Qualys Inc (QLYS) 2012 Q3 法說會逐字稿

Good day, ladies and gentlemen, and welcome to the Qualys Inc. third-quarter earnings call.

At this time all participants are in a listen-only mode. Later we will conduct a question-and-answer session and instructions will be given at that time. (Operator Instructions)

I would now like to turn the call over to Don McCauley, CFO of Qualys. Please go ahead, sir.

Thank you and welcome to the Qualys third-quarter 2012 investor call. As she just said, I am Don McCauley, the CFO of Qualys. We are very pleased that you could join us today for our first call as a publicly-traded company.

Joining me on the call today is Philippe Courtot, our Chairman and CEO. This is the first step in what we hope will be a regular and active dialogue with the investment community as you follow our story and learn more about the bright future that lies ahead for Qualys.

Before we get started we would like to remind you that our presentation today contains forward-looking statements within the meaning of the federal securities laws. Forward-looking statements in this presentation include, but are not limited to, statements related to our business and financial performance and expectations for future periods; our expectations regarding the growth of the market for security and vulnerability management solutions; our expectations regarding the introduction of new solutions and enhancements to existing solutions; and to our expectations regarding customer adoption of our solutions.

Our expectations and beliefs regarding these matters may not materialize and actual results in future periods are subject to risks and uncertainties that could cause actual results to differ materially from those projected. These risks include those set forth in the press release that we issued earlier today, as well as those more fully described in our filings with the Securities and Exchange Commission. The forward-looking statements in this presentation are based on information available to us as of now and we disclaim any obligation to update any forward-looking statements except as required by law.

We also remind you that this call will include a discussion of GAAP and non-GAAP financial measures. The non-GAAP financial measures are not intended to be considered in isolation or as a substitute for the results prepared in accordance with GAAP. The discussion of why we present non-GAAP financial measures and a reconciliation of the non-GAAP financial measures discussed in this call to the most directly comparable GAAP financial measures are included in our earnings press release that is available on our website.

For those of you new to the Qualys story, Philippe will provide you with a brief overview of our company and then discuss the Company's performance for the quarter. Then I will cover the financials and the factors that drove the third quarter in more detail, and also lead a discussion of our outlook for the balance of the year. Finally, we will open the call up for your questions.

With that I'd like to turn it over to Philippe Courtot.

Thank you, Don, and welcome to you all to our first earnings conference call as a public company. We have very good results to share with you as we continue to make substantial progress in all aspects of our business. We spoke with many of you during our IPO roadshow and you heard firsthand about the large market and growth opportunity Qualys is well-positioned to capture.

For those of you is just joining us today, let me take a few minutes to tell you a little bit about us and why we believe our cloud security platform and suite of solutions, as well as our business model, set us apart in the market and will enable us to deliver solid growth for years to come.

Cloud computing and mobility are changing businesses all around the world and our daily lives, and security has become front and center in this new computing era. Security breaches are escalating and can be devastating for organizations of all sizes. Now, more than ever, CIOs need to constantly make sure that vulnerabilities within their IT infrastructure are discovered on a continuous basis and addressed. Then must verify that vulnerabilities have been effectively remediated or mitigated.

In response to such IT risks, today's regulatory environment has expanded and created a slew of new compliance obligations for companies across all sectors. CEOs and their Boards are now asking CIOs are we secure and are we compliant? Qualys answers those questions with a cloud platform and a suite of solutions that allows enterprises to have a view of their security and compliance postures on a global scale.

Security has become a problem of scale as securing the perimeter and a few critical server is now inadequate. Qualys' cloud platform approach helps organizations solve scalability problems as they are now relieved from deploying traditional enterprise solutions that are difficult to deploy and costly to maintain.

With our cloud platform we provide our customers with a continuous view of their assets. We identify the vulnerabilities on those assets and prioritize and audit their remediation in a highly automated way, thus making such a complex task easier and cost-effective when compared with traditional on-premise enterprise software. We were the pioneers of this approach and have become a leader in cloud security and compliance, because we made our solution powerful yet easy to use and simple to deploy.

