Qualys Inc (QLYS) 2014 Q1 法說會逐字稿

Welcome to the Qualys first quarter 2014 investor conference call.

(Operator Instructions)

I'd now like to turn the call over to Don McCauley, CFO of Qualys. Please go ahead, sir.

Thank you. Welcome to the Qualys first quarter 2014 investor conference call. I'm Don McCauley, CFO; and I'm here with Philippe Courtot, our Chairman and CEO.

Before we get started we would like to remind you that during the call, management expects to make forward-looking statements within the meaning of the Federal Securities laws. Forward-looking statements generally relate to future events or to our future financial or operating performance. Forward-looking statements in this presentation include, but are not limited to, statements related to our business and financial performance in expectations for future periods, our expectations regarding capital expenditures, including investments in our cloud infrastructure, and our expectations regarding the introduction of new solutions and enhancements to existing solutions.

Our expectations and beliefs regarding these matters may not materialize and actual results in future periods are subject to risks and uncertainties that could cause actual results to differ materially from those projected. These risks include those set forth in the press release we issued earlier today, as well as those more fully described in our filings with the Securities and Exchange Commission including our annual report on Form 10-K that we filed on February 28, 2014. The forward-looking statements in this presentation are based on information available to us as of today and we disclaim any obligation to update any forward-looking statements except as required by law.

We also remind you that this call will include a discussion of GAAP and non-GAAP financial measures. The non-GAAP financial measures are not intended to be considered in isolation or as a substitute for results prepared in accordance with GAAP. Discussion of why we present non-GAAP financial measures and a reconciliation of the non-GAAP financial measures discussed in this call to the most directly comparable GAAP financial measures are included in our earnings press release that is available on our website.

Finally, one housekeeping item I'd like to point out is that Phillipe will be presenting at the Wedbush Transformational Technologies Conference in New York on May 13 at an earlier time than previously posted. He'll be speaking at 12.45 PM instead of the 9.45 AM that was previously announced.

Now, to begin the discussion, Phillipe will provide an overview of the Company's performance for the first quarter. Then I will cover our financial results and factors that drove the quarter in more detail as well as our outlook for the second quarter and full year 2014. Then we will open up the call for your questions. I will now turn the call over to Phillipe.

Thanks, Don. Welcome to all of you. The first quarter of 2014 was a very strong quarter for Qualys. We had strong progress in all aspects of our business. Don will cover the financial details of our performance for the quarter and let me first start with an overview of key highlights that are driving the momentum in our business. In the first quarter, we added many new noteworthy accounts, including Alcatel-Lucent, British Broadcasting Corporation, Fujitsu America, ICAP, Infosys Technologies, Kendle International, Sallie Mae, The E.W. Scripps Company, Tribunal de Justica de Sao Paulo Brazil, World Vision International and Wyndham Worldwide.

Our vulnerability management solution remains the largest component of our business and at the same time we continue to making meaningful progress in diversifying our revenue base. We derived 83% of first quarter revenue from subscriptions to our VM solution which continues to grow very well compared to 85% in the first quarter of last year. This ongoing diversification for revenues is principally due to increased sales of our web application scanning and policy compliance solutions, both of which continue to show robust growth.

As you know, we're still in the early days of selling additional solutions into our customer base, for the most part, depending upon our vulnerability management solutions. In fact, we are making very good progress with selling new solutions into our installed customer base. At the end of 2012 only 20% of our customers had bought more than one solution from Qualys. By the end of 2013, that number was 30%, and at the end of March, 37% of our customers have now adopted more than one of our solutions. We introduced our new continuous monitoring solutions for the perimeter during the first quarter.

This groundbreaking technology allows customers to continuously assess the security of their internet facing systems and applications and they are alerted when a new vulnerability, misconfiguration or network anomaly is discovered. We believe this is the new paradigm for vulnerability management as it better empowers customers to take immediate action for mitigating vulnerabilities that can lead to cyber attacks. We released our web applications for firewall or WAF for general availability on Amazon EC2 as well as for on-premise deployment on VM-ware virtualized platforms. Qualys' WAF is delivered via our cloud platform integrated with our web application scanning solution.

