a week. This is 20 years of effort, and we focused not on the growth of the company. We focused on building the platform and essentially building sustainable growth and a highly profitable goal. That's when we went public, what we said, and I think throughout the years, we are demonstrating that. Now today, we've really put the pieces together, and that you are going to see very different companies in the months to come.
Okay, great. Could you discuss that large single Cloud Agent purchase in terms of the products that customer is deploying? Maybe as a follow-on to that, do you see an opportunity to drive similar-sized deals going forward?
We don't really disclose really much these kind of things because as you know, our customers are always a bit leery of telling the world what they do. This is obviously a big cloud providers, which has now totally adapted the a gent to secure their own platform. Now you speak of millions of a gents, really. Of course, there's more and more cloud providers, and there's more and more of those. For us, more importantly, it's all these additional services that you can build on the top of it. Again, the beauty of our Cloud Agent, and now we're so happy that we have these patents around, is that they spawn multiple services, and we're just at the beginning.
Today, we have seven, but you can realize that now once you have an agent, of course, we are moving into OT and IoT as well. You can realize once you have an agent, you can now do enforcement. You can go into response. It's all about the game today in security. We always believe was one, you need to detect at scale, and then second, you need to respond, and you need to eliminate the false positives. The fact that our agent gives us the context in real- time is significant. Across, again, all these different environment, because you cannot today say, "Oh, I just look at my logs." That doesn't work anymore. You need to really have the complete view.
That's, again, not a walk in the park, and this is the reason why we're moving with a data lake, because we have a unique advantage of one, we collect the data. No SIEM today on the planet collects the data. They got to take the data from multiple different sources, which is very complicated, very expensive, and also very difficult to normalize because you don't know if that application tells you about that device. Is that the same device? You don't know. The big advantage we have with our architecture, again, is that we have absolutely full contextual value, and that's quite significant. I think we're entering into a new era of Qualys in which we believe that's what our goal, but I think we're really getting very close.
All right, great. Thank you.
Thank you. Our next question comes from the line of Erik Suppiger from JMP. Your question, please.
Yeah. Congrats on a good quarter. Couple questions. One, who is the asset discovery service competing against? Are you sacrificing much revenue by giving that away for free?
That's a good question. By the way, Erik, you remember you were, in fact, the first one who told us to accelerate the Cloud Agent. You should really think about giving one of your services free of charge. It seems that we followed your lead. In fact, absolutely. I was really waiting.
The reason why we didn't move early, because we were waiting for that Cloud Agent, so we needed to create all the libraries and everything so we could automatically create the inventory because telling the customer to do their inventory themselves, that's the problem you have with the CMDBs, is you've got to do everything yourself. That's why we waited to have that piece completed, and now we have it. To answer your question, there's a plethora of solutions out there, like Flexera, and I can name many other ones. You have Armis, you have quite a few. The problem with all of them is not that they are not good.
They do the job, but they are myopic. They only look at a certain part of the environment. If you take your security hat on, you've got to have the global view. You cannot just say, "Oh, I've got that thing. I've got a good view on my windows," or, "I got my good view on this." You need to put all these pieces together, which is almost impossible, and the CMDBs cannot really do that. They were never designed for that. So that's really where the difference is. In terms of, yes, on one hand, you could say, "Oh, we're giving away what Forescout is doing. We're giving away what Flexera is doing." You could say, "Maybe this is $500 million, if not more." Look at the leverage that we have, as I was mentioning earlier.
With $0.20, then I can get 50x the return, and the beauty of our solution is that it's all automated. It's all machines. I don't need a lot of salespeople. I don't need a lot of support people. It's all in a platform. It's a very effective model. I go back to the early days, very few people realized that VeriSign was the granddaddy. I always say that. It was the granddaddy of SaaS. They were the first one to have a really cloud distribution model. If you look, I remember because I looked at it when I was there, what I could see that their salespeople, 10 salespeople could do $4.5 million a year of renewals. In fact, I took some of their models, and that's why we had a model which is so effective.
You look at their gross margin today, they are at 70%. B ecause a gain, they have leveraged the cloud. Now what we do is more complex in a way. I'm not saying that what they do is simple, but we have much more variables. Of course, I'm not saying that we are going to reach 70% gross margin.
Operating margin.
Operating margin, yes. Operating margin, sorry. I can tell you, we still have under the foot to be capable of leveraging the model again. It's all about the model. The model is the cloud, the platform is the distribution channel. That's where you cut a lot of costs. That's what the digital transformation is all about, eliminating the middleman and the businesses in between. There's nothing new here.
