Please be advised that today's conference is being recorded. I would like now to turn the conference over to Blair King, Investor Relations. Please go ahead.
Thanks, Michelle, and good afternoon and welcome to Qualys' third quarter 2026 earnings call. Joining me today to discuss our results are Sumedh Thakar, the President and CEO, and Joo Mi Kim, our CFO. Before we get started, I would like to remind you that our remarks today will include forward-looking statements that generally relate to product capabilities, future events, or future financial or operating performance. Actual results may differ materially from these statements. Factors that could cause results to differ materially are set forth in today's press release and our filings with the SEC, including our latest Form 10-Q and 10-K. Any forward-looking statements that we make on this call are based on assumptions as of today, and we undertake no obligation to update these statements as a result of new information or future events.
During this call, we will present both GAAP and non-GAAP financial measures. A reconciliation of GAAP to non-GAAP measures is included in today's earnings press release. As a reminder, the press release, prepared remarks, and investor presentation are all available on the Investor Relations section of our website. With that, I'd like to now turn the call over to Sumedh.
Thank you, Blair, and welcome to our third quarter earnings call. AI has fundamentally transformed the adversary's playbook, graduating from accelerating existing attack techniques to autonomously operating inside live production environments. To put the scale of this shift in perspective, Microsoft's recent Patch Tuesday disclosed 1,414 new vulnerabilities in a single release compared to 93 before the advent of Frontier AI. That's a 15-fold increase in exposure volume within the last seven months alone that every enterprise must now absorb in real time. Within 10 minutes of Microsoft publishing this advisory, Agent Insta, powered by InstaScan, posted scanless detections in a customer's environment, giving them immediate view of their exposure. No scan cycle, no agent disruption, no days-long wait. The detection at AI speed. But detection alone changes nothing if what follows still takes weeks, still relies on manual handoffs, and still can't prove the exposure is closed.
Events like the PHP2Shell disclosure and others are just a warning of what lies ahead, and the need for speed from disclosure to remediation is clear. Durable pre-breach risk management requires a vendor-neutral agentic AI risk fabric that can autonomously transform detections into proven remediation of actual exploitable risk at the speed of modern attacks. Against this backdrop, we delivered another strong quarter of revenue growth and profitability alongside one of our most meaningful quarters of platform innovation to date. The execution reflects a clear shift in how customers evaluate and select their security platforms. The traditional C10 model wasn't built for this moment, and it shows. More findings, more theoretical risk scores, more dashboards, and more handoffs, each one a gift of time to an adversary that now operates at machine speed.
When customers can't patch fast enough to outrun autonomous exploitation, the last thing they need is another tool that tells them what's wrong and passes the problem to someone else to fix. CISOs are looking to update their boards with their plan of action against autonomous exploitation with a roadmap of autonomous remediation instead of more manual tools and processes. That architecture was already losing before the Frontier AI era. Today, against an AI-powered adversary, it's indefensible. We developed the vision and built the AI-native ROC powered by our ETM solution over three years ago to end that cycle entirely. Today, Agent Insta, powered by InstaScan, is detecting newly exposed vulnerabilities at customer systems in less than 60 minutes of disclosure on an average.
Agent Val, powered by TruConfirm, has already performed approximately nine million exploit validation across customer environments, and still 11% of those confirmed exploitable, eliminating 89% of that noise would have been otherwise consuming security and IT resources. TruRisk Eliminate with Agent Sara has helped customers deploy over 180 million patches in the last 12 months alone, with 60% of those running autonomously, doubling from 30% a year ago, at a rollback rate of fewer than one in 8,000. Together, they operate natively in a continuous closed loop that proves autonomous closure within hours, not weeks. The AI-native ROC isn't a roadmap. It's not a vision slide. It's operational, measurable, and provable, and that's nearly all enterprise and federal customer conversations are centered. Carrying this momentum forward, we are further evolving our ETM and TruRisk Eliminate capabilities through an expanded ecosystem of remediation solutions.
Over the last two quarters, we introduced our AI-powered Patch Reliability Score, Agent Sara's wave-based remediation, peer-to-peer patching, and AI-guided rollbacks. The cumulative effect of our TruRisk Eliminate agenda gives organizations confidence to deploy in production environment with rollback rates below 1/10 of 1% across well over half a billion patches delivered to date, including more than 200 million executed autonomously. That customer confidence is translating into accelerating adoption with patch deployments up 47% from the advent of Frontier models in early April of this year, and autonomous deployments growing even faster. The biggest blocker to faster patching is lack of confidence in operational outcome. At our recent ROCon conference in Austin, we built on this foundation by announcing what we call Autonomous RemOps, brought to life through TruRisk Eliminate 2.0 with TruConfidence.
TruConfidence is a remediation orchestration intelligence engine delivered on a straightforward operating principle: fix the minimum, credit existing controls, choose the right remediation path, control the rollout, and prove that it held. Three new capabilities represent meaningful new ground for Qualys. First, before a corrective action is raised, TruConfidence assesses the protection already provided by third-party security controls, so customers don't duplicate their efforts. Second, it extends coverage beyond endpoints to cloud applications, perimeter, and edge assets, including routers, switches, firewalls, and air-gapped infrastructure that historically sat outside response workflows because they cannot run an agent. Third, built on the rollback capabilities we introduced last year, post-deployment operational resiliency monitoring through partners like Dynatrace, Splunk, System Health to confirm that environment remains stable post-patch. When a patch doesn't hold, AI-powered patch failure analysis explains the root cause in plain English and recommends corrective action.