To further expand our market reach, three years ago we re-architected our entire cloud software backend and delivery infrastructure to make it more [extensible] and to enable global reach. Now we have a robust core services foundation from which we have developed a suite of scalable, modular, and extensible security and compliance applications. We have now moved well beyond vulnerability management with our policy compliance and web application scanning solution which are being adopted by our customers at a rapid pace.

We have established a significant beachhead with more than 6,000 customers over 100 countries and had achieved over $87 million in LTM revenues. Importantly, and unlike most of our competitors, these are pure SaaS revenues, meaning no professional services or other nonrecurring items. And we have been net income profitable since 2009.

With the security and vulnerability market segment set to grow by a 16% CAGR to almost $10 billion by 2015, opportunity is even more appealing given that we are growing faster than the market today up to 20% year over year. We can also see further growth ahead with the delivery of additional services replacing traditional enterprise point solution that have become clearly inadequate. We call this the platform effect as we are starting to see existing customers adopting Qualys solutions.

The upsell opportunity for Qualys is significant as 80% of our 6,000 customers have deployed only one solution from our suite today. That is one of the most exciting aspects of our story.

We are continuing our investment to further expand the capabilities and reach of our platform. We've introduced a cloud-based Web application firewall offering which is now in beta. And we are working on adding real-time big data capabilities to our core services as well as an innovative solution for mobile devices, as we continue to expand our reach beyond our core vulnerability management business while building a bigger opportunity for our investors and ourselves.

This platform approach has enabled us to build a highly leveraged business model with multiple growth drivers that, in fact, build onto one another. We have seen a clear inflection point in our revenue growth since 2010 and we believe our model will drive growth in the years to come as we continue to acquire new customers and upsell existing customers on new solutions that will continue to build and deliver on our cloud platform.

For more on how this strategy drove our strong third-quarter results I'd like now to turn the call over to Don.

Okay, thanks Philippe. We are very pleased with our third-quarter performance as we executed on the fundamentals that Philippe just mentioned and we delivered on our key financial and operating metrics. Beginning with the top line, we drove revenue growth to 21% -- of 21% to $23.4 million versus the same quarter last year. For the nine months ended September 30 revenues were up 20% year over year and US revenues made up 68% of those revenues, up slightly from the 67% share at the six months ended June 30 and also for the year 2011.

Looking at our product mix, we continue to see growth rates of approximately 15% for our vulnerability management solution and 50%-plus for our newer solutions, Policy Compliance and Web Application Scanning. In addition, we derived 87% of our year-to-date revenues from subscriptions to our VM solution, down from 90% in the same period last year, further highlighting the increasing customer adoption of the additional solutions.

We also saw continuing strong momentum in our key financial metric four-quarter bookings which for the most recent four-quarter period was up 25% over the four-quarter period ending September 30 last year. We calculate four-quarter bookings as revenues for the preceding four quarters plus the change in current deferred revenues over the same period.

Since we are in a one-year subscription business, we use the current portion of deferred revenues to focus on the next one year revenue value of our subscriptions. This metric fully reflects our current business because it includes sales of subscriptions to new customers as well as renewals and upsell to existing customers.

I would like to point out that there is approximately $2 million of inflation in current deferred revenues which will continue until Q1 of next year. This relates to a number of legacy monthly billing accounts that a partner switched to annual billing back in Q1 of this year. Now this, of course, is a very good thing for our business but since this was a continuing revenue stream already in place, the increase in current deferred revenues related to the incremental annual billing adds about 2% to this metric at this point.

For the third quarter of 2012 GAAP gross profit increased to $18.7 million, a 16% increase over the same period last year, and non-GAAP gross profit increased to $18.8 million, also a 16% increase over the same period last year. Non-GAAP gross margin was 80% for the third quarter of 2012 compared to 84% during the same period last year.

The decrease in both GAAP and non-GAAP gross margins was related to increased investments we made to expand our data center infrastructure and add capacity to deploy new solutions on our cloud platform. I will comment more on these investments when we discussed the balance sheet.

A key differentiator for Qualys is that we generate positive and growing operating income, net income, adjusted EBITDA, and cash flows. These numbers are all detailed in the financial schedules and reconciliations in today's press release, so I won't go through each of them now.

