Well, good afternoon or almost good evening, everybody. Thank you so much for joining us. My name is Hamza Fodderwala. I'm the cybersecurity analyst here at Morgan Stanley. With us we have the team from Qualys. We have Sumedh Thakar, CEO, Joo Mi Kim, CFO. Thank you so much for joining us.
Thank you.
Before I begin, a brief disclosure on our end. For important disclosures, please see the Morgan Stanley research disclosure website at www.morganstanley.com/researchdisclosures. With that, we'll get started. Sumedh, Qualys has been one of the best cybersecurity stocks year to date, despite some of the naysayers. What would you contribute sort of Qualys' resilience to relative to even a lot of other cybersecurity companies that have had to, you know, cut their numbers more significantly more recently? What are you seeing from customers and how have you gotten around maybe some of the macro headwinds that have been increasing in recent quarters?
Thanks for having us, Hamza. For us, Qualys has always been focused on profitable growth, you know, for many years, and so I think that is a key part of our growth strategy. I think our focus on innovation on the platform side over the last few years has enabled us to create capabilities that have helped our customers be able to do more with Qualys and be able to expand into asset management and patch management, et cetera, which gives them better outcomes, and so which gives our customers the ability to expand very quickly with Qualys, with adjacent capabilities, without us having to have multiple sales forces required to sell individual products if we were acquiring separate platforms and selling each of them separately.
Part of those things and the fact that our customers can actually do more with the Qualys platform is sort of the key aspect why we are seeing, you know, being able to maintain our profitable growth and, you know, even in the macro headwinds, work with the customers to talk to them about the capabilities of consolidation, which is a big topic that CISOs are talking about, and giving them outcomes. Because today everybody wants to actually show that they've reduced their cyber risk, not just reports and dashboards. I think those key elements are really what help us. It just, our focus over the last few years on maintaining profitable growth, has helped the stock where it is.
Got it. Yeah, consolidation right now is a big theme, right? As customers look to rationalize some of their spend. Not necessarily cut their security budgets, but become more efficient. What are the two or three key pillars that customers are consolidating around with Qualys? Can you maybe just give a little bit of color on each of those?
Sure. look, I think customers in our conversations continue to look at vulnerability management as a key component of their risk reduction strategy today. The conversation CISOs are having in the board meetings are more about risk reduction rather than projects and tools. When they look at, "I don't wanna get compromised, with a low-hanging fruit like my exchange server was not patched for a particular vulnerability," which has a patch out there for, you know, one year or so, which is very common. We see people not doing a good job at vulnerability management. As our customers when they look at just say vulnerability management is a key component, but when you look at vulnerability management, it has four key components as part of the process, right?
First is the ability to know your assets. Without that, you cannot do vulnerability management on those assets. Second is finding ways to detect these vulnerabilities in near real time, as we do with our agents. Third is prioritizing because we are finding so many vulnerabilities, how do we figure out the ones that actually cause a risk to your environment as a customer? The last part, which is the most important, actually fix it. I can do all these other three, but if you don't actually patch and fix in a timely manner, you are exposed, right? You look at Log4Shell, et cetera, compromises are accelerating in terms of how short time it takes from going from a detection of the vulnerability to actually compromising that vulnerability. The amount of time that customers have to actually fix those vulnerabilities is reducing.
When customers are looking at a comprehensive ability to reduce their risk, these four components today are done by four different tools, four different teams, and that is where a lot of times time is wasted. In fact, we had a conversation with a customer recently, and they basically broke it down into three components of their lifecycle. One is the time to detect, and they said, "With Qualys, we're able to detect every four hours." Then they said time to communicate. Finding the right asset and the owner is taking couple weeks. Even after that we communicate they're missing the 90-day SLA.
The consolidation that they're looking for is, "How can I actually have a single platform, single agent, single tool that is not just giving me a list of my CVEs, but actually helping me the end-to-end process of finding assets, finding vulnerabilities, prioritizing and fixing it?" Which is what we do with our Patch Management capability, Cybersecurity Asset Management and VMDR.