The result is an AI-native ROC that serves as both the system of record and the system of action for cyber risk reduction. Other vendors entering the mitigation conversation are orchestrating a handoff or agent-based endpoints and passing a patching recommendation to a third-party tool without giving the operational confidence and no verification that the fix was successful, be applied, or that the environment remains stable afterwards. The Qualys platform was purpose-built to eliminate that handoff entirely and delivers natively integrated Autonomous RemOps with TruConfidence at scale, rapidly proving closure across every domain and asset type. With Qualys, no asset, whether it runs an agent or not, and no exposure, whether a patch exists or not, will be left without an immediate path to closure. Our continuous innovation and industry-leading capabilities are now garnering significant recognition from customers, partners, and independent analysts.
In the 2026 Forrester Wave for proactive security platforms, Qualys received the highest rating among all evaluated vendors on the key criteria, including network visibility, exposure, business-driven prioritization, and remediation. Additionally, KuppingerCole named Qualys the highest-rated leader in the 2026 Leadership Compass for Attack Surface Management, earning the top position in both product and market leadership. Both underscore our customer-driven engineering and growing competitive differentiation across the platform. Moving to our business update, the number of customers spending $500,000 or more with us grew 15% from a year ago to 243. Let me now share a couple of recent wins which illustrate why organizations are turning to Qualys to help unify their security stacks, operationalizing the ROC, and put autonomous remediation to work. First, we closed a new low seven-figure annual booking deal with a large government agency.
This agency had been running on an on-prem vulnerability management program for years, scanning with one vendor, manually triaging across disconnected dashboards, and handing patch cycles off to yet another vendor. Seeking to streamline operations, the agency ran a highly competitive process and selected Qualys to help activate its ROC on a single FedRAMP High authorized platform. In doing so, it landed with seven Qualys modules right out of the gate, including ETM Identity, VMDR, TruRisk Eliminate, Policy Audit, TotalCloud, and TotalAppSec.
The net result is that this agency has now consolidated a fragmented multi-vendor workflow into a unified AI-powered risk fabric, a fabric that detects exposure within minutes of disclosure, validates actual exploitability so teams can act on real risk rather than theoretical scores, and automates response by natively applying patches and other compensating controls when patches are too risky to deploy or unavailable. What used to take weeks from detection to confirm fix now takes hours, and a patch backlog that has been compounding security debt for years is now under control. Given the success of this deployment, the customer is now actively evaluating TotalAI and planning to deploy agentic AI workflows across its operations. The second was an existing large federal agency which has struggled to manage its cloud and infrastructure security using siloed tools while manually consolidating findings with no unified view of risk.
Prioritization relied on CVSS security scores rather than validated exploitability, and their security and IT teams are making critical decisions on incomplete data. Threat response had historically followed a pattern here too often. Security operations identified a vulnerability, opened a ticket, and handed it to an IT team running a third-party patching tool, a cycle that averaged weeks from identifying threats to assumed fix. With the advent of the CISA BOD 26-04, which requires agencies to operationalize risk-based remediation and address AI-accelerated threats that compress expert timelines to hours, that cycle was no longer sustainable. Our own Qualys Threat Research Unit's five-year analysis of more than 1.5 billion critical vulnerability instances shows that Qualys customers had already remediated approximately 173 million exposures before they were entered in CISA's KEV catalog, which is exactly the kind of proactive posture this directive now demands.
In response, this customer evaluated several solutions and chose Qualys to operationalize its ROC automation. Where competing solutions aggregated data and continued to generate theoretical risk insights, Qualys was the only platform in their evaluation that could detect at AI speed across hybrid environments, hyper-prioritize millions of findings to the exposure that genuinely required immediate action, and autonomously fix them. That translated into bringing third-party sources into the platform while consolidating several siloed tools in a seven-figure annual bookings upsell. Adding ETM and TruRisk Eliminate while expanding the existing Qualys footprint. This customer is now aligning with the agency's risk tolerance across nine separate bureaus, unifying detection with Agent Insta, exploitability-based prioritization with Agent Val, and recognizing the operational efficiencies and speed of automation, wave-based zero-day remediation with Agent Sara.
These wins, alongside several other six and seven-figure federal and state wins in Q3, underscore the growing demand we see in our federal, state, and local government business, driven in part by agencies moving to meet these new operational requirements. They also reflect a consistent pattern we see across the business as more and more customers move from evaluating the AI-native ROC to operationalizing. Complementing this momentum, QFlex is emerging as an effective lever for platform adoption and ETM expansion. In the first full quarter following GA, QFlex customers increasing their average annual bookings by over 20% compared to their prior year annual bookings, while many added new modules to their subscription. Both wins I had just described with direct examples of QFlex in action.
The new federal agency customer consolidated into a QFlex commitment spanning all seven modules from day one, while the existing agency added ETM and TruRisk Eliminate while expanding deployments at a footprint that already included seven Qualys modules. In both cases, QFlex gave them the flexibility to commit more extensively across the platform while preserving the ability to shift investment as their risk priorities evolve. That is the commercial pattern QFlex was designed to create. Customers commit at a higher level because the model removes the friction of predicting exactly what modules they might need 12 months from now, which in turn drives higher utilization across the platform and positions us for larger upsells over them. Turning to strategic alliances, I am pleased to announce that we recently delivered several new technology integrations spanning mobile and identity, IoT, and OT systems.