We do consider adjusted EBITDA to be a key metric for our business and so I would like to point out that adjusted EBITDA for the third quarter came in at $4.6 million, an increase of $1.8 million, or 66%, over last year's Q3. As a percentage of revenue, adjusted EBITDA increased from 14% of revenues in Q3 last year to now 20% of revenues for Q3 this year. We achieved these impressive adjusted EBITDA results while still making strategic investments in the business.

These factors contributed to third-quarter GAAP EPS of $0.06 per diluted share versus $0.02 per diluted share in the same quarter last year. Third-quarter non-GAAP EPS came in at $0.10 per diluted share compared to $0.04 per diluted share in the same period last year.

The key driver of EPS growth was the increase in GAAP net income from $0.5 million in last year's third quarter to $1.7 million this year. And non-GAAP income increased impressively also, going from $1.0 million to $2.7 million in this year's third quarter.

Just a few comments on the balance sheet. As you know, we have a very clean and well-capitalized balance sheet with virtually no debt and more than $100 million in cash. Our cash position stood at $25.8 million at September 30 and, of course, right after the end of the quarter we received the net proceeds from our IPO of $87.5 million, which will be reflected in our cash position the next time we report to you after Q4.

As we discussed on our IPO investor meeting, CapEx is an important element of investment in the growth of our business and we told investors to expect Qualys to invest approximately $3 million per quarter in CapEx for the next couple of years. For Q3, CapEx came in at $2.1 million but we are still expecting to average about $3 million per quarter.

Now turning to our outlook for the fourth quarter and full year 2012. Revenues are expected to be in the range of $24.0 million to $24.6 million for the fourth quarter of 2012 and in the range of $90.8 million to $91.4 million for the full year.

For the fourth quarter, GAAP EPS is expected to be in the range of $0.00 per share to $0.02 per share and non-GAAP EPS is expected to be in the range of $0.03 to $0.05. Both of these are based on approximately 35.2 million weighted average diluted shares outstanding.

For the full year GAAP EPS is expected to be in the range of $0.04 to $0.06 and non-GAAP EPS is expected to be in the range of $0.17 to $0.19. These both based on approximately 28.4 million weighted average diluted shares outstanding.

We are very excited about the future and confident in our prospects. Qualys is a pioneer and leader in cloud security and compliance solutions, competing in a rapidly expanding marketplace with multiple long-term growth drivers, including significant upsell opportunities.

Our platform is scalable and extensible. Capable of serving organizations of all sizes with our integrated suite of cloud security solutions. And as you know, our attractive SaaS financial model has significant operating leverage opportunities and that we expect to drive strong results for years to come.

With that, Philippe and I would be happy to answer any questions that you might have. Operator?

(Operator Instructions) Sterling Auty, JPMorgan.

Just a couple of questions. The first one is can you talk a little bit about how your new customer acquisition momentum looked versus sales to existing customers?

Hi, Sterling, this is Don. We continue to have a good balance to result here. We had very good on both fronts and the pipelines are looking the same way. So really we continue the same momentum we had earlier in the year and it's continuing nicely.

Then how about in terms of -- you talk about the 50%-plus growth in some of the new value-added solutions. How did -- when you look across them any particular standouts in terms of within the product portfolio?

Well, you know the two we pointed out were Policy Compliance and Web Application Scanning. They've both been very strong. I think this year we've seen a real acceleration in Web Application Scanning with our new version that came out this year. That's a pretty unique solution in the marketplace and we are seeing excellent growth in both, but I think we've even seen more acceleration in Web Application Scanning.

Okay, last question (multiple speakers). Sorry, go ahead.

I was just saying, just to add, we are considering enhancing these products as well, so tremendous reception from our customers, both new and existing customers and new customers. We are enhancing them, investing more in them, and these are really winners.

That is great. Then just last question. When you take a look at the new customers that are coming in is there any change in terms of what they are choosing as the first product to come in with? Or any change in terms of are they coming in buying multiple products at once or still kind of a land and expand type of strategy?

