Qualys Inc (QLYS) 2016 Q3 法說會逐字稿

Good day, everyone and welcome to the Qualys third quarter 2016 earnings conference call. This call is being recorded. (Operator Instructions). I would now like to turn the call over to Joo Mi Kim, Vice President of FP&A and Investor Relations. Please go ahead, ma'am.

Good afternoon and welcome to Qualys's third quarter earnings call.

We would like to remind you that during this call, we expect to make forward-looking statements within the meaning of the federal securities laws. Forward-looking statements can only relate to future events or a future financial or operating performance. Forward looking statements in this presentation include but are not limited to the following. Statements related to our business and financial performance and expectations for future periods, including the rate of growth of our business, our expectations regarding capital expenditure, including investments in our cloud infrastructure and intended uses and benefits of those expenditures.

Trends related to the diversification of our revenue base. Our ability to sell additional solutions to our customer base and the strength of demand for those solutions. Our plans regarding the development of our technology and its expected timing. Our expectations regarding the capabilities of our platforms and solutions.

The anticipated needs of our customers, our strategy, the scalability of our strategy and our ability to execute our strategy and our expectations regarding our market position. The expansion of our platform and our delivery of new solutions, the expansion of our partnerships and the related benefits of those partnerships. Our ability to effectively manage costs.

Our expectations for currency exchange rates. Our plans to pursue arrangements with MSSP, which are multi-year contract at fixed prices and finally our expectations for the number of weighted average diluted shares outstanding and effective GAAP and non-GAAP income tax rates for the fourth quarter and full year 2016. Our expectations and beliefs regarding these matters may not materialize and actual results and future periods are subject to risks and uncertainties that could cause actual results to differ materially from those projected.

These risks include those set forth in the press release that we issued earlier today, as well as those more fully described in our filings with the Securities & Exchange Commission including our latest form 10-Q and 10-K. The forward-looking statements in this presentation are based on information available to us as of today and we disclaim any obligation to update any forward-looking statements except as required by law.

We also remind that you this call will include discussion of GAAP and non-GAAP financial measures. The non-GAAP financial measures are not intended to be considered in isolation or as a substitute for results prepared in accordance with GAAP.

Discussion of why we present non-GAAP measures and a reconciliation of the non-GAAP financial measures discussed in this call to the most directly comparable GAAP financial measures are included in our earnings release issued earlier today.

Joining me today on the call are Philippe Courtot, our Chairman and CEO and Melissa Fisher, our CFO. Philippe?

Thank you, Joo Mi. And welcome to everyone to our Q3 earnings call.

We had a very good third quarter. Where our top line revenue was at the very high end of our guidance and EPS was above, again, reinforcing the value of our cloud-based security platform in the marketplace and our balanced approach between profitability and growth.

As you certainly recall, earlier in the year, we pointed out our ability to become a key player in the forthcoming consolidation of traditional enterprise security and compliance solutions. This quarter, we put more pieces in place, central to the strategy with continued product innovation and expansion of our strategic partner ecosystem and I will further elaborate on this later.

First let me address what we're seeing from a micro-industry level. A few weeks ago, we hosted our 16th annual Qualys Security Conference in Las Vegas. The theme of the conference was centered around the visibility companies must achieve to effectively fend off cyber attacks and our Qualys cloud platform approach can make this possible. At the conference I had the opportunity to discuss with quite a few customers their long term security needs and the state of the industry.

They all expressed their need to consolidate the stock of the many security and compliance solutions they currently have as they've become too costly to deploy and maintain and integrating them is becoming complex and extremely expensive. In fact, our large customers are handling in excess of 30 disparate security and compliance solutions and they simply cannot take on more.

Compounding the problem is the fact that they have a hard time finding qualified people to operate them. Such discussions clearly reinforce our belief that Qualys is now very well-positioned to address these needs because of the breadth of the new solutions we're now bringing to market, solutions that are designed for scale, natively integrated, centrally manage and self-updating. Thus eliminating significant cost while providing best-of-breed functionalities.