Got it. Asset Management, Vulnerability Management, and then Patch Management are some of the key pillars among other things.
Yeah.
Joo Mi Kim, how has that sort of consolidation, if you will, translated into metrics like your net retention rate or the percentage of ACV that's coming from new versus existing upsell?
Yeah, great question. The way we look at our play is our go-to-market strategy has always been a platform play, and so the way we thought about VMDR when we first came out with it was really strategic for us. What we thought would happen was it would increase our retention rate because our product would be secure and it would increase our upsell and cross-sell rate, which has translated. What we're seeing right now is on a constant currency basis in Q3, our net dollar expansion rate was 111%, up from 104% a year ago. That's mostly due to our customers increasing their deployment with VMDR, but also purchasing additional products like CSAM and Patch Management.
As of Q3 on an LTM basis, you're looking at CSAM and Patch Management contributing to 8% of total bookings, which is significant for us. Those two combined also contributed to 15% of new bookings. This is where you're kind of seeing that the success of the adoption of our newer products is really lending itself to, for us to think about the opportunities ahead with products like EDR and XDR being even newer than Patch Management and CSAM, and the potential given the target is a small market for those two products.
Got it. Some of the people who are saying, "Look, VMDR, you're selling it, but there's no ASP uplift, and that you're selling it for quote unquote free," it was never supposed to be a price uplift. It was supposed to be a means to make that customer more sticky. What is the differential, if you will, from a gross retention standpoint when a customer adopts VMDR as opposed to single VMDR?
Our gross retention rate has, like historically been around that 90% range. What we're seeing is we thought that because it was always so high, since our customer base is approximately 20% enterprise and 80% SME and SMB, so the gross retention rate for 90% as a whole is really high for us. We didn't think that there was room to go up from there, but we have seen it tick up slightly in addition to the upsell going up. What we're seeing is VMDR is helping the customers to really plan their security spend out. Before, what we heard from customers when we just had VMDR was, they would say, "Okay, we can see ourselves being with Qualys this year and next year, given the budget.
The way we see it is two years out, three years out, because of your price point, how you price other products like Threat Protection, there's no way that we can stay with us 'cause it just becomes too expensive." With VMDR, what that allowed them to do is, "Okay, VMDR is priced in such a way that I can increase the deployment with... and we're getting more value for every dollar that we spend with you.
On top of that, we can see a volume discount if we decide to purchase Patch Management, CSAM, and eventually EDR and XDR. That's why they see 5 to 10 years with Qualys given how they're thinking through it and we're helping to shape them, and this is why we're always acting as their advisor or consultant, if you will, to help them to reduce risk in a way that also makes sense for them from a cost savings perspective.
I'll add quickly to that. In our recent user conference a couple weeks ago in Las Vegas, and the recording is online, one of the customers actually got up and talked about how by standardizing these capabilities on the single Qualys platform, they were actually able to save a bunch of cost, and the cost saving was not so much from the licenses of these 4 different products they would otherwise have to use, but the integration of those products, the resources that they were needing to actually get to the patched state was half of what they would otherwise were using before with multiple different solutions. That's actually the consolidation play right now is translating, and customers are talking about that publicly now in how they see the platform play bringing value to them. Got it.
You roll out the VMDR bundle initially in early 2020. You see the benefits in terms of enhanced gross retention, and it gives you a better on-ramp to upsell some of your other modules. Are there any instances where... I think your duration is generally around 12-18 months, if I'm not mistaken, your contract durations. Are there any instances when the VMDR customer comes up for renewal where you might think about just raising the price because they're getting so much value out of you and it's, you know, too cheap?