Yes, so we definitely have a land-and-expand strategy. Three years ago we would have said every customer came in and bought VM and that was the landing point. Then we expanded from there.

We continue to see on an increasing basis, although it's not a majority yet but an increasing basis of customers coming in buying Web Application Scanning as their entree to the suite. And as far as -- one other point I'd just like to make for those who don't know this, even though we have a suite we still look to serve the initial buyer who comes to us on whichever solution they came in, like Web Application Scanning.

The land and expand strategy, in our mind, means let's take care of that first buyer, get him signed up to a contract, take care of that initial need, get them up and running, solving the problem that they came to us with, and worry about selling the rest of the suite later. So we don't make an attempt to bog down the transaction and sell the whole suite upfront. Very few customers would come to us with that initial requirement.

Got it, thank you.

Phil Winslow, Credit Suisse.

This is Siti Panigrahi for Phil Winslow. Just wondering, could you share any customer feedback from the Web Application Scanning beta customer that you have.

Yes, it is actually extremely well received for two reasons. The first one is that with the current solutions customers have hard time to identify all their web applications. Web applications have become an entry point for hackers into your network, and so knowing how many applications you have and where they are is important.

So what Qualys offers is the ability to identify, then catalog all the Web applications, and we do that extremely well. The second is in instead of having now to scan to identify vulnerabilities on a few critical Web applications, you have to do that on many more and that's where the scale comes in. And that's the driver of adoption for our marketplace.

So we replaced a lot of these traditional tools, which requires an engineer either to go -- s a security expert to use the tool, to identify vulnerabilities as we bring significantly more automation. So we had very good adoption. Large corporation, for example, placing orders for more than 1,000 Web applications and that's again underscores the scale and the quality of detection that we bring.

All right, thanks.

Robert Breza, RBC Capital.

Thanks for taking my question. Philippe, maybe you could talk a little bit about the Web application appliance that you have in beta. How do you see this kind of competing against other solutions in the market and when do you think it will be generally available? Thanks.

Yes, this is the Web application firewall that we mentioned. Web Application Scanning is already in production and going very well.

We look at Web application as a whole. For us, the Web application firewall is a component of ensuring that you secure your Web application. In that case this is a mitigation component. So we identify your Web application, we catalog them, we identify their vulnerabilities, and then we firewall or we mitigate until you have been able to remediate.

So this is a very key component. What makes us unique here is that we can bring all of the information that we gather from the Web application scanning so we could create better rules and more adequate rules for this web application.

So our product is a cloud-based approach. It takes time to build the infrastructure which we are building. It also takes time to mature security applications. We are just at the very beginning.

We are also working on adding other components. It should be referred to that web application element and to provide a full solution for your Web application. So you are going to see more announcement during next year.

I think we have a very good solution here. It is a little bit too soon to predict its success, but we have a lot of customers interested. And will do like we have done with all of our other solutions -- bring scalability and quality and full integration with our suite of applications.

Thanks.

Rob Owens, Pacific Crest.

Good afternoon. Could you give us an indication of large deals in the quarter and/or what an average deal size looks like in the quarter for you?

Rob, this is Don. We typically don't talk about the size of individual large deals. Our average deal size continues to be in the range of around $75,000 for enterprise deals and about 10% of that on the SMB side. That's been pretty consistent over the last couple of years.

We generally don't comment on individual deals at this point.

Okay, fair enough. And then, Don, on the sales and marketing line it seemed to be lighter than we were looking for and down sequentially. Was there anything one-time in nature in the quarter, did you slow hiring, and how should we expect that to ramp moving forward?

So your question is on the sales and marketing expense line, correct?

Yes.

Just to clarify. Okay. Well, you know, Q2 is the big quarter here for our big RSA, InfoSec, and many other regional marketing shows. That spring season is a very big one. So Q2 has a lot of marketing and sales expenses in it and more travel as well.

Q3 is a lot slower in a lot of parts of the world, especially Europe obviously. So it's more that Q2 is heavy.

As far as hiring, we've been -- year-to-date we have been increasing the size of the sales force. It stayed about the same size net in Q3. We have done a lot of recruiting towards the end of Q3, but those hires are now showing up in Q4, so we did not have an increase in that spending in Q3 to offset the decrease in trade shows and stuff like that.

