Qualys Inc (QLYS) 2015 Q3 法說會逐字稿

Good day, everyone, and welcome to Qualys' third quarter 2015 investor conference call. This call is being recorded.

( Operator Instructions)

I would now like to turn the call over to Don McCauley, CFO of Qualys. Please go ahead, sir.

Thank you and welcome, everyone, to Qualys' third quarter 2015 investor conference call. I am Don McCauley, CFO, and I'm here with Philippe Courtot, our Chairman, President and CEO.

We would like to remind you that during this call, we expect to make forward-looking statements within the meaning of the federal securities laws. Forward-looking statements generally relate to future events or our future financial or operating performance.

Forward-looking statements in this presentation include, but are not limited to, the following list: statements related to our business and financial performance and expectations for future periods, including the rate of growth of our business; our expectations regarding capital expenditures, including investments in our cloud infrastructure and the intended use of the benefits of those expenditures; trends related to the diversification of our revenue base; our ability to sell additional solutions to our customer base and the strength and demand for those solutions; our plans regarding the development of our technology and its expected timing; our expectations regarding the capabilities of our platform and solutions; the anticipated needs of our customers; our strategy, the salability of our strategy and our ability to execute our strategy, and our expectations regarding our market position; the expansion of our platform and our delivery of new solutions; the expansion of our development operations and support teams in India; the expansion of our partnerships and the related benefits of those partnerships; our ability to effectively manage costs; our plans to expand our sales force; our plans to explore strategic acquisitions; and finally, our expectations for the number of weighted average diluted shares outstanding and the effective GAAP and non-GAAP income tax rates for the fourth quarter and full year 2015.

Our expectations and beliefs regarding these matters may not materialize, and actual results in future periods are subject to risks and uncertainties that could cause actual results to differ materially from those projected. These risks include those set forth in the press release that we issued earlier today, as well as those more fully described in our filings with the Securities and Exchange Commission, including our quarterly report on Form 10-Q that we filed on August 5, 2015. The forward-looking statements in this presentation are based on information available to us as of today, and we disclaim any obligation to update any forward-looking statements, except as required by law.

We also remind you that this call will include a discussion of GAAP and non-GAAP financial measures. The non-GAAP financial measures are not intended to be considered in isolation or as a substitute for results prepared in accordance with GAAP. A discussion of why we present non-GAAP financial measures and a reconciliation of the non-GAAP financial measures discussed in this call to the most directly comparable GAAP financial measures are included in our earnings press release issued earlier today.

Now to begin the discussion, Philippe will provide an overview of the Company's performance for the third quarter 2015, then I will cover our financial results and factors that drove the quarter in more detail, as well as our outlook for the fourth quarter and full year 2015. Then we will open up the call for your questions. With that, I would now turn the call over to Philippe.

Thanks, Don, and welcome to all of you. The third quarter 2015 was another excellent quarter for Qualys. While Don will cover the financial details of our performance for the quarter, I will share with you why I think these are exciting times for Qualys from both a growth and strategic perspective.

First of all, I would like to thank all of you participated in our Investor Day, as well as in our 15th Qualys User Conference a few weeks ago. Both events were successful, very successful, and allowed investors, partners, customers and prospective customers to see for themselves the many expansions we have made to our disruptive next-generation cloud security platform. We also discussed a number of exciting new product which will be coming in the near future. And I will highlight several of them in our call today with you.

I will start off with an overview of key highlights that are driving the momentum in our business and discuss in more detail our new product releases. In Q3, we released two groundbreaking extensions to the platform that have been very well received by our customers. Let me start first with the AssetView service that allows enterprises to search across millions of IT assets in real-time and in a matter of seconds to find information about these assets and create customizable reports and dashboards that both IT and security teams can use to perform continuous asset inventory and synchronization, as well, with CMDBs. AssetView is now enabled with agents for our customers to activate for free asset inventory within their IT environments.