The solutions allow customers to more rapidly deploy robust security for their web application while minimizing administrative efforts and costs thanks to the centralized cloud-based management capabilities of our solutions. What is unique about our web solutions is that it seamlessly integrates with our web application scanning which makes it easier for customers to detect and automatically mitigate security gaps in their web applications. We believe this is a powerful solution and it is very timely considering that the latest 2014 Verizon data breach investigation report indicates that breaches from web app attacks grew the fastest to comprise 35% of all breaches in 2013.

As most of you may know from recent press reports, Qualys has played a significant role in recent weeks in helping companies identify their exposure to the Heartbleed OpenSSL vulnerability. Our popular free service, Qualys SSL lab, as well as our vulnerability management solution, have both been instrumental in these efforts. We experienced tremendous increase about our normal scanning volume during the week that the vulnerability was announced as our customers used our service to detect vulnerable systems, applying the appropriate remediation measures and then tracking their progress with a new SSL dashboard feature we recently launched.

We also are on track with the new innovations we're implementing to the Qualys platform including the cloud agent and the advanced malware protection services with a goal to (inaudible) new offerings in beta later this year. This quarter we added key partnerships, the first of which is with Cognizant, a leading global outsourcing company. The Qualys cloud platform uniquely fits well with our delivery model and as a result, we are now bundling security services with our cloud offerings. We also announced integration partnership with Risk IO as well as AlgoSec to further expand the reach of our cloud platform.

I'm pleased to say that this quarter we were named by SC Magazine as the best security company. It is an honor we share with our customers and partners. Finally, as many of you know from the Form 8-K we filed today, we announced that Ann Johnson has decided to leave Qualys after about five months as President and CO. Ann is a (inaudible) executive, and we all wish her well in her future endeavors. In the last five months, we have also added several other significant sales executives to our team; VP Interim Manager of Europe, Managing Directors in the UK and Germany, a VP to drive our federal business, a regional VP to drive our northeast US business and a VP to drive our SNB business.

In addition, and I'm extremely pleased to announce today, that we have promoted Earl Porter, who has done a fine job as our regional sales VP to become VP of America's sales. I wanted to share these details with you today to let you know how confident we are in the continued improvement of our sales execution. During this whole period, I have been personally focused on driving our sales force worldwide. We continue to attract and add very capable sales leaders around the world.

In time we will find another senior sales executive to join our executive team and until then I will continue to make sales execution and revenue growth my top priorities every single day. Given our momentum, which has continued strongly through the first quarter, we are beginning to realize the benefits of our investments in building a security and compliance cloud platform upon which we can deliver enhancements and new solutions. We believe that our cloud platform will continue to play a critical role in enabling Qualys to stay ahead of our competition.

Now for a review of our financial performance and our guidance, I will turn the call over to Don.

As Philippe said, Q1 was a strong quarter across our business and this will be evident as we review our results and metrics. Revenues grew in the first quarter to $30.4 million which represented 22% growth over the same quarter last year. For the first quarter, the US represented 70% of revenues, the same as a year ago. Current deferred revenues are 22% greater than one year ago and total deferred revenues are 21% greater than the comparable figure of last year. GAAP gross profit increased to $23.5 million in the first quarter of 2014, compared to $19.1 million for the same quarter last year.

GAAP gross margin was 77% for the first quarter of 2014, the same as in the prior year's first quarter. Non-GAAP gross profit in the first quarter of 2014 increased to $23.7 million compared to $19.2 million in the same quarter last year and non-GAAP gross margin was 78% for the first quarter of 2014 compared to 77% in the same quarter last year. Adjusted EBITDA for the first quarter of 2014 increased by 67% to $4.7 million compared to $2.8 million in the first quarter of 2013.

As a percentage of revenues, adjusted EBITDA increased to 15% in the first quarter of 2014 compared with 11% in the same quarter last year, demonstrating another year of solid progress and profitability even while we are continuing to make strong investments in growing our business. Moving on to earnings per share. For the first quarter of 2014, GAAP EPS was a loss of $0.01 per diluted share versus a GAAP net loss of $0.02 per diluted share in the first quarter last year. Non-GAAP EPS was $0.05 per diluted share in the first quarter of 2014 compared to $0.01 per diluted share in the first quarter of last year.