Great. One more quick, if I may. Just the accounts receivable I think jumped out a little over $5 million sequentially, deferred was up a little over $3 million sequentially. Was it a backend-weighted quarter; was there some linearity there?

To be fair, some of it was backend weighted, Rob, but we also came to the realization that we didn't have our eye on that ball as well as we should. We actually added another person to our staff to focus on than a little more. Most of my accounting staff was focused on the S1 and the IPO process.

It's not a huge problem, but you're exactly right and we look to bring that down next quarter. As I said, we added some more resource to follow up.

Great. Thanks, Don. Thanks, guys.

You're welcome.

Steve Ashley, Robert W. Baird.

Thanks. Just wonder if you could maybe comment on the renewal rates that you are seeing in the business.

So, Steve, we continue -- the renewal rates haven't changed. We continue to see really high renewal rates on the enterprise side, 95% or better, and about 10 points lower on the SMB side for pure renewal rates. So pretty consistent to what we have done in the past; we haven't seen any real change going on there.

Does FX have any impact on your reported international revenue?

It does, over time it does. We had our FX every month to protect what we build. We protect our cash and receivables position every month in the euro, for example, but over time it does.

I mean if a subscription that's denominated in euros was EUR100 last year and EUR100 this year, on its renewal date it gets translated to however many dollars that is worth. So, yes, on an annual rolling basis there is an impact there. And it goes both directions, obviously.

Sure. And then, lastly, Philippe, you just mentioned about looking out at maybe big data and mobile devices would offer some opportunity. I wonder if you could give us a little more color around what kind of security opportunities there are around those big trends.

Very good question. If you look at security, I mentioned earlier in my introduction speech the notion of scale. So security has become a product of scale, but it has also become what I will add a problem of real-time. So you've got to capture and correlate information and the challenge is that you have got a lot of data that you have to do that in real time.

Unless you do forensic. If it's forensic then you have time; if you prefer to analyze the patient, what happened after he's dead. But if you really want to protect you need to have real-time, and that presents a huge technical challenge to build a backend which can correlate information in what we call semi-real-time.

We already have done that with our asset management solution, our asset tagging solution as we call it, where we can essentially manipulate millions of assets in real time in milliseconds. So we are building -- as we mentioned, we are investing big time in further expanding the capabilities of our backend and so we could add real-time big data capabilities for correlation.

This is also going to be extremely useful for mobile devices. You have to essentially build a solution that scales for hundreds of millions of devices and that's just not for the 10,000 or 100,000 of mobile devices that one company may have. So that's part of expanding our infrastructure.

We are making very good progress at this. In fact, we have an extremely strong engineering team so you are going to see some of that sometime next year. I cannot give times and commitment at this time, but we are really working and investing big time there.

Thank you.

Erik Suppiger, JMP Securities.

Good afternoon. First off, any comments about Europe, how did Europe perform relative to expectations given that you saw a modest shift towards North America?

We have seen, like almost everybody, the slowdown in Europe. It is a combination of the typical, the third quarter is never very strong, but the uncertainty is that we all know in Europe the budget pressure has really showed that the business -- slowdown in the business. Conversely, we have seen a very strong momentum in both the US, as well as Latin America and Canada and Asia Pac.

Okay. Can you give us any, even a qualitative sense, for what your exposure is between EMEA and Asia Pacific?

Yes, Eric. We have about -- I think it's about 14% or 15% of our business is in the euro.

Okay.

And our total international business is around 26%, something like that. Close to that; spread between the pound, the yen mostly.

Okay. Total currency, because you had said that US was -- or North America I think was 68% of revenue?

Right, right, right. Okay.

Your foreign currencies are 26%, is that correct?

Right, yes. Some foreign -- we have to bill in dollars for some international stuff, so I think the foreign currency piece is more like around 25%, 26%, something like that.

Okay. As we start looking into Q4 on the bookings and even Q1 is there any reason we might expect different seasonality than what you would have seen a year ago? Or should we just work from a four-quarter bookings perspective that would maintain fairly consistent growth from quarter to quarter?

