Qualys Inc (QLYS) 2014 Q4 法說會逐字稿

Good day everyone, and welcome to the Qualys fourth-quarter and full-year 2014 investor conference call. This call is being recorded.

(Operator Instructions)

I would now like to turn the call over to Don McCauley, CFO of Qualys. Please go ahead, Sir.

Welcome to the Qualys fourth-quarter and full-year 2014 investor call. I'm Don McCauley, CFO, and I'm here with Philippe Courtot, our Chairman, President and CEO. We would like to remind you that during this call, management expects to make forward-looking statements within the meaning of the federal securities laws.

Forward-looking statements generally relate to future events or future financial or operating performance. Forward-looking statements in this presentation include, but are not limited to the following: statements related to our business and financial performance and expectations for future periods, including the rate of growth of our business; our expectations regarding capital expenditures, including investments in our cloud infrastructure, and the intended uses and benefits of those expenditures; trends related to the diversification of our revenue base; our ability to sell additional solutions to our customer base; our plans regarding the development of our technology and the expected timing thereof; our expectations regarding the capabilities of our platform and solutions; the anticipated needs of our customers; the strength of demand for our solutions; our strategy; the scalability of our strategy; our ability to execute such strategy and our expectations regarding our market position; the expansion of our platform, the expansion of our partnerships and related benefits of such partnerships; and our delivery of new solutions.

Our expectations and beliefs regarding these matters may not materialize, and actual results in future periods are subject to risks and uncertainties that could cause actual results to differ materially from those projected. These risks include those set forth in the press release we issued earlier today, as well as those more fully described in our filings with the securities and exchange commission, including our quarterly report on form 10-Q that we filed on November 6, 2014. The forward-looking statements in this presentation are based on information available to us as of today and we disclaim any obligation to update any forward-looking statements, except as required by law.

We also remind you that this call will include a discussion of GAAP and non-GAAP financial measures. The non-GAAP financial measures are not intended to be considered in isolation, or as a substitute for, results appeared in accordance with GAAP. A discussion of why we present non-GAAP financial measures, and a reconciliation of the non-GAAP financial measures discussed in this call to the most directly comparable GAAP financial measures, are included in our earnings press release that is available on our website.

Now to begin the discussion, Philippe will provide an overview of the company's performance for the quarter and full year 2014. Then I will cover our financial results, and factors that drove the quarter in more detail, as well as our Outlook for the first quarter and full year 2015. Then we will open up the call for your questions.

With that, I will turn the call over to Philippe.

Thanks, Don. And welcome to all of you. The fourth quarter of 2014 was a record quarter for Qualys, underscored by the continued acceleration of our revenues, by the impressive acceleration of our free cash flow and increased profitability.

This was a consistent theme for the entire year as Qualys significantly increased both revenues and profitability in 2014. We added over 1000 new customers in 2014, a significant acceleration over the 550 we added in 2013. Ending the year with over 7700 active prescribers worldwide. Don will cover the financial details of our performance for the quarter and full year, but let me first start off with an overview of key highlights that are driving the momentum in our business.

In the fourth quarter, we added a number of important new accounts, including Associated British Foods, Blue Cross and Blue Shield of Minnesota, Blue Shield of California, Bridgewater Associates, British American tobacco, Cadillac Fairview, Dimension Data Cloud Solutions in Australia, Gatwick Airport, Graham Holdings, Halliburton, HIS, Inc., Michigan State University, Netflix, QBE North America, Rexam PLC, Siemens AG, The Church of Jesus Christ of Latter Day Saints, Tyco International, UC Health and Yellowpages.com.

On the partnership side, we continued expanding our global partnerships and established significant new strategic partnerships with managed security services providers, including Telstra in Australia, Orange CyberDefensive in France, and DMI, a federal contractor based in the US. These new partnerships allows us to further expand our reach in both commercial and federal markets across the globe.

These partnerships are unique, as they deliver the complete suite of quality security and compliance offerings, fully integrated with their managed services, which can be seamlessly delivered from either our shared cloud platforms or via product cloud. Orange CyberDefense, for example, expanded their sovereign cyber defense services with ours, which is allowing Qualys to reach customers and markets we could not serve through our shared platforms.

We saw accelerated adoption for our new services, namely Web Application Scanning, Policy Compliance, Continuous Monitoring, and Private Cloud Platform, as well as continued expansion of our industry-leading Vulnerability Management solution. As a result, at the end of 2014, 54% of our customers have now purchased more than one solution.

This momentum underscores the power of our disruptive cloud platform, as well as the rapid adoption of our newer solutions. This is clearly a promising trend, as supported by the fact that these metrics stood at 20% at the end of 2012, and 30% at the end of 2013.

In the fourth quarter, we released new versions of our Web Application Scanning, Policy Compliance, and Continuous Monitoring for their perimeter. Each of these your new releases added new capabilities and work flows that are designed to better address the increasing needs of our customers, to help them better protect their corporate data from cyber attacks. Thanks to our cloud delivery remodel, such improvements are delivered transparently to our customers, and at no additional cost, allowing us to maintain very high renewal rates and stickiness as we continue to provide increased value to our customers.

For Continuous Monitoring, we are expanding the solution from the perimeter into internal IT systems, due to the high demand from our customers. This new service will be available this quarter.

As indicated in our last earnings call, we are on track to deliver a key extension of our Web Application Forward, or WAF, and we are now gearing up to fully announce Web 2.0 at the RSA conference in April, with a new automated rules engine that provides customers the ability to do virtual patching for variability in their web applications.

In the fourth quarter, we saw strong demand for our Private Cloud Platform, which allows customers to use our full suite of security compliance solutions while keeping all data on premise. Demand is particularly strong in Europe and the Middle East, due to data sovereignty requirements from our partners and customers.