Yeah. Great question. It's an ongoing discussion that we have right now, especially because of inflation. The way we've looked at VMDR is initially when we came out with VMDR, we could have priced it higher because of value proposition too, 'cause we've never been viewed as a lower cost product or provider, if you will. The reason why we price it the way we have, and we have no intention of raising the prices, is because we wanna make sure that we optimize our pricing and the packaging to maximize the return and from a value perspective to our shareholders, and to our customer, all stakeholders included, as well as allow us to increase market share. That's really important to us. If you think about it from our perspective, we've always talked about balancing growth with profitability.
We have a really high profitability margin, which allows us to not really increase price, but maintain our margins. This is why I think that we're kind of making sure that we take this opportunity to increase our market share.
All right. Just the last question on VMDR. I think it's now close to 50% of your customer base. Do you think it gets to 100% of the customer base over time?
I think that will be difficult just because historically, 70% of our customer base has had VMDR solution. It's never been the case that 100% of our customers had a VMDR solution with us. For example, a customer might just have Web Application Scanning I do think that there's a possibility. There's definitely more room for that 45% customer penetration to go up. Reaching that 100%, I think that it's not to say we won't be able to achieve it ever, but there will always be a subset of our customers who are looking to just purchase other products and not VMDR solution with us.
Are we saying 70% then is what we should think about as the upper bound?
That's right.
Okay. All right. That's helpful. Thank you. Maybe just shifting back a little bit to the macro. Obviously, the consolidation theme makes a lot of sense. What we're hearing from, you know, a lot of companies recently is you're seeing large enterprise deals are taking longer to close, and some of these deals are being broken now into multiple phases. Is that something that you're seeing? Or if not, what are you seeing on the macro front?
Yeah, I think we're not immune from the macro impact that everybody else is seeing. We're seeing similar scrutiny of deals. You know, what used to be 2 signatures is like 19 signatures. Everybody's asking the question, "Why this? Why that?" Our stake... our supporters, our stakeholders, have to justify exactly what the plan is, what the value is, how they're going to get value out of that. you know, consolidation, when you do that, it always comes with that.
project that you need to put in place to actually maybe rip out an existing vendor or move to a newer solution which takes some resources. Customers are looking at, you know, how do I, what's my plan to... I want to go for consolidation. In this macro environment, it makes sense. It helps me reduce the resources. To implement that, they have to have a starting point at which they feel like they have the right resources to go with some of that. In some cases, as we have seen, as Joo Mi Kim talked about, 15% of net new bookings already buy those two additional products from us, right? In Q2, which was good because they came to Qualys, said, "Hey, I'm in the process of changing my architecture.
I'm gonna buy all 3 of them," which is great. In other cases, they look at it, they say, "I am still going to buy only VMDR, but it is good for me to know that 6 months, 9 months down the line, I can put a project in place that will replace my other Patch Management solution with Qualys or my cybersecurity management solution with Qualys. I can implement ServiceNow integration or something like that." We are seeing that pause that people are putting in some cases, additional scrutiny, and trying to plan how they want to actually roll out the consolidation, which of course, you know, it takes up a little bit on initial resources, but in the midterm and the longer term brings more value to the customer.
I wanna shift to profitability questions for a second. Qualys is one of the most profitable security and software businesses out there, you know, 40%+ operating margins. You also wanna be a 20% grower longer term. Do you think, and Sumedh, feel free to chime in here as well, do you think that 40% operating margins in this industry can coincide with 20% top line growth?
We do, this is a conversation that we've had internally, especially when last year was the first year that we've hired the CRO for the very first time. When you bring on a new CRO, you have this discussion about all the other players that are out there that don't have the sales and marketing engine that we do. The question that we have for ourselves is, can we really maintain this go forward? How are we able to achieve this historically and maintain it so far? I think that nothing fundamentally has changed for us. Our sustainable business model will continue.
The way we were able to maintain this margin is from the fact that we're a cloud platform, and the way we've been able to cross-sell and up-sell customers is their ability to try out new products, which is so much more effective than just talking about the product and the benefit they will be getting from it. When they try it out, we're seeing that the conversions are happening. Because of that, we don't see necessarily us having to double our sales force. We are increasing our sales force. We've increased our sales and marketing investment this year more so than we have in the recent years. Right now we're turning to optimize, optimizing that spend. Even still, you're looking at last quarter, we ended the quarter with 44% EBITDA margin and 20% revenue growth. It will be lumpy going forward.