So for those who are new to this part of the story, Qualys does have an established seasonality which ties into the corporate buying pattern of our enterprise customers where Q1 and Q2 are the smaller quarters for bookings, picks up in Q3, and then Q4 is the largest quarter of the year. I have nothing to suggest that that pattern won't continue for like the 10th consecutive year, Erik.

That's one of the reasons four-quarter bookings is a very good metric because it always gives you the full year view and takes all that into account. So we don't -- those swings don't affect revenue nearly as much as obviously they affect what we bill and book.

Okay. Then, lastly, just on the Web App Scanning, you've said that that was strong. You said that that was -- or your newer products did 50% more growth. Can we assume that the growth in Web App Scanning has sustained or even accelerated from what you've seen in previous quarters?

Yes, I think that is what I said. We have seen -- they're both doing really well and we've actually seen good acceleration in Web App Scanning, which I think is also specifically tied to the market need in general.

But as Philippe mentioned, we continue to -- I had mentioned it was a new version and broader scope. Philippe mentioned we are constantly improving these products. We listen to our customers and keep improving them and adding features. As we do that, the product becomes more suitable for more and more customers and we are definitely seeing that.

I should add then that thanks to our SaaS model, which is a development cycle that is significantly shorter than enterprise software solutions, we are also keeping continuously improving. So it's a pretty fast pace of improvement which our customers appreciate. So we can really answer back to the needs of our customers, change things, improve the quality of the scanning, etc., etc.

Very good, thank you.

Joel Fishbein, Lazard.

Just a quick question down on the margins. You had a really nice job on the EBITDA margin side. Is this the new baseline or was there some seasonality there? Any color there would be very helpful.

It jumped to 20% in Q3. I think that brings year-to-date up to 14%, something like that. I think the year-to-date is a better way to think about it.

Again, Q2 heavy marketing expenses; Q3 light marketing expenses. So I think Q3 is by itself a little bit getting ahead of the curve because it has lighter -- very light on those expenses that came up in an earlier question.

Great, thank you.

Craig Nankervis, First Analysis.

Thanks, nice quarter. I wonder if you could comment or any flavor on SMB progress; how your strategy to more exploit the opportunity at the lower end of the market is going along.

Okay, very good. So we are, in fact, now, again, with the re-architecting of our backend as we mentioned that allowed us to simplify. In fact, you come up with a UI more specific to the SMB and also a platform from which we are going to, in fact, announce large numbers of lead generations in our trials which are pretty easy for people to have immediate, instant gratification.

So you are going to see in the months to come, major lead generation campaigns on the SMB front. We have the platform -- (inaudible), packaging, all of that -- so just a question of doing it. So we have everything we need.

Okay. Philippe, is there any update on your channel activity, especially in the newer channels, consulting firms, hosting providers? How far along are you into breaking into those new channel opportunities?

So we are doing very well. We are continuing expanding our business with existing partners, such as Dell SecureWorks, we are doing very well with Accuvant and many others, and we are also globally. We've expanded our relationship with Wipro and many others and continuing the expansion.

We are, in fact, looking to expand our channel partner team, so we could essentially grow our business more with partners which represent about 41% of our business now today. So we are continuing very solid performance from our channels.

And, lastly, have there been any changes in your investment plans in terms of the timetables? Have you seen anything that causes you to accelerate your investment or, conversely, slightly throttle it back? Or is it pretty much unchanged?

No, it is pretty much unchanged. I think we are pretty much on plan and continuing to do the same. We will be looking at potentially some licensing of technologies or making maybe small acquisitions if that can accelerate our product, delivering new services to the market. As we mentioned during the roadshow, we are doing a very carefully.

Thank you. That does it for me.

At this time I am showing no further questions. I would now like to turn the call back over to management.

Okay, so thank you very much. Should you have any follow-up questions, Don and I, we are always available, like any good SaaS company 24/7. Otherwise, we look forward to speaking with you our next quarter call. Thank you.

Thank you. Bye-bye.

Ladies and gentlemen, that does conclude the conference for today. Again, thank you for your participation. You may all disconnect. Have a good day.