Okay. One other quick question. The cloud hosting provider that took 3.5 million agents, is that the same one that took 5 million agents about a year ago?
No, it's another one.
It's a different one. Okay. If we think about your Cloud Agent count in the September quarter, is that going to be a tough comp? Because I think it was the September quarter last year where you had one customer that took $5 million. Is that going to roll off? In which case, that Cloud Agent count could come down.
No. We would assume that they would be renewing. To your point, we might not be adding $5+ million in that quarter, but these are based on 12-month rolling subscriptions.
Yeah. We will differentiate with the free agent. We are going to also make sure that we don't, because, of course, we should have a lot of agents as well, which will come from the free service, but we'll make sure that we essentially differentiate-
Free versus the paid.
Free versus the paying ones.
Very good. Thank you very much.
Thank you. Our next question comes from the line of Alex Henderson from Needham. Your question, please.
Hey, guys. I'm thinking the primary thing that is necessary to get the stock to really have any kind of real acceleration or move in it is the top-line growth. You talked about getting to a 20%+ growth rate at some point. The guidance in the back half doesn't look like an acceleration. It actually looks fairly much of a continuation of what we've been doing. Can you talk about a little bit of the pings and pongs relative to what would be necessary to get your growth rate to show an inflection and start to accelerate, and what the headwinds are relative, is the macro environment or any other variable holding things back? I assume that that's not the case, but could be. What is the slope of that acceleration to get to the 20% longer-term target?
Is it very, very gradual and then pick up at some later date? How do we think about that?
Yeah. No, absolutely. First, we don't see any headwinds in front of us, really. Of course, we need to continue developing product and so forth, but there's nothing that we see as headwind in front of us. Second, I just want to reemphasize again the fact that we are absolutely 100% subscription-based. When you compare, when I look at some of our competitors and so forth, when I look at the quarter-to-quarter growth, which essentially could be 3%, 4%, that doesn't generate 30% growth. Where is that coming from? It's coming from, of course, adding a few spoons or sprinkle of perpetual license here and there. We don't have any of that. The result is that for us to pick up growth, essentially, it takes a little bit longer. That's essentially the way our model is.
Of course, the big advantage is that we are significantly more profitable, and that's something we don't have to do. It takes a little bit more time. We needed certain patience, that's what we have been all along, and I think we're very confident again that we believe that we're going to pick up growth, and now with all the things that we have done. We had that kind of a pause in our growth. As we discussed last time and the time before is that today we didn't have these new services mature enough and so forth to really start to contribute to the growth when we have a huge install base, which has been growing very well. Of course, it becomes harder now with just the VM, all the Policy Compliance, all the Web Application Scanning to generate accelerated growth.
We need the new services. We're very happy to see that now today it's 25% contribution from the new services, and this is going to continue. We always say that look at that adoption. It's a question of time, but it's there. There's no question. We have very strong loyalty from our customers. The other point, which is significant, we really believe this Cloud Agent will make us what I call naturally sticky. As you may remember, with customers which have adopted four solution, the growth renewal rate is 99%. Those who have adopted three is 97%, and those who have two is 91%. Of course, these Cloud Agents, that free G lobal Asset Inventory really are going to make us very sticky.
In a way, it makes us immune of some of the tactics of some of our competitors, which drop the price. They don't have the breadth of solution that we have. We're not losing our sleep at all.
Yeah, and I'll just add on, Alex.
To just be clear, your growth rate guidance for the back half of the year is slower than the growth rate guidance in the first half of the year, and it's against easier comps. I'm still wondering why your growth isn't accelerating as opposed to decelerating.
Alex, we have a healthy business. We do have a higher negative impact from FX in the second half than we previously expected. We expect the growth rates to be negatively impacted by about 1% each quarter, but we're still maintaining the midpoint of our guidance. The reason for the growth rates from where we are today versus last year, as Philippe explained, was that as we talked about, our previous growth rate had been bolstered by what we call fractionally priced solutions, for lack of a better term, right? Cloud Agent for Vulnerability Management and Policy Compliance or Threat Protection that were priced at 20% or 30% of these older products. Now many of the newer, we call sort of the new new, the newer solutions coming out, we expect to see deal sizes similar or more than these older products.
Today it's still primarily VM Policy Compliance, Cloud Agent usage, and Threat Protection. To tie it all back together, even in the 25% of bookings, the new products and bookings, it's mostly those newer products. That's why we're so excited about the additional features that were added onto FIM and IOC, as well as the free release of Asset Discovery and Inventory, because this potentially will help accelerate both adoption of the Cloud Agent broadly as well as of these newer solutions where we expect deal sizes to be larger and they can potentially have a bigger impact on our growth rates.