That's what we see in this macroeconomic conditions in terms of the bookings growth. In turn, because of that, we're focused on optimizing that spend and investment to make sure that we maximize that return before we double down again. Longer term, we don't see a reason why we couldn't maintain that growth rate in the 20% range and EBITDA margin 40%, especially because you have so many other products that are new that are out there. The addressable market is large, so we're going after a very large market opportunity. The onus is really on us to go after and capture as much as possible in the coming years, given that the products are already out there.
Yeah, I'll, you know, I'll quickly jump in to give an example of a customer who has Qualys on 300,000 laptops. They had the vulnerability management agent, when they wanted to try out Patch Management, you know, if you were looking at a different solution, it would take weeks and months to get agents deployed and to get the back end deployed to even see value out of that. With us, within 24 hours, they were able to get patches deployed on all 300,000 assets, that same salesperson who was working with them for VMDR was able to sell them Patch Management, right? That's, you know, one example of how we, you know, with.
Once we get that integrated approach and the customers are trying it helps us actually have our sales team go and do the value prop. With the macro, you know, there's gonna be some lumpiness in the short term, but I think as Joo Mi Kim said, we feel like with the integrated platform capabilities, we do see opportunities for us to get to that 20% with the 40% margin.
Sumedh, when you have conversations internally with Joo Mi Kim and your board, it sounds like every CEO is grappling with the question around growth versus profitability. On the one hand, we're gonna be in a slower growth environment, so you wanna show more leverage. On the other hand, you've got 40% EBITDA margins, you've got a good amount of cash on your balance sheet, and there are a lot of private competitors who are probably going to be finding a more difficult time in terms of fundraising. Do you see this as a time to double down on this massive market opportunity and maybe give up some of that margin, or do you see it as a time to maybe harvest?
Look, I think this year was a year of investment for us. We're satisfied with the growth in sales and marketing that we have had in terms of headcount and other spend. I think now as we enter next year and in this macro environment, what we are focusing on is optimizing that spend because, you know, this is something that with the new CRO, new team, we have gone and done different things.
Now how do we get into the next year and focusing on optimizing the spend by ensuring that all these new salespeople are properly trained, they have the enablement that is needed, that we are working with the partners that we have, you know, rolled out the new partner program to, and make sure that we see the value, we see that productivity coming from them, and then make further decisions on whether we want to, you know, at what point do we want to continue to do more. I think right now we're satisfied with the investment we have made, and I think next year, of course, we will continue to invest, but I think it'll be an optimization and not necessarily an acceleration of that investment. You know, we look forward to that 40% margin.
Okay. Sounds good. Maybe shifting the conversation to some of your newer growth initiatives. You talked about, EDR, XDR. Those are some big market opportunities. A lot of larger competitors in those spaces as well. How do you see your prospects there? Are you seeing any pipeline there at all? Do you think this is a market where, again, you'll have to kind of double down in terms of investment to really go after?
I think we've been spending last couple years on innovating, on creating capabilities through engineering. Some of the early adopter customers today who have used our EDR capability, XDR capability are giving us some positive feedback on that. Based on that feedback, we are making updates to the product. It's early days for us, but we see the opportunity because, you know, there are 40-plus EDR players out there in the market. Almost every asset that you deploy an EDR agent on, you also are doing vulnerability management and patch management, but you're doing that with different vendors. You end up with 3 different vendors, 1 for EDR, 1 for vulnerability management, 1 for patch management.