At our conference, in fact, we showcased our groundbreaking suite of new services, namely the file integrity monitoring solution, the detection of indication of compromise solution and our web application firewall, Firewall 2.0. We're on target to deliver these additional solutions by the first half of next year.

Now let me share some business highlights. Qualys has built a new distribution model that continues to set us apart from other competitors in the marketplace. We want meaningful engagement with additional global MSSPs while now embedding the Qualys platform with their managed security services offerings. These weeks we're very pleased to announce a global strategic partner with HPE, who will be integrating the Qualys platform and suite of integrated solutions to deploy to their user base.

Earlier this year, as you may recall, we also expanded our engagement with Wipro, already so valuing our platform it is now including Qualys across all of their global offerings. Additionally, we sign NTT who is now rolling out Qualys as a critical part of their security offerings. Again, on a global basis. The channel was not only the -- area that scaled in the quarter.

I'm very pleased now to announce that we have received, yesterday, our authority to operate or ATO from the Department of Health and Human Services under our FedRAMP certification which opens up the federal marketplace for us. Furthermore, our product development efforts continue to move forward with additional features and functionalities to our Cloud Agent platform.

For example, we announce that the cloud agents are now available on the Microsoft Azure platform at a click of a mouse, allowing Azure users to have a continuous view of the security and compliance posture of the Azure environment. We continue to see strong adoption for the Cloud Agent from our customers with now more than 1.3 million cloud agents being purchased in the last 12 months as well as the pent-up demand for our new ThreatPROTECT solution that allows our customers to prioritize the remediation vulnerabilities in relation to the active threat landscapes.

Additionally, we continue to make significant progress with injecting new capabilities into our industry-leading platforms including implementation of the Cassandra open-source engine, passive scanning and container security. It is now clear that in a perimeter less hyper connected world, our solutions, visible in a single pane of glass are critical tools that enable Qualys to become the actor of choice -- to be the actor of choice in this new era of enterprise security consolidation, while helping customers expand their security policies to the new cloud computing environment.

In essence, we now provide our customers with a two-second visibility across all of their global IT assets whether on premise, on end point, on elastic cloud environments. We allow them to continuously assess the security and compliance posture of those assets and next year, we will help them identify those who have been already compromised. In addition, we eliminate significant cost out of the IT and IT security budget as we now consolidate more than ten traditional on premise enterprise security compliance solutions.

In summary, we have never been more optimistic with regards to our future and believe that Qualys is very well-positioned for 2017 and beyond.

With that, I will turn the call over to our CFO, Melissa, to discuss our financial results in more details. Melissa?

Thanks, Philippe. And good afternoon, everyone.

Our strong third quarter performance reflects the continued success our cloud-based security platform is finding in the marketplace. Total revenues in the third quarter were $51 million, which represents 20% growth over the third quarter of 2015. We also see adoption increasing with the number of enterprise customers who purchase three or more Qualys solutions rising to 23% up from 18% a year ago and up from 21% last quarter.

The percentage of total customers with two or more products including PCI, the prior metric disclosed, was 63% in Q3, up from 61% a year ago and 63% last quarter. In addition, our average deal size increased 22% year-over-year in Q3. The negative impact of FX on our revenue mostly offset the positive impact from the MSSP contract this quarter. Our revenue plus the change in current deferred revenue balance grew 20% year-over-year.

As I highlighted last quarter, this calculation will not always mirror our current bookings due to the timing of the actual invoicing as well as the impact of FX. This quarter, our revenue plus the change in current deferred revenue balance continued to be negatively impacted by those factors as well as the impact from the MSSP contract. In accordance with our prior disclosures, our vulnerability management solutions remain strong, continuing to represent 79% of third quarter revenues in line with results in the third quarter of 2015.