While now further expanding the reach of our private platform to make it fully disconnected from the Qualys stock for days and monitoring, to address customers in the defense sector and other highly classified environments. We're expecting to deliver our first version of this disconnected platform in the second quarter.

We are also making great progress with new solutions currently under [deblockness], namely the cloud agent and the log management and analytics technologies. We demonstrated these groundbreaking capabilities to our customers at our annual user conference in Las Vegas and in Europe last October.

The cloud agent delivers the ability to drop a lightweight agent on IT, in an IT asset, for continuous assessment of its security and compliance posture and keep it up-to-date. It's intelligence is key in securing IT assets in the enterprise, especially in mobile workforce environments or in environments where virtualization is predominant.

This agent technology is designed to schedule millions of devices and therefore we believe, it allows us to expand our footprint within the enterprise into areas where our current remote scanning technology doesn't reach. We plan to release the cloud agent, in beta, in Q2 of this year.

The Web Log Management and Analytics solution, which will come fully integrated with our Web Application Scanning and Web Application Forward solutions will help customers improve web log management and increase the protection for their websites through continuous detections of web threats, automated alerting, and mitigation. We plan to release Web Log Management and Analytics in the first beta, in Q2 of this year as well.

Late last month, our newly formed Qualys malware and vulnerability research lab discovered the ghost vulnerabilities in the leaders at GNU C library and released a security advisory. Ghost is categorized as a high-severity vulnerability that allows attackers to remotely take control off an entire system without having any prior knowledge of systems credentials. The same day, we also released a detection for this vulnerability, so our customers could immediately start scanning their IT systems and track remediation progress.

Finally, Qualys won three Information Security magazine awards, and a searchsecurity.com 2014 Reader's Choice award for Risk Policy Management, Vulnerability Management, and Application Security. Qualys was also honored by Frost & Sullivan with a 2014 Company of the Year award.

Now for a review of our national performance, and our guidance, I will turn the call now to Don.

As Philippe said, the fourth quarter and full year 2014 were very strong at both the top and bottom lines, as our business made significant progress on all fronts. Revenues in the fourth quarter grew to $36.6 million, which represented 26% growth over the fourth quarter of 2013. For the fourth quarter, US represented 70% of revenues, which is the same percentage as a year ago.

Our current deferred revenue balance at December 31, 2014, was 20% greater than at the end of 2013. Full year 2014 revenues grew 24% to $133.6 million. This represents strong revenue acceleration, as our revenue growth had been 18% in 2013.

Let's drill down into the full year revenue growth. In 2014, total revenues grew by $25.6 million to the $133.6 million that I just mentioned. Revenues from customers existing at or prior to December 31, 2013, grew by $15.7 million in 2014, to a total of $123.7 million. This number represented 114% of 2013 revenues.

This compares to a prior year view, where revenues from customers existing at or prior to December 31, 2012, increased by $8.7 million, to a total of $100.1 million in 2013, which represented 110% of 2012's total revenues. Revenues from new customers that were added in 2014 contributed $9.9 million to our 2014 revenue growth, compared to a $7.8 million contribution from new customers to our 2013 revenue growth. So as you can see, Qualys made very good progress on growing revenues from new customers, but the much larger contribution to the 2014 revenue growth came from the expansion of revenues from our existing customer base.

Our Vulnerability Management solution continues to grow at an accelerated rate and remains the largest component of our business. At the same time, we continue to make progress in diversifying our revenue base. We derived 80% of fourth-quarter revenues from subscriptions to our VM solution, compared to 84% for the same period in 2013. This ongoing diversification of our revenues is primarily due to increased sales of our Web Application Scanning and Policy Compliance solutions which continue to grow by more than 50% year-over-year.

GAAP gross profit increased to $29.1 million in the fourth quarter of 2014, compared to $22.5 million for the fourth quarter of 2013. GAAP gross margin was 79% for the fourth quarter of 2014, compared to 78% in the same quarter of 2013.

Non-GAAP gross margin was 80% for the fourth quarter of 2014, compared to 78% in 2013. For the full year, 2014 GAAP gross profit increased to $104.6 million, compared to $83.3 million in 2013. And the GAAP gross margin was 78% for 2014, compared to 77% in 2013. Non-GAAP gross margin was 79% for 2014, compared to 78% for 2013.

Adjusted EBITDA for the fourth quarter of 2014 increased by 139% to $10.7 million, compared to $4.5 million in the fourth quarter 2013. Adjusted EBITDA as a percentage of revenues increased to 29% in the fourth quarter of 2014, compared with 15% in the same quarter in 2013. For the full year, adjusted EBITDA increased by 82% to $31.7 million, compared to $17.4 million in 2013. And as a percentage of revenue, adjusted EBITDA increased to 24% in 2014, compared to 16% in 2013.

Qualys generated impressive cash flows in 2014. Net cash from operations increased by 65% to $41.4 million, compared to $25.1 million in 2013. Free cash flow increased by 138% to $27.4 million, compared to $11.5 million and 2013.

Moving on to earnings per share, the first thing to keep in mind as we discussed GAAP EPS, is the one-time benefit in the fourth quarter of 2014 related to the tax benefit recorded for the recognition of deferred tax assets. For ease of comparisons, we have not included this one-time benefit in our non-GAAP EPS amounts. This adjustment added approximately $0.63 per fully diluted share in the fourth quarter, and approximately $0.64 for the full year 2014, again just to our GAAP EPS numbers.

For the fourth quarter 2014, GAAP EPS was $0.69 per diluted share versus a GAAP EPS of $0.00 per diluted share in the fourth quarter of 2013. Non-GAAP EPS was $0.15 per diluted share in the fourth quarter of 2014, compared to $0.05 per diluted share in the fourth quarter of 2013.