If I could just extend the question a little bit. You've given longer term indication of a 20%-type growth rate. When do you think you might get there? Do you think 2020 is an accelerated growth rate versus 2019? Those are kind of the basic questions that I think we heard every time we went out in the field to talk about the stock.
Right. We talked about our long-term target, which we generally update our model on an annual basis, and we'll do so for our spring Analyst and Investor Day in New York. The framework hasn't changed, which is as Philippe referenced, that the total spend per IP could be 10x that of $1 a VM. This does include the paid version of the free versions of Asset Discovery and Inventory. We're also not expecting all customers to adopt all solutions. In terms of the interim period, we provide guidance for 2020 after Q4 earnings. It would be imprudent to provide any direction earlier than that.
All right. Well, thank you very much for the help.
Okay. Thank you.
Thank you. Our next question comes from the line of Keith Weiss from Morgan Stanley. Your question, please.
I just want to thank you guys for taking the questions, filling in for Melissa Franchi here. One question on kind of OpEx and one on sort of geographies. On the OpEx side of the equation, margins continued to be really impressive and expand really well. OpEx was to be kind of in line with seasonality, but definitely kind of outperforming targets. I just wanted to check in, like the outperformance on OpEx, is that because of kind of better leverage you're seeing or has kind of the spending underpaced your projections of it, you weren't able to get salespeople up and running fast enough or you were unable to, or find the salespeople or find the R&D guys. Is there any kind of pent-up spending that's helping those operating margins? That's question number one.
Question number two, if we look at sort of geographic growth on a year-to-date basis, Europe's been performing really, really well. It's almost like 30% growth. The U.S. has been a little bit less well, at about 10% growth. Anything in particular that explains that dichotomy of sort of the much better growth overseas?
I'll start with the OpEx. Keith, we're very happy to have you.
Thank you.
On the OpEx, you can see from our guidance, we are guiding for contracting margins for the second half. There is an element of spend that is just really a timing issue. We did come in basically lower on headcount expense and operations and sales and marketing. Some of that is hires where we didn't find the right person, and so we expect to see the hiring pick up on those in the second half. Some of it was also, we just spent less on trade shows than we needed, and third-party consultants and marketing costs. Not to make Philippe blush, but for example, if you look at our campaign and a lot of it was driven by our multi-talented CEO. That helped save us dollars, too. There's also leverage.
Absolutely. Yeah. On the geography, this is just a very natural evolution of the market when you have today, of course, we have a very strong penetration in the U.S. as compared to Europe. What we see in Europe is the natural expansion in Europe of people deploying more of our solutions. When in the U.S., of course, today, this is where we have the phenomena, where essentially the mass is so big, so we need these additional new services to really propel the growth in the U.S. Again, that's something we're very optimistic with our new services and see accelerated adoption. It took us a little bit longer, of course, because you need to essentially bring all these new services at the level that we need.
It takes time and we also want to make sure we get the right products, and we don't push a solution into our customers. That's also the other very important thing in our model. I will repeat again, we cannot absolutely, if we start to add our customers consuming more, so we don't incentivize our sales force to do bigger deals than what the customer can really swallow. The reason is because if not, they will not renew at some point in time, and then we'll have to push more. Now this is the way enterprise software works.
Of course, there's always the music stops at some point in time. It takes a long time for customer support to suddenly run out of new customers when you can shove it into them and create a lot of shelf wear without, with a pure subscription model like ours, you will see that much quicker because then they start down selling, which is exactly what you want to avoid. These are the dynamics, essentially.
Excellent. Thank you.
Thank you. Our next question comes from the line of Matt Hedberg from RBC Capital Markets. Your question, please.
Hi, guys. Thanks. Melissa, I know you referenced bookings in your prepared remarks and on prior calls, but we are getting quite a few questions on short-term billings. I think it grew 13% this quarter. Could you talk about sort of the trends in short-term deferred? I think it grew a little bit less this quarter sequentially than it did last year. How should we think about short-term deferred as this model progresses and we look for revenue to accelerate?
Yes. Thanks, Matt. We had a good quarter, and we have a healthy outlook. As we've discussed, deals move in and out all the time. There are multiple scenarios in which the renewal does not happen at the same time as the anniversary date, so it's hard to normalize for comparison purposes, which is why we point to the trajectory of our annual revenue guidance as the best proxy for business momentum, because current bookings certainly inform our guidance. As I mentioned, we do have some FX headwinds, but we're maintaining the midpoint of our guidance. We're also thinking about introducing ARR next year because it should reduce the volatility you see associated with current billings metric.