Second, we released Cloud Agents, which is now available on Windows and Linux and will become available on Mac by the end of the fourth quarter. While seeing strong demand from our customers for the agent technology, which a few customers already deploying it at a very large scale on millions of assets, including end points and within cloud environment. From such a positive and early adoption of our Cloud Agents within our customer base, as well as with new customers, we believe that we have the potential of doubling the revenue of both our vertical team management and of our policy compliance position, as well now able to address end points in elastic clouds environments, which we could not address with our traditional scanning technology.

We continue to work on our WAS solution and to deliver APIs and more customization for enterprise customers. This enhancement will increase product adoption and facilitate fast attraction within large enterprises. We expect to introduce these advanced capabilities for our WAS offering by the RSA conference in the first quarter of 2016.

We completed our integration with Splunk to help customers perform real-time security analytics on Qualys data on an enhanced breach detection and faster incidence response. Similarly, we completed our integration with ServiceNow CMDB to help customers synchronize asset information in real-time between Qualys and ServiceNow and push updates for assets and their attributes that are discovered by Qualys into ServiceNow CMDB.

In the third quarter, we added a number of important new accounts, including BBVA Spain, Criteo, EiQ Networks, IMS Health, JW Associates in China, Markit, Post Office LTD, Quintiles, Santander UK, Spectrum Health Companies, State Farm Insurance, Texas Instruments, Department of Transportation -- I'm sorry -- Texas, the Department of Transportation -- T-Mobile, Tropicana Entertainment, Whitbread PLC and Windstream Hosted Solutions.

Our industry-leading vertical management solution once again continued to grow at approximately 19%, and this despite some headwinds that we have seen from currency fluctuation this year. We saw approximately 40% growth from our new, newer services, which include web application scanning, policy compliance and web application firewall.

An indication of our continued success in diversifying our cloud platform offerings is that 61% of our customers have now purchased more than one solution. This is another valid point on our promising land and expand trend line, as this metric stood at 30% at the end of 2013 and 54% at the end of 2014.

Lastly, we continue to expand our sales force, including the addition of several new sales executives and, as a result, are even better equipped to sell at higher executive levels in the enterprise, while keen continuing to expand our sales force aggressively on a global scale so we can meet the increasing demands of the market for our expanded offerings. And now, for a review of our financial performance and our guidance, I will turn the call over to Don.

Thanks, Philippe. Again, as previously mentioned, our third quarter 2015 results were excellent. Revenues in the third quarter grew to $42.5 million, which represented 24% growth over the third quarter of 2014. Our current deferred revenue balance is $91.9 million as of September 30, 2015, which is also 24% greater than the balance one year ago. Similar to many other companies, both our revenues and our current deferred revenue balance has faced a considerable headwind due to the strengthening of the US dollar compared to last year.

Now a quick review of some other revenue metrics. For the third quarter, the US represented 70.5% of revenues, compared to 70% a year ago. Also, we derived 78.5% of third quarter revenues from subscriptions to our vulnerability management solution compared to 81% in the third quarter last year.

GAAP gross profit increased by 25%, to $33.7 million in the third quarter of 2015, compared to $26.9 million in the prior year. GAAP gross margin was 79% for the third quarter of 2015, compared to 78% a year earlier. Non-GAAP gross margin was 80% for the third quarter of 2015, compared to 79% in the third quarter last year.

Adjusted EBITDA for the third quarter increased by 67%, to $15.1 million, compared to $9 million a year earlier. Adjusted EBITDA as a percentage of revenues increased to 36% in the third quarter of 2015, compared with 26% in the same quarter of 2014.

Net cash from operations in the first nine months of 2015 increased by 68%, to $41.7 million, compared to $24.9 million in first nine months of 2014. Free cash flow for the first nine months increased by 82%, to $26.7 million, compared to $14.7 million last year.

In the third quarter of 2015, capital expenditures were $4.5 million, compared to $3.7 million in the third quarter last year. In the fourth quarter, we expect capital expenditures to be in the range of $5 million to $6 million, as we expand our cloud infrastructure to support more customers, add more solutions and functionality to our platforms, and also build out an expanded office facility in India.