As more organizations adopt the AI-native ROC as their autonomous risk fabric for pre-breach risk management, the value of that fabric grows with every new source of risk intelligence it can ingest, normalize, prioritize, and act on. These partnerships strengthen our multi-vendor architecture, extend the ROC's advanced coverage, and serve as a key differentiator for Qualys. In summary, over three years ago, we set out to transform Qualys from a company steeped in vulnerability management, detection, and response to a holistic, vendor-neutral, pre-breach risk management platform defined by measurable, proactive, and automated risk reduction at scale.
This quarter, with the AI-native ROC operational and gaining customer momentum, TruRisk Eliminate with TruConfidence, extending our reach to every type of asset, a growing federal customer business, strong product roadmap, and early QFlex adoption broadening now customers' commitment to the platform, we are seeing the clearest evidence yet that organizations are choosing Qualys because we do not stop at just telling them what is wrong. We prove it is fixed. That is now driving larger commitments, deeper adoption, and stronger competitive differentiation while reinforcing our confidence in durable long-term growth. With that, I will turn the call over to Joo Mi to further discuss our third quarter results and outlook for fourth quarter and full year 2026.
Thanks, Sumedh, and good afternoon. Before I start, I would like to note that except for revenues, all financial figures are non-GAAP, and growth rates are based on comparisons to the prior year period unless stated otherwise. Turning to third quarter results, revenues grew 11% to $188 million. As a result of our strategic emphasis on leveraging our partner ecosystem to drive growth, the channel continued to increase its contribution, making up 55% of total revenues compared to 50% a year ago. Revenues from channel partners grew 24%, offsetting a 2% decline in direct. By geo, 50% growth outside the U.S. was ahead of our domestic business, which grew 7%. U.S. and international revenue mix was 54% and 46% respectively. In Q3, our overall net dollar expansion rate remained unchanged from last quarter's 105%.
The net dollar expansion rate of customers with prior year purchase of ETM or CSAM subscriptions improved to 108%, up from 107% last quarter. Moving on to product mix, ETM and CSAM combined made up 12% of total bookings and 14% of new bookings on an LTM basis in Q3, up from last year's 10% and 11% respectively. Next, Patch Management made up 9% of total bookings and 18% of new bookings on an LTM basis in Q3. This compares to 8% and 16% respectively in Q3 of last year. Lastly, TotalCloud made up 5% of total LTM bookings in Q3, unchanged from a year. ETM and CSAM combined with Patch Management are driving a meaningful shift in our bookings composition towards higher value solutions. We expect that trajectory to continue as customers deepen their engagement with the platform.
TotalCloud remains an important growth lever for the business, and we are focused on improving adoption within our customer base. Reflecting our scalable and sustainable business model, Adjusted EBITDA for the third quarter of 2026 was $89.9 million, representing a 48% margin compared to 49% last year. Operating expenses in Q3 increased by 11% to $72.2 million, driven by investments in sales and marketing, which grew 17%. With this strong performance, EPS for the third quarter of 2026 was $2.12 per diluted share, and the free cash flow was $100 million, representing a 53.2% margin compared to 52.7% in the third quarter of last year. In Q3, we continued to invest the cash we generated from operations back into Qualys, including $1.8 million in capital expenditures and $53.6 million to repurchase 330,000 of our outstanding shares.
As of the end of the quarter, we had $176.1 million remaining in our share repurchase program. With that, let us turn to guidance, starting with revenue. For the full year 2026, we now expect revenues to be in the range of $736.9 million-$738.9 million, which represents a growth rate of 10%. This compares to prior guidance of $732 million-$738 million. For the fourth quarter of 2026, we expect revenues to be in the range of $191 million-$193 million, representing a growth rate of 9%-10%. Shifting to profitability guidance, for the full year 2026, we expect 46% EBITDA margin, a low double-digit increase in operating expenses, and free cash flow margin in the low 40s. We expect full-year EPS to be in the range of $8.07-$8.14, up from the prior range of $7.74-$7.88.
For the fourth quarter of 2026, we expect EPS to be in the range of $2.05-$2.12. Our planned capital expenditures in 2026 are expected to be in the range of $9.5 million-$11.5 million, and for the fourth quarter of 2026, in the range of $2.3 million-$4.3 million. With that, Sumedh and I would be happy to answer any of your questions.
Thank you. As a reminder, to ask a question, please press star one one on your telephone and wait for your name to be announced. To withdraw your question, please press star one one again. Our first question will come from Jonathan Ho with William Blair. Your line is now open.
Hi. Good afternoon, and congratulations on another set of strong results. Sumedh, I wanted to start with your comments around getting customers past some of their concerns around automated Patch Management and shifting that mindset away from the human in the loop towards full remediation. Can you talk a little bit about how that pathway works and ultimately what that can mean from a revenue or net retention standpoint?
Yeah, that's a great question, and I think nothing reflects better the mood in terms of what people are looking for than the CISA BOD 26-04 that essentially requires within 72-hour remediation of critical vulnerabilities. If you look at vulnerability management, the three core components really are how quickly, if you can detect it, then you have to prioritize the ones that need to be fixed, and then you have to actually get it fixed. If you're talking about three days to do that, and your existing approach on scanning is taking anywhere from two to five days to just get the information first, then you are applying manual prioritization on top of that. Then if the remediation is taking you weeks to get that within IT tickets or it's always an emergency, people are struggling with that.