Turning to the balance sheet, we continue to have a strong cash position with $145 million in cash and investments and only $500,000 remaining of capital lease obligations. In the first quarter of 2014, capital expenditures were $3.8 million compared to $3.7 million in the first quarter of 2013. Going forward, we plan to average approximately $3 million per quarter in capital expenditure spending as we continue to expand our cloud infrastructure to support more customers and add more solutions and functionality to our platform.

Now turning to our outlook for 2014, starting with revenue. For the second quarter, we expect revenues to be in the range of $31.3 million to $31.8 million. At the midpoint this represents 20% growth over the second quarter 2013 revenues. For the full year 2014, our guidance is unchanged as we expect revenues to be in the range of $128.5 million to $130.5 million. At the midpoint this represents 20% growth over 2013 revenues. For earnings per share, we expect GAAP EPS for the second quarter to be in the range of negative $0.01 to positive $0.01 and non-GAAP EPS is expected to be in the range of $0.05 to $0.07.

Our second quarter EPS estimates are based on approximately 37 million weighted average diluted shares outstanding. For the full year 2014, we continue to expect GAAP EPS to be in the range of negative $0.06 to negative $0.02 and non-GAAP EPS to be in the range of $0.22 to $0.26. Our full year EPS estimates are based on approximately 37.4 million weighted average diluted shares outstanding. With that, Phillipe and I would be happy to answer any of your questions. Operator?

(Operator Instructions)

Our first question comes from Sterling Auty of JPMorgan. Your line is open.

This is Jackson Ader standing in for Sterling. I just had one quick question on the reception that you guys mentioned on the web application firewall and the constant monitoring products. How much interest on those products is coming through the channel?

This is Philippe. The answer is that, today, we are more than 40% of our business is coming from the channel. We have, in fact, signed major partnerships now with all of the Indian outsourcers (inaudible). So, we see the interest from both the direct customers, as well as the channel partners. There is no really big differentiation.

Continuous monitoring is something which is very well received. We're going to launch a major campaign in the Summer as we deliver one of the very important components, which is integration with sims. So, we could automatically now drive the alerts that we provide directly into the sims out there. So, with that, we're going to make a major push -- very strong reception. I absolutely believe that this is a game changer in [vulnerability] management.

And the web application firewall is maturing. As we all know, it takes time to bring a security solution to the market because you need absolutely high quality. You want to be best of breed in everything you do, which is the [differentiator] of Qualys, and delivering that as a single solution. We are very encouraged by the quality of our web application firewall. And the same we are expecting in the Summer to have some additional key features and really push the product very strongly.

Great. And one quick follow-up on that. As far as the sales force is concerned -- how do you feel about them? How far ramped up are they on being able to sell all the solutions? And how should we think about where they are as far as being able to sell all the solutions and how they're going to ramp?

So, first of all, we have a technical sales force, which is very different from your traditional enterprise software where people are not that technical and rely on the [Cs] to do the job. By nature, they are much more capable of learning additional modalities.

In addition to that, we have now also SMEs, subject matter experts, which are now based in the field, which on vulnerability management, policy compliance, web application scanning, and now web application firewall, are looking to expand SME capabilities in the field, so they could have experts, so our field operation could grow on these experts, luckily. Generally speaking, I think we're very well equipped.

The products are very well received, and you could see from the numbers today that we are doing bigger deals, larger up-sells, because of the fact that we bring best-of-breed technologies in a single platform. That's a huge differentiator at Qualys today.

Great, thank you.

Phil Winslow of Credit Suisse.

This is Siti Panigrahi for Phil Winslow. Congrats on a good quarter. So, just wondering if you have started to see any kind of impact from your partnership announcement with Accuvant and Lumension earlier this year? Could you give us some color also when you expect Lumension customers to move to QualysGuard platform?

I think on the Accuvant side, we already had the relationship with Accuvant, but Accuvant was, in the past, a re-seller of Qualys -- re-selling the solution. What is very unique, and I think this is [kind of the] marketplace, because of the platform that we have now, Accuvant is capable of delivering managed security services for VM, for policy compliance, for web application scanning, and bringing these applications, if you prefer, the Qualys way to the market. I'm absolutely convinced that we will see more of these other traditional, security, if you prefer, channels starting to realize that this is a much better model. So, we see good traction with them.