Moving on to earnings per share. For the third quarter of 2015, GAAP EPS was $0.11 per diluted share, versus $0.08 a year ago. Non-GAAP EPS was $0.19 per diluted share in the third quarter of 2015, compared to $0.15 in the third quarter of 2014.

As most of you already know, starting this year, our earnings are fully taxed. Our impressive GAAP and non-GAAP EPS results for this quarter and year-to-date in 2015 are net of a much larger provision for income taxes in 2015. In fact, our GAAP effective tax rate for the first nine months in 2014 was approximately 13%, compared to this year's GAAP effective tax rate of approximately 38%.

Now turning to our guidance, starting with revenue. For the fourth quarter, we expect revenues to be in the range of $44.3 million to $44.8 million. At the midpoint, this represents 22% growth over fourth quarter 2014 revenues.

With one quarter remaining in 2015, we have adjusted our full-year 2015 revenue guidance range to equal the revenues of the first three quarters plus the fourth quarter revenue guidance range that we just discussed. Therefore, we now expect full-year 2015 revenues to be in the range of $164.1 million to $164.6 million. At the midpoint, this represents 23% growth over 2014 revenues. Our previous full-year 2015 revenue guidance range was $165.0 million to $166.5 million.

Now on to earnings per share guidance. We expect GAAP EPS for the fourth quarter of 2015 to be in the range of $0.08 to $0.10, and non-GAAP EPS is expected to be in the range of $0.16 to $0.18. Our fourth quarter EPS estimates are based on approximately 38.2 million weighted average diluted shares outstanding.

For the full year 2015, we are raising our guidance ranges for both GAAP and non-GAAP EPS. We now expect full-year GAAP EPS to be in the range of $0.35 to $0.37, an increase from our previous guidance range of $0.22 to $0.27. We now expect non-GAAP EPS to be in the range of $0.65 to $0.67, an increase from the previous guidance range of $0.50 to $0.55. Our full-year EPS estimates are based on approximately 38.2 million weighted average diluted shares outstanding.

With that, Philippe and I would be happy to answer any of your questions. Operator?

(Operator Instructions)

Sterling Auty, JPMorgan.

Yes. Thanks. Hi, guys. Wondering, in terms of looking at the results for the quarter and, more importantly, the guidance for the December quarter, relative to your previous outlook, what's the area that you're seeing slower growth than what you originally anticipated? Is it the newer stuff? Because it looked like the VM growth held in, in the quarter. Or is there something happening on the VM side relative to what your previous outlook had incorporated?

Hi, Sterling. This is Don. As Philippe mentioned, our growth of our newer services, which previously had been growing at 50% plus, are now approximately 40%, whereas VM stayed the same, at 19%.

But is there a particular reason why, in terms of -- is it you've reached a certain penetration within your customers that you're starting to see that deceleration, or is there any change in the competitive landscape that's caused that change in trajectory?

No -- this is Philippe -- this is not the case. In fact, it's more the fact that today we are doing bigger upsells, so the timing of these upsells affect, obviously, the growth within the quarter. We're doing between $250,000 to even $1 million upsells now on Policy Compliance and on our Web Application Scanning. So, the timing of those, when they arrive in the quarter, obviously can have an impact. Yes, have an impact, but can have an impact.

So, we don't see any -- it's nothing to do with the competition. In fact, we see significant opportunity to displace more rapidly solutions like Symantec CCS and others of this policy compliance application, where Qualys is a far better solution. And our agent, by the way, also is extremely well received to precisely displace and compete against these solutions.

Okay. And last question would be: On the sales and marketing side, can you give us a sense of -- did you hit the headcount hiring plans that you had put into place? Because it came in several million dollars lower than what we anticipated. I didn't know how much of that would be variable comp versus maybe just timing of hiring.