What we are hearing in terms of conversations with our customers is really at the end of the day, to achieve that 72-hour or 24-hour remediation cycle that people are looking for, everybody has to look at some sort of a roadmap that takes you into fast detection, which we're doing with InstaScan, less than 60 minutes, quick prioritization with Agent Val, where you're able to reduce significantly the number of things that need to be fixed because we are testing existing controls and saying we don't need to fix it. Then the last piece, which is, as I mentioned in the earnings call, the only reason people don't patch everything is because they don't have enough confidence that it will not cause an outage.
So, with the advent or with the release of our Eliminate 2.0 with TruConfidence, what we have done is focus on remediation intelligence to be able to provide customers with AI-powered reliability scores, additional comfort in knowing that certain things, when they are deployed, we can actually tell them if the patch is going to be safe or not, and monitoring with somebody like Dynatrace that if there are any issues. So, the more we are providing in terms of having them see the value of that they can actually do this in an automated way with the confidence, with something like TruConfidence and the intelligence built in, that's really the only meaningful direction you can go now.
People are looking to say, "How do I go back to my board and give them that roadmap on how we are going to go from 0% automation and remediation when we are fighting AI-based autonomous exploits? How do we put ourselves on a roadmap that over the next couple of years, we can actually get to the point where more and more automation can happen in a much quicker period of time?" If you look at the way we have aligned ETM and Eliminate, that's sort of how it is, where ETM is helping you either pull data from VMDR or from other third-party scanning solutions and very quickly figure out which of those exposures are exploitable.
Additionally, if you want to look at getting it remediated as well, then ETM, or rather, TruRisk Eliminate 2.0 with TruConfidence is the additional thing that they can purchase to get to that point. That's really how we're seeing customer conversations as they're looking to say, "How do I go back to provide confidence back to my organization that we can actually meet these requirements that are coming up more and more, where you have to remediate within three days or 24 hours, given how many vulnerabilities and exploit paths we're seeing coming out of these AI models that are being used by attackers?
That's very helpful. Just in terms of the pipeline, Joo Mi, can you maybe help us understand sort of the sustainability of Qualys' booking strength? I think the CCB number was a little bit down from last quarter, but still very healthy here in the mid-teens. How should we be thinking about sort of the shape of the pipeline and maybe the sustainability of that over time? Thank you.
Yeah. If you take a look at our bookings trajectory, what we see in the business today is really a healthy 8% is approximately what we are expecting for Q4 calculated current billings. That stems from the fact that if you take a look at our beat in Q3, it was a really strong quarter. Another double-digit current billings quarter at 14%, albeit, like you mentioned, slightly down from 16% last quarter. Part of it was due to, we had a really strong federal quarter. I think that the examples that we gave in the script kind of demonstrate our strength. We executed well, and this is something that we hope to continue. But with that said, it can be lumpy.
We do have some in the pipeline for Q4, but right now, from non-federal business perspective, we kind of expect the 8% as a base case for calculated current billings, ending the full year calculated current billings growth at 11%.
Thank you.
Thank you. Our next question will come from Roger Boyd with UBS. Your line is open.
Great. Thanks for the questions, and congrats on the results. I wanted to double-click on Jonathan's question, Sumedh. We all hear from CISOs that operational confidence is the biggest barrier to automated patching. I guess, how is that product suite resonating with non-security buyers within enterprises, and is that at all changing your selling motion around the product? Are you bringing those non-security buyers into the sales process, and is that at all giving you access to additional budget? Thanks.
Yeah, very good question. I think what we are seeing right now is, and when we started with Patch Management a few years ago, sort of the first ones in the industry come, we learned a lot from that, and there has always has been a bit of that pushback from those IT teams because they might be using existing scanning solution, et cetera. But we did pretty well over the years convincing those buyers the value of Qualys and our ability from a cybersecurity Patch Management perspective. What we are seeing now post the Frontier AI model era, we are seeing that IT teams and security teams are actually coming together. We have been on calls where we have more conversations with the CIO teams as well now because they are all looking for some way for solutions that are focused on cybersecurity risk management.
Now with TruConfidence, we do get into conversations with our IT teams to say, "Well, how are we giving higher confidence that we can separate patches that can be low impact but high value? How do we help them understand which ones will not cause an outage? How do we help you mitigate and sort of patching?" That level of intelligence and information is definitely giving higher confidence to the IT teams. So what we do see is CIOs, CISOs are in certain conversations coming to the table. In some cases, right off the bat, they are going into autonomous remediation for 20%, 30% of their estate.
In some cases, they are saying, "Let's start consuming your intelligence first so that our IT teams can still fix things faster by leveraging the intelligence you are providing." Over time, we will move into a model where maybe we start by taking 15%, 20%, 30% of the stuff we can automate as we build the confidence. But like I said, the whole point of releasing that TruConfidence was it was very clear that the biggest blocker to patching is the lack of confidence it will not cause an outage. If we can provide AI-powered intelligence to make that decision much smarter and quicker, then we are going to see more and more adoption of this going forward.
Conversations are very much driven by our ability to remediate, and that's the starting point for many conversations is, "How can you help me remediate so I can go back to the board and give them a story about how we are going to do autonomous remediation against AI-based autonomous exploitation?" That leads into conversations around ETM, how ETM can further reduce what you are remediating. By using ETM and Eliminate together, you're reducing your operational risk while at the time increasing the speed at which you're able to actually get the things that are important fixed quickly. We're pretty excited about the conversations that we're having right now.
Like I said, things like CISA order in trying to ask people to remediate things in three days is definitely a driving force to say, "What's an architecture that does not have siloed solutions that can really focus on getting that 1% fixed really quickly so I can meet these guidelines?