The second question was -- I forgot -- the second question was related to -- ?

About Lumension.

Lumension -- we have seen a few of their customers trickling to Qualys. This is obviously not as huge of an install base that they had. So, we see some customers, of course, coming, replacing the solutions that they had. They had a federal component to their business, which also gives us the opportunity to further accelerate our penetration in federal, where, as I mentioned earlier, we have hired a very seasoned executive to drive our federal business.

Thank you.

Steve Ashley, Robert W. Baird.

This is Chaitanya Yaramada for Steve Ashley. Great quarter, guys. You could see the billings growth here, and my question is on the billings growth. We saw a nice acceleration this quarter, and I was just wondering if you could give us any color on what might have contributed to that strength? Philippe mentioned the Heartbleed bug, and we had the Target data breach not so long ago. Perhaps -- were there any one-time events that helped that billings growth in the quarter, or maybe any larger deals that we should take note of?

Hi, Chaitanya, this is Don. No, not really; no one-time. Those events are obviously all in the press, and I think generally contribute to a good environment for security, but our sales cycles are not that short here.

Q1 was just a good, solid quarter. I think Philippe hit on the main thing: We're seeing bigger deals, bigger up-sells across the board in all regions, across all product lines. So, no, just a good, solid quarter; no one-time events.

Okay, perfect. It was also nice to see the increase in the cross-sell going from 30%, I believe, at the end of last year, to 37% at the end of March. Is that being driven by a higher attach rate to newer customers, or is that increasing success in going back to the existing customer base and maybe cross-selling some of the newer products, and maybe any changes that you made to the go-to-market that is helping to this.

First of all, thanks for pointing out our new favorite metric this quarter; the 37% from 30% in one quarter is pretty stunning. Really both new and existing. Now, of course, our existing base is a much larger base, so numerically, we get a lot more from existing customers. But we're seeing more and more new customers.

I can think of a dozen significant deals in the quarter where they didn't just buy vulnerability management; they added on one or both of the other services as well. We're seeing more of that as well.

Great. Any changes to the go-to-market or are the sales guys getting more comfortable with the newer products? What is helping that process?

No change to the go-to-market, but I'm sure, as every quarter goes by, people get to know the products better. We continue to improve the features with more -- as a fast company, we have continuous releasing of additional features and bug fixes and stuff like that. So, the product gets better and better, and the sales force, of course, the more they sell it, the more they know about it and they have more reference accounts, et cetera. I think it builds on itself.

What it does, in fact, is now that we're more than -- we're really coming up as a platform, and not any more as a best-of-breed solution in the VM. So, it is really the platform itself that is really playing into our hands. And, of course, the more new services we add to that, the more stickiness we'll see as a result of that company's -- not only they go and buy more than one solution from the get-go, they also want to do longer-term deals with us -- three years type of engagement with Qualys.

Because, of course, now, from a CCO standpoint, we represent significantly cost reduction because of the administrative. You don't need to have any more, your expert just for VM running the VM application, and your expert for policy compliance and your expert for web application, et cetera. You can really have a huge consolidation, which eliminates a lot of people that you needed for enterprise software solutions.

Great. That's really great to hear.

Final question for me is on Europe. We have seen two quarters of very strong growth there. Just wondering if you can comment on -- is that execution, as you have had some management changes there recently? And also, are you seeing any change in terms of companies' willingness to adopt cloud solutions for security more broadly?

It is all of the above. In fact, we did expand our management team in Europe with the addition of a very seasoned person, as well as some locals. The cloud is absolutely much more accepted than it used to be.

And, finally, Europe went through a kind of pretty dark outcome, now almost two years ago, so we're past that. So, it's the combination of all of these factors. We do have effectivity now. Europe is back on track very well, so we're very happy with that -- strong customers, good team. We're very happy with that.

Great. Thank you very much for taking my questions.

Sterling Auty of JPMorgan. Your line is open.

Thanks, guys. Can you give us a little bit more color on Ann Johnson -- ?

We're not hearing you well. You want us to give you more color on Ann Johnson? There is not really more to say than what we just said.