So, we first of all -- we put the emphasis last quarter on expanding our management. And this is something that we have done; rather than hiring more sales people, we strengthened significantly the management, in many aspects, both in our enterprise business, as well as in our SMB business. We have also -- the RSA this year was, of course, in the previous quarter, which is typically a very big expense. And we're now gearing up to essentially launch quite significant marketing campaigns on the Cloud Agents.

Okay. Thank you.

Phil Winslow, Credit Suisse.

Hi, thanks, guys. Just as a follow-on to Sterling's question, obviously he focused on the new products, but wanted to touch on VM. I know in the year, you'd mentioned some deceleration of the business, but it continued to have, actually, pretty healthy growth, relatively limited deceleration this quarter, as you mentioned. Just what dynamics are you seeing there, and what was the currency effect on that versus the other dynamics that are going on in the space?

Oh, yes. So, effectively, the currency has been a significant drag on our VM business because, as you know, our model, instead of being your perpetual license, is a subscription base. Of course, the dollar, the euro and the currency has an impact of a few percent to our renewal base, so this is quite significant, of course, in terms of revenues.

We see that marketplace continuing to be very strong with Qualys. I'm sure all of you know that the company with whom we were competing the most fiercely at the very high end of the marketplace, namely the McAfee MVM -- in fact, Intel announced that they are retiring this product. So that, in fact, will accelerate, we believe, our ability to displace some of the large MVM deployments which still exist, and in fact, we are already working on those. So that's, I think, is a very good plus.

And so, of course, generally speaking, we see that VM business totally invigorated by our Cloud Agents, as now, as I mentioned in the introduction, our customers can now scan the end points of the laptops, which will yield significantly more units there than the servers. So, we are essentially limited in the past with our traditional scanning technology to servers, essentially. So that's also expand our ability of both the VM, as well as the Policy Compliance application.

So, no, we see, bottom line, the VM continuing to be very strong. We have introduced significant break-through products with both the Agent and our AssetView, which allows our customers to create customizable dashboard which are dynamic, so they can essentially have at their fingertips the security and compliance posture of their enterprise at the scale that none of our competitors can essentially follow.

Phil, I just have a follow-up point on the beginning of your question. So, just to clarify for you and everyone else, the growth rate of our VM business hit 20% in the fourth quarter last year. In the quarter before that, and the three quarters since that, it's been 19%.

So, this has been basically a stable environment. This is not a declining environment. This is a stable 19% growth environment for four of the last five quarters, including the last three.

Great. Thanks, guys.

Steve Ashley, Robert W. Baird.

Perfect. Thank you very much. I'd just like to ask about the Cloud Agent business. Was there revenue in the period? And when you report your VM growth of 19%, is the Cloud Agent revenue included in that? Thank you.

So, we had some revenue in the period. As you know, this is pretty early days for the Cloud Agent. We expect, of course, to see more coming. I think it has been very well received. We have a lot of interest in the product -- a lot of trials for the Cloud Agent. These are not insignificant upsells for existing customers, as again, because of the volume that I mentioned earlier.

And to answer your second question, the way we count the Cloud Agent is we have multiple opportunities of revenues on the Cloud Agents. So, we have the VM components, which, of course, we charge for, and that goes with the VM. The Policy Compliance component that we also charge for -- that goes to the Policy Compliance.

And then there is a slew of forthcoming new services which we expect to bring to market pretty quickly, first with the [file integrity] monitoring, which is essentially competing against [Tretoire]. We have a huge demand for that, so that will be part of the new service, while also we'll introduce early next year the ability to provide indication of compromises, which we'll also charge for as an additional service, and that also will count as new services.

Perfect. And then one housekeeping: Don, can we get the number of sales reps you ended the period with? Thank you.

We added five more from last quarter. I think that brings us to 144.

Perfect. Thanks.

Matt Hedberg, RBC Capital Markets.