For the full year, GAAP EPS was $0.81 per diluted share, versus GAAP EPS of $0.05 per diluted share in 2013. Non-GAAP EPS was $0.46 per diluted share in 2014, compared to $0.20 per diluted share in 2013.

If you were to back out the one-time effect related to the tax benefit for the recognition of deferred tax assets, again, of $0.63 for the fourth quarter and $0.64 for the full year, you would see that we significantly grew each GAAP EPS measure over its 2013 equivalent. And also as you can see, it's clear that we exceeded our previously announced guidance ranges, with or without the one-time tax benefit.

Turning to our balance sheet, we continue to have a strong cash position as we ended 2014 with $167 million in cash and no debt. In the fourth quarter of 2014, capital expenditures were $3.7 million, compared to $3.3 million in the fourth quarter of 2013. For the full year 2014, capital expenditures were $13.9 million compared to $13.7 million in 2013.

In the first quarter, we expect capital expenditures to be in the range of $5.5 million to $6.5 million as we expand our cloud infrastructure to support more customers and add more solutions and functionality to our shared platforms, as well as to prepare for the increasing demand of our private cloud platforms.

Now, turning to our guidance for the first quarter and full year 2015, starting with revenues, for the first quarter, we expect revenues to be in the range of $37.6 million to $38.1 million. At the midpoint, this represents 25% growth over the first quarter 2014 revenues. For the full year 2015, we expect revenues to be in the range of $167.3 million to $169.3 million. At the midpoint, this represents 26% growth over 2014 revenues.

For earnings per share, we expect GAAP EPS for the first quarter of 2015 to be in the range of $0.04 to $0.06, and non-GAAP EPS to be in the range of $0.10 to $0.12. Our first quarter EPS estimates are based on approximately 38.0 million weighted average diluted shares outstanding.

For the full year 2015, we expect GAAP EPS to be in the range of $0.22 to $0.27. Non-GAAP EPS is expected to be in the range of $0.50 to $0.55. Our full year EPS estimates are based on approximately 38.6 million weighted average diluted shares outstanding.

And now that we have recognized deferred tax assets related to our previous full valuation allowance for income taxes, for the first time we have assumed a normal income tax rate in our EPS guidance for 2015. For both the first quarter and full year 2015, for GAAP EPS and for non-GAAP EPS, we have assumed an income tax rate of 35%. And even with income taxes now taken into account going forward, both our GAAP and non-GAAP EPS estimates are higher than last year's first quarter and full year GAAP and non-GAAP EPS amounts.

So in summary, what you're seeing in these expectations is a continuation of the strong sales execution that we experienced across our various solutions and sales regions in 2014. Our outlook also reflects the power of the cloud platform that we've built, with customers increasingly purchasing multiple products from us. In short, our land and expand strategy, and our business model, are working very well.

With that Philippe and I would be happy to answer any of your questions. Operator?

(Operator Instructions)

Our first question comes from the line of Sterling Auty with JPMorgan. Your line is now open. Please proceed with your question.

Yes, thanks. Hi, guys.

On the strong growth that came from existing customers, how do we think about the balance of that, that came from increased adoption of DM versus the up-sell, cross-sell of the additional solutions?

Hi, Sterling this is Don.

Pretty balanced. Pretty similar to prior quarters. We're getting both significant up-sells from existing customers. We've seen that for the last four or five quarters, on Vulnerability Management, as they expand those programs. And we just continue to see more and more strengthening of Web Application Scanning and Policy Compliance.

Philippe read you the metric of more and more of our customers buying multiple solutions. And so, it's really been pretty balanced.

And then, when we roll that forward to looking at 2015 guidance. Given the number you added, I think it was north of 1,000 new customers this year, is it really those customers coming back for their second and third purchases, that should drive an increase into that metric? So maybe we see the same dynamic happen in 2015, that we saw in 2014?

Well, the strong pickup of new customers certainly adds a lot more up-sell possibilities. But keep in mind that, our up-sells occur throughout our customer base. We've done some studies of our customers over time here, and they continue to expand over a 10-year period, substantially.

But having extra almost 500 new customers last year certainly gives us a lot more to work with for up-sells this year.

Yes, and I would add to what Don just said. If we look at our existing customers, we are still significant. Even with our largest customers, we see that significant up-sell opportunity. And with our new customers, what we're seeing today is that the average, if you prefer deals on your revenue, is significantly greater.

So essentially, all the pieces of our business are growing, and very naturally. And of course, the more services we deliver, the more sticky we become, and we bring more value to the customers. They're all looking to have less vendors, not more vendors. And so you can see really now, the effect of our disruptive platform. Which is now, really starting to show.

Okay. And maybe just one last one if I could, Don. How should we think about the cash flow outlook for 2015, in light of the commentary about taxes and CapEx, that you made.

Yes, so in terms of cash flow, Sterling, there won't be any impact. We're still not a US taxpayer. We have significant net-operating losses. So we will be recording book taxes, and we'll actually be starting to use up our net-operating losses over the next few years. So really not a cash effect.

Great. Thank you.

Our next question comes from the line of Philip Winslow with Credit Suisse. Your line is now open. Please proceed with your question.

Hi, this is Siti Panigrahi. Congrats on a good quarter.

Thank you.

Obviously you guys are seeing acceleration in your new product's adoption. And I just started expanding your portfolio, as you highlighted on the call. How should we think about your global market strategy? Both in the direct and channel partners?

And also, could you talk about your sales headcount in this quarter, and how should we think about that for 2015?

So, you know, as you just said, our business is expanding. And we have fine, very powerful partners. And we can see that momentum coming from our partners. We are becoming more strategic to our partners than we were in the past. Because instead of having just to sell one single solution, which was be the DM Vulnerability Management solution, today, essentially, can bring the entire suite of Qualys to these customers.