Got it. Thanks. Maybe, Philippe, thinking about the Capital One breach this week, it looks like it was a misconfigured WAF. I'm sort of curious, can you talk about that as a broader issue, and maybe how you guys can help prevent that from happening to others?
I think this is a complicated situation here, and because as you know, there's a kind of insider. Whenever you deal with insider, that's the most difficult thing to combat because they have, of course, inside knowledge of your configuration, and they could either find ways to get credentials they should not have. That's the Snowden case. Or they could essentially find or identify vulnerabilities because they were just there. That's the tricky part. It's very difficult to combat insider threats, as we all know. Again, I go back to it's all about hygiene. That's where Qualys shines, because we can help you absolutely identify vulnerabilities on your environment at a huge scale across all these different environments.
That's again, what's behind the decision that we made to make the Global IT Asset Inventory free of charge, discussing with our advisory board, with our large customers. In fact, the idea came as well to make that one free from, on one hand, I mentioned Erik Suppiger would say, "By the way, you would adopt," but then we have also the customers telling us, "Look, this is such a pain point that we encourage you, if you could do something here." That will give you the visibility you need, because how could you, if you don't know what you have, if you cannot even identify the vulnerabilities? That hygiene is the, if you look at the Verizon breach report, et cetera.
Yes, we put a lot of these shiny objects around and this and that, but if you don't do your vulnerabilities, if you don't configure your system properly, if you don't know that that camera, for example, is still connected to your network and anybody can have access to it. If you don't, then you're going to get breached. It's that simple. It's becoming very critical in that environment where now everything is becoming connected with everything, whether you like it or not. We are entering now, wait until 5G arrives. Oh, my God. That visibility is crucial. Everybody will tell you, the experts, 100% visibility. On our offering, for example, there's one thing that [audio distortion] surprised to see how many devices connect to your network via Bluetooth. We, of course, will introduce that shortly, but you need 100% visibility.
That's the one thing you've got to do. Then making sure that you are very careful with your contractors, and you extend that visibility to your ecosystem as well. It's a lot of work. Without visibility, you're going to get breached.
Got it. Thanks a lot.
Thank you. Our next question comes from the line of Rob Owens from KeyBanc Capital. Your question, please.
Great, and thanks for taking my question. Melissa, I appreciate the commentary around short-term deferred and deals that move between one quarter and another. If I look at three out of the last four quarters, you've grown at this consistent 13%. With the business setting up to inflect to achieve that 2021 target of low to mid-20s growth, at what point do we see that? Does that actually come through in that short-term deferred, kind of as a velocity-based metric? Thanks.
Yeah. Thanks, Rob. Ultimately, 2021 revenue growth will be based on bookings performance in 2020. It should flow through in deferred revenue. As we talked about many times, for example, the correlation between quarterly billings and quarterly bookings is not always the same. That's why we are looking to improve how we communicate externally with you guys. As we mentioned, we're thinking about introducing ARR for next year.
Sure. I understand that, but you've got a three out of four quarter history of that 13%, which theoretically suggests kind of a downward draft in that revenue. Even over time, that becomes an unreliable metric if we look at, again, three of the last four quarters?
No.
Sorry, I was going to say. If you look at LTM billings, that's going to be a much closer proxy to LTM bookings because you have much more normalization. What we've had today is the fact that our growth has been supported by these fractionally priced solutions, as opposed to generating an impact from more of the higher-priced solutions, which are things like FIM and IOC, Patch Management, et cetera. That's really where the opportunity is. As well as, again, as we've talked about expansion onto the endpoints, that could fuel even kind of what else older products in terms of driving future revenue growth.
Great. Thanks for the color, Melissa.
Thank you. Our next question comes from the line of Gur Talpaz from Stifel. Your question, please.
Hi. This is actually Chris Speros , on for Gur. On the call, you mentioned that the free Asset Inventory service already has 800. Can you talk about the makeup of this group in regards.
It's a mixture. It's a combination of small customers, mid customers, and even large customers. We could give you the breakdown, but we're just at the beginning. Essentially, we're targeting the entire. For us, we can serve very small customers, we can serve very, very large customers. We have the largest customers in the world. We've got 70% of the Fortune 100 today. They come from all walks of life. Again, that Global IT Asset Inventory is really a need for everybody. The large company because they have no visibility, and the small companies because they have only very few people. For them to do the cataloging of all their application and what they have, even if they have a small network, they have very little people to do it.
The poor IT guys, they do IT, they do security in the small companies. Now they have to deal with the cloud and with the mobile and with this. It's absolutely a nightmare. I think that's a godsend for all of them, small or large.