Hey, guys. Thanks for taking my questions. I wanted to follow up on Sterling's question also. You guys had strong billings performance in the quarter, and I understand, Don, you mentioned that newer product sales are slowing slightly. But this still doesn't make sense why Q4 revenue is guided lower, given the billings in the quarter. I'm curious, was there a change in duration, either the quarter or your outlook?

No, there wasn't, Matt. There wasn't a change in duration.

It's solely the timing of big deals. Of course, if a big deal arrives early in the quarter, it contributes, obviously, to more revenue than it derives at the end of the quarter.

So, I guess drilling in on that, is that a commentary in terms of where you think some of the large deals in Q4 may likely come later in the quarter, more of a back-end-loaded quarter than maybe we were thinking?

Correct.

Okay. And then I guess, you touched on it on your analyst day -- you brought in a new Head of Sales and a new Head of EMEA. As we look forward to 2016, are there any changes that you guys expect to make, given the sales leadership, or should it be more or less what we've come to expect on an annual basis in terms of potential sales changes?

I'm not for sure that I understand the question. You mean changing into the sales organization or changing -- ?

I guess maybe like, if territories get reorganized or anything that a new Head of Sales might do, kicking off a new fiscal year.

In fact, we already did that in parallel. So, the organization changes have already taken place. So, today we are essentially done with that. So, we have the new management. We did all that with them in Q3, almost in parallel.

And then today are hiring more sales people. So, we're very stable and solid in terms of management. And it's going to be more headcount, both on the new business side, as well as on the renewal [in a sense] since we have so much opportunities on the upsell side, we're increasing also the headcount there, as well.

Got it. Thanks, guys.

Erik Suppiger, JMP.

Yes. Thanks for taking the question. On the new services, just to be clear, was it both the Web App Scanning and the Policy Compliance that decelerated to 40%? Is there any reason why they would have both decelerated simultaneously?

Essentially, there was -- just to be specific -- there's two -- on both cases, there was two large upsell which got delayed.

Say that again? There were two what?

Two large upsells in both categories which were delayed.

Okay. And one was in each, Web App Scanning and one was Policy Compliance?

Exactly. Absolutely.

Okay. And then, in terms of the McAfee solution, they've partnered with Rapid7. How do you look at your opportunity to capture some of that business, given their partnership?

I think their partnership is something which -- put yourself in the shoes of the customer which has essentially have seen McAfee not supporting the product for quite a while, and basically recommending another solution. What we see today is that the market is coming -- people will go and try to evaluate the solution.

But the high end of the marketplace, which is essentially where most of the McAfee was, we have an extremely strong position because we scale, unlike our competitors. And at the more mid-range of the marketplace, we're now essentially preparing, as I mentioned -- we'll probably launch a replacement campaign anytime soon. And so, this is the way we see the market.

So, all of the large accounts have already connected with us. And these companies, they are not going to follow the recommendation of [Intel] for sure, and they all are evaluating the various options for them.

Okay. And then lastly, on the hiring front, you added five sales reps in the quarter. Given some of the management additions that you've had, do you think you're going to be accelerating the sales rep hiring going forward?

Definitively. We've already started, so we're really interviewing significantly, as we speak.

Very good. Thank you.

Srini Nandury, Summit Research.

All right. Thank you for taking my call, guys. And I just wanted to understand your federal business a little bit. I know that you just hired Mark Hutnan recently, and I just wanted to understand if you have (Inaudible) to operate with or selling to federal business, and how big is your federal business as a percentage of your revenue?

Our federal business has been extremely small for us as a security company, which is about 1% of our revenue. So, as you can see, it's probably negligible. We have quite a few good customers in that space which were early adopters, like the SEC, like the [IRS], and a few other agencies.

Now today, we are expecting to be federal -- we're in the process of being [fed run] compliant. We see the federal marketplace has warmed up to our cloud architecture. And so this is why we believe now is the time for us to really be very aggressive in the federal markets.

We are, in fact, already handling a few large opportunities, as we speak, and we are going to beef up our federal team. So, we're very happy to have Mark joining us. He's a very experienced person in that space, and so we're ready for it.