Our last 12 month bookings year-over-year growth rate for policy compliance and web application scanning was 23%. Note that this figure does not include newer solutions like our Cloud Agent used for VM, our private cloud platform and ThreatPROTECT. In fact, Q3 bookings from the Cloud Agent platform grew almost 50% sequentially and from ThreatPROTECT, grew 90% sequentially. Before moving to profit and loss items, I would like to point out unless otherwise specified, all of the expense and profitability metrics I will be discussing on this call are non-GAAP results. Our non-GAAP metrics exclude stock-based compensation and non-recurring items.

A full year reconciliation of all GAAP to non-GAAP measures is provided in the financial tables of the press release issued earlier today and is available on the Investor Section of our website. As I discussed last quarter, our strong margins are a testament to the scalable operation model Qualys and higher than other comparable security and Saas companies. Driven by the opportunity to increase our profitable growth, we've been increasing our investment in 2016.

While gross margin declined slightly to 79%, down from 80% in the third quarter last year, driven by an increase in software and hardware expenses, gross profit increased by 18% year-over-year to $40.2 million in the third quarter of 2016. Operating expenses increased by 19% year-over-year to $27 million. Research and development expense increased to $7.8 million or 25% year-over-year, primarily due to higher head count.

Sales and marketing expense increased to $13.4 million or 19% year-over-year primarily due to higher head count, higher marketing expense and costs related to our salesforce.com implementation. G&A increased to $5.9 million, 13% year-over-year largely due to higher head count. Operating expenses were sequentially flat despite a meaningful increase in head count because over 80% of our net hires in Q3 were made in India.

The sequential increase in sales and marketing expense from customer and acquisition costs and branding expenses were offset by a sequential decrease in G&A from lower third party spend. Due to our strong revenue growth, adjusted EBITDA for the third quarter of 2016 increased by 16% to $17.6 million compared to $15.1 million in the third quarter of 2015. Excluding the positive impact to revenues from the MSSP contract, adjusted EBITDA would have still increased over the third quarter of 2015.

Adjusted EBITDA margin in the third quarter of 2016 was 35% as compared to 36% in the third quarter of 2015. Moving on now to earnings per share, for the third quarter of 2016, GAAP EPS was $0.13 per diluted share, up from $0.11 in the third quarter of 2015. Non-GAAP EPS was $0.22 per diluted share in the third quarter of 2016 up from $0.19 in the third quarter of 2015. Net cash from operations in the third quarter of 2016 increased by 26% to $20.2 million compared to $16.1 million in the same period in 2015.

Free cash flow generated in the third quarter of 2016 was $10.4 million compared to $11.7 million in a comparable period of 2015. The lower free cash flow was due to $4.8 million of capital expenditures incurred in Q2 that was paid out in Q3. As we discussed last quarter, we front-loaded CapEx expected to be paid later in the year. Of the $7.4 million front-loaded, $4.8 million was paid out in Q3 with the rest scheduled to be paid out in Q4.

Excluding the previously-mentioned $4.8 million, capital expenditure were $5.1 million in the third quarter of 2016, compared to $4.5 million in the third quarter of 2015. In the fourth quarter of 2016, we expect capital expenditures to be in the range of $3.5 million to $4.5 million excluding the $2.6 million remaining to be paid from the $7.4 million Q2 expenditure. As a reminder, $5.2 million of the $7.4 million was related to the early renewal of a license arrangement as we were able to lock in an attractive rate on database software for the next several years.

This was CapEx that otherwise would have been spent and set in 2017 and does not represent a change in our business model. Excluding the early license renewal, our expectation for capital expenditures remains roughly the same at approximately $20 million to $21 million for fiscal year 2016. Now turning to our guidance, starting with revenues, for the fourth quarter of 2016, we expect revenues to be in the range of $51.9 million to $52.9 million. In the fourth quarter, we expect a negative impact from FX to outweigh the positive impact on revenues from the MSSP contract.