We are expanding our management. This is something that is a priority of mine, (inaudible) global customer support, so we're continuing enhancing. We just hired also a [CSO]. So, we're expanding our management. And with Ann's, albeit she's a very seasoned executive and we left on good terms, but I think it was just not working out as well as both of us, I would say, would have expected.

I got you. Just a quick back-of-the-envelope calculation, it looks like the 83% from vulnerability assessment, it looks like VA grew at the higher end of that 15% to 20% range. Is that from just the solid larger deal upsell into existing customers, or what are you seeing on maybe some new sales of the traditional VA solution?

Hi, Sterling; Don. You know, we continue to have a steady drum beat of new VM customers every quarter. But I think it is the increase in the growth rate, which you are correct in back of the enveloping, really came from upsells to existing customers as they're expanding their scope of what they're doing on vulnerability management.

To add to what Don said, it is interesting that what we see today is synergies because, if you really like policy compliance, which essentially allows you to look at the configuration of all of the systems, has, in fact, an interesting effect of driving more scanning for vulnerabilities, interestingly enough. So, all of these different applications now they have their own little synergistic effect on each other, not only just as the platform, but they have a positive effect that customers want to scan more, to do more. It deploys, it works, it's integrated, and that is why we see strong growth in our VM.

Last question: You have a number of new products that already started to roll out. Can you remind us what the next steps in the product road map for this year are?

So, we just announced our continuous monitoring of the perimeter. We also announced, as you know, the web application firewall, going out today.

And then, of course, we have now a suite of new services, our customizable questionnaires, which is a very important extension to our policy compliance application. So, this is well on its way, as well. And this is additional paying services. Essentially, you could do your vendor questionnaires, as well as your internal questionnaires, so you eliminate a lot of manual costs in doing that.

The other thing is our cloud agent, which we believe is an absolutely groundbreaking solution which allows us to address essentially three elements. One is making VM realtime whenever this is possible. Now you could have an agent that will continuously report changes in the configuration or in the [vulnerabilities] of given systems where you could put that agent. The second thing is expanding the reach of our policy compliance application for mobile devices, and as well as providing us the capabilities to start now to do [fine] integrity monitoring. So, that's another significant expansion.

Finally, a component, an agent which allows us to essentially audit IOCs, indication of compromise, which will fit hand in glove with our manual protection service. So, this is something we will -- as I mentioned earlier, we plan to essentially go beta before the end of the year.

The other one malware -- I'm sorry, our web application log management, which is complements to our effort around web security. Where now with web application security we can identify your application. We have cataloged them. We can identify their vulnerabilities. We can then follow those vulnerabilities with our web application firewall, and now we can go and look back at the logs for indication of potential compromise, as well. So, this is also coming.

Finally, we have a few other services that we're also going to announce, and the advantage of our platform is that we can take some kind of subsegment of the market and really package a solution that we can deliver very cost effectively. So, we're working also on a few others. All of that could be -- shows the leverage that we have with our platform. Because once we package a solution, we can now deploy that globally, not only to our customers, but as well as new markets.

Got it. Thank you, guys.

Erik Suppiger, JMP Securities.

Congratulations -- very good billings quarter there. On the billings front, I calculate you did about 28% growth, and your revenue outlook for the year is maybe slightly better than 20%. Should we think of this quarter as a bit of an anomaly on the billings front, or where do you think the trajectory goes from here from a billings perspective?

Erik, we think our trajectory is what our guidance is, which is a 20% median. This quarter was strong, in one respect; as you know from having followed our Company for years, we have some pretty distinct patterns that have emerged in terms of when deals come in, in the quarter. About half of the deals on a billings point of view come in, in the last month of the quarter, and the other half is split pretty equally, normally, between the first two months.

In this particular quarter, we actually got most of our big deals done in January, which gave us some extra rev rec and really helped spice up the quarter. That may or may not be a new pattern. I tend to think patterns will revert back to the normal patterns. We had a more front-weighted closing deal quarter in Q1, which was very good for us.

Okay. Secondly, in terms of Ann Johnson's departure, are you looking for a new President or are you going to replace her with a new Head of Sales, did you say?

At the moment, I'm more looking for talent than titles, quite candidly here. I've been involved in sales in Qualys since the beginning, so this is something I know almost everybody, all the customers. So, currently -- and, of course, I will want to replace myself there, but we need to find somebody who can really have those qualities [to business much faster when opportunities]. So, whether this is going to be an EVP of Worldwide Sales or President would depend on the candidate.