Okay. And if I may, can you talk about the IT spending environment from your perspective and, more importantly, on the sales cycles? Have you seen any changes in your sales cycles in the last quarter or so? And also, can you talk about the average deal sizes that you're making?

So, in terms of the sales cycle, we've not seen, essentially, the sales cycle changing. As you know, we're addressing three markets with package or solutions. We have Express Lite for the SMB, Express for the SME -- for the mid-market -- and Enterprise for the large enterprise.

The selling cycle has been remained about the same in these three categories. The difference, as you alluded to, is the fact that we are now doing significantly bigger deals and bigger upsell. So, that's the big difference.

All right. Thank you, gentlemen.

Michael Kim, Imperial Capital.

Hi, good afternoon, guys. Just going back to the Cloud Agent platform, hoping you could provide an update on the deployment to some of the customers that you mentioned at the analyst day, Visa, Cisco and the cloud provider, if they have expanded on those deployments? And also, with the trials, are they primarily existing customers looking for an upsell opportunity, or is that an opportunity to capture new customers?

So, all the companies we've mentioned, they all have deployed, essentially very successfully. So, we're very happy with that. We have, as I mentioned earlier, a lot of trials, both from existing customers, as well as new customers. And the new customers really appreciate the value that we bring for both VM and Policy Compliance.

And let me remind you what these values are. With these Cloud Agents, you don't have to worry about scanning windows, which have always been kind of a pain. You don't have to worry about the credentials. So you could identify what you have on the devices and their vulnerabilities. So that's another very big advantage.

And finally, what you have is the real-time component. With the scanning windows, you were depending on scanning your system every week. In fact, we have today customers, believe it or not, scanning 1 million IP every day. So, of course, this agent eliminates all of that, and gives you that ability to fundamentally scan at real time.

So, we anticipate over time that most of our customers, wherever they can put an agent, will use our agent as the technology to identify the vulnerabilities on those devices, and only use the scanning technology essentially for those devices like printers, et cetera, where you cannot put an agent. And as you may know also, if you were at the conference, we're also introducing in beta what we call the passive scanning.

So, with these three technologies combined -- with the scanning technology, we can look at the device from the outside. With the agent, we can look at the device from the inside. And now with our passive technology, we can look at what's coming in and out of the device.

And the beauty of our architecture is that instead of having three different applications, like you find with enterprise software solutions, we bring all that data into that one central place, which is our Cloud Platform, which we can deliver either as a shared platform or as an on-premise solution. And now you can correlate all of that information in real time, and as well as essentially creating the customizable views and dashboard and alerts. So, this is what we have done, and it is absolutely well received from all of our customers today, and prospects.

And as you're going through some of the trials, have you gotten a little better sense on the pricing that you might be able to see as a premium relative to VM or PC, Policy Compliance?

So, currently today, we believe we could sustain about -- in the beginning, essentially giving some promotion -- but ultimately, we see that we could get the premium on the [vulnerability] scanning both for Policy Compliance and for VM as, in fact, it would create a significant more value for the customers. So, we believe we can maintain about a 20% premium over the traditional scanning solutions.

Got it. And then just going back to the core vulnerability management business and the consistency and the growth this year, has that been driven by share gains primarily, or scope expansion by existing customers, or maybe expansion in use cases [like] Continuous Monitoring?

I think it is -- the Continuous Monitoring doesn't really drive that much revenue by itself, but it's absolutely make the vulnerability management application much more, if you prefer, more effective, as we can now create alerts. The big driver is the combination of a lot of new customers and starting bigger than in the past. In the past, we are starting, for example, to do the perimeter. And then, it was taking some time for the company to really believe in the model and then adopt us in the inside.

Today we see companies from the get-go which are really taking both inside and the outside. And that obviously makes a bigger deal. So it's kind of a mix of customers. Some existing customers -- for example, who have a big bank which has moved -- which is moving from the outside to the inside. And that, of course, will create a bigger sell, as well as, as I mentioned earlier, new customers, which are starting both for the perimeter and for the inside at the same time.