I mentioned some of the new agreements we've made with Telstra in Australia. And we see our partner business expanding, as well as our direct sales business. So for us, I mean, we will have built a highly scalable model, delivering all these different point solutions out of the same platform. Properly managed, it illuminates a lot of costs for our customers, makes it much more deployable, and the same for our partners.

So what we see with our partners is that, they start to realize that Qualys brings them significantly more net-margins than your traditional enterprise software solutions. So they are starting to be very interested buyers. Because not only we bring them the recurrent business, but also it's a business which grows over time as Qualys does. But also a business which is significantly more profitable than your traditional enterprise software solutions.

Siti, this is Don. Your last question was about the sales headcount, I think?

Yes.

In Q4 -- we had ended Q3 with 124 folks in sales, up from 120 at the end of last year. We added 11 in Q4 and ended with 135.

Okay. Great. Thank you.

Our next question comes from the line of Matt Hedberg with RBC Capital Markets. Your line is now open. Please proceed with your question.

Yes, guys, thanks for taking my questions and I'll offer my congrats as well, on the quarter.

Your revenue continues to accelerate, but I think what stands out to me also is the profitability. It really looks to be running ahead of schedule here. Now, I think when you guys went public, we were always under the assumption, kind of in a long-term margin between call it maybe, in the mid-20s. And you just reported obviously a 20% margins this quarter.

I think, per our math, you're looking for maybe 18% to 19% margins in 2015. How should we think about the long-term model now? Have some of your assumptions changed?

Hi, Matt.

No, our assumptions really haven't changed. But as you note, we're getting further along in our progress. I think we still look at, for example, an adjusted EBITDA margin in the range of around 30% over the next several years. And you know, I think it shows that we are on track, is I think what it shows.

Yes, what I would add to that is, that you can see in our period, we have much more data points on the curve. And what these data points are really telling you is that, our business is absolutely scaling very well. And so that's really what the conclusions we can reach now, when we went public with fewer data points.

And in fact, some people were estimating that our business would not really generate more than 20% growth. And when in fact, we knew all along that will happen. It was just a question of getting the time to bring these new services, et cetera, and expand our partnerships. And this is exactly what has happened now.

That's great. And it sounds like there was a question earlier on the channel, and it sounds like you added 11 headcount in sales and marketing Q4. Should you guys be even hiring even faster? Is this more about balanced growth at this point?

So, what I would say here is that, if you really realize today, what was the business model, that we're done. In the early days, Qualys was essentially selling directly. About three years ago, only 16% of our revenues were coming from indirect channels.

And the reason why, as we discussed in previous earnings call, is because our model was not really well accepted at the time by the security professionals. They were really foreign to the notion of security delivered from the cloud.

After time, that balance has shifted. And now today, more than 40% of our revenues is coming from partners. And this continues to accelerate. I mentioned earlier that, in the previous earnings call, that today all the engines of sources, [backpacks], ventures, emphasis, et cetera. All of them, take Mahindra, are not only Qualys users, but have become also Qualys partners.

So, all of that naturally accelerates, if you prefer that trend, to our having partners delivering the Qualys services. And that of course means that, we don't need to put as many direct salespeople in front of the market. And ultimately, it may not -- of course when you sell directly, you have higher revenues, because of the margin we give to the partners. But on the other hand, you have significant cost of sales because you need to have, and keep, a very expensive sales headcount.

So we have a very balanced approach, where we clearly see significant pickup from our partners. And I will take for example, if you look at the foreign markets, when you start to have partners like Orange CyberDefense, like Telstra, they have essentially a lock on some portion of this market. And they become much more cost-effective to reach out, this kind of markets, than to build a direct sales force.

Very helpful, guys. Thanks a lot.

Our next question comes from the line of Rob Owens with Pacific Crest Securities. Your line is now open. Please proceed with your question.

Great. Thanks.

Focusing on the VM side of your business, it grew about 19% to 20% this year. As you look at 2015, the acceleration there, what would you expect from that portion of the business, number one?

Number two, you had mentioned a lot of new customer wins on that front as well. Are those displacements? And if so, who are you displacing? Or is there some green field opportunities out there?

So, to answer the first question, our VM business is very strong and continues to remain strong. It's fueled, essentially by more displacement, essentially from our competitors. And the second is also about the fact that our existing customers are further expanding their VM application. So that's -- this is, we see the trend of the strong strength of the VM business continuing, looking forward. We don't see any de-acceleration of that business at all.

As far as the new customers are concerned, essentially, with the -- it's a combination of displacing, of existing enterprise software solution, which of course, that problem of scaling, very expensive to manage. But also, we create a kind of new opportunities. We're changing the market.

For example, I will give you a specific example with our Web Application Scanning. We're competing in displacing some of traditional enterprise security software solutions there. But we are also expanding the market considerably.

With your traditional enterprise software solution, you can, for example, look at the vulnerabilities of maybe hundreds of applications, 200 are the most. With us, we simply allow our customers to look at their entire web application, now which counts in the thousand. So we make that cost effectiveness. In that sense, we are changing the market. It is not so much of a displacement, it becomes a huge expansion of the market that we are creating.

With our Web Application [Firewall] 2.0, then we will have a very interesting solution because, now not only could you identify and scan thousands of web applications, but now you're going to have an approximate mean of virtual patching, or patching the solutions, with the forthcoming functionalities of the virtual patching totally integrated with our Web Application Scanning.

And a quick one for Don, how much of your business now, is coming through the service provider channel? And how does that compare year over year?

Yes, about 40% of our business comes in directly, Rob. I don't have a metric in front of me of service -- by service providers you -- who exactly do you mean?

MSSPs.

I suspect that it's at least half of that, but I don't have a metric in front of me. We have never released a metric on that. But it's a significant part. We are partners with almost all of the significant MSSPs.

My sense is, that's been one of the better growth areas, in that indirect channel, correct?