For the full year 2016, we are raising the bottom end of our guidance for revenues bringing our current guidance to a range of $197.6 million to $198.6 million. For the full year of 2016, we are raising our guidance for both GAAP and non-GAAP EPS. Our current guidance for GAAP EPS is now $0.41 to $0.42 and for non-GAAP EPS, $0.79 to $0.80 for the full year 2016.

We expect GAAP EPS for the fourth quarter of 2016 to be in the range of $0.06 to $0.08 per diluted share while non-GAAP EPS is expected to be in the range of $0.16 to $0.18 per diluted share. We expect our operating expenses to sequentially increase in Q4 as we are continuing to invest in our business as we scale for the roll-out of additional solutions to our platform because we have a highly profitable operational model.

Our fourth quarter EPS estimates are based on approximately 39.2 million weighted average diluted shares outstanding and our full year 2016 EPS estimates are based on approximately 38.5 million shares. For the fourth quarter and full year 2016, we have used an expected effective GAAP rate of 37% and 38% respectively and an expected effective non-GAAP tax rate of 36%.

Like Philippe, I was delighted to see such strong customer response by both partners and customers at our user's conference. Customers are looking for fully integrated cost-effective and scalable security and compliance solutions, which provide instant visibility across all of their global ITT assets whether on premise, on end points or on elastic cloud environments and Qualys is the best positioned to fill those needs.

With that, Philippe and I would be happy to answer any of your questions.

Thank you, (Operator Instructions). Our first question comes from Bill Choi with Wunderlich. Your line is open.

Yes. Thank you. I guess, if I had to stick to one question it would be, largely trying to understand the traction you're getting currently in bookings for the new product. You talked about ThreatPROTECT and the Agent and yet when we look at your guidance for revenue, understanding there's maybe some FX pressures there, is sequential growth rate here looks weaker than what you normally see into Q4, what, 2% to 4% sequential growth. I wanted to get some sense of when you talk about these new products, how big are they and are they making an impact yet meaningfully to revenue. Thanks.

Well you know, let me answer that by addressing a couple of points, Bill. So, first, Q4 is a big quarter for us and as, in general, we've been seeing increasingly larger upsells. We continue to see that in the pipeline for Q4 and so we guide appropriately based on the fact that larger upsells are a little bit less predictable for us in terms of which quarter they're going to get signed in.

We are also -- as I mentioned, negatively impacted by FX in Q4 which is actually going to outweigh the positive impact from the MSSP by about -- by impacting our growth rate to such it would be 0.5% lower. Those are the data points then. But we are seeing, as you pointed out, good traction early in the new services and it's, again, it is going to take time because of our staff's radible revenue model for it to flow through on the revenue line.

Our next question comes from Gur Talpaz with Stifel. Your line is open.

Hi. This is actually Chris Speros on for Gur. Thanks for taking my question. Can you talk about what the pipeline is looking lithe like for the Cloud Agent and the mix of that pipeline in regards to new versus current customers?

We don't have the mix between the new and the existing customers. What we can say is we see continued adoption, very strong adoption by all of our existing customers. There's no question about that.

In fact (inaudible) I gave you some statistics before that. As far as the few -- sorry, as far as the new is concerned, we see mainly more and more of the new business coming with the Agent. It is very clear that the Agent becomes the differentiator. So I don't have the exact person page to give you but it is significant.

Yes so when we report the Cloud Agent statistics, we are seeing that both from existing customers as well as from new customers, to be clear. And it is going to skew more toward existing because as our renewal base grows, our opportunities for upsell continue to increase, especially with these additional solutions. So our business always tends to skew toward existing. As well as because of how large our customer base is already.

Thank you. Our next question comes from Craig Nankervis with First Analysis. Your line is open.

Thanks. Good afternoon, nice quarter, folks. You know, you've had some nice, for two quarters now, some nice growth in your average deal size, which I believe is a bookings metric. Can you talk about that? Is that, you know, here's another existing versus new customer question? Which is influencing that more? Is it multi product sales? Is it larger initial deals? What can you say about these last two quarters and the growth of your average deal size?