Yes. That's great color there. Where I was going with that question was, can you just talk about the makeup of the group in regard to the proportion that had already deployed the Cloud Agent relative to the proportion that represents net new Cloud Agent deployments?
I would say in general, the Cloud Agent has been more adopted in the enterprise than the SMB/SME to date. We don't track exactly every quarter where the net new adds are. We kind of look at it overall for the business. This is what's revolutionary about what we're doing with the release of the free Asset Discovery and Inventory app is that, again, it provides an incentive for many prospects in the lower end, let's say, to adopt the Cloud Agent, and then it's frictionless to subscribe to paid applications.
Yes. I guess what I'm asking is the percentage of the 800 customers that have signed up, what percentage of this group had already deployed the Cloud Agent and were just signing up for the Asset Inventory versus the percentage of customers that the deployment of the Asset Inventory would need them to deploy the Cloud Agent?
Got it. That's a great question. We haven't gone through all the data as we just announced it on Monday, so it's something we can get back to you with, Chris.
All right. Thanks, Melissa, I appreciate it.
Yeah.
Thank you. Our final question for today comes from the line of Sterling Auty from JPMorgan. Your question, please.
Yeah, thanks. Hi, guys. I want to clarify or understand, in terms of the Cloud Agent, are the Cloud Agents included just in the core VM pricing? What portion are maybe paid subscription versus what portion are now part of what appears to be the free program? I want to make sure I'm not mixing apples and oranges here.
Yeah. The numbers that we've released, when we say 23.6 million Cloud Agent subscriptions, those are all paid subscriptions associated with a product, because you don't just subscribe to the agent just for it to be an agent. Now, you can use, on the VM, you can use what I'll call the traditional scanning technology VM that's not using an agent, right? For example, you can't do that with endpoints because the laptop leaves the network. If you want to do VM on an endpoint on a laptop, you'd have to use the agent.
When I think about our existing customer base, we have a lot of customers who are still using traditional scanning, and then many of them rolled over a portion or all of their VM subscriptions into using the Cloud Agent for VM, because not only can you extend it to endpoints, but it also goes in cloud environments and gives you more real-time information because you're not just relying on the scanning windows. Let me pause and see if that answers, if that makes sense so far.
Yes. No, that definitely helps. In terms of the procurement of the new solutions, is there an expectation of what you think moves first? Is it going to be FIM and then followed by inventory? Do you think in terms of both the timing of GA as well as the customer traction, or do you think they're simultaneous in terms of the uplift?
Inventory we announced is going to be GA September 1st. FIM has been out, but we've added new solutions, or added new features, sorry. IOC, we went into GA with the new features. In terms of the timing of adoption of which ones do people subscribe to the most first, it's always difficult to predict because we have no data points yet for newer solutions or not enough substantial, I would say. Philippe, would you?
Yeah. They're all also a little bit different because FIM is more typically for regulated industries rather than because they have to do it. This is a different rhythm. They're all a bit different at the end of the day. What we can see today, Patch Management, which is a new service, we have a pretty big demand on Patch Management already. I think FIM is taking off, Patch Management will take off. We really believe that that new generation, that new version of IOC is going to really rock the world because unlike anybody else, we can identify suspicious devices. In other words, the big advantage of our solution of IOC is that as you give us an IOC, instantly, we can tell you without scanning anything, just querying our backend, we can tell you wherever you are compromised.
Because we have classified the malware into families, we can now identify the family match, which doesn't really give us 100% assurance that this is a real compromise. Of course, with the passive scanning, we can look at what's coming in and out of the device and identify that if this is a behavior which is suspect, then we could absolutely now take action and quarantine, which will come in Q4. Of course, not only we can also put that device on watch because as you know, the malware can be dormant. In that sense, you don't see anything. We, I think we're bringing IOC to its next level. We're very well- received by our customers as well.
I think that will also help the adoption of our agent as well because, again, you need the agent to do these IOCs as well.
Got it. Thank you.
We feel we're in good shape.
Thank you. This does conclude the question- and- answer session of today's program. I'd like to hand the program back to Vinayak Rao for any further remarks.
Thank you all for attending our second quarter 2019 earnings call. As Philippe and Melissa mentioned, we're holding a product luncheon for our analysts and investors during Black Hat on Wednesday, August 7th from 11:00 A.M.- 1:00 P.M. Registration is available on our website. We also look forward to seeing you at Citi's Global Technology Conference in New York in September. Thank you.
Thank you, ladies and gentlemen, for your participation in today's conference. This does conclude the program. You may now disconnect. Good day.