Got you. Joo Mi, nice to see the strength in federal wins. We've been hearing you talk about the opportunity there for a couple of quarters. Nice to see that manifest. Can you just talk about the relative strength relative to what you typically see in that vertical? It sounded like that was an area of outperformance. Any commentary on how the rest of the commercial business kind of trended relative to your expectations? Thanks.
Yeah, I think that primarily the beat was driven by the federal business. We haven't seen this type of outperformance when it comes to this vertical. We have been focused on making sure that we're building this pipe all throughout the year, and we were very pleased to see that the deals that we were working on actually ended up closing in Q3. That's really reflected in the current billing. If you take a look at our net dollar expansion rate, staying the course at 105%, that hasn't ticked up. I think it kind of indicates that rest of the growth really came from the new logo acquisition, which was primarily federal.
Got it. Thank you.
Thank you. Our next question is going to come from Rudy Kessinger with D.A. Davidson. Your line's open.
Hey, guys. Great. Thanks for taking my questions, and congrats on the strong quarter. Look, I think the question on a lot of investors' minds is, really strong current calculated billings growth the last two quarters, 16%, 14%, your guidance only 8% for Q4. I guess, should we take the mid-teens growth the last two quarters to be an indication that we might see an acceleration in revenue growth at some point near term? Or should we look more towards that currently 12-month figure that has improved a little bit, but been relatively more stable? I think that is just what everybody is asking here is, should we expect acceleration in revenue growth near term or not?
I think it is more the latter. Based on what we were able to deliver, we saw the up to Q2 had to do with post-Mythos. A lot of the discussion that we were having with a small cohort of customers that we have in place. In Q3, the primary, the beat was from the federal, albeit it would love that to continue, or we will continue to work on that, but it could be lumpy. From our perspective, the base case remains, of course, where we do not see a significant change in the net dollar expansion, which is our key KPI. So that 105% is healthy. It stayed the same from Q2. Right now, we do not see that materially changing.
We are hoping that we continue to outperform in the new logo acquisition, but this is based on the pipeline that we see for Q4 and kind of seeing the course in terms of no material change in the sales cycle, the close rate. What we see right now is ending the year strong with current billings, closing the year at 11% for the full year, and then the revenue closing the year at 10%.
Okay. Super helpful. Secondly, could you talk about the competitive environment, Sumedh, and just who you are seeing there and how things have maybe changed versus a couple quarters ago or maybe even a year ago? Are you seeing more of the larger platforms in there that post-Mythos have really amped up how much they are talking about patching and vulnerability scanning, things of that nature?
We have been talking about vulnerability management evolving for a few years now before this whole thing came about, and that is why we started really focusing on Patch Management and remediation capabilities. Today, we present a very compelling case for somebody who wants to actually do remediation in their production environment with the half a billion patches deployed so far with extremely low rollback rates. We have established ourselves as not just a vendor that is detecting tons and tons of new vulnerabilities, which as you saw with the Patch Tuesday, you are just going to get more and more findings. What we are seeing is the vulnerability management is evolving where it is about not just about finding and detecting CVEs because it is just unmanageable at this point, the number of CVEs being detected.
It is really about being able to do validation of those exploits like a hacker would, and then actually running into remediation and doing remediation with high confidence at a much faster speed. That is where, for us, even if a customer has some other detection capability for CVEs with ETM, what we are seeing is those customers, when they come and build a ROC and they work with Qualys, they are pulling either using Qualys for fast detection or they are pulling data from maybe some other solution they might have and leveraging the Qualys ETM license to then figure out if that thing is exploitable, and then the Eliminate license to then go and run remediation so that they can actually get rid of that particular exposure in the three days, as [uncertain] has said.
I think for us, we see that continuing, less conversations about how many CVEs are you detecting, more about are you able to detect them faster than competing solutions, which are taking two to three days for scanning. Then the last piece is, ultimately, how can I build an automated workflow? The issue is that if you have a separate scanning solution, a separate prioritization capability, and a separate remediation capability, that makes it a lot harder to really get to that three-day remediation or 24-hour remediation that people are looking for. The conversations are less about, can somebody detect more CVEs? Really, our conversations we're seeing are more about, how do you help me build a story that I can take back to the board that shows a roadmap for autonomous remediation as a response to autonomous exploitation?
Thank you. Our next question will come from Brian Essex with JPMorgan. Your line's open.
Hi, good afternoon. Thank you for taking the question. I echo my congrats on a second quarter of pretty healthy billings growth. I guess, Sumedh, a couple things stand out more from a trend perspective that I wanted to ask you about. One is the really nice growth in international business, sustainably in the mid-teens, particularly when you compare it to domestic, which kind of had a tailwind effect, as you noted, this quarter. Then also the partner contributions also seem to be ramping nicely. Is there a correlation between those two, and how do we think about each of those in terms of your ability to win new logos outside of the Fed business, which I noted you had a strong new logo traction with this quarter? Thank you.
Yeah, that's a great question, and we have been doubling down on working with our partners over the last few years, and so we're pretty happy with the way that contribution from partners has increased over time while maintaining our margins as well. We do continue to see that as a way that we are going to see long-term impact. I think what we are also, our non-U.S. business always tends to be more partner-driven, of course. But in general, I think what we are seeing is that right now, and typically we don't see that knee-jerk reaction from our customers who are larger customers, enterprise customers.