What we see is the opportunity to say the comprehensive risk reduction on that asset includes four things, making sure you have your inventory, know what is running on the asset, and reducing your end of life. Second is doing your Vulnerability Management and Configuration Management and patching that asset, so you reduce the risk of someone getting on your asset. If somebody does get on your asset, then use the same agent to monitor that asset for malware and then take responsive action. Today, the EDR players are only focused on after somebody gets on it, what are they gonna do? I think what we look at is how can we provide comprehensive capabilities to our customers so that they can do the risk mitigation and the threat detection with the same agent.
That is resonating, the idea is resonating well with the customers. As we roll out more capabilities through 2023, we look forward to starting to make a bigger impact in that market, as we work with our customers. Especially, you know, initially, the mid-market customers who have only one IT person or two IT people and maybe one security person, they don't have experts in Vulnerability Management or expert in Patch Management, expert in EDR. For them, single console, single agent, once they get it deployed, they can just click a button, and it can take care of all these different aspects of risk management, is appealing to them. We're looking forward to that opportunity next year.
Any questions from the audience? Everyone's quiet after lunch. Okay. Capital allocation. I think you have about $200 million or so in run rate free cash flow, and a good amount of cash on the balance sheet. How do you see, you know, opportunities in terms of build versus buy? I know you've done mostly tuck-in M&A in the past. Is that something that we should expect to see going forward?
Yeah, look, I think with the example I gave you of when we do a really good job of integrating those solutions, the opportunity for us to then sell and, you know, do a quick POV and be able to close that deal increase. We've always been driven by making sure that we are not just going out and buying 10 different solutions and selling them independently through different sales force and stuff like that. Whatever we do, we focus on making sure that we can bring that on top of our platform, integrate it extremely well, so that it's a one-click enablement for our customers, and that makes it more efficient for our sales team to sell those. We will continue to look at opportunities like we just recently did with Blue Hexagon as a way to bring ML/AI capabilities onto the platform.
We'll continue to look at tuck-in acquisitions or opportunities that can bring potential customers to us. It'll always be driven by ensuring that whatever technology we bring doesn't end up causing technology debt for us over a period of time that ends up us having to sell multiple different solutions, you know, with different sales force. I think we continue to stay open. We continue to look at those opportunities. You know, in this environment, as valuations are resetting in private company valuations as well, we see more and more conversations and more opportunities that can potentially come to us, and we always continue to stay open to that.
On the competitive angle, there's obviously two other public VMDR vendors in this market. It sounds like this VMDR platform has differentiated you versus competitors. Just within the core VMDR market, have you seen any changes in terms of pricing at all? Is it getting more competitive, less competitive, any?
Yeah. I mean, I think Qualys, we always maintain more premium pricing and because we bring more value to our customers. We are seeing the last couple quarters, more discounting, heavier discounting by competition because they are, you know, giving more the pure play. You know, I scan and give you a list of CVEs, it's harder for them to differentiate amongst each other. You know, while we see that discounting that they are doing, the good thing that we look at is, of course, we look at a case-by-case basis, but we are able to go in with the customer and say, "Look, you have the budget, right? We can give you Cybersecurity Asset Management. We can give you some additional Patch Management." That brings them more value rather than just essentially taking a discount.
That conversation, those conversations are helping because we have more of a platform approach. For the same asset, we are able to give customers more value by helping them, you know, fix their things quicker and faster. Yeah, we do see some of the pressure, but we are countering that more by looking at the value that we can bring with the unified platform.
On the budget point, are you still seeing, among the customers who have finalized their security budgets for next year, are those budgets still growing? Are there any instances where security budgets have been cut based on your conversations?
I think it's a little bit mixed. For the most part, the budgets are resilient to what they have spent this year. I think any extra spend is being scrutinized above and beyond renewals. Questions are being asked, and so that is causing the elongated cycles that we see, and people want to make sure. We haven't seen as many customers really come and say that, "Hey, my security budget has been cut." I think what we see more is caution.
They want to say, "Let me wait for next year's budget to be finalized so I get a better picture." We also see in other cases, customers just coming and saying, "Hey, can we do a multi-year deal now so we can lock in our spend, and we know exactly what we are going to spend the next 3 years, so there's no price increase, and we actually have a predictable spend on our cyber?" Overall, we haven't heard any customers really say that cyber has been deprioritized or there have been, you know, any major cuts from a cyber perspective.