Okay. Can you tell us whether or not your web app scanning and your policy compliance services were both still growing in excess of 50% year on year in terms of billings?

Yes, Erik, we can confirm that; yes, that's true.

Okay. And then, coming back to the first question -- this was an unusual quarter. Do you think that your ability to continue selling bundled or multi-product or multi-services -- do you think 37% was unusually high, or can you continue to expand beyond that as we look at the next couple of quarters?

Well, based on the way the metric had behaved, it went from 20% to 30% in a year; we were all pleasantly surprised to see it grow 7% in one quarter. Eventually, Erik -- I don't think that is going to be an important metric in the long one. I think eventually we should have 90% to 100% of our customers buying multiple services. Recognizing that a lot of new customers start out with one, so maybe it will never get to 100%.

But we're clearly, as Philippe said, a platform company now, not just a single-solution company. I would look for continued steady growth in that metric. I can't predict it, but it should, in the long run, in my opinion, hit 80%, 90%.

Okay, great. And last quick one: Did you say what your headcount was?

No. (laughter) Would you like to know?

I would love to know, thank you.

We ended the quarter at 414. And one other little note on headcount: We had said at the beginning of the year we intended to increase the sales force by about 25 to 30 headcount this year. We added seven in the quarter. So, we're on the pace that we said.

Very good. Thank you.

Michael Kim, Imperial Capital.

I just want a better sense of expansion for the Business internationally; what you're doing to build out the channel in the EMEA and also in APAC? Secondarily, I think, Philippe, you mentioned adding a VP in the SMB sector; curious how much you are doing there and your expectations for that opportunity?

Starting with EMEA, we are considering expanding our channel in EMEA. Our business in the EMEA is more channel-driven than it is in the US. So, we are expanding our partnerships with companies like Orange Business Systems and a few others -- strong partners. So, this is more of the same.

As far as APAC is concerned, now that we're packaged, APAC is a marketplace which is a bit different than Europe. Already, Europe is fragmented, but it's more for cultural reasons. In the APAC marketplace, you don't have that large companies with large network. It is much more of an SME/SMB marketplace from a product standpoint.

So, now that we have absolutely -- we have packaged our SME/SMB solutions very well with an SMB offering, which is, we call Express Lite, with an SME offering we call Express, part of that major push of the continuous monitoring that we're going to do this Summer are really going to be very aggressive, essentially pushing the solution into the Asia Pac marketplace. So, where we have a good presence everywhere, it is all about -- it's more from this SME/SMB market, so we want to bring, in fact, more automation to our Business there.

That leads me to speak about the SME/SMB business. That re-packaging that we did is now bearing its fruits. We have very good growth rates on our SME/SMB business. We are taking a lot of these away from the competition. And I think we're primed to really push it into Asia Pac.

We can localize it also as well, because now it is fully [worldwide], so we have a lot of things to play with and, of course, we have the power of the platform, which allows us to very cost effectively continue our strategy of try and buy. So, you have nothing really to install, and so it's very effective.

And I think Asia Pac is also now warming up to the cloud, when, in the past, they were like Europe was, and like the US was -- always: no, I want to have the software in-house. Today, everybody realizes the cloud is obviously is where you want to go.

Great. Switching gears to the Heartbleed vulnerability, just given how extensive that vulnerability is, can you talk about how much that drove inquiries and perhaps expanded the sales pipeline? Are you already seeing that translate into business for the VM side of your revenues?

First of all, in terms of the product itself, the detection tool that we provided to our customers, which is now totally integrated with our Qualys cloud offering, that's where you see the cloud allows customers to admittedly find out where they are vulnerable and what to do with. Compared to some of these other competing solutions that we have seen, the quality of our detection has been far superior; so, extremely well received by all of our customers. We're not charging for that, of course.

We created the dashboard, which really essentially allows us not only to find just vulnerabilities, but also to control much better your digital certificates. The issue that most company have today is that they don't have really good solutions to make sure that their digital certificates are up to date. So, all of what we provide here is one place where you can really look at all of your digital certificates and control them much better.