Everybody's going through a cycle right now of. This is a fundamental shift in the way vulnerability management has been done in the past, and to be able to do the exploit validation that's now specifically required, and this is CISA BOD 26-04 as an example, or to do autonomous remediation, structurally, they have to figure out within their organizations how they can bring IT teams along, what kind of changes they need to make in terms of the team, the structure, the processes, et cetera. A lot of the conversations that people are engaged in right now with us are about how do we continue over the next few quarters and next few years on changing out how vulnerability management is done. Our partners are a key part of that.
They are turning to the trusted partners to say, "Help me go back with a plan for autonomous remediation," and we are continuing to work with those partners. For us, we do see that the more and more we work with our partners, and you see the mROC partners program as well, our partners will be working with these customers to help them plan out their autonomous remediation capabilities, and Qualys obviously is going to be a key part of that. We do see this more as a continued long-term area of investment, and we're excited about building out these capabilities with our partners.
Got it. Is there anything to infer about the profile of the international customers and what might make them a little bit more, I guess, ripe for better growth than domestically? Or how do we think about what you're seeing in one geo versus the United States?
Nothing really to call out that's different from what we have seen in the past.
Got it. Thank you very much. I appreciate it.
Thank you. Our next question will come from Joseph Gallo with Jefferies. Your line's open.
Hi, this is Grant Darling on for Joe Gallo. Thanks for taking the questions. I wanted to start, the billings beat was really strong. Revenue beat a little bit narrower than usual. Just to start, anything to call out with large deals or linearity, and maybe how we should think about that going forward?
Yeah, current billings seems to be not exactly a great proxy when you're looking at how to recognize revenue ratably. To call out the Q3 revenue, the linearity was worse than what we typically see in the quarter. So that did impact it. Revenue came in slightly lower at 10.7% versus the 8% growth rate in Q2.
Got it. Then maybe just to unpack the expectations around that 8% billings in 4Q. Just as we're hearing about PHP, pipeline opportunity patching, is there something from a renewal base size or anything in 4Q that's maybe making you more optimistic on the 2027 trajectory versus 4Q?
I would say, like I said in what I mentioned earlier, we do see customers engage when these kind of things happen. But even in the past when Log4j and stuff came, we don't see that knee-jerk reaction immediately, and that's like immediate in the quarter. Of course, those cohort of customers that are up for renewal that already are having conversations about ETM and Eliminate that quarter, those conversations can be more fruitful at times.
But overall, when you look at the customer base and the opportunity that we have, we see this as a continued conversation with these customers who are very engaged with us to figure out what's the right way for them to make the changes internally within their teams, their processes, to be able to roll out and give their management a confidence in a new way of doing vulnerability management that is truly AI-driven and is able to do autonomous remediation with the confidence of not having operational outages. So, those conversations are going to continue. We're seeing good pipeline of conversations happening there, and we're excited to see how and when these conversations will end up closing once these guys are able to go back and make the changes and put the proposals in front of their management. That's going to take some time.
I think right now, we're focusing on those conversations rather than some sort of a knee-jerk reaction immediately happening this quarter.
Great. Thank you.
Thank you. The next question will come from Mike Cikos with Needham. Your line's open.
Hey, great. Thanks for taking the questions here, guys. I just wanted to come back to the QFlex customers that were adopting. The average annual bookings increase of over 20% versus prior year was an impressive stat. I know it's early here, but was that 20%+ similar to what you guys had seen in the prior quarter, or is the prior quarter just too small to even start comparing and contrasting? I'd just love to get a sense of how that 20%+ tracked versus precedent as well as how we're looking here in Q4. Thank you.
Yeah, it was really too small. So, we just went on GA with QFlex last quarter. So, what we wanted to do was just give you an indication and an anecdotal example of us, even though it was a small cohort of customers that started with QFlex last year, just to give you a sense of what we're kind of expecting going forward. This is in line with our expectation, as in if you purchase QFlex, what it'll enable our customers to do is try out other products, which makes it much easier when it comes to the annual renewal. When they come, they'll be able to convince themselves or better justify the increase in spend with Qualys. So, it was a great kind of a testament or a validation of the whole point of QFlex, why it could be a win-win for both parties.
Terrific. I will keep it to one. Thank you so much.
Thank you. Our next question will come from Meta Marshall with Morgan Stanley. Your line is open.
Great. Thanks. As you have expanded the budget or the audience of budgets and interested buyers, and that brings much more of a resiliency audience, has that changed kind of what partner channel you think will be the most successful or the ones that you are making investments in?
I am not sure I understood the question. It was hard to hear you, sorry.
Sorry. As you were kind of focused on more, getting more CIOs and resiliency budgets involved, is that changing kind of the overall, like what channel partners you think are going to be more successful, the ones that you're looking more to find?
Yeah, that's a good question. I mean, I think we are seeing more conversations that are with our managed service partners, our mROC partners, because the CISOs are looking at less about, "How can I more efficiently buy this particular tool?" and more about guidance on how they can have a risk-based conversation with their boards and management. So, when those kind of conversations come up, we tend to see our large MSSP partners, our mROC partners that are authorized mROC partners, are the ones that work with us closely because they're able to go in and have conversations more around business risk rather than just because the number of CVEs and patches, they went up 15 times doesn't mean that your budget's going to go up 15 times, right?
So how are you going to work with that particular customer to be able to work with them and put a plan in place that allows them to find the right investment, optimize across the platform, and have a risk-based conversation with the board? So, I don't know that it's really changing the partner conversation, but it does end up becoming more strategic when it's the conversations with the MSSP partners and the mROC partners.