Not really. Because we're seeing today, as you can see, there's a consolidation which is taking place as well, which is very natural. On the -- with the security consulting firms, so you see companies like Accuvant, for example, and FishNet specifically merging. And that, in fact, makes us even do more, doing business with both of them.

I really believe the combination of these two companies together are creating a much more powerful consulting, if you prefer organization, and therefore it's very good for us.

Thanks, guys.

Our next question comes from the line of Steve Ashley with Robert W Baird. Your line is now open. Please proceed with your question.

Thank you. I would just like to drill down on a couple of areas that we've already been talking about. One, in terms of sales reps, added 15 net this last year, what kind of growth might we expect in the coming year 2015?

Yet, Steve, our plans are to probably hire 20 to 25 this coming year.

And we talk about the indirect business being 40%, is the expectation that that will rise, as a percentage of your total business going forward?

I think it should rise, here. There are two elements here. As, if you look at the -- what's interesting here is that, we are doing bigger and bigger deals with our existing customers and direct customers. Which some of them, you know, are doubled their subscription. So that offsets, in a way, the growth of our indirect channels.

So you have a kind of -- if you prefer, the combination, one offsets the other in some ways. So I think, yes, we are going to see growing our indirect business. But it's going to be in term of revenues. It's going to be probably kind of a, gaining a few more points every year.

And at some point in time, ultimately the business will be very driven through the channel. As more and more companies would prefer to get the entire refund, one big partner. So, but that will take some time. It's a natural evolution.

And in terms of the fourth quarter for the core VM business, is that growing still in that 19% to 20% area?

Yes, Steven, it continued to accelerate again to about 20%.

And the expectation kind of baked into your guidance, I'm assuming, maybe kind of stay at that rate, that growth rate? Or get a little better in 2015?

Well, you know, we've been on a -- we've had about five or six quarters in a row where we've seen kind of a steady acceleration of that metric. And you know, usually at Qualys, when we see a trend start, it usually starts with the slow steady trends, they tend to continue for a while. So we never take a crazy view in anything going forward, but we feel pretty good about the momentum that we have in that business.

It's a big base, obviously, and I think it continues to grow pretty healthy. So I think the answer to your question is yes.

Perfect. Thanks, guys.

Our next question comes from the line of Craig Nankervis with First Analysis. Your line is now open. Please proceed with your question.

Thanks very much, it all sounds very exciting.

Philippe, interested on virtual private cloud commentary. Are you starting to, do you believe, see an inflection point here with that form factor, and if so why? Or is it more a one-time spike that you saw in the quarter? If we could start their.

That's a very good question. In fact, we are investing more into making our virtual private cloud even easier to, for us to build, if you prefer to deliver. Because we see that as a significant -- as a very unique delivery model.

What is important to understand is that, first of all, this is exactly the clone of our share platform. So this is not another piece of code, it's exactly the same thing. While remotely managing these product clouds, we have about 14 of those today, now installed, exactly the same way that we manage our remote, our shared platform.

So the reason why we see an uptick is for two reasons. Fundamentally, one is, from large companies, which are for example, adopted Qualys as there standard Vulnerability Management solution and now are looking at Qualys as their global compliance solutions.

So they are starting to put more data with more, what they call sensitive data, like credentials, for example. So for them to take a virtual private cloud, that now a bigger reason. And also they keep the data into the walls of their enterprise. Which made satisfied some compliance or requirement that they may have.

So that's a natural extension of our business. We do not push it. It just depends on customer demand and their degree of [maturity].

So that's very healthy. We have very large customers. Today if you do not like Microsoft, and quite a few other ones, which are that private cloud solution, as I mentioned earlier.

Now the second element is essentially driven by that, I would say initiative that most foreign governments have, and including the US of course as well, of creating a cyber sovereign, as we call them sovereign cyber defense solution.

And of course Qualys comes here with a very attractive proposition. Because we can deliver, as I mentioned earlier to a company like Orange CyberDefense, our virtual cloud. And now they can integrate within their own infrastructure, with all the level of securities and regulation required by the French in that case, the ANSI in [ASI]. And now deliver in the junction to all these other services that they bring to the market, the Qualys solutions.

So we are really, absolutely a real match for them. And we see that happening as I mentioned, in France, in Australia, in Saudi Arabia, in Dubai, and in Germany. And of course, we are now further expanding that opportunity by working on providing a disconnected version of the same product cloud, whereby we can train an operator to operate the Qualys, if you prefer stock, by themselves. So in that case we could enter now into market, which so far, have been markets that we could not really address, which are essentially the defense-related market. So whether it's in the US or whether it is broad.

Do you see virtual private cloud? If you look out 12 months, or maybe 18 months, is virtual private cloud a fringe contributor to your growth? Or do you expect it to be something more than that?

So two things. We see that a huge enabler of our growth, in that sense. Not so much the subscription for the private cloud itself. You have to realize that the private cloud drives also, additional subscriptions for the VM, the Policy Compliance, the Web Applications of Scanning, our forthcoming -- our web efficient firewall, our forthcoming malware protection service, et cetera.

So by themselves, they do not represent much revenues, but they also will amplify and generate more revenues. So this is a very good driver for our business, again, allowing us to enter markets that we could not really addressed before. Whether it's the federal or whether it's this, for example in France or in Siemens, some bit of companies which are essentially regulated, if you prefer, by these various governments.

Thank you very much. Don, a question for you, just trying to understand in the way the OpEx played out in Q4, perhaps somewhat of a seasonally strong quarter, yet R&D was basically flat sequentially -- It was actually flat through the year, now. But sales and marketing was flat, sequentially. Is that -- was there a one-time issue that enabled you to be so lean in the expanse? Or just -- what should I take away from that profile?

Yes, so two different stories for two different line items. On the R&D line. We have been doing much of our expansion of R&D in India, which has been a pretty recent initiative at Qualys. So that's enabled us to have more efficiency on the R&D line.