So, as far as driving, yes, it is driving a lot of new business. There is no question about that. And, again, for us it is just one functionality; it is not a business on its own. But it is one feature that Qualys has demonstrated that we can deliver to the market extremely quickly in a record time. We were the first one out there to have the tool, and with the best quality that you could ever think, which is, again, the nature of Qualys.

The probability, quality, the enemy of security, and what makes security very difficult is you have to eliminate false positives and false negatives. It is like when you do mammography, you have to absolutely make sure that you can detect if there is a tumor or that, of course, you want to make sure that you don't miss one. So, you don't want the false positives; you don't want the false negatives. That is what we have done very well with that specific instance of vulnerability.

Have you found that most organizations have already patched the vulnerability?

No. You mean today? We know from our customers, of course, they put a huge priority into that. In fact, we got praises from the fact that it was very easy to do with Qualys, at organization like the State of Colorado, for example. That's what we bring to the market, and of course, it enhanced the trust that our customers have in us because we deliver a solution that works and deploys. But that was a very good case, if you prefer, for Qualys.

Great. Thank you very much.

Rob Owens of Pacific Crest Securities.

Thanks for taking my questions. Don, I wanted to drill down on the guidance a little bit for the second quarter and for the year. If I look at the sequential ramp at the midpoint, I think it is a little bit less than you've seen actually in each of the last five quarters. You mentioned how Q1 benefited from the early closing of deals in the month of January. Can we assume from your guidance, then, that April wasn't quite what January was, and you should see that go back to normal linearity?

Second, given the beat of the high end of the range in Q1, why not increment guidance for the year?

Yes, so, working backwards, because I think the more important question is the second one. It is just too early in the year. We had a good first quarter; we'll keep an eye on guidance as we work our way through the year, but it is only Q1.

Again, we did the 22%, which, as I said, we benefited a little bit by some early rev rec, which is a good thing, but not something I'm counting on, to get to the first part of your question. I think April was a normal first month of the quarter. And we've had, as you know, Rob, because you've followed us a long time, our historical patterns are pretty steady; nothing negative in going back to the established pattern. But we had a little better pattern than usual in Q1, which gave us that extra little boost of revenue growth, which was good, but I'm not counting on it going forward.

If you dissect Q1, was there any particular vertical -- obviously, a lot of focus on the retailers here as of late?

It was the most balanced growth quarter I've ever seen here, across product lines and regions and verticals. It was amazingly well balanced.

Okay. And then on the pricing side, what are you guys seeing? Are you seeing it hold? I know there's some -- I won't say newer competition, but it seems like some of the competitors are getting more aggressive at this point.

We saw in Rapid7, just to name a company, a few years ago being very, very aggressive in terms of pricing, to try to displace, because if you look at these companies, where can they go? They have to go, of course, to try to gain market share. So, they were very aggressive; we resisted very well.

We see today pricing pressure, but we fend that off very well because of our platform. Because when you start to add -- even if one of these competitors give away their product, here we come back and say: Yes, but by the way, we have all of these other solutions here, and they all work together; it's all integrated. So, we do TCO analysis, which favor us significantly because of the costs that we eliminate.

So, I think we can resist that pricing pressure for some of our competitors. We did that very well with Rapid7, and now, if we see anybody else doing it, none of them have the solution that we have as a platform -- all integrated, all delivered as a cloud service.

Great, thanks, Philippe. Thanks, Don.

You're welcome.

(Operator Instructions)

Sanjit Singh of Wedbush.

Congrats, Don and Philippe, on a great quarter. My question on renewal rates: Don, if you could update us on the metrics there of -- both on SMB and enterprise -- if you saw any changes on the renewal rates?

No, we continue to see high-90%s renewal rates in the enterprise, and about 10% less at SMB -- steady, solid, renewal rates.

Great. Philippe, I know a couple quarters ago we were talking about federal government. And I wanted to get what your expectations on what you think the federal government could look like this year? Not necessarily from a quantitative point of view, but maybe from a go-to-market standpoint, are you making progress in federal as we look to the September quarter?

Yes, I think in the federal -- first of all, we're not expecting significant revenues in 2014. However, we are now on federal contracts, we are looking at expanding our partnerships. Again, the federal government now is much more receptive to cloud solutions with our private cloud that give us the capabilities to answer the need much better.