Great. Thanks. That's helpful.
Thank you. Our next question will come from Joshua Tilton with Wolfe Research. Your line's open.
Hey, guys. Thanks for taking my questions. Can you hear me?
Yeah.
Awesome. I just have two kind of clarification questions. My first one is, I think a lot of us on the call are seeing two really solid quarters of current billings growth. There are a million different things I would call it in the cyber narrative that we can all want to and try to and hope to point that those two quarters of billing growth are coming from, whether it is Mythos or AI or whatever other awesome narrative that you want to point to today. But it sounds like on the call you are trying to tell us that these two quarters kind of seem to be pretty unrelated.
Last quarter, the outperformance was driven by just some outsized Mythos spending, and this quarter it seems to be driven by a good Fed vertical quarter. I am trying to just understand, is that how we are supposed to interpret it? If that is the case, I guess, how do you view your 8% base case for Q4 versus the last two quarters? You kind of also pointed that to us to that same base case and then now outperformed. Are there just less opportunities for outperformance in Q4 versus the last two quarters because we do not have the Fed quarter closing and that Mythos spending is behind us? Does that make sense?
Yes. The reason why we called out the primary drivers of the outperformance or the beat that we hadn't necessarily expected was so that you understand how our business is performing. I would say right now the base case is 8%, not to say that these outperformance will not continue going forward. It could be due to different reasons, but for example, Q4, what we see in the pipeline is 8% based on the historical close rate, historical sales cycles, but it could very well be the case that we have another strong federal quarter, which could explain the beat. There is a scenario where you have the base case of 8%, there's room for outperformance, but with that said, we're not assuming that as a base case today.
What we talked about post-Mythos is at that point in time, we had a small cohort of customers that we were talking to already about upgrading to ETM and purchasing Patch Management, Eliminate at that point in time, and then they ended up executing. Since then, of course, we have other customers that we have continued to have discussions around, and those set of customers could easily close in Q4 as well. The reason why we called it out is so that you understand kind of what we expected, and then the potential upside was greater in 2026, and I think it will be greater in Q4, based on the conversations that we have and the size of deals that we're seeing today.
Okay, super helpful. Then maybe just one other point of clarification is, you did say that that linearity was a little worse this quarter, which is what drove the lighter revenue beat. I think those mechanics totally make sense. Can you just help us understand, at least from your perspective, why was linearity worse? Is there a reason as to why linearity came in below expectation?
Yeah, it really has to do with the timing of the closing of the deal. For example, Q3 was a strong new logo acquisition quarter, and it ended at the near the end of the quarter, so it impacted the revenue recognition. It really depends on the percentage of the deals coming from new as well as upsell versus the renewal, and the timing of that close and how much we're able to recognize in the quarter that could have a couple hundred thousand impact on the revenue.
Okay. Super helpful. Thanks, guys.
Thank you. Our next question will come from Shrenik Kothari with Baird. Your line's open.
Hey, guys. This is Zach Schneider on for Shrenik. Thanks for taking our question. Maybe to follow up to that last one, actually, previously you talked about how the change you were seeing with customers was starting with a larger deployment and not materially shorter sales cycles. Curious to hear in Q3 if that remained the pattern, or if you are now seeing evaluations convert faster or purchases happen outside normal renewal windows. Thank you.
Yeah. From a business that kind of closed sales cycle perspective, we do not really see a material change or an improvement. That is part of the reason why our base case, in terms of what we are expecting for the growth rate, remains the same. From a sales productivity perspective, win rate, from all those traditional metrics perspective, it remains the course, as in we do not see significant changes one way or the other. What we are seeing is some of the larger deals that we do not necessarily are able to predict exactly when the deals will close, are closing at different period of time. So, for example, in Q3, it was a really strong quarter. We had not anticipated all these deals in the federal space to close in Q3.
Some of them could have easily slipped into Q4, especially because it is their new logo acquisitions, but they ended up closing in Q3, which was great for us.
Got it. That is great. Then maybe among customers that renewed the core subscription while continuing to evaluate ETM or TruRisk Eliminate, are the incremental purchases, or some of those at least now closing, and are they landing at the scope that you guys originally expected?
Yeah, I think the conversations continue to be strong. I think we are excited about what we are hearing from them around Eliminate and deploying that. Like we talked a few times earlier, it just really depends on a little bit how internally their organizations are able to move to make it happen quicker or maybe taking a little bit more time because they would have to sometimes bring along their dev team, sometimes they have to bring along their IT team. So that, when it comes to the Eliminate capabilities, et cetera, that becomes a little bit of a thing where it might take a little bit longer at times, it might move a little bit quicker.
Some of that, it really impacts on, yes, do they have the runway now to make it part of the renewal itself, or they want to add a little bit, but then they want to add more once they get the broader teams onboarded? That timing sometimes can be really figured out by their IT team. I mean, one of the federal examples we gave was a new logo for us, but they did not have Qualys, and they deployed Qualys within less than six weeks. They already had tens of thousands of agents deployed with no issues. The CISO went in through the platform and said, "Hey, what's this button do?" He said he could see a patch all button, so he worked with his IT team to press the button.
They have 300,000 patches deployed, going from no Qualys at all to within six weeks having deployed 300,000 patches with zero outages. So, in their case, they were able to bring along the IT team and move fast. In some cases, it takes a little bit longer. It just depends a little bit on how they are internally able to make. It is not just adding the license of the same capability. That is where we are also working with these customers, where some of those deals might close a little bit sooner, some of them might take a little bit longer as they go through work with their internal teams to get this to happen.