Okay. Great. Thank you very much.

Mike Cikos, Macquarie.

Hi, guys. Question for you on the two larger upsells that were delayed, one for the WAS product and one for the PC. Were you expecting both of those upsells to close during the third quarter or the fourth quarter? And I guess, have those upsells now closed at this time?

So we have, in fact, one of each, in a way. And none of them have closed at this time.

So, I'm sorry, you expected both of those to close, you said, or just one of those?

No. What I mentioned is one was we were expecting to have in the previous quarter, and the other one is in the current quarter, and they both have not closed yet.

Okay. And this is the second time you guys have had to take down your full-year revenue guidance. And both of them, we can attribute in part to the FX, but also to when these larger deals are starting to come in. I guess the question then is: Are you guys rethinking or changing your approach to guidance now? Just so that way, you guys don't have to keep coming out and doing this? Or is there any change in the process that you guys have for when you set your guidance?

No, Mike. There's no change in the methodology that we use. We have a very granular, bottoms-up approach to look at our Business and forecast it out.

Okay. And then just the last question, if I could, was regarding the pricing of the Cloud Agents. I know you had said you expect that you can command a premium for these agents of, call it, 20% compared to the traditional scanning solutions. I guess the question is: Are these Cloud Agents being priced on a per-device basis or per IP address?

It's the same, because each device -- yes, it's per device, but it's equivalent to per IP. Yes.

Okay. Thank you.

Robert Breza, Wunderlich.

Hi, thanks for taking my questions. Most of my questions have been asked already. Just, Don, real quickly, when you look out to FY16, and you didn't mention taxes in your prepared remarks. Can you just talk to us on a non-GAAP basis how you're thinking about taxes? Thanks.

Yes. At this point, Rob, I expect -- I don't have any reason to think that rates we're using right now are going to change.

Perfect. Thanks, guys.

Yes.

Gur Talpaz, Stifel.

Hi, guys. This is Chris Speros on for Gur. First of all, thanks for taking our question. Second of all, in regards to your Continuous Monitoring Cloud service, could you guys highlight some recent successes, and describe the overall state of the pipeline?

The Continuous Monitoring is an extension to the VM. Essentially it allows customers to essentially define a certain kind of circumstances where they believe it's the combination of, for example, of [port being open] with a severity number 5, and that creates an alert. And then, with this alert, you now remove that alert into their incidence response system. So, it's a very natural extension of our vulnerability management. Currently today, we see customers have been using it much more for the perimeter, and we are starting to see an adoption for doing the same thing for your internal devices.

All right. Sounds good. Thank you, guys.

(Operator Instructions)

Rob Owens, Pacific Crest.

Hey, guys. This is Ben on for Rob. Thanks for taking my questions.

First question I had was around -- you talked about a deal getting pushed from Q3. I wanted to ask about the linearity of business for the rest of the Business throughout Q3. Was it pretty linear relative to what you've seen in the past? Or do you see some shifts on when deals were coming in?

It was a normal quarter, Ben, in terms of the pattern of business.

Okay. Great. And then, also wanted to -- I know in the past you've talked about some of your existing customers coming up and asking for upsells to the point where it kind of surprised you to the degree of what they wanted to buy, as far as additional VM solutions. I wondered if you could talk a little bit as far as what type of visibility you're seeing into these VM upsells? Are you easily able to telegraph which customers are looking for broader deployments? Are you actually seeing significant amount of upsells that are coming as kind of a surprise -- they're coming to you?

So, in fact, we have a very good visibility on those upsell on the VM side. The reason is because, again, you have some customers which are still only doing the perimeter. And these one, it's obvious a question of time before they go and expand Qualys inside, which are typically much bigger deals.

And then on the other customers, it's essentially much more their growth. So this is also more statistically predictable because we can know how much of the total environment they are currently scanning, and we can, of course, discussing with them, understanding their plan of expansion. Those which are -- so, this is very predictable, both of them.