Typically this time, Q4, you know, you see some sort of budget flush.
Yeah.
in enterprise software. Would you expect to see that budget flush this year?
again, it's been mixed, right? Different companies are looking differently.
Yeah.
It's, you know, we still will get somebody saying, "I need to use this." In other cases, they're saying, "I wanna conserve it." That's where it's been different and lumpy and quite different from what we saw last year where it was, you know, much more of a budget flush.
I'll go back if anybody has any questions. No? Okay. Channel. Joo Mi Kim I'll bring you into the conversation. I think, earlier this year you made some changes to how you go to market with the channel, and I think it required a change in the incentive structure to really drive net new customer adoption. Can you talk a little bit about that change? How do you expect that to flow through, you know, your margins, let's say, in the coming years?
Yeah. It was early. It's still early just because we launched it this year. What we found in having discussions with different channel partners is we really didn't have the basics in place. The feedback has been that it sounded like Qualys wasn't really willing to partner with them. I think that's shifted. We're hearing them out in terms of the deal registration protection, changing the incentive structure, if you will, in terms of the rev share. What we see right now, historically it's always been 60% direct and 40% indirect. That mix could easily shift to be more even in the coming years, but we don't see a dramatic change right now.
In the next year, I don't think that there's going to be any material change to margins, 'cause even if it were to change from 40% channel to 50% channel, because that 40% is already fully baked in and reflected in our margin, it's not going to be a material impact to our EBITDA margin at the end of the day.
Okay. Last question, Sumedh. You're coming up, I think, almost on your two-year anniversary as CEO of Qualys, and you've done a remarkable job, running the business, you know, in some unfortunate circumstances. When you think about your vision for Qualys over the next three to five years, what does that look like? I know it's a broad question, but.
No, I think that's a great question. You know, Qualys has always been driven by a vision, and, you know, Today, look, CISOs have been wanting to have a seat at the table for at the board, and they got it, and then they are speaking a language that the board doesn't understand. Because they're going in and saying, "I implemented MFA, I implemented vulnerability management," and, you know, the board is like, "Well, what does that mean? I gave you $2 million, like, what does that mean?" I think where the market is moving and where I see the opportunity is, at the end of the day, it's all about cyber risk. You have to quantify that risk.
You have to tie that risk to your business risk and be able to showcase that your risk was at this point, this is the investment you made in cyber, and this is where the risk is. The residual risk you have to take from your cyber insurance, and that's basically what it is.
Today, with MDR, with TruRisk, with what we have done and the ability for us to have a platform that's not just highlighting the issues but actually just continuously reducing your risk, the future opportunities really where I see is Qualys can really help customers get a holistic view of their risk and actually also mitigate that risk across on-prem, cloud, container environments and really tie that to the business outcome, which is basically be able to show, this is my investment, this was my risk, here's the risk that I've been able to brought down. I think, today at the end of the day, that's really what businesses are focused on, not the tools or architectures or whatever it is. The board just want to know.
You know, we are also doing some forward-looking partnerships with insurance, Cyber Insurance companies like Cowbell as an example, where, you know, I believe that if you're making an investment in a platform like Qualys for risk reduction, it should help you on your Cyber Insurance premium as well. What we have done with Cowbell as an example is that with the integration with TruRisk into their platform, if the customer has a good risk score in Qualys, they automatically get a rebate on their Cyber Insurance the following month. This is really where it needs to go.
My vision for the future is cyber risk needs to be quantified. Then we need to bring it down to a dollar value that you spend on it from the tools. Then the rest you do on Cyber Insurance. They need to work together so customers can overall bring down the cost of what they're spending in cyber to bring down the risk.
All right. Sumedh, Joo Mi Kim, thank you so much, and thank you everyone for joining us.
Okay. Thank you very much, Hamza.