That is great to hear. Thank you.
Thank you. Our next question is going to come from Luke Morison with Canaccord. Your line is open.
Hey, guys. Thanks for taking the question here. We've had several high-profile AI-discovered vulnerability events this year, most recently, obviously, PHP2Shell in October. Maybe just stepping back from any one of those incidents, what does an event like that do to your buying cycles and pipeline? Does it have a tendency to maybe pull decisions forward?
Yeah. We've been consistent about this even all the way back to when SolarWinds and Log4j happened. What we see with our customer base is not a typical knee-jerk reaction where they're just somehow suddenly buying in the same quarter just to show that they're doing something. A lot of our conversations with customers tend to be, when you take a step back, what are these celebrity vulnerabilities, as we like to call them, indicating? By the way, on the same day as PHP2Shell, there was a Node2Shell vulnerability that was also pretty critical. Now when you have overlapping vulnerabilities like that, people don't even know how to track so many of these coming out.
Like I said, the conversations with our customers are less sort of knee-jerk, what can I do immediately, but more about the fact that overall approach towards vulnerability management cannot continue the way it has been, where it takes a week to scan, another week to import the data into a SIEM solution, which then gives you a dashboard, and that dashboard is then reviewed by the IT team, and then tickets are created, and things are fixed in like three weeks or four weeks. That has to fundamentally change across processes, across tools, across different teams. What we see is a pretty good increase in the number of conversations on how to do with when it comes to that. But that doesn't necessarily mean immediately that this quarter or something that we're going to see them purchase a bunch of things.
I think it again, goes back and depends on their ability a little bit to go and make that happen politically also within their own environment. Those who are able to bring their IT teams to the table quicker, we see them move faster, and others are still working through to say that they will need to work on making sure they get the right alignment because this is not just the security and go buy one tool and it's going to be done, right? There's going to be a change in process. How do we go from one-week detection to 60-minute detection? How do we go from theoretical validation to actually running the exploits ourselves and not having those exploits go crazy on us? How do we actually do some form of autonomous remediation?
A lot of these are less about just buying more of the tool and more about fundamental change. But the encouraging thing for us is those conversations about changes in how they're going to do vulnerability management, exposure management moving forward are happening. That excites us that over the next few quarters and years, we are excited to see how that's going to build up into our business.
Yeah, makes sense. Maybe just for my follow-up, if I look back over the last, call it decade plus, I would think most incremental security budget has gone to detection and response, with response obviously being after an incident occurs. If I think about this new paradigm, as AI shortens the time from disclosure to exploit, do you see budgets actually moving from that reactive side of the market to the proactive side where you guys are living?
There's no doubt that we are seeing those conversations in terms of how do we take a newer approach to pre-breach risk management, because the number of things coming at us are so significant, and the speed at which they are being exploited are so high that everybody needs to look at a new paradigm, and you cannot wait for a breach to happen to then take response after that. I think, and I always talk about this, it's like when you're buying a car, you kind of have your airbags that if you hit something, the airbag's going to protect you, but doesn't mean you're not going to buy a car with brakes. That's the same thing, that if you have good brakes, doesn't mean you're not going to get airbags.
I think the way we look at it is, ability to take proactive actions to prevent any issues from happening is becoming more and more part of the conversation now. But like I said, it does take them a bit of effort to change organizationally and tool-wise internally. I have no doubt that over a period of time, we're going to see the shift where more and more proactive risk management is a focus. It is just now a question of when that timing is and how we're going to get there. But we are seeing definitely a more focused approach on pre-breach risk management to complement, and that's why we have the concept of a ROC, which complements the SOC. The SOC is after the fact, the ROC is more proactive risk management.
Helpful. Thank you.
Thank you. Our last question will come from Rob Owens with Piper Sandler. Your line is open.
Great. Thank you guys for squeezing me in. Was hoping to touch a little bit on large transactions. Looked like one of your better quarters in terms of over $500,000 deals to date. Just what is driving that execution at this point, and are you actually seeing lands that large, or is that mainly within the installed base?
Like I said, I think the desire to kind of have the end-to-end workflows, which is more complex in larger customers, and so Qualys, in the way our platform is always trying to solve the more complex problems for the more complex customers. The adoption of those capabilities is sort of what is driving that increase in that $500,000+ . Again, it depends quarter- to- quarter, but I think we are happy with that direction, and we are looking forward to continuing that momentum by working with those customers and finding a way. When new customers also come, they are not looking just to replace a scanning solution with another scanning solution.
They are looking to add remediation, they are looking to add ETM, and you see that in the numbers as well, where new bookings, ETM bookings, percentage of some of these capabilities is also higher. We are seeing that on both sides in terms of the interest in evolving their overall risk management program and not just adding another scanner or replacing a scanner with another scanner.
Joo Mi, with retention rates remaining at 105%, have we flattened out here, or could you still see some volatility moving forward in terms of that number potentially going down a bit?
We are not expecting that right now. Based on the momentum of the business, I think that it is more likely that it moves up rather than down, or most likely scenario, of course, is right now kind of recording 105% last quarter, 105% this quarter. With that said, ETM, CSAM customer cohort did go up from 107%- 108%. So based on that, I would say that for now, we are not expecting a tick down in Q4.
All right. Thank you very much.
Thank you. This does conclude today's conference call. Thank you for participating, and you may now disconnect.
Goodbye.