No less emphasis on R&D here. As you're well aware, we have many, many projects going. But most of the growth of engineering has occurred in India.

And on the sales line, remember, in Q3 is when we have a lot of the big trade shows and stuff. So, as we look sales and marketing together, there's really nothing going on there usually. It's just a question of, we had heavier marketing in the prior quarter. We actually had, probably heavier sales commissions in the fourth quarter because Q4's our bigger, bulkiest quarter.

So you can start to see also the partner effect that I was discussing about. And in India, we're absolutely expanded and we're continuing expanding our engineering effort. We're extremely happy with our Indian operation, which will, by the way, also expanding to customer support as well and operations. So we're really expanding our Pune office out there.

That's very helpful. Thanks a lot and congratulations.

Our next question comes from the line of Erik Suppiger with JMP Securities. Your line is now open. Please proceed with your question.

Yes, congratulations on a good quarter.

Thank you.

First off, as you look out into 2015, your growth, revenue growth, 25% to 26%. How would you think bookings would compare for that? Would you expect bookings to be higher, lower, same?

We would expect them to be higher. Remember, the way our model works Erik, bookings growth leads revenue growth. So to achieve higher revenue growth, we expect higher bookings.

Okay. Very good.

What was -- last quarter you had noted that you carried a good project pipeline into the December quarter. How did that play out this quarter? Did you also have a similar pipeline at the end of the quarter?

Our pipeline is really growing very well. So I think that's obviously something which is important, but our pipeline is growing very well. And so that has been a trend, by the way. If I go back to last year, we had at the end of Q1 with the bigger pipeline. At the end of Q4 [it's a tra] at the end of Q2 with a bigger pipeline.

We measure our business pretty tightly. And so we have very good visibility. Of course, having a fantastic renewal business, which is much more predictable, than with that big base of customers that we have, would renew and expand the business. It is also makes as much more accurate in predicting how our pipeline is going to be.

But last quarter, it sounded like there was a bit of an anomaly, in terms of a good couple of projects that just closed, as you entered the new quarter. Did you have similar dynamics this quarter? Did you have anything near-term or was it unusually large again?

That's a technicality between the time we invoiced it, and so forth. Maybe Don you want to comment about that. But that doesn't change the pipeline at all.

Yes Erik, I think we had some deals that we weren't able to count in deferred revenues quarter. We weren't able to bill them until a few weeks into the quarter. That doesn't really effect any of the long-term trends, Erik. We pointed it out because it kind of affected the deferred revenue metric. Because we had a little less than $2 million, I think, that was not included in deferred revenue, but were orders that we actually billed the customer for in the first or second week of the quarter.

Okay.

And then lastly, on the Continuous Monitoring, it sounds like that's getting a pretty good ramp here. Can you compare that to either the Policy Compliance or the Web Apps Scanning, and give us a little flavor? Do you think this is quite likely the third leg, in terms of the emerging services? Is this one that you think is going to be starting to grow, alongside those other two?

That's a very good question. In fact, we absolutely measure that ourselves, to try to see of course, historical rates of adoption of our composite Policy Compliance and Web Application Scanning, so we compared this. So just to reminder you, we introduced the Continuous Monitoring for the perimeter only where you have much less IPs than you have of course, for the internal network.

So of course, the dollar being driven by that is not a very significant dollar number. However, we have seen an accelerated adoption. In fact, much faster than our Web Application Scanning and Policy Compliance.

We are now introducing the Continuous Monitoring, as I mentioned earlier in the call, for the internal networks, which have significant more devices. And that is because our customers wanted to be careful.

It's a new paradigm that we've been introducing, where we change Vulnerability Management from a more, if you prefer, batch-oriented system where you scan your network and then you analyze and then you report to a model, whereby we essentially find an anomaly or something, which -- and we turn that into an incidence response.

So we didn't want to bring that too quick into the enterprise before we had enough experience on the perimeter. So we are now introducing this month as -- from the demand of our customers. So we expect that modality to really continue, in fact accelerating. Now in term of revenues.

Now, is that going to be the fastest one or the bigger ones? I would've said this is going to be a very good addition, which probably would add about 20%, let's say, to give your number, to our VM business. That's about what we would expect for that over time. We expect, you know, the combination of our WASP and Web Applications Forward being a significant driver as well.

So again, all that feeds into itself and for our customers, again, it's all the same platform, the same infrastructure, centrally managed, one single consul. It's very easy for them to try, then of course to buy and then to deploy. That's again the big advantage of our -- of that very unique cloud security compliance platform that we have built.

And did you say that would be attached to about 20% of your Vulnerability Management business? Is that what the 20% was?

No, what I would say is that the potential revenue from that Continuous Monitoring solution would be about 20% of the revenues that we have of our installed base, if you prefer. In term of revenues, not of adoption.

I think everybody will adopt the [modality], but that is just a question of time. It's a very natural extension of the VM application.

Okay. Great. Thank you very much.

Our next question comes from the line of Michael Kim with Imperial Capital. Your line is now open. Please proceed with your question.

Hi, good afternoon, guys. For the newer or upcoming products, cloud agent and web log management, can you give a sense of how long we should expect the betas to last? Then, when we might be able to expect those two products to go into general availability?

Okay so very good. So I think today, on both the agents and both web log management system, I think we will have a relatively short data, which is not going to take, probably a few months. Web planning essentially to announce our agent at the RSA in April. And be in GA very soon thereafter.

And I think we plan to have also the log analysis and the log management in Olympics, available two or three months, at the latest in GA. We're making very good progress with the solutions and I mentioned also in the previous call that we're making very good progress on our malware protection service, which we're already planning to launch at Black Hat, in July.

So, a lot of very good new services coming out of the box, out of the gates.