It is actually -- it's going to be driven more by existing because one thing Philippe and I have discussed, you know, that's maybe different in our business model than some other companies is this nomenclature of new versus existing is a bit artificial because often we'll get new customers in for -- it can be a very small initial dollar volume. It could be a PCI only customer who then we upsell for close to a $1 million. So it would be -- you would see the increase coming more from the existing customer base.

Absolutely. To give you some color, for example, a large financial institution which was essentially, you know, spending about $200,000 a year for Qualys and the upsell became $1.4 million. So you can see that the big advantage -- in a way -- take our customers young, if you prefer, and then we grow them.

So our business would be always tilted toward the up seller. Especially that we have more and more services. So even that compounding effect.

Right.

(Operator Instructions). Our next question comes from Steve Ashley with Baird. Your line is open.

Good afternoon. This is Matt Lemenager on for Steve. My question was around the Q4 guidance and implying the EBIT margins would be down sequentially. Just looking at the last few years, seasonality has kind of seen an increase in the EBIT margin Q3 to Q4. I realize you came in nicely ahead of margins this quarter.

Maybe some of it is expenses that pushed to Q4. You talked a little bit about extra expenses, investing in R&D and things in the fourth quarter. But I was wondering if maybe you can comment or provide color on the implied guidance for the fourth quarter around expenses and the implied EBIT margin.

Yes, that's right, Matt. So we do expect our expenses to sequentially increase as I had highlighted, we had expected for the Q3 and ended up coming in lower. We're investing across all of the functions, R&D and operations, sales and marketing and G&A and so that's what our guidance is based upon.

Our next question comes from Srini Nandury with Summit Redstone. Your line is open.

Hi. This is Jonathan Kees, I'm speaking for Srini. Thanks for taking my questions. I just have two. First one is a follow-up. I guess in regards to that Q4, you talk about the Opex going up. Should we think then that GM will stay relatively flat with Q3? That most of the increase is just going to be in the Opex line? And then the second question, the more high-level question is you're talking about providing services as a differentiator. Earlier you mentioned that finding the right personnel with security expertise has been difficult for your clients. Is that something that you're providing and that is going to be something that is going to move the needle for you and how do you differentiate relative to your competitors?

No, in fact, you know on your second question, one of the unique things that Qualys does, because we have adopted that cloud model, the cloud model has allowed us to package our solutions, little bit like salesforce.com and all these cloud solutions, is like we don't need all of that professional services. And that's one of the other reasons for our profitability. In fact, we have no professional services, zero since the inception.

What I was referring to about with our customers today, which the biggest advantage of Qualys today is the same platform offers you ten traditional security and compliance solutions, totally integrated so you need significantly less people to operate and the complexity to operate is different solution is also reduced as opposed to having, if you line up all of the different best-of-breed enterprise, on premise security solution, you need to have one infrastructure for that application, another one for the other one and on and on.

So you have to deploy and maintain different architecture and on the top of that, you have to maintain and operate all of the different solutions independently. And then in order to make better sense of your security to get the overall security posture of your company, you need now to integrate those.

So you end up now using a different solution -- another solution where you integrate all of that information which again costs a lot of money. You need to find the people for you to be able to do that. So that's what Qualys fundamentally eliminates. On the first question which I forgot --.

I'll take over.

Okay so Melissa will answer.

Yes, so I was speaking about expenses broadly because we don't guide by a functional area. But as Philippe mentioned, he went into some of the details around how we're investing in the operations in the back end. So you can use that guidance for building out your model.

Where we've tried to be clear is on the one-time FX of guidance around things like the MSSP contract which, as you guys are aware, we shared the information about how it has impacted our top line positively but obviously we won't have for 2017 so I'm sure as you're thinking about your models going forward, you'll be taking that into account as a headwind as well.

Our last question comes from Sterling Auty with JPMorgan. Your line is open.