What is not predictable, and we have quite a few of those, is when the company today acquire another company. That's obviously an opportunity of having now Qualys being used in the new company they have acquired. So, there's been a lot of these mergers. And because we have a large percentage already of the high end of the marketplace, and this is where essentially a lot of that activity is taking place, this is really favoring us.

Great. Thank you.

Alban Cousin with Arete Research.

Hi, thanks for taking my question. I may have missed that earlier but, Don, will you specifically spell out the effect of FX? Some of your peers have been able to say that the euro quickness have impacted their (inaudible) dips also. I'm wondering whether you could do the same for Qualys?

Yes, we could do that. For Q3 revenues, our forecast of Q4 revenues, and also our deferred revenue balance at September 30 -- approximately 2.5% impact.

Thanks.

John Lucia, JMP Securities.

Hey, guys. Thanks for taking my questions. The first question is: I think you said that 60% of your customers have purchased more than one solution at this point. That stood at 54% at the end of 2014, and 30% at the end of 2013. It seems to be slowing from the pace that you had in 2014 going into this quarter. Can you just talk about what's causing that slowdown in terms of upsells?

John, this is Don. We actually mentioned this a quarter ago on our call, kind of preemptively. Today, waiting for the agent and file integrity monitoring and some of these other products to kick in, which is just getting started, revenue is comprised principally of Vulnerability Management, Policy Compliance and Web Application Scanning.

And numerically, when we give this metric, we're counting customers. And our SMB customers, by and large, don't buy Compliance very much. Compliance is more of an enterprise-focused product, and the smaller customers generally aren't too compliance-oriented. So naturally, until we get some other products joining the mix, it's inevitable that the metric will start to level off.

Okay. That makes sense. And then I have one more question. What was total headcount in the quarter? And then, did hiring come in below, in line with, or ahead of your expectations, and then also the same for turnover?

Yes, so, our headcount was -- total headcount is 497 in the quarter. I already gave the sales headcount. I don't think we really get into what we budget and so forth. So we're always looking for good people.

So I don't think we've previously given headcount targets or turnover figures. Nothing unusual going on this quarter though. We're always looking for good people, and we were able to add quite a few this quarter.

And one point that I could add is that -- one point here in terms of, we're also expanding big-time in India. As Don mentioned, we are moving into new, beautiful offices in Pune. We have a unique ability to really attract a lot of good talents there, and we are very happy. And that allows us to continue investing in our R&D without, of course -- while maintaining, if you prefer, our cost structure, if not in fact improving our cost structure.

Okay. Makes sense. Thank you.

Jeff Cardon, Wasatch Advisors.

Hi, thank you. I just want another clarification on the deals that won't come through in the fourth quarter. Are they in the backlog number now, and that's one of the reasons the backlog accelerated? Or have they not been signed yet?

We don't actually have a -- you're talking about deferred revenues?

Yes, sorry.

So, deferred revenues are actually deals that closed that we billed the customer. So, we're not -- when we say a deal closed, it would be in deferred revenues. These are not in deferred revenues at September 30.

And have they been signed?

As I mentioned earlier, no, not yet.

Okay. Thank you.

I'm not showing any further questions at this time. I would now like to turn the call back to Philippe Courtot, CEO of Qualys, for closing remarks.

Okay. Thank you, operator.

In summary, our new offerings, including AssetView and Cloud Agents, are a game-changer for Qualys. They significantly expand our market opportunity, and allow us to play a very important role in the convergence of IT and security. We are now better equipped than ever to capitalize on our scalable business model and outstanding team, which together allows us to continue accelerating the adoption of our offerings on a global scale.

Thank you for attending our earnings call today. Should you have any follow-up questions, Don and I are available to you. We're looking forward to speaking with you next quarter. Thank you very much.

Ladies and gentlemen, thank you for participating in today's conference. This does conclude the program, and you may all disconnect. Everyone have a wonderful day.