And presumably, the Web Log Management solution, that will probably be most easily crossed with the Web Application Scanning customers and Web App Firewall customers. How about for cloud agent? Does that sort of span more widely for the cross-over opportunity?

Absolutely, so the cloud agent essentially, just to remind all of you about the functionalities. One is the natural extension of the VM application to all of these mobile devices, your laptops, essentially. But on the Mac, on the Windows Mac or UNIX platform. So we have here very significant opportunity because, that is where you have those large number -- the largest number of IPs. So it's a national extension of the VM.

It's also a natural extension of the Policy Compliance. So that's absolutely a no-brainer. What also that agent does, is also providing now, essentially real-time capabilities. So you won't have to scan.

It if you put the agent on a device that's a critical device internally, you will not have to scan it anymore. So that could be a replacement, in a way, of our existing, internal scanning of these servers by a solution, which is much more effective. And that we will also get additional value out of it.

The second version of our agent that will come with our malware protection service, will be also capable of identifying, on those servers or clients, indication of compromises. But that will come later.

But the first releases is absolutely an extension of our vehement Policy Compliance. They are 1 megabyte agent. They are extremely easy to deploy. They are in demand from all of our customers. I mean, they all want to get that thing.

They are currently in first beta with one very large and very prestigious customer, wanting to expand that second beta program now, as we speak. So this is looking very good.

Great. And then just briefly on Web Application Firewall, did that have a meaningful contribution in the quarter, to the revenue line? And is it your expectation that version 2.0, post-RSA, you might see a possible inflection in that adoption rate?

Yes, so we have not really pushed the Web Application 1.0 because it was essentially missing the key functionalities, and a couple of other ones, which is that virtual patching. So what we did, conversely, is that we received a very good acceptance. We have an engine which is extremely good. That's all the feedback we're getting from our customers.

This is, with that Web Application Forward 2.0, that's [170] I think. We are the solution to the problem that every company has today. I need to know how many web application I have. I need to know the vulnerabilities, and I need to find a way to essentially protect them, or if you prefer, mitigate those vulnerability's.

And today, nobody has the solution that Qualys is coming up to market. So we expect then, as you said, that that will be a pretty quick update of our solution.

And pricing is pretty similar to the Web Application Scanning? Or can you give us a relative sense?

Yes, I mean, this is a little bit different. Because here you have the web app, yes, because we essentially charge for application that you protect. Yes, it's about similar.

Okay. Great. Very good. Thank you very much.

The next question comes from the line of Robert Breza with Sterne Agee. Your line is now open. Please proceed with your question.

Hi. Thanks for taking my questions.

Don, I was wondering if you could help us understand a little bit of the dynamics around deferred revenue? And, obviously the revenues been out pacing deferred. Just help us understand the dynamics going forward as we think about our billings kind of model.

Well, Rob, one of the things we've noticed this quarter was that deferred revenues were only up 20% over a year ago, even though revenues and bookings in our guidance and everything else is more than 25% to 26% range.

And in the reason for that is, we've seen a lot of up-sells from our customers, especially in Q4, where you know you do get budget flush, and so forth. But a lot of the up-sells from customers, they co-term their subscription with their existing subscription. Which means that their initial order for the up-sell, say on average, might be more like a six-month order, to co-term it with their subscription. So what goes into deferred revenues, in that case, isn't a full 12 months worth of revenues, hitting deferred revenue.

But it does represent the beginning of the same exact revenue stream. So when that happens, deferred revenues will lag for the effect of these partial years, up-sell subscriptions, that customers are tagging on to their, say their Vulnerability Management subscription. So we look at that really granularly to come up with our guidance and so forth. To make sure that we know what we're dealing with there.

So would there be a metric? Or have you thought about thinking of an annual recurring revenue number? If people are doing that 6-month versus 12-month, where we only get a -- we, as in the investment community, get a 6-month due, is there a way to think about that, like --

Rob, I don't think we're going to be issuing any new metrics. I think our metrics are really simple. Recurring revenue here is, if you took last quarter's revenue and multiplied by four, that's kind of the current revenue rate. And if you look at the revenue growth from quarter to quarter, you could start to almost plot out the next quarter's yourself.

Sure.

-- using similar growth rates. You really get the revenues and extrapolate them. We'll continue to give the deferred revenue, because I do think it's meaningful. But we did see, you know for example, when I was going through earlier on the call, I pointed out that we had a lot more on the revenue growth, this year, from existing customers expanding, than we did from new.

And just by definition, when they expand, they frequently give us less than a full-year's order as that initial order. So it's all good news. It just didn't hit that metrics as hard as you would expect, if it was all, for example, if it was all brand-new business.

Perfect. Thank you very much.

Our next question comes from the line of Aaron Schwartz with Macquarie. Your line is now open. Please proceed with your question.

Good afternoon. Thank you.

Just a follow-up on the last question. Is there anyway you can provide sort of an average duration, or an average age on the deferred?

Yes our average contract length, Aaron, is about 1.15 years. And our average contract length, Aaron, (multiple speakers) it's been pretty constant. We haven't delved into -- you're saying like, within a quarter, to give something like that?

Yes, I guess a lot people focus on deferred for subjection models. And just given what you talked about, I mean certainly that, that's impacting it. I just didn't know if you are starting to see the average duration sort of shorten. If the six-month contracts, if you will, have been enough to actually pull that duration down a little bit.

Yes, no, we haven't seen that at all. But I'll give some thought to it, Aaron. We didn't think about it for today. But it something we'll take a look at it.

Okay. And then secondly, just on the OpEx, I think someone asked about this but, I thought the Q4 OpEx was actually abnormally low for seasonal trends, as historically it increased about 10% on average, sequentially. So it was far below that. And is most of that just the off shoring of R&D? Or maybe you know, you could walk through, sort of how you're balancing this higher growth rate with your reinvestment plan?