So, we have hired a very seasoned executive, and I'm very happy with the way we're approaching that market. That market should start to really represent business for us in 2015.

Great, thank you. In terms of the new product roll-outs, I know you -- web application firewall just was available for GA in recent weeks, and you have a whole slew of other products coming out. From a revenue perspective, which of the products do you think is your nearest-term opportunity? Is it going to be continuous monitoring or maybe the web application firewall, from a revenue perspective?

You know, it is very clear, as we discussed, all of these new services take some time to reach maturity. That's the pattern -- again, security is looking for best of breed. It doesn't immediately ramp up.

Continuous monitoring: It is a huge differentiator, which I think will generate new business. In terms of add-on to existing customers, this is not going to represent significant amount of revenues; however, I think it is a significant wedge into entering new customers.

The web application firewall: We need, again, to mature that solution a little bit more. Policy compliance is getting stronger and stronger. Web application scanning is getting stronger and stronger.

So, it all works on its own, but we need to have some patience because you have to be best of breed, and as well as integrated. And that's not a technological thing easy to do. As we very well know, McAfee tried to do that by acquiring companies and integrating all of that with ePO. Symantec tried to do the same thing; and of course, with enterprise software it is extremely difficult. Delivering that as a cloud architecture makes it possible, but it is still hard to do, which I believe is a huge barrier to entry that we have [created] here.

Thank you for that answer.

And my last question kind of relates to the overall environment. Q1 saw a lot of these big headlines that caused a lot of attention. My question is: Did these headlines -- are they creating a burst of spending right now, and that's something that would potentially subside going forward? Or are you seeing more broader strategic conversation with your customers that would imply a more sustainable spending environment going forward?

That is a very good question. It did effectively create a burst for a certain category of vendors, which claim that they got the solution for the problem, where the problem is acute. But customers -- security people -- they really understand that this is not -- security, there's not one simple bullet. It is good, I think, for our customers because they can get more budget, which that's been always the fight of security.

This being said, you do have solutions that deploys a cost effective that you need to have people who know how to manage it. It is not that easy.

So, to answer your question, it did create a burst for a certain number of vendors, which have a specific solution to the problem we see. But ultimately, I think it is creating a very strong trend, and customers are really looking. They realize that they have got to really create -- get platform like Qualys. We are hearing that from all of our customers. So, the platform play is becoming crucial for every security companies, you know, looking forward.

Great. Thank you so much. Congrats.

Robert Breza from Sterne Agee.

Hi, thanks for taking my questions. Most of my questions have been answered, but, Don, I know you talked about the sales capacity and the headcount. Can you talk about the general hiring trends, as you think about them through the year, just for the other component? Thanks.

Yes, thanks, Robert. We've never been able to predict this. It depends on finding the right people at the right time, but we're pretty much one-fourth of the way through in one quarter. So, it looks like a well-oiled machine at this point. We should just march right through the year, right?

We hope to, like I said, add 25 to 30 for the year. I don't know the pace, exactly. We're interviewing people constantly, and trying to find the right ones.

One thing I could add to what Don did was: Significantly expanding our operation in India, for our engineering operation, our ops, our operation team in India as well. And we are able to really recruit very, very top people there. So, this is also encouraging because, as you very well know, the cost of acquiring individuals in India is still far lower than it is in the US.

But what drive us is not the cost, let me be sure about that. It is the quality of the people. So, we have very strong engineering team now in India, and now operations. We're also going to expand our customer support capabilities there as well.

Thank you.

Thank you. I'm not showing any further questions in queue. I'd like to turn the call back over to Philippe Courtot for any further remarks.

Thank you all for joining us today. We are pleased with our strong performance and continued momentum in the marketplace as we work our way through 2014. We believe that we are well positioned to deliver best-of-class security and compliance solutions to our customers and partners, as we continue to expand our cloud platform and deliver more innovative solutions, as I just mentioned during our Q&A sessions.

Should you have any follow-up questions, Don and I are available to you, and we look forward to speaking with you next quarter. Thank you very much.

Ladies and gentlemen, thank you for participating in today's conference. This concludes today's program. You may all disconnect. Everyone, have a great day.