Hi, guys. It is Jackson Ader on for Sterling tonight. One really high-level question from us and that is, are you seeing any either increased demand or interest from customers after some of the recent attacks and I think we're thinking mostly the Dyn attack that came out last week.

In fact, I would say -- I would not say maybe directly because of that but this is what we see at the microeconomic level. Today as we all know, most large companies have embarked into what is called the digital transformation. What is happening today is now they realize, and we see that spinning up, which is using newer technology, retooling their IT infrastructure to gain -- to reduce costs and increase agility from a business standpoint.

What we see today happening at that micro level is that these divisions in these companies are starting to realize that today securing the current computing environment is becoming more and more and more expensive and diminishing returns. So there's now a demand that we see, that favors Qualys significantly.

We already have quite a few very significant examples about that. They see that if they move it, if they accelerate and where, for example -- that example of a very large bank in Europe which has publicly announced that they accelerated the digital transformation from a five-year plan down to a three-year plan and Qualys now is becoming critical for them securing the new infrastructure because the current solutions, security and compliance solution were designed for that, if you prefer, client server, typical computing environment.

And not at all for these now more cloud-based computing environment. So that's where we see the demand for our solutions. That ability that we have today to provide with you that two-second visibility across your entire global IT assets. This is what differentiates us. In addition to that, we can now provide you with a continuous view of the security and the compliance.

That's quite significant and next year, as I've indicated in my introduction here, that we're going to be able to allow you, also, to detect where you have zero days almost instantly without having you to search. We'll tell you exactly where you're exposed to zero days and tell you where we have identified assets, which have been already compromised or asset which we highly suspect that they have been compromised. And all of that out of one single platform.

Eliminating significant for large corporations. You speak about millions of dollars of cost that we can eliminate. So that's where Qualys is extremely well-positioned. And that's what makes us positive about the future of Qualys.

Our last question comes from Steven (inaudible) with Stephens. Your line is open.

Hi, figured I would sneak in here at the end. This is Steven on for Jonathan. With regards to adoption of the Cloud Agent, is that -- is the primary service that benefits from increased adoption, whether it is from a new client or existing client, that VM that primarily benefits from that or are you seeing the Cloud Agent being utilized for other services? Thanks.

Yes, a very good question. So, in fact, yes, it does benefit the -- benefit immediately of very strong historic VM because it eliminates the need to scanning windows, it eliminates the need to fetch credentials and it gives you real-time. So that's, of course, very important. But it also benefits, for the same reason by the way, the policy compliance application and now what we see is a very strong adoption of our Agent of the (inaudible) providing the asset inventory.

We really believe that today, the number one issue that large corporations have is that they do not know what they have, who owns them, where are they? And of course, you cannot secure what you do not know. So there is a new understanding because of the breaches, that despite all of the billions of dollars that we're pouring into securing that environment, the breaches are not stopping, very clearly.

So now there's a very clear conscience that you need to know what you have which is making, I think, a global and continuous view of your global IT assets. And again, the world is changing. So whether you have existing assets on premise, whether it is your end points or again whether it is your cloud environments.

What we did with that absolutely integration, while preinstall our Agents now, preinstall in the Microsoft Azure platform, which is quite significant. That's what we offer today. This is where we see, if you prefer, that demand. The fact that we see a very strong deployment of our Agent for asset inventory, this really underscores that capability that we now have.

Thank you.

Thank you everyone for attending our Q3 earnings call. As mentioned in our press release earlier today, our analyst and investor day will be held in New York on November 17th. At the event we will discuss the complete vision, strategy, product road map and investment highlights as well as showcase our new services.

We're delighted that Mark Butler, Enterprise Information Security Officer Advisor, will be with us to present his perspective on the industry and Qualys's competitive position in the marketplace. We look forward to seeing you then.

Ladies and gentlemen, thank you for participating in today's conference. This concludes today's program. You may all disconnect. Everyone, have a great day.

Thank you.

Thank you.