And then secondly on that question, understanding all the comments on the partner channel, and the leverage you're seeing out of that, where are you today with sales force productivity? It seems, by our metrics, that's pretty -- that's been growing nicely.

Is that sort of, or where would you characterize that, is that getting near full? How much of the forward growth here is dependent on continued productivity versus new reinvestments? Thanks.

Okay. I'll try to go back to the first part and you can prompt me if I don't remember everything about what the second part was. You know, Aaron, I think one of the things about our sequential expense thing here is, I think, maybe you guys are all underestimating the power of our model. Our expenses were up 6% sequentially.

And, again, the only one of them that really was less than Q4 is marketing, because of the trade show thing. I was mentioning that we had more trade shows in the prior quarter. But things like R&D and GNA for example, R&D was up 8% sequentially. Our GNA was up 14% sequentially.

So what you're seeing is the power of our model here. We're able to generate significant additional revenues without pouring a ton of additional expenses in, because of a lot of things Philippe talked about in the model, with more coming through partners, the power of the platform and all that. So really nothing unusual here. You're just seeing the company starting to really hit stride on showing how this business model can perform.

That sequential growth, are you looking at GAAP? Or is that non-GAAP on the OpEx?

I was looking at GAAP.

Okay.

And then lastly was just the sales productivity. Were you thinking -- and understanding, you talked about the partner side, so that's a different dynamic there. But, just interested in the productivity for what you have on the direct side?

Well, I'll let Philippe handle this in the second. I think my opinion is, I think there is plenty of them room for increased productivity on the sales side and on the channel side. We are just starting to hit stride here. We certainly had a nice pickup in the last year so here. But we are not over achieving. I think we're just starting to hit our stride.

And just to add to what Don said, remember, you have to look back at our sales model, where we have a new business sales force and a renewal sales force. On the new business sales force was, drive the productivity for sales forces, that as I mentioned earlier, while doing much bigger deals. Even companies buying multiple solutions from the get go.

Or, even one application, which is deployed much more quickly. So that naturally drives the productivity. Because it doesn't take you more sales effort to sell a $0.5 million deal than to sell $1 million deal.

On the beauty of our model, as Don mentioned earlier, when you look now at the renewal sales force, same story all over again. Today we find that, for example, today we can manage with one renewal person and we can manage, let's say, forty accounts, for example. But these accounts are growing.

We start to see today, our renewal team is managing multi million dollar revenues in their territory. So you have again, another model here that scales very well. But now you start to layer the partners on the top of it.

So for example, today, when we had these coming from our engine of sources partners. These deals are typically part of a five year or seven year deals that they do with our large customers. And so that business is now served by our post-sales technical account manager, as we call them. Which means, I won't have any expense really, at that time, except the margin, I give to the partners to essentially deliver that -- this new business. And of course after that, it's all about renewing and up-selling during the period.

So we are building an incredibly scalable business model from the sales stand point. So, using matrix -- if you prefer traditional matrix of enterprise software, it doesn't really fit with us because we have absolutely leveraged the cloud model that we have, I think from a sales stand point, extremely well. And if you like, we'll be very happy to go into the details of that. And you will see how, really that builds a significant momentum in the business.

Thank you very much.

And we have a follow-up question from the line of Sterling Auty with JP Morgan. Please proceed with your follow up.

Yes, thanks.

Don, in your prepared remarks for CapEx, I think you talked about, what was it, $5 million to $6 million of CapEx in the first quarter.

Is that a one-time item, and then it should fall back from those levels? Or were you suggesting that was going to be more of the quarterly run rate? In other words, what should we be thinking for CapEx for 2015?

Well Sterling, of course, you are exactly right. And we said it was for Q1, so we didn't mean to say any of those other things. It probably will fall back. But we are only giving a view for the quarter that we are in. CapEx was reasonably consistent the last two years. In fact, we had guided a higher amount in Q4 than we actually did.

And some of that, just in general, getting done in Q1, instead of Q4. So I suspect it will come down somewhat. But on the other hand, as Philippe mentioned, we are seeing so much increase in demand for our -- especially our private cloud solution, that may be a high-class problem that we will talk to you about next quarter.

But probably it will come down. But if we had guidance for Q2, we'd give it to you now.

Should we think about -- I think the last couple of years, you spent about 12% or 13% of revenue in CapEx for 2012 and 2013. Seeing 2014 is more like 10%, given that shift out of Q4 into Q1, if we were to normalize that shift, do you think that kind of CapEx level, as a percentage of revenue, would've been pretty consistent with what you've done the last couple years?

I think so. I do think over the next several years, it will come down to more like 7% or 8% of revenues. But we're still on a growth spurt here.

More applications, more data centers, and especially this private cloud solution which is becoming so popular. But yes overtime it should come down. But in the short run, we have a lot to do.

Plus new appliances as well, for our Web Application Forward, for our malware protection service, all of that of course carries a CapEx component.

Gotcha. Thank you.

Okay.

Thank you. And with no further questions in the queue, I would like to turn the call back over to the host for closing remarks.

Okay, so thank you all for joining us today. We are very pleased with our strong performance and continued momentum in the market place as demonstrated by another strong quarter, which wrapped up a fantastic year for Qualys. Our results demonstrate the differentiation and sustainability of our unique cloud platform by the security and compliance solutions.

The scalability, as we discussed, of our growth to market model and our ongoing growth potential of existing solutions, and the new offerings we plan to launch in 2016. We believe we are well positioned to deliver best of class security in compliance solutions to our customers and partners as we continue to expand our cloud platform and deliver more innovative solutions.

So if you have any follow-up questions, Don and I are available to you, and we look forward to speaking with you next quarter. And thank you very much.

Ladies and gentlemen, thank you for participating in today's conference. This does conclude the program and you may all disconnect. Have a good day, everyone.